Skip to content

Commit bf182ff

Browse files
hashiblaumhashiblaum
committed
Squash merge branch 'main' into VAULT-40103-approle-extension
1 parent 627c60e commit bf182ff

File tree

14 files changed

+171
-121
lines changed

14 files changed

+171
-121
lines changed

‎.github/workflows/build.yaml‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@ jobs:
164164
runs-on: ubuntu-latest
165165
strategy:
166166
matrix:
167-
arch: ["arm64", "amd64", "s390x"]
167+
arch: ["arm64", "amd64"]
168168
env:
169169
repo: ${{github.event.repository.name}}
170170
version: ${{needs.get-product-version.outputs.product-version}}
@@ -219,6 +219,7 @@ jobs:
219219
run: |
220220
make ci-build-scripts-dir GOARCH="${{ matrix.arch }}"
221221
- name: Docker Build (Action)
222+
if: ${{ matrix.arch != 's390x' }}
222223
uses: hashicorp/actions-docker-build@v2
223224
env:
224225
VERSION: ${{ needs.get-product-version.outputs.product-version }}
@@ -231,11 +232,22 @@ jobs:
231232
tags: |
232233
docker.io/hashicorp/${{env.repo}}:${{env.image_tag}}
233234
public.ecr.aws/hashicorp/${{env.repo}}:${{env.image_tag}}
234-
235-
- name: Check binary version in container
235+
- name: Docker Build (Action) s390x
236+
if: ${{ matrix.arch == 's390x' }}
237+
uses: hashicorp/actions-docker-build@v2
238+
env:
239+
VERSION: ${{ needs.get-product-version.outputs.product-version }}
240+
GO_VERSION: ${{ needs.build-pre-checks.outputs.go-version }}
241+
with:
242+
version: ${{env.version}}
243+
target: release-ubi
244+
arch: ${{matrix.arch}}
245+
redhat_tag: quay.io/redhat-isv-containers/64b072322e2773c28d30d988:${{env.image_tag}}
246+
- name: Check binary version in container ${{ matrix.arch }}
247+
if: ${{ matrix.arch != 's390x' }}
236248
shell: bash
237249
run: |
238-
version_output=$(docker run hashicorp/${{env.repo}}:${{env.image_tag}} --version --output=json)
250+
version_output=$(docker run --platform linux/${{matrix.arch}} hashicorp/${{env.repo}}:${{env.image_tag}} --version --output=json)
239251
echo $version_output
240252
git_version=$(echo $version_output | jq -r .gitVersion)
241253
@@ -269,6 +281,7 @@ jobs:
269281
- "0.10.0"
270282
- "1.0.0"
271283
- "1.0.1"
284+
- "1.1.0"
272285
steps:
273286
- uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
274287
with:

‎.go-version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.25.4
1+
1.25.5

‎.release/security-scan.hcl‎

Lines changed: 27 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -2,33 +2,37 @@
22
# SPDX-License-Identifier: BUSL-1.1
33

44
binary {
5-
go_stdlib = true // Scan the Go standard library used to build the binary.
6-
go_modules = true // Scan the Go modules included in the binary.
7-
osv = true // Use the OSV vulnerability database.
8-
oss_index = true // And use OSS Index vulnerability database.
5+
go_stdlib = true // Scan the Go standard library used to build the binary.
6+
go_modules = true // Scan the Go modules included in the binary.
7+
osv = true // Use the OSV vulnerability database.
8+
oss_index = true // And use OSS Index vulnerability database.
99

10-
secrets {
11-
all = true
12-
}
10+
secrets {
11+
all = true
12+
}
1313

14-
triage {
15-
suppress {
16-
vulnerabilities = [
17-
// GO-2022-0635 is of low severity, and VSO isn't using the affected functionalities
18-
// Upgrading to latest version of go-secure-stdlib is not possible at this time.
19-
// The required functionality was inadvertently dropped from
20-
// github.com/hashicorp/go-secure-stdlib/awsutil during the migration to aws-sdk-go-v2.
21-
"GO-2022-0635"
22-
]
23-
}
24-
}
14+
triage {
15+
suppress {
16+
vulnerabilities = [
17+
// GO-2022-0635 is of low severity, and VSO isn't using the affected functionalities
18+
// Upgrading to latest version of go-secure-stdlib is not possible at this time.
19+
// The required functionality was inadvertently dropped from
20+
// github.com/hashicorp/go-secure-stdlib/awsutil during the migration to aws-sdk-go-v2.
21+
"GO-2022-0635",
22+
// CVE-2025-6020 is for the UBI image.
23+
// It has not yet been patched in registry.access.redhat.com/ubi10/ubi-micro:latest,
24+
// and is not applicable to this project.
25+
"CVE-2025-6020",
26+
]
27+
}
28+
}
2529
}
2630

