Skip to content

Commit 2caa2f2

Browse files
knative-automationknative-automation
authored
upgrade to latest dependencies (#2248)
bumping knative.dev/eventing ba8ac76...26b9071: > 26b9071 make sinkbinding oidc-token volume mount readOnly (# 8894) bumping knative.dev/serving 89f3fe7...f161c41: > f161c41 Update net-istio nightly (# 16426) bumping knative.dev/pkg 1f39e94...a902bbf: > a902bbf Replace NewConfigFromEnv with DefaultConfigFromEnv (# 3328) Signed-off-by: Knative Automation <automation@knative.team>
1 parent 06a8a7e commit 2caa2f2

File tree

7 files changed

+63
-95
lines changed

7 files changed

+63
-95
lines changed

‎go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ require (
2121
k8s.io/client-go v0.35.2
2222
k8s.io/code-generator v0.35.2
2323
knative.dev/caching v0.0.0-20260303015151-ff2668f65724
24-
knative.dev/eventing v0.48.1-0.20260303190100-ba8ac76433d4
24+
knative.dev/eventing v0.48.1-0.20260304104053-26b9071e4ef3
2525
knative.dev/hack v0.0.0-20260212092700-0126b283bf20
26-
knative.dev/pkg v0.0.0-20260302190359-1f39e94ef003
26+
knative.dev/pkg v0.0.0-20260304131155-a902bbfa38de
2727
knative.dev/reconciler-test v0.0.0-20260303022055-b6439c2a1955
28-
knative.dev/serving v0.48.1-0.20260303142400-89f3fe74309a
28+
knative.dev/serving v0.48.1-0.20260304122354-f161c41d3df3
2929
sigs.k8s.io/yaml v1.6.0
3030
)
3131

‎go.sum‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1716,18 +1716,18 @@ k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzk
17161716
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
17171717
knative.dev/caching v0.0.0-20260303015151-ff2668f65724 h1:ZrQxBxUCVFb+QrUCR6+hVHjwKtyW8ZyXpIkIYi2Cgdc=
17181718
knative.dev/caching v0.0.0-20260303015151-ff2668f65724/go.mod h1:NlTx/oxLKjMnMjoHbE4OtlPkHMu9IVdSl7eJCmXhUiI=
1719-
knative.dev/eventing v0.48.1-0.20260303190100-ba8ac76433d4 h1:KaJAdxxaV9IbtvFzoJuh1vFE47/+c9rlsCCsJUHwzms=
1720-
knative.dev/eventing v0.48.1-0.20260303190100-ba8ac76433d4/go.mod h1:HseSdM0vR//gaW5g0+iU1ApPJZ1mInL+A7DD8kef1sU=
1719+
knative.dev/eventing v0.48.1-0.20260304104053-26b9071e4ef3 h1:wujjcmDVnCMkpwZaG2ybXjSjOf57jBf2+x84ChvNY+c=
1720+
knative.dev/eventing v0.48.1-0.20260304104053-26b9071e4ef3/go.mod h1:HseSdM0vR//gaW5g0+iU1ApPJZ1mInL+A7DD8kef1sU=
17211721
knative.dev/hack v0.0.0-20260212092700-0126b283bf20 h1:Ocya6ILPQxGrozD5gPELC4J2ASnqvTLvYGJjddKr4Fs=
17221722
knative.dev/hack v0.0.0-20260212092700-0126b283bf20/go.mod h1:L5RzHgbvam0u8QFHfzCX6MKxu/a/gIGEdaRBqNiVbl0=
17231723
knative.dev/networking v0.0.0-20260223015858-080d52fcffb4 h1:ZXE3pdtSPB0quCfAFUodFT+VsT2Xaoqdj4r//O+zk18=
17241724
knative.dev/networking v0.0.0-20260223015858-080d52fcffb4/go.mod h1:ITVa/pZZpgmev4E64KDICg9ZC87YLulpF4J8iMgons4=
1725-
knative.dev/pkg v0.0.0-20260302190359-1f39e94ef003 h1:VG+CUgVKm+mLEudP16wLj++xDM2PuVFeua9+MLLBUa8=
1726-
knative.dev/pkg v0.0.0-20260302190359-1f39e94ef003/go.mod h1:mV8s7Uc92am8byZSJPIaVm1NBr0h8vsFL+sEEvMoBbk=
1725+
knative.dev/pkg v0.0.0-20260304131155-a902bbfa38de h1:cz1QT/L7SNC+dF47xYRPJt1WRP/HfTx8+KoZjmGA8V8=
1726+
knative.dev/pkg v0.0.0-20260304131155-a902bbfa38de/go.mod h1:mV8s7Uc92am8byZSJPIaVm1NBr0h8vsFL+sEEvMoBbk=
17271727
knative.dev/reconciler-test v0.0.0-20260303022055-b6439c2a1955 h1:1SRnHx9BimeT4rIYUA91kjgllqEe7F3VPNdB3ak+kog=
17281728
knative.dev/reconciler-test v0.0.0-20260303022055-b6439c2a1955/go.mod h1:WQUf92QsHOho5etxhuSpa7t8SziOhBhXUsg4jRSb1l4=
1729-
knative.dev/serving v0.48.1-0.20260303142400-89f3fe74309a h1:UqpGzMDykdinOeGuWPtWKw1LgZyKoFcFxVEnYe2yt1I=
1730-
knative.dev/serving v0.48.1-0.20260303142400-89f3fe74309a/go.mod h1:5EbHL9BqS4wVEXINAc7oSrQojcDh9i6tEiACyEApiLM=
1729+
knative.dev/serving v0.48.1-0.20260304122354-f161c41d3df3 h1:bDZ+w8ULeTMotPmBvppuFYyXFLOkuMpP3yUPIKCMm70=
1730+
knative.dev/serving v0.48.1-0.20260304122354-f161c41d3df3/go.mod h1:5EbHL9BqS4wVEXINAc7oSrQojcDh9i6tEiACyEApiLM=
17311731
nhooyr.io/websocket v1.8.6/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
17321732
pgregory.net/rapid v1.1.0 h1:CMa0sjHSru3puNx+J0MIAuiiEV4N0qj8/cMWGBBCsjw=
17331733
pgregory.net/rapid v1.1.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=

