Merge branch 'kubernetes-sigs:main' into rotation

dargudear-google · web-flow · commit a1f19b73ef78 · 2025-05-14T23:18:09.000+05:30
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -7,6 +7,7 @@ updates:
     commit-message:
       prefix: "chore"
     labels:
+      - "area/dependency"
       - "ok-to-test"
 
   - package-ecosystem: "gomod"
@@ -16,6 +17,7 @@ updates:
     commit-message:
       prefix: "chore"
     labels:
+      - "area/dependency"
       - "ok-to-test"
 
   - package-ecosystem: docker
@@ -25,6 +27,7 @@ updates:
     commit-message:
       prefix: "chore"
     labels:
+      - "area/dependency"
       - "ok-to-test"
 
   - package-ecosystem: docker
@@ -34,6 +37,7 @@ updates:
     commit-message:
       prefix: "chore"
     labels:
+      - "area/dependency"
       - "ok-to-test"
 
   - package-ecosystem: docker
@@ -43,6 +47,7 @@ updates:
     commit-message:
       prefix: "chore"
     labels:
+      - "area/dependency"
       - "ok-to-test"
 
   - package-ecosystem: gomod
@@ -52,4 +57,5 @@ updates:
     commit-message:
       prefix: "chore"
     labels:
+      - "area/dependency"
       - "ok-to-test"
diff --git a/.github/workflows/chart.yaml b/.github/workflows/chart.yaml
@@ -16,13 +16,13 @@ permissions:
 
 jobs:
   deploy:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.0.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.0.0
         with:
           submodules: true
           fetch-depth: 0
diff --git a/.github/workflows/codecov.yaml b/.github/workflows/codecov.yaml
@@ -14,16 +14,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.0.0
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.0.0
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
           go-version: "^1.20"
       - name: Run tests
         run: make go-test
-      - uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303
+      - uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d
         with:
           files: ./cover.out
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
@@ -21,20 +21,20 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.0.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.0.0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
+        uses: github/codeql-action/init@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
         with:
           languages: go
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
+        uses: github/codeql-action/autobuild@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
+        uses: github/codeql-action/analyze@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
diff --git a/.github/workflows/create-release.yaml b/.github/workflows/create-release.yaml
@@ -9,15 +9,15 @@ permissions:
 
 jobs:
   create-release:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.0.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.0.0
         with:
           fetch-depth: 0
       - name: Goreleaser
diff --git a/.github/workflows/dependency-review.yaml b/.github/workflows/dependency-review.yaml
@@ -17,11 +17,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
       - name: 'Checkout Repository'
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.0.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.0.0
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4
+        uses: actions/dependency-review-action@38ecb5b593bf0eb19e335c03f97670f792489a8b # v4.7.0
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
@@ -32,11 +32,11 @@ jobs:
         KUBERNETES_VERSION: ["v1.30.10", "v1.31.6", "v1.32.3"]
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.0.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.0.0
         with:
           submodules: true
           fetch-depth: 0
@@ -45,7 +45,7 @@ jobs:
         with:
           bats-version: 1.4.1
       - name: Setup Kind
-        uses: engineerd/setup-kind@aa272fe2a7309878ffc2a81c56cfe3ef108ae7d0 # v0.5.0
+        uses: engineerd/setup-kind@71e45b960fc8dd50b4aeabf6eb6ef2ca0920b4c1 # v0.6.2
         with:
           version: "v0.27.0"
           image: "kindest/node:${{ matrix.KUBERNETES_VERSION }}"
diff --git a/.github/workflows/markdown-link-check.yaml b/.github/workflows/markdown-link-check.yaml
@@ -22,11 +22,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+      uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
       with:
         egress-policy: audit
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.0.0
-    - uses: gaurav-nelson/github-action-markdown-link-check@1b916f2cf6c36510a6059943104e3c42ce6c16bc # v1.0.16
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.0.0
+    - uses: gaurav-nelson/github-action-markdown-link-check@3c3b66f1f7d0900e37b71eca45b63ea9eedfce31 # v1.0.17
       with:
         # this will only show errors in the output
         use-quiet-mode: 'yes'
diff --git a/.github/workflows/scan-vulns.yaml b/.github/workflows/scan-vulns.yaml
@@ -19,11 +19,11 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
           go-version: "1.21"
           check-latest: true
diff --git a/.github/workflows/scorecards.yaml b/.github/workflows/scorecards.yaml
@@ -31,17 +31,17 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.0.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.0.0
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
         with:
           results_file: results.sarif
           results_format: sarif
@@ -63,14 +63,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
+        uses: github/codeql-action/upload-sarif@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
         with:
           sarif_file: results.sarif
diff --git a/Makefile b/Makefile
@@ -29,8 +29,8 @@ E2E_PROVIDER_IMAGE_NAME ?= e2e-provider
 
