From 21969d20f31c635307ac2d3b8450d32a60853817 Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Tue, 14 Apr 2026 11:34:08 +0200 Subject: [PATCH 01/23] Bump test chart dependencies (#795) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 2 +- .github/tests/oci-charts.json | 2 +- charts/spire/charts/spiffe-csi-driver/README.md | 2 +- charts/spire/charts/spiffe-csi-driver/values.yaml | 2 +- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 12 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 5be1408..2f23113 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "82.18.0" + "version": "83.4.0" }, { "name": "cert-manager", diff --git a/.github/tests/oci-charts.json b/.github/tests/oci-charts.json index 2152508..2b1712f 100644 --- a/.github/tests/oci-charts.json +++ b/.github/tests/oci-charts.json @@ -2,7 +2,7 @@ { "name": "mariadb", "registry": "docker.io/bitnamicharts/mariadb", - "version": "25.0.6" + "version": "25.0.8" }, { "name": "postgresql", diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index 11a7511..785ff8c 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -74,5 +74,5 @@ A Helm chart to install the SPIFFE CSI driver. | `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` | | `selinux.image.repository` | The repository within the registry | `ubi9` | | `selinux.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1774415752` | +| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1775624009` | diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index e87b4c3..7e0527c 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -169,4 +169,4 @@ selinux: registry: registry.access.redhat.com repository: ubi9 pullPolicy: IfNotPresent - tag: 9.7-1774415752 + tag: 9.7-1775624009 diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 54b56e1..3d52aeb 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -128,11 +128,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:6ba4fb1b19bb35fa0b7e6bf08b308379a5b865727e50b7b3068efb824b39ebba` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c74bf9073220b627dfde71a1165f6836a6539620045c72e77fc9889d30a6815d` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 2a84e56..2df5162 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -363,7 +363,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e + tag: latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -375,7 +375,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:6ba4fb1b19bb35fa0b7e6bf08b308379a5b865727e50b7b3068efb824b39ebba + tag: latest@sha256:c74bf9073220b627dfde71a1165f6836a6539620045c72e77fc9889d30a6815d step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index d70df1f..7a4bff1 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -73,7 +73,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -125,11 +125,11 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:6ba4fb1b19bb35fa0b7e6bf08b308379a5b865727e50b7b3068efb824b39ebba` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c74bf9073220b627dfde71a1165f6836a6539620045c72e77fc9889d30a6815d` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index bcbab33..4ea5223 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -159,7 +159,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e + tag: latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602 keyManager: memory: @@ -317,7 +317,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e + tag: latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602 hostCert: ## @param hostCert.image.registry The OCI registry to pull the image from @@ -329,7 +329,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:6ba4fb1b19bb35fa0b7e6bf08b308379a5b865727e50b7b3068efb824b39ebba + tag: latest@sha256:c74bf9073220b627dfde71a1165f6836a6539620045c72e77fc9889d30a6815d ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. priorityClassName: "" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index dee4c3c..09eef24 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -525,5 +525,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index d1fa7d5..46026f7 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1337,7 +1337,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e + tag: latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602 ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 5116da9..79188ba 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index a97af65..03b3937 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e + tag: latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602 From 3c1dec30354a7c7e6cf5eca03cab47dba1e38c45 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?D=C3=A1vid=20Szak=C3=A1llas?= <5807322+dszakallas@users.noreply.github.com> Date: Wed, 15 Apr 2026 18:08:25 +0200 Subject: [PATCH 02/23] fix casing of svidStore (#787) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Dávid Szakállas <5807322+dszakallas@users.noreply.github.com> --- charts/spire-lib/templates/_helpers.tpl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire-lib/templates/_helpers.tpl b/charts/spire-lib/templates/_helpers.tpl index 7185d77..e705980 100644 --- a/charts/spire-lib/templates/_helpers.tpl +++ b/charts/spire-lib/templates/_helpers.tpl @@ -202,7 +202,7 @@ Take a copy of the config and merge in .Values.customPlugins and .Values.unsuppo {{- $pluginsToMerge := dict "plugins" dict }} {{- range $type, $val := .root.Values.customPlugins }} {{- if . }} -{{- if eq $type "svidstore" }} +{{- if eq $type "svidStore" }} {{- $_ := set $pluginsToMerge.plugins "SVIDStore" (deepCopy $val) }} {{- else }} {{- $nt := printf "%s%s" (substr 0 1 $type | upper) (substr 1 -1 $type) }} @@ -212,7 +212,7 @@ Take a copy of the config and merge in .Values.customPlugins and .Values.unsuppo {{- end }} {{- range $type, $val := .root.Values.unsupportedBuiltInPlugins }} {{- if . }} -{{- if eq $type "svidstore" }} +{{- if eq $type "svidStore" }} {{- $_ := set $pluginsToMerge.plugins "SVIDStore" (deepCopy $val) }} {{- else }} {{- $nt := printf "%s%s" (substr 0 1 $type | upper) (substr 1 -1 $type) }} From dfe8089160434928a861367f724a77868cdb872e Mon Sep 17 00:00:00 2001 From: Jesper Engberg Date: Wed, 15 Apr 2026 18:33:53 +0200 Subject: [PATCH 03/23] feat: add gcp_iit node attestor configuration options (#796) * feat: add gcp_iit node attestor configuration options Signed-off-by: Jesper Engberg * fix: align indentation Signed-off-by: Jesper Engberg * fix: remove unused var Signed-off-by: Jesper Engberg --------- Signed-off-by: Jesper