Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
The diff you're trying to view is too large. We only load the first 3000 changed files.
2 changes: 1 addition & 1 deletion .ci-operator.yaml
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
build_root_image:
name: builder
namespace: ocp
tag: rhel-9-golang-1.24-openshift-4.20
tag: rhel-9-golang-1.25-openshift-4.21
2 changes: 1 addition & 1 deletion Dockerfile
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Build the external-secrets-operator binary
FROM docker.io/golang:1.24 AS builder
FROM docker.io/golang:1.25 AS builder
ARG TARGETOS
ARG TARGETARCH

Expand Down
4 changes: 2 additions & 2 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,10 @@
# To re-generate a bundle for another specific version without changing the standard setup, you can:
# - use the VERSION as arg of the bundle target (e.g make bundle VERSION=0.0.2)
# - use environment variables to overwrite this value (e.g export VERSION=0.0.2)
VERSION ?= 1.0.0
VERSION ?= 1.1.0

# EXTERNAL_SECRETS_VERSION defines the external-secrets release version to fetch helm charts.
EXTERNAL_SECRETS_VERSION ?= v0.19.0
EXTERNAL_SECRETS_VERSION ?= v0.20.4

# CHANNELS define the bundle channels used in the bundle.
# Add a new line here if you would like to change its default config. (E.g CHANNELS = "candidate,fast,stable")
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets-webhook
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
external-secrets.io/component: webhook
spec:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets-cert-controller
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
rules:
- apiGroups:
Expand Down Expand Up @@ -45,6 +45,14 @@ rules:
- "list"
- "get"
- "watch"
- apiGroups:
- "discovery.k8s.io"
resources:
- "endpointslices"
verbs:
- "list"
- "get"
- "watch"
- apiGroups:
- ""
resources:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
rules:
- apiGroups:
Expand Down Expand Up @@ -64,6 +64,7 @@ rules:
- "generators.external-secrets.io"
resources:
- "acraccesstokens"
- "cloudsmithaccesstokens"
- "clustergenerators"
- "ecrauthorizationtokens"
- "fakes"
Expand Down Expand Up @@ -91,6 +92,13 @@ rules:
- "get"
- "list"
- "watch"
- apiGroups:
- ""
resources:
- "namespaces"
verbs:
- "update"
- "patch"
- apiGroups:
- ""
resources:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
rbac.authorization.k8s.io/aggregate-to-edit: "true"
rbac.authorization.k8s.io/aggregate-to-admin: "true"
Expand All @@ -29,6 +29,7 @@ rules:
- "generators.external-secrets.io"
resources:
- "acraccesstokens"
- "cloudsmithaccesstokens"
- "clustergenerators"
- "ecrauthorizationtokens"
- "fakes"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ metadata:
servicebinding.io/controller: "true"
app.kubernetes.io/name: external-secrets
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
rules:
- apiGroups:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
rbac.authorization.k8s.io/aggregate-to-view: "true"
rbac.authorization.k8s.io/aggregate-to-edit: "true"
Expand All @@ -28,6 +28,7 @@ rules:
- "generators.external-secrets.io"
resources:
- "acraccesstokens"
- "cloudsmithaccesstokens"
- "clustergenerators"
- "ecrauthorizationtokens"
- "fakes"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets-cert-controller
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
roleRef:
apiGroup: rbac.authorization.k8s.io
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
roleRef:
apiGroup: rbac.authorization.k8s.io
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ metadata:
labels:
app.kubernetes.io/name: bitwarden-sdk-server
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.5.0"
app.kubernetes.io/version: "v0.5.1"
app.kubernetes.io/managed-by: external-secrets-operator
spec:
replicas: 1
Expand All @@ -26,7 +26,7 @@ spec:
containers:
- name: bitwarden-sdk-server
securityContext: {}
image: "ghcr.io/external-secrets/bitwarden-sdk-server:v0.5.0"
image: "ghcr.io/external-secrets/bitwarden-sdk-server:v0.5.1"
imagePullPolicy: IfNotPresent
volumeMounts:
- mountPath: /certs
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets-cert-controller
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
spec:
replicas: 1
Expand All @@ -21,7 +21,7 @@ spec:
labels:
app.kubernetes.io/name: external-secrets-cert-controller
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
spec:
serviceAccountName: external-secrets-cert-controller
Expand All @@ -39,7 +39,7 @@ spec:
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
image: oci.external-secrets.io/external-secrets/external-secrets:v0.19.0
image: oci.external-secrets.io/external-secrets/external-secrets:v0.20.4
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify external-secrets v0.20.4 image and check for security advisories

echo "=== Checking image availability ==="
# Check if crane is available
if ! command -v crane &> /dev/null; then
  echo "crane not available, attempting to install..."
  pip install go-crane 2>/dev/null || echo "Cannot install crane"
fi