2731
container {
28-
dependencies = true // Scan any installed packages for vulnerabilities.
29-
osv = true // Use the OSV vulnerability database.
32+
dependencies = true // Scan any installed packages for vulnerabilities.
33+
osv = true // Use the OSV vulnerability database.
3034

31-
secrets {
32-
all = true
33-
}
35+
secrets {
36+
all = true
37+
}
3438
}

‎.release/vault-secrets-operator-artifacts.hcl‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,10 @@ artifacts {
1111
container = [
1212
"vault-secrets-operator_release-default_linux_amd64_${version}_${commit_sha}.docker.tar",
1313
"vault-secrets-operator_release-default_linux_arm64_${version}_${commit_sha}.docker.tar",
14-
"vault-secrets-operator_release-default_linux_s390x_${version}_${commit_sha}.docker.tar",
1514
"vault-secrets-operator_release-ubi_linux_amd64_${version}_${commit_sha}.docker.redhat.tar",
1615
"vault-secrets-operator_release-ubi_linux_arm64_${version}_${commit_sha}.docker.redhat.tar",
1716
"vault-secrets-operator_release-ubi_linux_s390x_${version}_${commit_sha}.docker.redhat.tar",
1817
"vault-secrets-operator_release-ubi_linux_amd64_${version}_${commit_sha}.docker.tar",
1918
"vault-secrets-operator_release-ubi_linux_arm64_${version}_${commit_sha}.docker.tar",
20-
"vault-secrets-operator_release-ubi_linux_s390x_${version}_${commit_sha}.docker.tar",
2119
]
2220
}

‎CHANGELOG.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,37 @@
1+
## 1.1.1 (December 16th, 2025)
2+
3+
Fix:
4+
* Helm: properly set the PodSecurityContext: ([#1183](https://github.com/hashicorp/vault-secrets-operator/pull/1183))
5+
6+
Enhancements:
7+
* Helm: bump CSI driver version to 1.0.1: ([#1184](https://github.com/hashicorp/vault-secrets-operator/pull/1184))
8+
9+
10+
## 1.1.0 (December 12th, 2025)
11+
12+
Enhancements:
13+
* Add support for linux/s390x and linux/arm64 (Red Hat): ([#1152](https://github.com/hashicorp/vault-secrets-operator/pull/1152))
14+
15+
Fix:
16+
* Topology spread constraints bugfix: ([#1148](https://github.com/hashicorp/vault-secrets-operator/pull/1148))
17+
* Update docs branch version: ([#1140](https://github.com/hashicorp/vault-secrets-operator/pull/1140))
18+
19+
Build:
20+
* ci: updating vault-helm to v0.31.0 and latest Vault versions: ([#1125](https://github.com/hashicorp/vault-secrets-operator/pull/1125))
21+
22+
Dependency Updates:
23+
* Bump the gomod-backward-compatible group across 1 directory with 4 updates: ([#1172](https://github.com/hashicorp/vault-secrets-operator/pull/1172))
24+
* Bump the gomod-backward-compatible group with 4 updates: ([#1178](https://github.com/hashicorp/vault-secrets-operator/pull/1178))
25+
* Bump github.com/gruntwork-io/terratest from 0.53.0 to 0.54.0 in the gomod-backward-compatible group: ([#1162](https://github.com/hashicorp/vault-secrets-operator/pull/1162))
26+
* Bump the gomod-backward-compatible group across 1 directory with 6 updates: ([#1147](https://github.com/hashicorp/vault-secrets-operator/pull/1147))
27+
* Bump golang.org/x/crypto from 0.43.0 to 0.45.0: ([#1154](https://github.com/hashicorp/vault-secrets-operator/pull/1154))
28+
* Bump the gomod-backward-compatible group with 7 updates: ([#1157](https://github.com/hashicorp/vault-secrets-operator/pull/1157))
29+
* Bump google.golang.org/api from 0.250.0 to 0.251.0 in the gomod-backward-compatible group: ([#1133](https://github.com/hashicorp/vault-secrets-operator/pull/1133))
30+
* Bump the gomod-backward-compatible group with 5 updates: ([#1128](https://github.com/hashicorp/vault-secrets-operator/pull/1128))
31+
* Bump Go version to 1.25.4: ([#1151](https://github.com/hashicorp/vault-secrets-operator/pull/1151))
32+
* Bump ubi10/ubi-micro from 10.0 to 10.1: ([#1150](https://github.com/hashicorp/vault-secrets-operator/pull/1150))
33+
* Bump ubi10/ubi-minimal from 10.0 to 10.1: ([#1149](https://github.com/hashicorp/vault-secrets-operator/pull/1149))
34+
135
## 1.0.1 (September 26th, 2025)
236