Engberg Co-authored-by: kfox1111 --- charts/spire/charts/spire-agent/README.md | 1 + .../spire-agent/templates/configmap.yaml | 11 ++++++-- charts/spire/charts/spire-agent/values.yaml | 3 +++ charts/spire/charts/spire-server/README.md | 7 ++++++ .../spire-server/templates/configmap.yaml | 25 ++++++++++++++++++- charts/spire/charts/spire-server/values.yaml | 15 +++++++++++ 6 files changed, 59 insertions(+), 3 deletions(-) diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 7a4bff1..29f86b1 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -94,6 +94,7 @@ A Helm chart to install the SPIRE agent. | `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` | | `nodeAttestor.awsIID.enabled` | Enable the aws_iid Node Attestor | `false` | +| `nodeAttestor.gcpIIT.enabled` | Enable the gcp_iit Node Attestor | `false` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | | `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 77be88f..9a5e922 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -120,13 +120,20 @@ plugins: {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} {{- end }} {{- end }} - {{- with .Values.nodeAttestor.awsIID }} - {{- if eq (.enabled | toString) "true" }} + {{- with .Values.nodeAttestor.awsIID }} + {{- if eq (.enabled | toString) "true" }} aws_iid: plugin_data: {} {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} {{- end }} {{- end }} + {{- with .Values.nodeAttestor.gcpIIT }} + {{- if eq (.enabled | toString) "true" }} + gcp_iit: + plugin_data: {} + {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} + {{- end }} + {{- end }} {{- if ne $nodeAttestorUsed 1 }} {{- fail (printf "You have to enable exactly one Node Attestor. There are %d enabled." $nodeAttestorUsed) }} {{- end }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 4ea5223..8ba9c00 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -216,6 +216,9 @@ nodeAttestor: awsIID: ## @param nodeAttestor.awsIID.enabled Enable the aws_iid Node Attestor enabled: false + gcpIIT: + ## @param nodeAttestor.gcpIIT.enabled Enable the gcp_iit Node Attestor + enabled: false # workloadAttestors determine a workload's properties and then generate a set of selectors associated with it. workloadAttestors: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 09eef24..9948353 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -435,6 +435,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` | | `nodeAttestor.awsIID.enabled` | Enable the aws_iid node attestor | `false` | | `nodeAttestor.awsIID.assumeRole` | AWS IAM Role NAME to use for the attestation | `""` | +| `nodeAttestor.gcpIIT.enabled` | Enable the gcp_iit node attestor | `false` | +| `nodeAttestor.gcpIIT.projectIDAllowList` | List of ProjectIDs from which nodes can be attested | `[]` | +| `nodeAttestor.gcpIIT.useInstanceMetadata` | If true, instance metadata is fetched from the Google Compute Engine API and used to augment the node selectors produced by the plugin | `false` | +| `nodeAttestor.gcpIIT.allowedLabelKeys` | Instance label keys considered for selectors | `[]` | +| `nodeAttestor.gcpIIT.allowedMetadataKeys` | Instance metadata keys considered for selectors | `[]` | +| `nodeAttestor.gcpIIT.metadataValueMaxSize` | Sets the maximum metadata value size considered by the plugin for selectors | `0` | +| `nodeAttestor.gcpIIT.agentPathTemplate` | A URL path portion format of Agent's SPIFFE ID. Describe in text/template format. | `""` | | `bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `true` | | `bundlePublisher.k8sConfigMap.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | | `bundlePublisher.k8sConfigMap.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 5750db9..5bac690 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -159,7 +159,7 @@ plugins: {{- end }} disable_migration: {{ .Values.dataStore.sql.disableMigration }} - {{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled .Values.nodeAttestor.awsIID.enabled }} + {{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled .Values.nodeAttestor.awsIID.enabled .Values.nodeAttestor.gcpIIT.enabled }} NodeAttestor: {{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPSAT.clusters }} {{- if or (eq (.Values.nodeAttestor.k8sPSAT.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true") (gt (len $clusters) 0)) }} @@ -248,6 +248,29 @@ plugins: {{- end }} {{- end }} {{- end }} + {{- with .Values.nodeAttestor.gcpIIT }} + {{- if eq (.enabled | toString) "true" }} + gcp_iit: + plugin_data: + projectid_allow_list: + {{ toYaml .projectIDAllowList | nindent 10 }} + use_instance_metadata: {{ .useInstanceMetadata }} + {{- if not (empty .allowedLabelKeys) }} + allowed_label_keys: + {{ toYaml .allowedLabelKeys | nindent 10 }} + {{- end }} + {{- if not (empty .allowedMetadataKeys) }} + allowed_metadata_keys: + {{ toYaml .allowedMetadataKeys | nindent 10 }} + {{- end }} + {{- if ne (int .metadataValueMaxSize) 0 }} + max_metadata_value_size: {{ (int .metadataValueMaxSize) }} + {{- end }} + {{- if ne .agentPathTemplate "" }} + agent_path_template: {{ .agentPathTemplate | quote }} + {{- end }} + {{- end }} + {{- end }} {{- end }} {{- with .Values.keyManager.disk }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 46026f7..c1c417d 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1074,6 +1074,21 @@ nodeAttestor: enabled: false ## @param nodeAttestor.awsIID.assumeRole AWS IAM Role NAME to use for the attestation assumeRole: "" + gcpIIT: + ## @param nodeAttestor.gcpIIT.enabled Enable the gcp_iit node attestor + enabled: false + ## @param nodeAttestor.gcpIIT.projectIDAllowList List of ProjectIDs from which nodes can be attested + projectIDAllowList: [] + ## @param nodeAttestor.gcpIIT.useInstanceMetadata If true, instance metadata is fetched from the Google Compute Engine API and used to augment the node selectors produced by the plugin + useInstanceMetadata: false + ## @param nodeAttestor.gcpIIT.allowedLabelKeys Instance label keys considered for selectors + allowedLabelKeys: [] + ## @param nodeAttestor.gcpIIT.allowedMetadataKeys Instance metadata keys considered for selectors + allowedMetadataKeys: [] + ## @param nodeAttestor.gcpIIT.metadataValueMaxSize Sets the maximum metadata value size considered by the plugin for selectors + metadataValueMaxSize: 0 + ## @param nodeAttestor.gcpIIT.agentPathTemplate A URL path portion format of Agent's SPIFFE ID. Describe in text/template format. + agentPathTemplate: "" # The secrets needed for this plugin are configured