‎vendor/knative.dev/eventing/pkg/apis/sources/v1/sinkbinding_lifecycle.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -262,12 +262,14 @@ func (sb *SinkBinding) Do(ctx context.Context, ps *duckv1.WithPod) {
262262
ps.Spec.Template.Spec.Containers[i].VolumeMounts = append(ps.Spec.Template.Spec.Containers[i].VolumeMounts, corev1.VolumeMount{
263263
Name: oidcTokenVolumeName,
264264
MountPath: "/oidc",
265+
ReadOnly: true,
265266
})
266267
}
267268
for i := range ps.Spec.Template.Spec.InitContainers {
268269
ps.Spec.Template.Spec.InitContainers[i].VolumeMounts = append(ps.Spec.Template.Spec.InitContainers[i].VolumeMounts, corev1.VolumeMount{
269270
Name: oidcTokenVolumeName,
270271
MountPath: "/oidc",
272+
ReadOnly: true,
271273
})
272274
}
273275
}

‎vendor/knative.dev/pkg/tls/config.go‎

Lines changed: 7 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -33,22 +33,14 @@ const (
3333
CurvePreferencesEnvKey = "TLS_CURVE_PREFERENCES"
3434
)
3535

36-
// Config holds parsed TLS configuration values that can be used
37-
// to build a *crypto/tls.Config.
38-
type Config struct {
39-
MinVersion uint16
40-
MaxVersion uint16
41-
CipherSuites []uint16
42-
CurvePreferences []cryptotls.CurveID
43-
}
44-
45-
// NewConfigFromEnv reads TLS configuration from environment variables and
46-
// returns a Config. The prefix is prepended to each standard env-var suffix;
36+
// DefaultConfigFromEnv returns a tls.Config with secure defaults.
37+
// The prefix is prepended to each standard env-var suffix;
4738
// for example with prefix "WEBHOOK_" the function reads
4839
// WEBHOOK_TLS_MIN_VERSION, WEBHOOK_TLS_MAX_VERSION, etc.
49-
// Fields whose corresponding env var is unset are left at their zero value.
50-
func NewConfigFromEnv(prefix string) (*Config, error) {
51-
var cfg Config
40+
func DefaultConfigFromEnv(prefix string) (*cryptotls.Config, error) {
41+
cfg := &cryptotls.Config{
42+
MinVersion: cryptotls.VersionTLS13,
43+
}
5244

5345
if v := os.Getenv(prefix + MinVersionEnvKey); v != "" {
5446
ver, err := parseVersion(v)
@@ -82,19 +74,7 @@ func NewConfigFromEnv(prefix string) (*Config, error) {
8274
cfg.CurvePreferences = curves
8375
}
8476

85-
return &cfg, nil
86-
}
87-
88-
// TLSConfig constructs a *crypto/tls.Config from the parsed configuration.
89-
// The caller typically adds additional fields such as GetCertificate.
90-
func (c *Config) TLSConfig() *cryptotls.Config {
91-
//nolint:gosec // Min version is caller-configurable; default is TLS 1.3.
92-
return &cryptotls.Config{
93-
MinVersion: c.MinVersion,
94-
MaxVersion: c.MaxVersion,
95-
CipherSuites: c.CipherSuites,
96-
CurvePreferences: c.CurvePreferences,
97-
}
77+
return cfg, nil
9878
}
9979

