Skip to content

Commit 52f1adc

Browse files
merllmerll
committed
Merge branch 'main'
2 parents 5d9f4d5 + e3f074a commit 52f1adc

38 files changed

+13412
-21713
lines changed

‎.github/workflows/coverage.yml

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: 'coverage'
2+
on:
3+
pull_request:
4+
branches:
5+
- main
6+
7+
jobs:
8+
coverage:
9+
if: ${{ github.actor != 'dependabot[bot]' }}
10+
runs-on: ubuntu-latest
11+
steps:
12+
- name: Checkout PR branch
13+
uses: actions/checkout@v4
14+
15+
- name: Install Node
16+
run: |
17+
export NVM_DIR="$HOME/.nvm"
18+
[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
19+
nvm install
20+
nvm use
21+
node -v
22+
npm install
23+
24+
- name: Install gucci
25+
run: |
26+
GUCCI_VERSION="1.6.13"
27+
curl -L -o gucci https://github.com/noqcks/gucci/releases/download/v${GUCCI_VERSION}/gucci-v${GUCCI_VERSION}-linux-amd64
28+
chmod +x gucci
29+
sudo mv gucci /usr/local/bin/
30+
31+
- name: Compare Coverage
32+
uses: ArtiomTr/jest-coverage-report-action@v2
33+
with:
34+
test-script: npm run test:ts

‎.husky/post-checkout

+6-1
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,9 @@ source_nvm
2323
# automatically change node version to the one indicated in .nvmrc
2424
nvm use
2525

26-
npm run run-if-changed
26+
# Prevent errors on shallow clones
27+
if git rev-parse --verify HEAD@{1} >/dev/null 2>&1; then
28+
npm run run-if-changed
29+
else
30+
echo "Skipping run-if-changed: Not enough Git history"
31+
fi

‎chart/chart-index/Chart.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,10 @@ dependencies:
3838
version: 7.10.0
3939
repository: https://prometheus-community.github.io/helm-charts
4040
- name: promtail
41-
version: 6.11.2
41+
version: 6.16.6
4242
repository: https://grafana.github.io/helm-charts
4343
- name: sealed-secrets
44-
version: 2.14.1
44+
version: 2.17.1
4545
repository: https://bitnami-labs.github.io/sealed-secrets/
4646
- name: tekton-pipeline
4747
version: 1.0.2
@@ -51,7 +51,7 @@ dependencies:
5151
repository: https://vmware-tanzu.github.io/helm-charts/
5252
- name: trivy-operator
5353
version: 0.25.0
54-
repository: https://github.com/aquasecurity/trivy-operator/
54+
repository: https://aquasecurity.github.io/helm-charts/
5555
- name: falco
5656
version: 3.8.5
5757
repository: https://falcosecurity.github.io/charts

‎charts/promtail/Chart.yaml

+12-11
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,17 @@
11
apiVersion: v2
2-
name: promtail
3-
description: Promtail is an agent which ships the contents of local logs to a Loki instance
4-
type: application
52
appVersion: 3.0.0
6-
version: 6.16.6
3+
description: Promtail is an agent which ships the contents of local logs to a Loki
4+
instance
75
home: https://grafana.com/loki
8-
sources:
9-
- https://github.com/grafana/loki
10-
- https://grafana.com/oss/loki/
11-
- https://grafana.com/docs/loki/latest/
126
icon: https://raw.githubusercontent.com/grafana/loki/master/docs/sources/logo.png
137
maintainers:
14-
- name: Loki Maintainers
15-
email: [email protected]
16-
- name: unguiculus
8+
- email: [email protected]
9+
name: Loki Maintainers
10+
- name: unguiculus
11+
name: promtail
12+
sources:
13+
- https://github.com/grafana/loki
14+
- https://grafana.com/oss/loki/
15+
- https://grafana.com/docs/loki/latest/
16+
type: application
17+
version: 6.16.6