in the secrets: section bundlePublisher: From c5ba8213df9c0411a54e73b567edf4db7c5e6196 Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 20 Apr 2026 04:27:18 -0700 Subject: [PATCH 04/23] Bump test chart dependencies (#797) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 4 ++-- .github/tests/oci-charts.json | 2 +- charts/spire/charts/spiffe-csi-driver/README.md | 2 +- charts/spire/charts/spiffe-csi-driver/values.yaml | 2 +- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 6 +++--- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 6 +++--- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 12 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 2f23113..19e8692 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,12 +2,12 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "83.4.0" + "version": "83.6.0" }, { "name": "cert-manager", "repo": "https://charts.jetstack.io", - "version": "v1.20.1" + "version": "v1.20.2" }, { "name": "ingress-nginx", diff --git a/.github/tests/oci-charts.json b/.github/tests/oci-charts.json index 2b1712f..f9c8b40 100644 --- a/.github/tests/oci-charts.json +++ b/.github/tests/oci-charts.json @@ -12,6 +12,6 @@ { "name": "envoy-gateway", "registry": "docker.io/envoyproxy/gateway-helm", - "version": "v1.7.1" + "version": "v1.7.2" } ] diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index 785ff8c..b5b9776 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -74,5 +74,5 @@ A Helm chart to install the SPIFFE CSI driver. | `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` | | `selinux.image.repository` | The repository within the registry | `ubi9` | | `selinux.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1775624009` | +| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1776645994` | diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index 7e0527c..e2d36ec 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -169,4 +169,4 @@ selinux: registry: registry.access.redhat.com repository: ubi9 pullPolicy: IfNotPresent - tag: 9.7-1775624009 + tag: 9.7-1776645994 diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 3d52aeb..05c6c63 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -76,7 +76,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from. Only used when TLS is disabled. | `docker.io` | | `insecureScheme.nginx.image.repository` | The repository within the registry. Only used when TLS is disabled. | `nginxinc/nginx-unprivileged` | | `insecureScheme.nginx.image.pullPolicy` | The image pull policy. Only used when TLS is disabled. | `IfNotPresent` | -| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.29.5-alpine` | +| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.30.0-alpine` | | `insecureScheme.nginx.ipMode` | IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] | `both` | | `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | | `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` | @@ -128,11 +128,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c74bf9073220b627dfde71a1165f6836a6539620045c72e77fc9889d30a6815d` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9e45e6836c28489a6e57ca1210ec66927e88eca2409e403616a1278e210e86c9` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 2df5162..69f2179 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -187,7 +187,7 @@ insecureScheme: registry: docker.io repository: nginxinc/nginx-unprivileged pullPolicy: IfNotPresent - tag: 1.29.5-alpine + tag: 1.30.0-alpine ## @param insecureScheme.nginx.ipMode IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] ipMode: both ## @param insecureScheme.nginx.resources Resource requests and limits @@ -363,7 +363,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602 + tag: latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -375,7 +375,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:c74bf9073220b627dfde71a1165f6836a6539620045c72e77fc9889d30a6815d + tag: latest@sha256:9e45e6836c28489a6e57ca1210ec66927e88eca2409e403616a1278e210e86c9 step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 29f86b1..0d6103b 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -73,7 +73,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -126,11 +126,11 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c74bf9073220b627dfde71a1165f6836a6539620045c72e77fc9889d30a6815d` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9e45e6836c28489a6e57ca1210ec66927e88eca2409e403616a1278e210e86c9` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 8ba9c00..f2b7402 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -159,7 +159,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602 + tag: latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58 keyManager: memory: @@ -320,7 +320,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602 + tag: latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58 hostCert: ## @param hostCert.image.registry The OCI registry to pull the image from @@ -332,7 +332,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:c74bf9073220b627dfde71a1165f6836a6539620045c72e77fc9889d30a6815d + tag: latest@sha256:9e45e6836c28489a6e57ca1210ec66927e88eca2409e403616a1278e210e86c9 ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. priorityClassName: "" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 9948353..c920d86 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -532,5 +532,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index c1c417d..6b1f11e 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1352,7 +1352,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602 + tag: latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58 ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 79188ba..f9f3f18 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 03b3937..21770fe 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:1d85eb4c1f20d687daab630290827dd9c14ea755403a55d246bcbeb4edad3602 + tag: latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58 From f537f7702f7502772609769d9d9155e3c11f856b Mon Sep 17 00:00:00 2001 From: Daniel Schlatter Date: Thu, 23 Apr 2026 06:31:17 -0600 Subject: [PATCH 05/23] allow unsupported built-in key manager plugins to be used (#798) Signed-off-by: Daniel Schlatter --- charts/spire/charts/spire-server/templates/configmap.