 # Release version is the current supported release for the driver
 # Update this version when the helm chart is being updated for release
-RELEASE_VERSION := v1.4.8
-IMAGE_VERSION ?= v1.4.8
+RELEASE_VERSION := v1.5.0
+IMAGE_VERSION ?= v1.5.0
 
 # Use a custom version for E2E tests if we are testing in CI
 ifdef CI
diff --git a/OWNERS b/OWNERS
@@ -4,8 +4,11 @@ approvers:
 
 reviewers:
 - aramase
-- nilekhc
 - ritazh
 
 emeritus_approvers:
 - tam7t
+
+emeritus_reviewers:
+- nilekhc
+- tam7t
diff --git a/charts/secrets-store-csi-driver/Chart.yaml b/charts/secrets-store-csi-driver/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: secrets-store-csi-driver
-version: 1.4.8
-appVersion: 1.4.8
+version: 1.5.0
+appVersion: 1.5.0
 kubeVersion: ">=1.16.0-0"
 description: A Helm chart to install the SecretsStore CSI Driver inside a Kubernetes cluster.
 icon: https://github.com/kubernetes/kubernetes/blob/master/logo/logo.png
diff --git a/charts/secrets-store-csi-driver/README.md b/charts/secrets-store-csi-driver/README.md
@@ -33,12 +33,12 @@ The following table lists the configurable parameters of the csi-secrets-store-p
 | `fullnameOverride`                      | String to fully override secrets-store-csi-driver.fullname template with a string                                                                                              | `""`                                                    |
 | `linux.image.repository`                | Linux image repository                                                                                                                                                         | `registry.k8s.io/csi-secrets-store/driver`              |
 | `linux.image.pullPolicy`                | Linux image pull policy                                                                                                                                                        | `IfNotPresent`                                          |
-| `linux.image.tag`                       | Linux image tag                                                                                                                                                                | `v1.4.8`                                                |
+| `linux.image.tag`                       | Linux image tag                                                                                                                                                                | `v1.5.0`                                                |
 | `linux.image.digest`                       | Linux image digest, image pull from digest instead of tag if specified                                                                                                      | `""`                                                    |
 | `linux.crds.enabled`                    | If the CRDs should be managed by the chart                                                                                                                                     | `true`                                                  |
 | `linux.crds.image.repository`           | Linux crds image repository                                                                                                                                                    | `registry.k8s.io/csi-secrets-store/driver-crds`         |
 | `linux.crds.image.pullPolicy`           | Linux crds image pull policy                                                                                                                                                   | `IfNotPresent`                                          |
-| `linux.crds.image.tag`                  | Linux crds image tag                                                                                                                                                           | `v1.4.8`                                                |
+| `linux.crds.image.tag`                  | Linux crds image tag                                                                                                                                                           | `v1.5.0`                                                |
 | `linux.crds.resources`                  | The resource request/limits for the linux crds container image                                                                                                                 | `{}`                                                    |
 | `linux.crds.podLabels`                  | Linux *Pod* labels appended to CRD helm hook job pods                                                                                                                          | `{}`                                                    |
 | `linux.affinity`                        | Linux affinity                                                                                                                                                                 | `key: type; operator: NotIn; values: [virtual-kubelet]` |
@@ -72,7 +72,7 @@ The following table lists the configurable parameters of the csi-secrets-store-p
 | `linux.updateStrategy`                  | Configure a custom update strategy for the daemonset on linux nodes                                                                                                            | `RollingUpdate with 1 maxUnavailable`                   |
 | `windows.image.repository`              | Windows image repository                                                                                                                                                       | `registry.k8s.io/csi-secrets-store/driver`              |
 | `windows.image.pullPolicy`              | Windows image pull policy                                                                                                                                                      | `IfNotPresent`                                          |
-| `windows.image.tag`                     | Windows image tag                                                                                                                                                              | `v1.4.8`                                                |
+| `windows.image.tag`                     | Windows image tag                                                                                                                                                              | `v1.5.0`                                                |
 | `windows.image.digest`                     | Windows image digest, image pull from digest instead of tag if specified                                                                                                    | `""`                                                    |
 | `windows.affinity`                      | Windows affinity                                                                                                                                                               | `key: type; operator: NotIn; values: [virtual-kubelet]` |
 | `windows.driver.resources`              | The resource request/limits for the windows secrets-store container image                                                                                                      | `limits: 400m CPU, 400Mi; requests: 50m CPU, 100Mi`     |
diff --git a/charts/secrets-store-csi-driver/values.yaml b/charts/secrets-store-csi-driver/values.yaml
@@ -2,15 +2,15 @@ linux:
   enabled: true
   image:
     repository: registry.k8s.io/csi-secrets-store/driver
-    tag: v1.4.8
+    tag: v1.5.0
     #digest: sha256:
     pullPolicy: IfNotPresent
 