‎charts/sealed-secrets/Chart.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
annotations:
22
category: DeveloperTools
33
apiVersion: v2
4-
appVersion: v0.24.5
4+
appVersion: 0.28.0
55
description: Helm chart for the sealed-secrets controller.
66
home: https://github.com/bitnami-labs/sealed-secrets
77
icon: https://bitnami.com/assets/stacks/sealed-secrets/img/sealed-secrets-stack-220x234.png
@@ -16,4 +16,4 @@ name: sealed-secrets
1616
sources:
1717
- https://github.com/bitnami-labs/sealed-secrets
1818
type: application
19-
version: 2.14.1
19+
version: 2.17.1

‎charts/sealed-secrets/README.md

+92-75
Large diffs are not rendered by default.

‎charts/sealed-secrets/crds/bitnami.com_sealedsecrets.yaml

+37-23
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
22
kind: CustomResourceDefinition
33
metadata:
44
annotations:
5-
controller-gen.kubebuilder.io/version: v0.12.0
5+
controller-gen.kubebuilder.io/version: v0.15.0
66
name: sealedsecrets.bitnami.com
77
spec:
88
group: bitnami.com
@@ -26,24 +26,30 @@ spec:
2626
name: v1alpha1
2727
schema:
2828
openAPIV3Schema:
29-
description: SealedSecret is the K8s representation of a "sealed Secret" -
30-
a regular k8s Secret that has been sealed (encrypted) using the controller's
31-
key.
29+
description: |-
30+
SealedSecret is the K8s representation of a "sealed Secret" - a
31+
regular k8s Secret that has been sealed (encrypted) using the
32+
controller's key.
3233
properties:
3334
apiVersion:
34-
description: 'APIVersion defines the versioned schema of this representation
35-
of an object. Servers should convert recognized schemas to the latest
36-
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
35+
description: |-
36+
APIVersion defines the versioned schema of this representation of an object.
37+
Servers should convert recognized schemas to the latest internal value, and
38+
may reject unrecognized values.
39+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
3740
type: string
3841
kind:
39-
description: 'Kind is a string value representing the REST resource this
40-
object represents. Servers may infer this from the endpoint the client
41-
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
42+
description: |-
43+
Kind is a string value representing the REST resource this object represents.
44+
Servers may infer this from the endpoint the client submits requests to.
45+
Cannot be updated.
46+
In CamelCase.
47+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
4248
type: string
4349
metadata:
4450
type: object
4551
spec:
46-
description: SealedSecretSpec is the specification of a SealedSecret
52+
description: SealedSecretSpec is the specification of a SealedSecret.
4753
properties:
4854
data:
4955
description: Data is deprecated and will be removed eventually. Use
@@ -56,17 +62,27 @@ spec:
5662
type: object
5763
x-kubernetes-preserve-unknown-fields: true
5864
template:
59-
description: Template defines the structure of the Secret that will
60-
be created from this sealed secret.
65+
description: |-
66+
Template defines the structure of the Secret that will be
67+
created from this sealed secret.
6168
properties:
6269
data:
6370
additionalProperties:
6471
type: string
65-
description: Keys that should be templated using decrypted data
72+
description: Keys that should be templated using decrypted data.
6673
nullable: true
6774
type: object
75+
immutable:
76+
description: |-
77+
Immutable, if set to true, ensures that data stored in the Secret cannot
78+
be updated (only object metadata can be modified).
79+
If not set to true, the field can be modified at any time.
80+
Defaulted to nil.
81+
type: boolean
6882
metadata:
69-
description: 'Standard object''s metadata. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
83+
description: |-
84+
Standard object's metadata.
85+
More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
7086
nullable: true
7187
properties:
7288
annotations:
@@ -91,10 +107,6 @@ spec:
91107
description: Used to facilitate programmatic handling of secret
92108
data.
93109
type: string
94-
immutable:
95-
description: 'Immutable, if set to true, ensures that data stored in the Secret cannot be updated (only object metadata can be modified).
96-
If not set to true, the field can be modified at any time. Defaulted to nil.'
97-
type: boolean
98110
type: object
99111
required:
100112
- encryptedData
@@ -127,12 +139,14 @@ spec:
127139
description: The reason for the condition's last transition.
128140
type: string
129141
status:
130-
description: 'Status of the condition for a sealed secret. Valid
131-
values for "Synced": "True", "False", or "Unknown".'
142+
description: |-
143+
Status of the condition for a sealed secret.
144+
Valid values for "Synced": "True", "False", or "Unknown".
132145
type: string
133146
type:
134-
description: 'Type of condition for a sealed secret. Valid value:
135-
"Synced"'
147+
description: |-
148+
Type of condition for a sealed secret.
149+
Valid value: "Synced"
136150
type: string
137151
required:
138152
- status