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 5bac690..9d40d33 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -322,7 +322,11 @@ plugins: {{- end }} {{- end }} -{{- $keyManagerUsed = add $keyManagerUsed (len .Values.unsupportedBuiltInPlugins.keyManager) }} +{{- if .Values.unsupportedBuiltInPlugins.keyManager }} +{{- $keyManagerUsed = add $keyManagerUsed 1 }} + KeyManager: + {{- .Values.unsupportedBuiltInPlugins.keyManager | toYaml | nindent 4 }} +{{- end }} {{- if ne $keyManagerUsed 1 }} {{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }} From bf16ddf75a858e0913c7ff5ec741ab3782714f6e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Apr 2026 03:53:01 +0000 Subject: [PATCH 06/23] Bump imjasonh/setup-crane from 0.3 to 0.5 Bumps [imjasonh/setup-crane](https://github.com/imjasonh/setup-crane) from 0.3 to 0.5. - [Release notes](https://github.com/imjasonh/setup-crane/releases) - [Commits](https://github.com/imjasonh/setup-crane/compare/v0.3...v0.5) --- updated-dependencies: - dependency-name: imjasonh/setup-crane dependency-version: '0.5' dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/check-versions.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml index 42a9644..cd1002b 100644 --- a/.github/workflows/check-versions.yaml +++ b/.github/workflows/check-versions.yaml @@ -28,7 +28,7 @@ jobs: version: ${{ env.HELM_VERSION }} - name: Setup crane - uses: imjasonh/setup-crane@v0.3 + uses: imjasonh/setup-crane@v0.5 - name: Update test chart versions run: | From bf8519364c5422d380bc7cfbe28fbaa25d519f92 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Apr 2026 17:42:48 +0000 Subject: [PATCH 07/23] Bump sigstore/cosign-installer from 3.4.0 to 4.1.1 Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.4.0 to 4.1.1. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](https://github.com/sigstore/cosign-installer/compare/v3.4.0...v4.1.1) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/helm-release.yaml | 2 +- .github/workflows/update-devcontainer-image.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index 7308609..50b9c6e 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -29,7 +29,7 @@ jobs: git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - name: Setup cosign - uses: sigstore/cosign-installer@v3.4.0 + uses: sigstore/cosign-installer@v4.1.1 with: cosign-release: v2.2.3 diff --git a/.github/workflows/update-devcontainer-image.yaml b/.github/workflows/update-devcontainer-image.yaml index 15f81d2..4652cbb 100644 --- a/.github/workflows/update-devcontainer-image.yaml +++ b/.github/workflows/update-devcontainer-image.yaml @@ -25,7 +25,7 @@ jobs: - name: Checkout uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - name: Install cosign - uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0 + uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 with: cosign-release: v2.2.3 - name: Install regctl From c430a5552911939b47510572576be225c8776320 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Apr 2026 17:44:03 +0000 Subject: [PATCH 08/23] Bump regclient/actions Bumps [regclient/actions](https://github.com/regclient/actions) from b6614f5f56245066b533343a85f4109bdc38c8cc to f3c6d87835906c175eb6ccfc18b348b69bb447e7. - [Release notes](https://github.com/regclient/actions/releases) - [Changelog](https://github.com/regclient/actions/blob/main/RELEASE.md) - [Commits](https://github.com/regclient/actions/compare/b6614f5f56245066b533343a85f4109bdc38c8cc...f3c6d87835906c175eb6ccfc18b348b69bb447e7) --- updated-dependencies: - dependency-name: regclient/actions dependency-version: f3c6d87835906c175eb6ccfc18b348b69bb447e7 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- .github/workflows/update-devcontainer-image.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/update-devcontainer-image.yaml b/.github/workflows/update-devcontainer-image.yaml index 4652cbb..66b8409 100644 --- a/.github/workflows/update-devcontainer-image.yaml +++ b/.github/workflows/update-devcontainer-image.yaml @@ -29,7 +29,7 @@ jobs: with: cosign-release: v2.2.3 - name: Install regctl - uses: regclient/actions/regctl-installer@b6614f5f56245066b533343a85f4109bdc38c8cc # main + uses: regclient/actions/regctl-installer@f3c6d87835906c175eb6ccfc18b348b69bb447e7 # main - name: Log in to GHCR uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: From 40a3ba5ea4cf5d5eca94c4e8eefb2c5ed795ebd4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Apr 2026 17:45:17 +0000 Subject: [PATCH 09/23] Bump actions/checkout from 4.1.1 to 6.0.2 Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v4.1.1...v6.0.2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/check-versions.yaml | 2 +- .github/workflows/helm-chart-ci-ignore.yaml | 2 +- .github/workflows/helm-chart-ci.yaml | 14 +++++++------- .github/workflows/helm-release.yaml | 2 +- .github/workflows/shellcheck.yaml | 2 +- .github/workflows/update-devcontainer-image.yaml | 2 +- 6 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml index cd1002b..741eaae 100644 --- a/.github/workflows/check-versions.yaml +++ b/.github/workflows/check-versions.yaml @@ -20,7 +20,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.1 + uses: actions/checkout@v6.0.2 - name: Set up Helm uses: azure/setup-helm@v3.5 diff --git a/.github/workflows/helm-chart-ci-ignore.yaml b/.github/workflows/helm-chart-ci-ignore.yaml index 733a5bb..83dce8f 100644 --- a/.github/workflows/helm-chart-ci-ignore.yaml +++ b/.github/workflows/helm-chart-ci-ignore.yaml @@ -43,7 +43,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.1 + uses: actions/checkout@v6.0.2 - id: set-matrix-example name: Collect all examples diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 11901ba..61bf02d 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -37,7 +37,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.1 + uses: actions/checkout@v6.0.2 - name: Verify Docs updated run: ./helm-docs.sh @@ -107,7 +107,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.1 + uses: actions/checkout@v6.0.2 with: fetch-depth: 0 @@ -149,7 +149,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.1 + uses: actions/checkout@v6.0.2 with: fetch-depth: 0 @@ -201,7 +201,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.1 + uses: actions/checkout@v6.0.2 - id: set-matrix-example name: Collect all examples @@ -242,7 +242,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.1 + uses: actions/checkout@v6.0.2 - name: Set up Helm uses: azure/setup-helm@v3.5 @@ -297,7 +297,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.1 + uses: actions/checkout@v6.0.2 - name: Set up Helm uses: azure/setup-helm@v3.5 @@ -343,7 +343,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.1 + uses: actions/checkout@v6.0.2 - name: Set up Helm uses: azure/setup-helm@v3.5 diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index 50b9c6e..52802d7 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.1 + uses: actions/checkout@v6.0.2 with: fetch-depth: 0 diff --git a/.github/workflows/shellcheck.yaml b/.github/workflows/shellcheck.yaml index 7e5b19e..f31f4c6 100644 --- a/.github/workflows/shellcheck.yaml +++ b/.github/workflows/shellcheck.yaml @@ -21,7 +21,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.1 + uses: actions/checkout@v6.0.2 - name: Run Shellcheck uses: ludeeus/action-shellcheck@2.0.0 diff --git a/.github/workflows/update-devcontainer-image.yaml b/.github/workflows/update-devcontainer-image.yaml index 66b8409..2652bfb 100644 --- a/.github/workflows/update-devcontainer-image.yaml +++ b/.github/workflows/update-devcontainer-image.