   crds:
     enabled: true
     image:
       repository: registry.k8s.io/csi-secrets-store/driver-crds
-      tag: v1.4.8
+      tag: v1.5.0
       pullPolicy: IfNotPresent
     ## Optionally override resource limits for crd hooks(jobs)
     resources: {}
@@ -110,7 +110,7 @@ windows:
   enabled: false
   image:
     repository: registry.k8s.io/csi-secrets-store/driver
-    tag: v1.4.8
+    tag: v1.5.0
     #digest: sha256:
     pullPolicy: IfNotPresent
 
diff --git a/deploy/secrets-store-csi-driver-windows.yaml b/deploy/secrets-store-csi-driver-windows.yaml
@@ -36,7 +36,7 @@ spec:
               cpu: 100m
               memory: 100Mi
         - name: secrets-store
-          image: registry.k8s.io/csi-secrets-store/driver:v1.4.8
+          image: registry.k8s.io/csi-secrets-store/driver:v1.5.0
           args:
             - "--endpoint=$(CSI_ENDPOINT)"
             - "--nodeid=$(KUBE_NODE_NAME)"
diff --git a/deploy/secrets-store-csi-driver.yaml b/deploy/secrets-store-csi-driver.yaml
@@ -36,7 +36,7 @@ spec:
               cpu: 10m
               memory: 20Mi
         - name: secrets-store
-          image: registry.k8s.io/csi-secrets-store/driver:v1.4.8
+          image: registry.k8s.io/csi-secrets-store/driver:v1.5.0
           args:
             - "--endpoint=$(CSI_ENDPOINT)"
             - "--nodeid=$(KUBE_NODE_NAME)"
diff --git a/docker/Dockerfile b/docker/Dockerfile
@@ -14,7 +14,7 @@
 