‎charts/sealed-secrets/templates/cluster-role-binding.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ metadata:
1010
{{- if .Values.commonLabels }}
1111
{{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }}
1212
{{- end }}
13+
annotations:
14+
{{- if .Values.commonAnnotations }}
15+
{{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
16+
{{- end }}
1317
roleRef:
1418
apiGroup: rbac.authorization.k8s.io
1519
kind: ClusterRole

‎charts/sealed-secrets/templates/cluster-role.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ metadata:
1010
{{- if .Values.commonLabels }}
1111
{{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }}
1212
{{- end }}
13+
annotations:
14+
{{- if .Values.commonAnnotations }}
15+
{{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
16+
{{- end }}
1317
rules:
1418
- apiGroups:
1519
- bitnami.com

‎charts/sealed-secrets/templates/configmap-dashboards.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ metadata:
1818
{{- if $.Values.metrics.dashboards.annotations }}
1919
{{- include "sealed-secrets.render" ( dict "value" $.Values.metrics.dashboards.annotations "context" $) | nindent 4 }}
2020
{{- end }}
21+
{{- if $.Values.commonAnnotations }}
22+
{{- include "sealed-secrets.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
23+
{{- end }}
2124
data:
2225
{{ base $path }}: |-
2326
{{ $.Files.Get $path | indent 4 }}