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install cosign uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 with: From 8fbf7e8e67d5204b23a86903a6de30595797a512 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Apr 2026 17:46:31 +0000 Subject: [PATCH 10/23] Bump actions/setup-python from 5 to 6 Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5 to 6. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v5...v6) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/check-versions.yaml | 2 +- .github/workflows/helm-chart-ci.yaml | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml index 741eaae..1f770c2 100644 --- a/.github/workflows/check-versions.yaml +++ b/.github/workflows/check-versions.yaml @@ -41,7 +41,7 @@ jobs: go-version: '1.21' cache: false - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v6 with: python-version: '3.9' diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 61bf02d..da078cb 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -117,7 +117,7 @@ jobs: version: ${{ env.HELM_VERSION }} - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: ${{ env.PYTHON_VERSION }} @@ -159,7 +159,7 @@ jobs: version: ${{ env.HELM_VERSION }} - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: ${{ env.PYTHON_VERSION }} @@ -250,7 +250,7 @@ jobs: version: ${{ env.HELM_VERSION }} - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: ${{ env.PYTHON_VERSION }} @@ -305,7 +305,7 @@ jobs: version: ${{ env.HELM_VERSION }} - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: ${{ env.PYTHON_VERSION }} @@ -351,7 +351,7 @@ jobs: version: ${{ env.HELM_VERSION }} - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: ${{ env.PYTHON_VERSION }} From 72f15a87f34fe1608575d0da424786e0fdf5e686 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Apr 2026 16:43:39 +0200 Subject: [PATCH 11/23] Bump helm/chart-testing-action from 2.6.1 to 2.8.0 (#807) Bumps [helm/chart-testing-action](https://github.com/helm/chart-testing-action) from 2.6.1 to 2.8.0. - [Release notes](https://github.com/helm/chart-testing-action/releases) - [Commits](https://github.com/helm/chart-testing-action/compare/v2.6.1...v2.8.0) --- updated-dependencies: - dependency-name: helm/chart-testing-action dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/helm-chart-ci.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index da078cb..5d6ab98 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -122,7 +122,7 @@ jobs: python-version: ${{ env.PYTHON_VERSION }} - name: Setup chart-testing - uses: helm/chart-testing-action@v2.6.1 + uses: helm/chart-testing-action@v2.8.0 with: version: ${{ env.CHART_TESTING_VERSION }} @@ -164,7 +164,7 @@ jobs: python-version: ${{ env.PYTHON_VERSION }} - name: Setup chart-testing - uses: helm/chart-testing-action@v2.6.1 + uses: helm/chart-testing-action@v2.8.0 with: version: ${{ env.CHART_TESTING_VERSION }} From 2dd8efae289c0b47a80267cfb56fb4b8b4d1fcd5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Apr 2026 16:44:04 +0200 Subject: [PATCH 12/23] Bump actions/setup-go from 5.0.0 to 6.4.0 (#809) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.0.0 to 6.4.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v5.0.0...v6.4.0) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/check-versions.yaml | 2 +- .github/workflows/helm-chart-ci.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml index 1f770c2..bce842e 100644 --- a/.github/workflows/check-versions.yaml +++ b/.github/workflows/check-versions.yaml @@ -36,7 +36,7 @@ jobs: git diff - name: Setup go - uses: actions/setup-go@v5.0.0 + uses: actions/setup-go@v6.4.0 with: go-version: '1.21' cache: false diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 5d6ab98..82610cf 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -78,7 +78,7 @@ jobs: fi - name: Setup Go - uses: actions/setup-go@v5.0.0 + uses: actions/setup-go@v6.4.0 with: go-version-file: tests/go.mod cache-dependency-path: tests/go.sum From 4d4f2490f57daf1bf6d2d57d5f78442543a9f002 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Apr 2026 14:45:07 +0000 Subject: [PATCH 13/23] Bump peter-evans/create-pull-request from 6.0.2 to 8.1.1 (#805) Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 6.0.2 to 8.1.1. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](https://github.com/peter-evans/create-pull-request/compare/v6.0.2...v8.1.1) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-version: 8.1.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/check-versions.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml index bce842e..319b16a 100644 --- a/.github/workflows/check-versions.yaml +++ b/.github/workflows/check-versions.yaml @@ -68,7 +68,7 @@ jobs: - name: Create Pull Request id: cpr - uses: peter-evans/create-pull-request@v6.0.2 + uses: peter-evans/create-pull-request@v8.1.1 with: token: ${{ steps.generate-token.outputs.token }} title: Bump test chart dependencies From bd9fc402e569e429c28e17dd297a12bb69c73ca3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Apr 2026 14:47:19 +0000 Subject: [PATCH 14/23] Bump helm/chart-releaser-action from 1.6.0 to 1.7.0 (#806) Bumps [helm/chart-releaser-action](https://github.com/helm/chart-releaser-action) from 1.6.0 to 1.7.0. - [Release notes](https://github.com/helm/chart-releaser-action/releases) - [Commits](https://github.com/helm/chart-releaser-action/compare/v1.6.0...v1.7.0) --- updated-dependencies: - dependency-name: helm/chart-releaser-action dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/helm-release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index 52802d7..50b1101 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -39,7 +39,7 @@ jobs: version: v3.10.3 - name: Run chart-releaser - uses: helm/chart-releaser-action@v1.6.0 + uses: helm/chart-releaser-action@v1.7.0 env: CR_TOKEN: '${{ secrets.GITHUB_TOKEN }}' From 5d4c0438c2961b2a07785442a2e33a4d8a44708a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Apr 2026 14:56:27 +0000 Subject: [PATCH 15/23] Bump helm/kind-action from 1.9.0 to 1.14.0 (#810) Bumps [helm/kind-action](https://github.com/helm/kind-action) from 1.9.0 to 1.14.0. - [Release notes](https://github.com/helm/kind-action/releases) - [Commits](https://github.com/helm/kind-action/compare/v1.9.0...v1.14.0) --- updated-dependencies: - dependency-name: helm/kind-action dependency-version: 1.14.