 ARG BASEIMAGE=registry.k8s.io/build-image/debian-base:bookworm-v1.0.4
 
-FROM golang:1.23@sha256:cb45cf739cf6bc9eaeacf75d3cd7c157e7d39b757216d813d8115d026ee32e75 as builder
+FROM golang:1.23.8@sha256:87bb94031b23532885cbda15e9a365a5805059648a87ed1b67a1352dd7360fe4 AS builder
 WORKDIR /go/src/sigs.k8s.io/secrets-store-csi-driver
 ADD . .
 ARG TARGETARCH
diff --git a/docker/Makefile b/docker/Makefile
@@ -15,7 +15,7 @@
 REGISTRY?=docker.io/deislabs
 IMAGE_NAME=driver
 CRD_IMAGE_NAME=driver-crds
-IMAGE_VERSION?=v1.4.8
+IMAGE_VERSION?=v1.5.0
 BUILD_TIMESTAMP := $(shell date +%Y-%m-%d-%H:%M)
 BUILD_COMMIT := $(shell git rev-parse --short HEAD)
 IMAGE_TAG=$(REGISTRY)/$(IMAGE_NAME):$(IMAGE_VERSION)
diff --git a/docker/windows.Dockerfile b/docker/windows.Dockerfile
@@ -15,9 +15,9 @@
 ARG BASEIMAGE=mcr.microsoft.com/windows/nanoserver:1809
 ARG BASEIMAGE_CORE=gcr.io/k8s-staging-e2e-test-images/windows-servercore-cache:1.0-linux-amd64-1809
 
-FROM --platform=linux/amd64 ${BASEIMAGE_CORE} as core
+FROM --platform=linux/amd64 ${BASEIMAGE_CORE} AS core
 
-FROM --platform=$BUILDPLATFORM golang:1.23@sha256:cb45cf739cf6bc9eaeacf75d3cd7c157e7d39b757216d813d8115d026ee32e75 as builder
+FROM --platform=$BUILDPLATFORM golang:1.23.8@sha256:87bb94031b23532885cbda15e9a365a5805059648a87ed1b67a1352dd7360fe4 AS builder
 WORKDIR /go/src/sigs.k8s.io/secrets-store-csi-driver
 ADD . .
 ARG TARGETARCH
diff --git a/go.mod b/go.mod
@@ -1,6 +1,6 @@
 module sigs.k8s.io/secrets-store-csi-driver
 
-go 1.23.7
+go 1.23.8
 
 require (
 	github.com/container-storage-interface/spec v1.6.0
diff --git a/hack/tools/go.mod b/hack/tools/go.mod
@@ -208,7 +208,7 @@ require (
 	go.uber.org/zap v1.26.0 // indirect
 	golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac // indirect
 	golang.org/x/mod v0.24.0 // indirect
-	golang.org/x/net v0.37.0 // indirect
+	golang.org/x/net v0.38.0 // indirect
 	golang.org/x/sync v0.12.0 // indirect
 	golang.org/x/sys v0.31.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
diff --git a/hack/tools/go.sum b/hack/tools/go.sum
diff --git a/manifest_staging/charts/secrets-store-csi-driver/Chart.yaml b/manifest_staging/charts/secrets-store-csi-driver/Chart.yaml
diff --git a/manifest_staging/charts/secrets-store-csi-driver/README.md b/manifest_staging/charts/secrets-store-csi-driver/README.md
diff --git a/manifest_staging/charts/secrets-store-csi-driver/values.yaml b/manifest_staging/charts/secrets-store-csi-driver/values.yaml
diff --git a/manifest_staging/deploy/secrets-store-csi-driver-windows.yaml b/manifest_staging/deploy/secrets-store-csi-driver-windows.yaml
diff --git a/manifest_staging/deploy/secrets-store-csi-driver.yaml b/manifest_staging/deploy/secrets-store-csi-driver.yaml
diff --git a/pkg/util/secretutil/secret.go b/pkg/util/secretutil/secret.go
diff --git a/pkg/util/secretutil/secret_test.go b/pkg/util/secretutil/secret_test.go
diff --git a/test/e2eprovider/Dockerfile b/test/e2eprovider/Dockerfile
diff --git a/test/e2eprovider/go.mod b/test/e2eprovider/go.mod
diff --git a/test/e2eprovider/go.sum b/test/e2eprovider/go.sum