10080
// parseVersion converts a TLS version string to the corresponding

‎vendor/knative.dev/pkg/webhook/env.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ func SecretNameFromEnv(defaultSecretName string) string {
7272
return secret
7373
}
7474

75-
// Deprecated: Use knative.dev/pkg/tls.NewConfigFromEnv instead.
75+
// Deprecated: Use knative.dev/pkg/tls.DefaultConfigFromEnv instead.
7676
// TLS configuration is now read automatically inside webhook.New via the shared tls package.
7777
func TLSMinVersionFromEnv(defaultTLSMinVersion uint16) uint16 {
7878
switch tlsMinVersion := os.Getenv(tlsMinVersionEnvKey); tlsMinVersion {

‎vendor/knative.dev/pkg/webhook/webhook.go‎

Lines changed: 41 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -191,36 +191,29 @@ func New(
191191

192192
logger := logging.FromContext(ctx)
193193

194-
tlsCfg, err := knativetls.NewConfigFromEnv("WEBHOOK_")
194+
tlsCfg, err := knativetls.DefaultConfigFromEnv("WEBHOOK_")
195195
if err != nil {
196196
return nil, fmt.Errorf("reading TLS configuration from environment: %w", err)
197197
}
198198

199-
// Replace the TLS configuration with the one from the environment if not set.
200-
// Default to TLS 1.3 as the minimum version when neither the caller nor the
201-
// environment specifies one.
202-
if opts.TLSMinVersion == 0 {
203-
if tlsCfg.MinVersion != 0 {
204-
opts.TLSMinVersion = tlsCfg.MinVersion
205-
} else {
206-
opts.TLSMinVersion = tls.VersionTLS13
207-
}
199+
if opts.TLSMinVersion != 0 {
200+
tlsCfg.MinVersion = opts.TLSMinVersion
208201
}
209-
if opts.TLSMaxVersion == 0 && tlsCfg.MaxVersion != 0 {
210-
opts.TLSMaxVersion = tlsCfg.MaxVersion
202+
if opts.TLSMaxVersion != 0 {
203+
tlsCfg.MaxVersion = opts.TLSMaxVersion
211204
}
212-
if opts.TLSCipherSuites == nil && len(tlsCfg.CipherSuites) > 0 {
213-
opts.TLSCipherSuites = tlsCfg.CipherSuites
205+
if opts.TLSCipherSuites != nil {
206+
tlsCfg.CipherSuites = opts.TLSCipherSuites
214207
}
215-
if opts.TLSCurvePreferences == nil && len(tlsCfg.CurvePreferences) > 0 {
216-
opts.TLSCurvePreferences = tlsCfg.CurvePreferences
208+
if opts.TLSCurvePreferences != nil {
209+
tlsCfg.CurvePreferences = opts.TLSCurvePreferences
217210
}
218211

219-
if opts.TLSMinVersion != 0 && opts.TLSMinVersion != tls.VersionTLS12 && opts.TLSMinVersion != tls.VersionTLS13 {
220-
return nil, fmt.Errorf("unsupported TLS minimum version %d: must be TLS 1.2 or TLS 1.3", opts.TLSMinVersion)
212+
if tlsCfg.MinVersion != tls.VersionTLS12 && tlsCfg.MinVersion != tls.VersionTLS13 {
213+
return nil, fmt.Errorf("unsupported TLS minimum version %d: must be TLS 1.2 or TLS 1.3", tlsCfg.MinVersion)
221214
}
222-
if opts.TLSMaxVersion != 0 && opts.TLSMinVersion > opts.TLSMaxVersion {
223-
return nil, fmt.Errorf("TLS minimum version (%#x) is greater than maximum version (%#x)", opts.TLSMinVersion, opts.TLSMaxVersion)
215+
if tlsCfg.MaxVersion != 0 && tlsCfg.MinVersion > tlsCfg.MaxVersion {
216+
return nil, fmt.Errorf("TLS minimum version (%#x) is greater than maximum version (%#x)", tlsCfg.MinVersion, tlsCfg.MaxVersion)
224217
}
225218

226219
syncCtx, cancel := context.WithCancel(context.Background())
@@ -240,42 +233,35 @@ func New(
240233
// a new secret informer from it.
241234
secretInformer := kubeinformerfactory.Get(ctx).Core().V1().Secrets()
242235