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/helm-chart-ci.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 82610cf..9703d57 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -169,7 +169,7 @@ jobs: version: ${{ env.CHART_TESTING_VERSION }} - name: Create kind ${{ matrix.k8s }} cluster - uses: helm/kind-action@v1.9.0 + uses: helm/kind-action@v1.14.0 # Only build a kind cluster if there are chart changes to test. with: version: ${{ env.KIND_VERSION }} @@ -255,7 +255,7 @@ jobs: python-version: ${{ env.PYTHON_VERSION }} - name: Create kind cluster - uses: helm/kind-action@v1.9.0 + uses: helm/kind-action@v1.14.0 # Only build a kind cluster if there are chart changes to test. with: version: ${{ env.KIND_VERSION }} @@ -310,7 +310,7 @@ jobs: python-version: ${{ env.PYTHON_VERSION }} - name: Create kind cluster - uses: helm/kind-action@v1.9.0 + uses: helm/kind-action@v1.14.0 # Only build a kind cluster if there are chart changes to test. with: version: ${{ env.KIND_VERSION }} @@ -356,7 +356,7 @@ jobs: python-version: ${{ env.PYTHON_VERSION }} - name: Create kind cluster - uses: helm/kind-action@v1.9.0 + uses: helm/kind-action@v1.14.0 # Only build a kind cluster if there are chart changes to test. with: version: ${{ env.KIND_VERSION }} From f17e024a66a6a6068145c46f3cacbc1be6ae0df8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 28 Apr 2026 04:26:51 +0000 Subject: [PATCH 16/23] Bump azure/setup-helm from 3.5 to 5 Bumps [azure/setup-helm](https://github.com/azure/setup-helm) from 3.5 to 5. - [Release notes](https://github.com/azure/setup-helm/releases) - [Changelog](https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md) - [Commits](https://github.com/azure/setup-helm/compare/v3.5...v5) --- updated-dependencies: - dependency-name: azure/setup-helm dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/check-versions.yaml | 2 +- .github/workflows/helm-chart-ci.yaml | 12 ++++++------ .github/workflows/helm-release.yaml | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml index 319b16a..5c09d07 100644 --- a/.github/workflows/check-versions.yaml +++ b/.github/workflows/check-versions.yaml @@ -23,7 +23,7 @@ jobs: uses: actions/checkout@v6.0.2 - name: Set up Helm - uses: azure/setup-helm@v3.5 + uses: azure/setup-helm@v5 with: version: ${{ env.HELM_VERSION }} diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 9703d57..15b6810 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -85,7 +85,7 @@ jobs: check-latest: true - name: Set up Helm - uses: azure/setup-helm@v3.5 + uses: azure/setup-helm@v5 with: version: ${{ env.HELM_VERSION }} @@ -112,7 +112,7 @@ jobs: fetch-depth: 0 - name: Set up Helm - uses: azure/setup-helm@v3.5 + uses: azure/setup-helm@v5 with: version: ${{ env.HELM_VERSION }} @@ -154,7 +154,7 @@ jobs: fetch-depth: 0 - name: Set up Helm - uses: azure/setup-helm@v3.5 + uses: azure/setup-helm@v5 with: version: ${{ env.HELM_VERSION }} @@ -245,7 +245,7 @@ jobs: uses: actions/checkout@v6.0.2 - name: Set up Helm - uses: azure/setup-helm@v3.5 + uses: azure/setup-helm@v5 with: version: ${{ env.HELM_VERSION }} @@ -300,7 +300,7 @@ jobs: uses: actions/checkout@v6.0.2 - name: Set up Helm - uses: azure/setup-helm@v3.5 + uses: azure/setup-helm@v5 with: version: ${{ env.HELM_VERSION }} @@ -346,7 +346,7 @@ jobs: uses: actions/checkout@v6.0.2 - name: Set up Helm - uses: azure/setup-helm@v3.5 + uses: azure/setup-helm@v5 with: version: ${{ env.HELM_VERSION }} diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index 50b1101..c77cc8b 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -34,7 +34,7 @@ jobs: cosign-release: v2.2.3 - name: Set up Helm - uses: azure/setup-helm@v3.5 + uses: azure/setup-helm@v5 with: version: v3.10.3 From 7f311dcd5eb049051bd9a93c116949d3b199bd08 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Apr 2026 03:53:41 +0000 Subject: [PATCH 17/23] Bump github.com/onsi/ginkgo/v2 from 2.28.1 to 2.28.2 in /tests Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.28.1 to 2.28.2. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/ginkgo/compare/v2.28.1...v2.28.2) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-version: 2.28.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- tests/go.mod | 2 +- tests/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index a49e26d..8a20b0e 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -3,7 +3,7 @@ module github.com/spiffe/helm-charts/tests go 1.25.0 require ( - github.com/onsi/ginkgo/v2 v2.28.1 + github.com/onsi/ginkgo/v2 v2.28.2 github.com/onsi/gomega v1.39.1 helm.sh/helm/v3 v3.20.2 ) diff --git a/tests/go.sum b/tests/go.sum index b4ddb29..7463456 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -89,8 +89,8 @@ github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFd github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= -github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI= -github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE= +github.com/onsi/ginkgo/v2 v2.28.2 h1:DTrMfpqxiNUyQ3Y0zhn1n3cOO2euFgQPYIpkWwxVFps= +github.com/onsi/ginkgo/v2 v2.28.2/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE= github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28= github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= From ad41ac1fa2b2dff10ec86bff1ea2a6d4e33f3158 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 28 Apr 2026 12:09:12 +0000 Subject: [PATCH 18/23] Bump docker/login-action from 3.1.0 to 4.1.0 Bumps [docker/login-action](https://github.com/docker/login-action) from 3.1.0 to 4.1.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v3.1.0...v4.1.0) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/helm-release.yaml | 2 +- .github/workflows/update-devcontainer-image.