# Try to fetch image metadata
if command -v crane &> /dev/null; then
  crane digest oci.external-secrets.io/external-secrets/external-secrets:v0.20.4 2>&1 | head -10
else
  echo "crane unavailable, checking via curl"
  curl -s -I https://oci.external-secrets.io/v2/external-secrets/external-secrets/manifests/v0.20.4 2>&1 | head -5
fi

echo -e "\n=== Checking GitHub release information ==="
# Check if gh CLI is available
if command -v gh &> /dev/null; then
  echo "GitHub CLI available - skipping due to auth requirements"
else
  echo "gh CLI not available in sandbox"
fi

echo -e "\n=== Checking via public GitHub API (no auth) ==="
# Fetch external-secrets releases data
curl -s "https://api.github.com/repos/external-secrets/external-secrets/releases?per_page=20" | \
  python3 -c "
import sys, json
try:
    data = json.load(sys.stdin)
    for release in data:
        tag = release.get('tag_name', '')
        if tag in ['v0.20.4', 'v0.20.3', 'v0.20.2', 'v0.20.1', 'v0.20.0', 'v0.19.0']:
            print(f\"Tag: {tag}\")
            print(f\"Published: {release.get('published_at', '')}\")
            print(f\"Prerelease: {release.get('prerelease', False)}\")
            print(f\"Body (first 300 chars): {release.get('body', '')[:300]}\")
            print('---')
except Exception as e:
    print(f'Error: {e}')
" 2>&1

echo -e "\n=== Checking external-secrets documentation and GitHub repo ==="
# Get basic repo info
curl -s "https://api.github.com/repos/external-secrets/external-secrets" | \
  python3 -c "
import sys, json
try:
    data = json.load(sys.stdin)
    print(f\"Repo: {data.get('full_name', '')}\")
    print(f\"Description: {data.get('description', '')}\")
    print(f\"Latest release: {data.get('latest_release', {}).get('tag_name', 'N/A')}\")
    print(f\"Stars: {data.get('stargazers_count', '')}\")
except Exception as e:
    print(f'Error: {e}')
" 2>&1

Repository: openshift/external-secrets-operator

Length of output: 2948


🏁 Script executed:

#!/bin/bash

echo "=== Fetching full release notes for v0.20.4 ==="
curl -s "https://api.github.com/repos/external-secrets/external-secrets/releases/tags/v0.20.4" | \
  python3 -c "
import sys, json
try:
    data = json.load(sys.stdin)
    print('=== v0.20.4 Release Notes ===')
    print(data.get('body', '')[:2000])
except Exception as e:
    print(f'Error: {e}')
"

echo -e "\n=== Fetching release notes for v0.20.0 (first minor version) ==="
curl -s "https://api.github.com/repos/external-secrets/external-secrets/releases/tags/v0.20.0" | \
  python3 -c "
import sys, json
try:
    data = json.load(sys.stdin)
    print('=== v0.20.0 Release Notes (first 2000 chars) ===')
    print(data.get('body', '')[:2000])
except Exception as e:
    print(f'Error: {e}')
"

echo -e "\n=== Checking for image location documentation ==="
# Check if there's any documentation or CHANGELOG about image registries
curl -s "https://raw.githubusercontent.com/external-secrets/external-secrets/main/README.md" | grep -i "ghcr\|oci\|registry\|image" | head -20

Repository: openshift/external-secrets-operator

Length of output: 4427


🏁 Script executed:

#!/bin/bash

echo "=== Checking for oci.external-secrets.io in official docs/config ==="
# Check main README
curl -s "https://raw.githubusercontent.com/external-secrets/external-secrets/main/README.md" | grep -i "oci.external-secrets" | head -10

echo -e "\n=== Checking helm chart values ==="
# Check if helm chart (which deploys this) mentions the registry
curl -s "https://raw.githubusercontent.com/external-secrets/external-secrets/main/deploy/helm-chart/values.yaml" | grep -i "registry\|image" -A2 -B2 | head -40

echo -e "\n=== Checking CHANGELOG for registry changes ==="
curl -s "https://raw.githubusercontent.com/external-secrets/external-secrets/main/CHANGELOG.md" | grep -i "oci\|registry" | head -10

echo -e "\n=== Checking if repository is external-secrets-operator (OpenShift specific) ==="
# This repository appears to be openshift/external-secrets-operator, not external-secrets/external-secrets
# Check if there's documentation about oci.external-secrets.io
curl -s "https://raw.githubusercontent.com/openshift/external-secrets-operator/main/README.md" 2>/dev/null | grep -i "oci\|registry\|image" | head -20

Repository: openshift/external-secrets-operator

Length of output: 1002


🏁 Script executed:

#!/bin/bash

echo "=== Checking file location and context ==="
file_path="bindata/external-secrets/resources/deployment_external-secrets-cert-controller.yml"