337
Fix:

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
# - use environment variables to overwrite this value (e.g export VERSION=0.0.2)
66
VERSION ?= 0.0.0-dev
77
KUBE_RBAC_PROXY_VERSION = v0.18.1
8-
VSO_CSI_DRIVER_VERSION ?= 1.0.0
8+
VSO_CSI_DRIVER_VERSION ?= 1.0.1
99
VSO_CSI_LIVENESS_PROBE_VERSION ?= v2.16.0
1010
VSO_CSI_NODE_DRIVER_REGISTRAR_VERSION ?= v2.14.0
1111

‎chart/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33

44
apiVersion: v2
55
name: vault-secrets-operator
6-
version: 1.0.1
7-
appVersion: "1.0.1"
6+
version: 1.1.1
7+
appVersion: "1.1.1"
88
kubeVersion: ">=1.21.0-0"
99
description: Official Vault Secrets Operator Chart
1010
type: application

‎chart/templates/_helpers.tpl‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -487,14 +487,14 @@ topologySpreadConstraints appends the "vso.chart.selectorLabels" to .Values.cont
487487
vso.privileged.securityContext extends the given securithContext to always
488488
include privileged: true
489489
*/}}
490-
{{- define "vso.privileged.securityContext" -}}
490+
{{- define "vso.privilegedContainer.securityContext" -}}
491491
{{- $sc := dict -}}
492492
{{- with . -}}
493493
{{- range $k, $v := . -}}
494494
{{- $_ := set $sc $k $v -}}
495495
{{- end -}}
496496
{{- end -}}
497-
{{- $_ := set $sc "privileged" (true | quote) -}}
497+
{{- $_ := set $sc "privileged" true -}}
498498
{{- toYaml $sc -}}
499499
{{- end -}}
500500

‎chart/templates/csi-driver.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,10 @@ spec:
6161
annotations:
6262
{{- include "vso.csi.annotations" . | nindent 8 }}
6363
spec:
64+
{{- with .Values.csi.securityContext }}
6465
securityContext:
65-
{{- include "vso.privileged.securityContext" .Values.csi.securityContext | nindent 8 }}
66+
{{ toYaml . | nindent 8 }}
67+
{{- end }}
6668
serviceAccountName: {{ include "vso.chart.fullname" . }}-csi
6769
{{- with .Values.csi.hostAliases }}
6870
hostAliases:
@@ -133,7 +135,7 @@ spec:
133135
{{- end }}
134136
imagePullPolicy: {{ .Values.csi.driver.image.pullPolicy }}
135137
securityContext:
136-
{{- include "vso.privileged.securityContext" .Values.csi.driver.securityContext | nindent 10 }}
138+
{{- include "vso.privilegedContainer.securityContext" .Values.csi.driver.securityContext | nindent 10 }}
137139
livenessProbe:
138140
failureThreshold: 5
139141
httpGet:

‎chart/values.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -197,7 +197,7 @@ controller:
197197
image:
198198
pullPolicy: IfNotPresent
199199
repository: hashicorp/vault-secrets-operator
200-
tag: 1.0.1
200+
tag: 1.1.1
201201

202202
# logging
203203
logging:
@@ -1049,7 +1049,7 @@ csi:
10491049
# The Docker repository of the CSI driver image.
10501050
repository: hashicorp/vault-secrets-operator-csi
10511051
# The version of the CSI driver image to download.
1052-
tag: 1.0.0
1052+
tag: 1.0.1
10531053

10541054
# Additional environment variables for the
10551055
# CSI driver container.

0 commit comments

Comments
 (0)