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index c77cc8b..6fe999d 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -44,7 +44,7 @@ jobs: CR_TOKEN: '${{ secrets.GITHUB_TOKEN }}' - name: Login to GitHub Container Registry - uses: docker/login-action@v3.1.0 + uses: docker/login-action@v4.1.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/update-devcontainer-image.yaml b/.github/workflows/update-devcontainer-image.yaml index 2652bfb..c8a5262 100644 --- a/.github/workflows/update-devcontainer-image.yaml +++ b/.github/workflows/update-devcontainer-image.yaml @@ -31,7 +31,7 @@ jobs: - name: Install regctl uses: regclient/actions/regctl-installer@f3c6d87835906c175eb6ccfc18b348b69bb447e7 # main - name: Log in to GHCR - uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 with: registry: ghcr.io username: ${{ github.actor }} From 53889562c483826e9d2929dc3dec85ac9f0f547a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 29 Apr 2026 03:53:08 +0000 Subject: [PATCH 19/23] Bump github.com/onsi/gomega from 1.39.1 to 1.40.0 in /tests Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.39.1 to 1.40.0. - [Release notes](https://github.com/onsi/gomega/releases) - [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/gomega/compare/v1.39.1...v1.40.0) --- updated-dependencies: - dependency-name: github.com/onsi/gomega dependency-version: 1.40.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- tests/go.mod | 2 +- tests/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index 8a20b0e..492e3a6 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -4,7 +4,7 @@ go 1.25.0 require ( github.com/onsi/ginkgo/v2 v2.28.2 - github.com/onsi/gomega v1.39.1 + github.com/onsi/gomega v1.40.0 helm.sh/helm/v3 v3.20.2 ) diff --git a/tests/go.sum b/tests/go.sum index 7463456..8fe2844 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -91,8 +91,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/onsi/ginkgo/v2 v2.28.2 h1:DTrMfpqxiNUyQ3Y0zhn1n3cOO2euFgQPYIpkWwxVFps= github.com/onsi/ginkgo/v2 v2.28.2/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE= -github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28= -github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg= +github.com/onsi/gomega v1.40.0 h1:Vtol0e1MghCD2ZVIilPDIg44XSL9l2QAn8ZNaljWcJc= +github.com/onsi/gomega v1.40.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= From 9226e4f1477a6a619d3e6b6a64485e1bd32f22c1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 29 Apr 2026 08:57:31 +0000 Subject: [PATCH 20/23] Bump github.com/onsi/ginkgo/v2 from 2.28.2 to 2.28.3 in /tests Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.28.2 to 2.28.3. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/ginkgo/compare/v2.28.2...v2.28.3) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-version: 2.28.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- tests/go.mod | 20 ++++++++++---------- tests/go.sum | 40 ++++++++++++++++++++-------------------- 2 files changed, 30 insertions(+), 30 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index 492e3a6..e2152e5 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -3,7 +3,7 @@ module github.com/spiffe/helm-charts/tests go 1.25.0 require ( - github.com/onsi/ginkgo/v2 v2.28.2 + github.com/onsi/ginkgo/v2 v2.28.3 github.com/onsi/gomega v1.40.0 helm.sh/helm/v3 v3.20.2 ) @@ -26,7 +26,7 @@ require ( github.com/gobwas/glob v0.2.3 // indirect github.com/google/gnostic-models v0.7.0 // indirect github.com/google/go-cmp v0.7.0 // indirect - github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 // indirect + github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 // indirect github.com/google/uuid v1.6.0 // indirect github.com/huandu/xstrings v1.5.0 // indirect github.com/josharian/intern v1.0.0 // indirect @@ -44,16 +44,16 @@ require ( github.com/x448/float16 v0.8.4 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/crypto v0.47.0 // indirect - golang.org/x/mod v0.32.0 // indirect - golang.org/x/net v0.49.0 // indirect + golang.org/x/crypto v0.50.0 // indirect + golang.org/x/mod v0.35.0 // indirect + golang.org/x/net v0.53.0 // indirect golang.org/x/oauth2 v0.30.0 // indirect - golang.org/x/sync v0.19.0 // indirect - golang.org/x/sys v0.40.0 // indirect - golang.org/x/term v0.39.0 // indirect - golang.org/x/text v0.33.0 // indirect + golang.org/x/sync v0.20.0 // indirect + golang.org/x/sys v0.43.0 // indirect + golang.org/x/term v0.42.0 // indirect + golang.org/x/text v0.36.0 // indirect golang.org/x/time v0.12.0 // indirect - golang.org/x/tools v0.41.0 // indirect + golang.org/x/tools v0.44.0 // indirect google.golang.org/protobuf v1.36.8 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/tests/go.sum b/tests/go.sum index 8fe2844..42ef5b2 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -52,8 +52,8 @@ github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7O github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= -github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc= -github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI= +github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg= +github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI= @@ -89,8 +89,8 @@ github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFd github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= -github.com/onsi/ginkgo/v2 v2.28.2 h1:DTrMfpqxiNUyQ3Y0zhn1n3cOO2euFgQPYIpkWwxVFps= -github.com/onsi/ginkgo/v2 v2.28.2/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE= +github.com/onsi/ginkgo/v2 v2.28.3 h1:4JvMdwtFU0imd8fHx25OJXoDMRexnf8v5NHKYSTTji4= +github.com/onsi/ginkgo/v2 v2.28.3/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44= github.com/onsi/gomega v1.40.0 h1:Vtol0e1MghCD2ZVIilPDIg44XSL9l2QAn8ZNaljWcJc= github.com/onsi/gomega v1.40.