# Check if this file exists and its context
find . -name "deployment_external-secrets-cert-controller.yml" 2>/dev/null

echo -e "\n=== Checking if this is part of bindata/vendor pattern ==="
ls -la bindata/external-secrets/resources/ 2>/dev/null | head -20

echo -e "\n=== Checking for registry configuration in OpenShift operator ==="
find . -type f \( -name "*.go" -o -name "*.yaml" -o -name "*.md" \) -path "*/external-secrets/*" 2>/dev/null | head -20 | xargs grep -l "oci.external-secrets.io" 2>/dev/null

echo -e "\n=== Checking OpenShift operator image references ==="
grep -r "oci.external-secrets.io" . --include="*.yml" --include="*.yaml" 2>/dev/null | head -10

echo -e "\n=== Checking if bindata contains vendored/bundled manifests ==="
head -50 "bindata/external-secrets/resources/deployment_external-secrets-cert-controller.yml" 2>/dev/null

Repository: openshift/external-secrets-operator

Length of output: 4741


🏁 Script executed:

#!/bin/bash

echo "=== Comparing version references across files ==="
echo "bindata deployments:"
grep -h "v0\.[0-9]\+\.[0-9]\+" bindata/external-secrets/resources/deployment*.yml | grep -i image | sort -u

echo -e "\n=== config/manager version references ==="
grep -r "external-secrets:" config/manager/ 2>/dev/null | grep -v ".swp"

echo -e "\n=== bundle/manifests version references ==="
grep "external-secrets:" bundle/manifests/external-secrets-operator.clusterserviceversion.yaml 2>/dev/null | sort -u

echo -e "\n=== Check if this PR is supposed to update all files ==="
# Look for any documentation or PR guidelines about versioning
find . -name "*.md" -o -name "CONTRIBUTING*" -o -name "DEVELOPMENT*" 2>/dev/null | xargs grep -l "version\|update" 2>/dev/null | head -5

Repository: openshift/external-secrets-operator

Length of output: 884


Update all version references consistently; verify image registry alignment with upstream sources.

This PR updates bindata deployments to v0.20.4 but leaves config/manager/manager.yaml and bundle/manifests/external-secrets-operator.clusterserviceversion.yaml at v0.19.0. This inconsistency will cause different components to run different versions.

Additionally, the deployment uses oci.external-secrets.io registry while the official external-secrets project publishes images to ghcr.io. This registry is not documented in the upstream project and cannot be verified as an official source. Confirm whether:

  • All version references should be updated to v0.20.4, or if a phased rollout is intentional
  • oci.external-secrets.io is an approved/documented image source (e.g., OpenShift vendor mirror), or if it should align with upstream's ghcr.io

imagePullPolicy: IfNotPresent
args:
- certcontroller
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets-webhook
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
spec:
replicas: 1
Expand All @@ -21,7 +21,7 @@ spec:
labels:
app.kubernetes.io/name: external-secrets-webhook
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
spec:
hostNetwork: false
Expand All @@ -39,7 +39,7 @@ spec:
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
image: oci.external-secrets.io/external-secrets/external-secrets:v0.19.0
image: oci.external-secrets.io/external-secrets/external-secrets:v0.20.4
imagePullPolicy: IfNotPresent
args:
- webhook
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
spec:
replicas: 1
Expand All @@ -21,7 +21,7 @@ spec:
labels:
app.kubernetes.io/name: external-secrets
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
spec:
serviceAccountName: external-secrets
Expand All @@ -39,7 +39,7 @@ spec:
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
image: oci.external-secrets.io/external-secrets/external-secrets:v0.19.0
image: oci.external-secrets.io/external-secrets/external-secrets:v0.20.4
imagePullPolicy: IfNotPresent
args:
- --concurrent=1
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
rules:
- apiGroups:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
roleRef:
apiGroup: rbac.authorization.k8s.io
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,6 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets-webhook
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
external-secrets.io/component: webhook
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ metadata:
labels:
app.kubernetes.io/name: bitwarden-sdk-server
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.5.0"
app.kubernetes.io/version: "v0.5.1"
app.kubernetes.io/managed-by: external-secrets-operator
spec:
type: ClusterIP
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets-cert-controller
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
spec:
type: ClusterIP
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
spec:
type: ClusterIP
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,14 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets-webhook
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
external-secrets.io/component: webhook
spec:
type: ClusterIP
ports:
- port: 443
targetPort: 10250
targetPort: webhook
protocol: TCP
name: webhook
- port: 8080
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,5 @@ metadata:
labels:
app.kubernetes.io/name: bitwarden-sdk-server
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.5.0"
app.kubernetes.io/version: "v0.5.1"
app.kubernetes.io/managed-by: external-secrets-operator
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,5 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets-cert-controller
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,5 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets-webhook
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,5 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets-webhook
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
external-secrets.io/component: webhook
webhooks:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ metadata:
labels:
app.kubernetes.io/name: external-secrets-webhook
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/version: "v0.19.0"
app.kubernetes.io/version: "v0.20.4"
app.kubernetes.io/managed-by: external-secrets-operator
external-secrets.io/component: webhook
webhooks:
Expand Down
Loading