243-
//nolint:gosec // operator configures TLS min version (default is 1.3)
244-
webhook.tlsConfig = &tls.Config{
245-
MinVersion: opts.TLSMinVersion,
246-
MaxVersion: opts.TLSMaxVersion,
247-
CipherSuites: opts.TLSCipherSuites,
248-
CurvePreferences: opts.TLSCurvePreferences,
249-
250-
// If we return (nil, error) the client sees - 'tls: internal error"
251-
// If we return (nil, nil) the client sees - 'tls: no certificates configured'
252-
//
253-
// We'll return (nil, nil) when we don't find a certificate
254-
GetCertificate: func(*tls.ClientHelloInfo) (*tls.Certificate, error) {
255-
secret, err := secretInformer.Lister().Secrets(system.Namespace()).Get(opts.SecretName)
256-
if err != nil {
257-
logger.Errorw("failed to fetch secret", zap.Error(err))
258-
return nil, nil
259-
}
260-
webOpts := GetOptions(ctx)
261-
sKey, sCert := getSecretDataKeyNamesOrDefault(webOpts.ServerPrivateKeyName, webOpts.ServerCertificateName)
262-
serverKey, ok := secret.Data[sKey]
263-
if !ok {
264-
logger.Warn("server key missing")
265-
return nil, nil
266-
}
267-
serverCert, ok := secret.Data[sCert]
268-
if !ok {
269-
logger.Warn("server cert missing")
270-
return nil, nil
271-
}
272-
cert, err := tls.X509KeyPair(serverCert, serverKey)
273-
if err != nil {
274-
return nil, err
275-
}
276-
return &cert, nil
277-
},
236+
// If we return (nil, error) the client sees - 'tls: internal error'
237+
// If we return (nil, nil) the client sees - 'tls: no certificates configured'
238+
//
239+
// We'll return (nil, nil) when we don't find a certificate
240+
tlsCfg.GetCertificate = func(*tls.ClientHelloInfo) (*tls.Certificate, error) {
241+
secret, err := secretInformer.Lister().Secrets(system.Namespace()).Get(opts.SecretName)
242+
if err != nil {
243+
logger.Errorw("failed to fetch secret", zap.Error(err))
244+
return nil, nil
245+
}
246+
webOpts := GetOptions(ctx)
247+
sKey, sCert := getSecretDataKeyNamesOrDefault(webOpts.ServerPrivateKeyName, webOpts.ServerCertificateName)
248+
serverKey, ok := secret.Data[sKey]
249+
if !ok {
250+
logger.Warn("server key missing")
251+
return nil, nil
252+
}
253+
serverCert, ok := secret.Data[sCert]
254+
if !ok {
255+
logger.Warn("server cert missing")
256+
return nil, nil
257+
}
258+
cert, err := tls.X509KeyPair(serverCert, serverKey)
259+
if err != nil {
260+
return nil, err
261+
}
262+
return &cert, nil
278263
}
264+
webhook.tlsConfig = tlsCfg
279265
}
280266

281267
webhook.mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {

‎vendor/modules.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1508,7 +1508,7 @@ k8s.io/utils/trace
15081508
## explicit; go 1.25.0
15091509
knative.dev/caching/pkg/apis/caching
15101510
knative.dev/caching/pkg/apis/caching/v1alpha1
1511-
# knative.dev/eventing v0.48.1-0.20260303190100-ba8ac76433d4
1511+
# knative.dev/eventing v0.48.1-0.20260304104053-26b9071e4ef3
15121512
## explicit; go 1.24.0
15131513
knative.dev/eventing/cmd/heartbeats
15141514
knative.dev/eventing/pkg/apis
@@ -1615,7 +1615,7 @@ knative.dev/networking/pkg/client/clientset/versioned/typed/networking/v1alpha1
16151615
knative.dev/networking/pkg/config
16161616
knative.dev/networking/pkg/http/header
16171617
knative.dev/networking/pkg/ingress
1618-
# knative.dev/pkg v0.0.0-20260302190359-1f39e94ef003
1618+
# knative.dev/pkg v0.0.0-20260304131155-a902bbfa38de
16191619
## explicit; go 1.25.0
16201620
knative.dev/pkg/apiextensions/storageversion
16211621
knative.dev/pkg/apiextensions/storageversion/cmd/migrate
@@ -1736,7 +1736,7 @@ knative.dev/reconciler-test/pkg/resources/service
17361736
knative.dev/reconciler-test/pkg/resources/serviceaccount
17371737
knative.dev/reconciler-test/pkg/state
17381738
knative.dev/reconciler-test/resources/certificate
1739-
# knative.dev/serving v0.48.1-0.20260303142400-89f3fe74309a
1739+
# knative.dev/serving v0.48.1-0.20260304122354-f161c41d3df3
17401740
## explicit; go 1.25.0
17411741
knative.dev/serving/pkg/apis/autoscaling
17421742
knative.dev/serving/pkg/apis/autoscaling/v1alpha1

0 commit comments

Comments
 (0)