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= @@ -133,26 +133,26 @@ go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8= -golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A= -golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c= -golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU= -golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o= -golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8= +golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI= +golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q= +golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM= +golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU= +golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA= +golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs= golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI= golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU= -golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= -golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= -golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ= -golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY= -golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww= -golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE= -golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8= +golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= +golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= +golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY= +golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY= +golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg= +golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164= golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE= golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg= -golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc= -golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg= +golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c= +golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI= google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc= google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From c489dfc4db62c53f1c188ecc5042a9dd064cfd5b Mon Sep 17 00:00:00 2001 From: Daniel Schlatter Date: Sat, 2 May 2026 01:25:29 -0600 Subject: [PATCH 21/23] Update helper images in spiffe-csi-driver (#815) csi-node-driver-registrar -> 2.15.0 ubi9 -> ubi10/ubi-minimal:10.1-1776834797 Signed-off-by: Daniel Schlatter --- charts/spire/charts/spiffe-csi-driver/README.md | 6 +++--- charts/spire/charts/spiffe-csi-driver/values.yaml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index b5b9776..a43873f 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -61,7 +61,7 @@ A Helm chart to install the SPIFFE CSI driver. | `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | | `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` | | `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.4` | +| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.15.0` | | `nodeDriverRegistrar.extraEnvVars` | Extra environment variables to be added to the nodeDriverRegistrar container | `[]` | | `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` | @@ -72,7 +72,7 @@ A Helm chart to install the SPIFFE CSI driver. | `selinux.enabled` | Enable selinux support | `false` | | `selinux.context` | Which selinux context to use | `container_file_t` | | `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` | -| `selinux.image.repository` | The repository within the registry | `ubi9` | +| `selinux.image.repository` | The repository within the registry | `ubi10/ubi-minimal` | | `selinux.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1776645994` | +| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `10.1-1776834797` | diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index e2d36ec..56a4a2f 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -134,7 +134,7 @@ nodeDriverRegistrar: registry: registry.k8s.io repository: sig-storage/csi-node-driver-registrar pullPolicy: IfNotPresent - tag: v2.9.4 + tag: v2.15.0 ## @param nodeDriverRegistrar.extraEnvVars [array] Extra environment variables to be added to the nodeDriverRegistrar container extraEnvVars: [] @@ -167,6 +167,6 @@ selinux: ## @param selinux.image.tag Overrides the image tag whose default is the chart appVersion image: registry: registry.access.redhat.com - repository: ubi9 + repository: ubi10/ubi-minimal pullPolicy: IfNotPresent - tag: 9.7-1776645994 + tag: 10.1-1776834797 From 146cf1add6b7b2fc96d20e596360392e2815cfee Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Sun, 3 May 2026 05:52:41 -0700 Subject: [PATCH 22/23] Bump spire-nested Helm Chart version from 0.28.4 to 0.28.5 (#818) Signed-off-by: Faisal Memon --- charts/spire-nested/Chart.yaml | 2 +- charts/spire-nested/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire-nested/Chart.yaml b/charts/spire-nested/Chart.yaml index 44db001..fe7c203 100644 --- a/charts/spire-nested/Chart.yaml +++ b/charts/spire-nested/Chart.yaml @@ -3,7 +3,7 @@ name: spire-nested description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.28.4 +version: 0.28.5 appVersion: "1.14.5" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md index f81c130..41679f0 100644 --- a/charts/spire-nested/README.md +++ b/charts/spire-nested/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.28.4](https://img.shields.io/badge/Version-0.28.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.5](https://img.shields.io/badge/AppVersion-1.14.5-informational?style=flat-square) +![Version: 0.28.5](https://img.shields.io/badge/Version-0.28.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.5](https://img.shields.io/badge/AppVersion-1.14.5-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. From 574fa87d573051ef63c5795c378c498b4488f8e4 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Thu, 7 May 2026 05:04:38 -0700 Subject: [PATCH 23/23] Bump spire Helm Chart version from 0.28.4 to 0.28.5 (#817) * c489dfc4 Update helper images in spiffe-csi-driver (#815) * f537f770 allow unsupported built-in key manager plugins to be used (#798) * c5ba8213 Bump test chart dependencies (#797) * dfe80891 feat: add gcp_iit node attestor configuration options (#796) * 21969d20 Bump test chart dependencies (#795) Signed-off-by: Faisal Memon Co-authored-by: kfox1111 --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 9b8e7ce..86a96c3 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,7 +3,7 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.28.4 +version: 0.28.5 appVersion: "1.14.5" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index 09ebcaf..c45fd11 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.28.4](https://img.shields.io/badge/Version-0.28.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.5](https://img.shields.io/badge/AppVersion-1.14.5-informational?style=flat-square) +![Version: 0.28.5](https://img.shields.io/badge/Version-0.28.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.5](https://img.shields.io/badge/AppVersion-1.14.5-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.