‎charts/sealed-secrets/templates/deployment.yaml

+65-11
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,10 @@ metadata:
88
{{- if .Values.commonLabels }}
99
{{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }}
1010
{{- end }}
11-
{{- if .Values.commonAnnotations }}
12-
annotations: {{- toYaml .Values.commonAnnotations | nindent 4 }}
13-
{{- end }}
11+
annotations:
12+
{{- if .Values.commonAnnotations }}
13+
{{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
14+
{{- end }}
1415
spec:
1516
replicas: 1
1617
{{- if .Values.revisionHistoryLimit }}
@@ -81,6 +82,14 @@ spec:
8182
- --key-renew-period
8283
- {{ .Values.keyrenewperiod | quote }}
8384
{{- end }}
85+
{{- if .Values.keyttl }}
86+
- --key-ttl
87+
- {{ .Values.keyttl | quote }}
88+
{{- end }}
89+
{{- if .Values.keycutofftime }}
90+
- --key-cutoff-time
91+
- {{ .Values.keycutofftime | quote }}
92+
{{- end }}
8493
{{- if .Values.rateLimit }}
8594
- --rate-limit
8695
- {{ .Values.rateLimit | quote }}
@@ -105,7 +114,7 @@ spec:
105114
{{- end }}
106115
- --privatekey-annotations
107116
- {{ trimSuffix "," $privatekeyAnnotations | quote }}
108-
{{- end }}
117+
{{- end }}
109118
{{- if $.Values.privateKeyLabels }}
110119
{{- $privateKeyLabels := ""}}
111120
{{- range $k, $v := $.Values.privateKeyLabels }}
@@ -120,14 +129,59 @@ spec:
120129
{{- if .Values.logInfoStdout }}
121130
- --log-info-stdout
122131
{{- end }}
132+
{{- if .Values.logLevel }}
133+
- --log-level
134+
- {{ .Values.logLevel }}
135+
{{- end }}
136+
{{- if .Values.logFormat }}
137+
- --log-format
138+
- {{ .Values.logFormat }}
139+
{{- end }}
140+
{{- if .Values.containerPorts.http }}
141+
- --listen-addr
142+
- {{ printf ":%s" (.Values.containerPorts.http | toString ) }}
143+
{{- end }}
144+
{{- if .Values.containerPorts.metrics }}
145+
- --listen-metrics-addr
146+
- {{ printf ":%s" (.Values.containerPorts.metrics | toString) }}
147+
{{- end }}
148+
{{- if .Values.maxRetries }}
149+
- --max-unseal-retries
150+
- {{ .Values.maxRetries | quote }}
151+
{{- end }}
123152
{{- end }}
124153
image: {{ printf "%s/%s:%s" .Values.image.registry .Values.image.repository .Values.image.tag }}
125154
imagePullPolicy: {{ .Values.image.pullPolicy }}
155+
env:
156+
{{- if (.Values.resources.limits).cpu }}
157+
- name: GOMAXPROCS
158+
valueFrom:
159+
resourceFieldRef:
160+
resource: limits.cpu
161+
divisor: "1"
162+
{{- end }}
163+
{{- if (.Values.resources.limits).memory }}
164+
- name: GOMEMLIMIT
165+
valueFrom:
166+
resourceFieldRef:
167+
resource: limits.memory
168+
divisor: "1"
169+
{{- end }}
126170
ports:
127-
- containerPort: 8080
128-
name: http
129-
- containerPort: 8081
130-
name: metrics
171+
- name: http
172+
containerPort: {{ .Values.containerPorts.http | default "8080" }}
173+
{{- if .Values.hostNetwork }}
174+
hostPort: {{ .Values.containerPorts.http }}
175+
{{- else if .Values.hostPorts.http }}
176+
hostPort: {{ .Values.hostPorts.http }}
177+
{{- end }}
178+
- name: metrics
179+
containerPort: {{ .Values.containerPorts.metrics | default "8081" }}
180+
{{- if .Values.hostNetwork }}
181+
hostPort: {{ .Values.containerPorts.metrics }}
182+
{{- else if .Values.hostPorts.metrics }}
183+
hostPort: {{ .Values.hostPorts.metrics }}
184+
{{- end }}
131185
{{- if .Values.startupProbe.enabled }}
132186
startupProbe: {{- include "sealed-secrets.render" (dict "value" (omit .Values.startupProbe "enabled") "context" $) | nindent 12 }}
133187
tcpSocket:
@@ -159,13 +213,13 @@ spec:
159213
{{- end }}
160214
volumeMounts:
161215
{{- if .Values.additionalVolumeMounts }}
162-
{{- toYaml .Values.additionalVolumeMounts | nindent 12 }}
216+
{{- toYaml .Values.additionalVolumeMounts | nindent 12 }}
163217
{{- end }}
164218
- mountPath: /tmp
165219
name: tmp
166-
volumes:
220+
volumes:
167221
{{- if .Values.additionalVolumes }}
168-
{{- toYaml .Values.additionalVolumes | nindent 8 }}
222+
{{- toYaml .Values.additionalVolumes | nindent 8 }}
169223
{{- end }}
170224
- name: tmp
171225
emptyDir: {}

‎charts/sealed-secrets/templates/ingress.yaml

+3-2
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,13 @@ metadata:
88
{{- if .Values.commonLabels }}
99
{{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }}
1010
{{- end }}
11-
{{- if .Values.ingress.annotations }}
1211
annotations:
1312
{{- if .Values.ingress.annotations }}
1413
{{- include "sealed-secrets.render" ( dict "value" .Values.ingress.annotations "context" $) | nindent 4 }}
1514
{{- end }}
16-
{{- end }}
15+
{{- if .Values.commonAnnotations }}
16+
{{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
17+
{{- end }}
1718
spec:
1819
{{- if and .Values.ingress.ingressClassName (eq "true" (include "sealed-secrets.supportsIngressClassname" .)) }}
1920
ingressClassName: {{ .Values.ingress.ingressClassName | quote }}

0 commit comments

Comments
 (0)