ba14962c1f
Add WithSystemCertPool for CA compatibility
...
Update pkg/runtime dependency from v0.76.0 to v0.78.0 and add
WithSystemCertPool() options to maintain backward compatibility
with the existing extend approach (system CAs + user CA).
This ensures source-controller continues to work with both system
and user-provided CA certificates, maintaining the same behavior
as before the pkg/runtime/secrets API changes.
Signed-off-by: cappyzawa <cappyzawa@gmail.com>
2025-07-30 11:39:11 +09:00
4b1ace618a
Enforce TLS certificate verification in Helm/OCI Repository controllers
...
Remove the insecure parameter from TLS configuration function calls to prevent
InsecureSkipVerify from being set when using certificate-based authentication.
This ensures TLS certificate verification is always performed when certificates
are provided, aligning with our security policy.
Updated pkg/runtime to v0.76.0 which no longer accepts the insecure parameter
in TLS configuration functions. For OCIRepository, maintain backward compatibility
by handling the specific case where no certificate is provided and insecure is
explicitly set to true. This is the only allowed exception in Flux controllers.
Signed-off-by: cappyzawa <cappyzawa@gmail.com>
2025-07-29 02:42:22 +09:00
74242e5d8a
Migrate OCIRepository controller to runtime/secrets
...
Migrates the OCIRepository controller's authentication handling from
internal implementations to the unified runtime/secrets API package.
The migration moves TLS configuration from internal/tls to
runtime/secrets.TLSConfigFromSecretRef and ServiceAccount processing
to secrets.PullSecretsFromServiceAccountRef, providing consistent
authentication handling across all source-controller components.
This change eliminates duplicate secret fetching logic and aligns
the OCIRepository controller with the standardized authentication
patterns used by other controllers in the GitOps Toolkit.
Signed-off-by: cappyzawa <cappyzawa@gmail.com>
2025-07-22 00:39:59 +09:00
9950f56d26
migrate HelmRepository to AuthMethodsFromSecret API
...
This commit upgrades pkg/runtime to v0.73.0 and adopts the unified
AuthMethodsFromSecret API for HelmRepository authentication handling.
The change replaces complex manual authentication detection with a
single API call and improves error handling consistency.
Breaking Changes:
- TLS certificate validation is now strictly enforced. Invalid CA
certificates will cause authentication failures even for public
repositories, where they were previously ignored.
- Empty TLS certificate secrets now trigger validation errors instead
of being silently ignored. This affects certSecretRef with empty
Data map - previously ignored, now causes proper error.
Signed-off-by: cappyzawa <cappyzawa@gmail.com>
2025-07-18 21:29:37 +09:00
274a6699cc
refactor: improve HelmRepository controller test structure for runtime/secrets migration
...
Signed-off-by: cappyzawa <cappyzawa@gmail.com>
2025-07-18 03:37:02 +09:00
8c951e3019
build(deps): bump github.com/go-viper/mapstructure/v2
...
Bumps [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure ) from 2.2.1 to 2.3.0.
- [Release notes](https://github.com/go-viper/mapstructure/releases )
- [Changelog](https://github.com/go-viper/mapstructure/blob/main/CHANGELOG.md )
- [Commits](https://github.com/go-viper/mapstructure/compare/v2.2.1...v2.3.0 )
---
updated-dependencies:
- dependency-name: github.com/go-viper/mapstructure/v2
dependency-version: 2.3.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2025-07-14 21:10:27 +00:00
e3abd39417
Upgrade Kubernetes to 1.33.2
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
2025-07-14 18:33:46 +01:00
d5920fee85
refactor: replace internal/transport with pkg/http/transport
...
Signed-off-by: cappyzawa <cappyzawa@gmail.com>
2025-07-09 19:28:36 +09:00
07ab3461dc
Fix: Prioritize sha2-512 and sha2-256 for ssh-rsa host keys
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2025-06-27 11:26:54 +03:00
738fb2b3a8
refactor: simplify OCI auth error handling
...
Update fluxcd/pkg/auth to v0.18.0 and remove unnecessary authenticator
nil check in Helm OCI repository authentication.
With fluxcd/pkg/auth v0.18.0, GetArtifactRegistryCredentials() returns
valid authenticator when error is nil, making the nil check redundant.
Signed-off-by: cappyzawa <cappyzawa@gmail.com>
2025-06-21 22:21:51 +09:00
5d5943fff0
Upgrade dependencies
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
2025-06-12 18:02:44 +01:00
575d936c9b
Upgrade dependencies
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
2025-06-09 17:07:52 +01:00
36e0d0dfca
Update containerd v1.7.27
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2025-05-27 09:16:15 +03:00
15e2448578
Update dependencies
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
2025-05-25 14:39:20 +01:00
a05567e2bb
Update cosign to v2.5.0
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2025-05-23 17:34:32 +03:00
26df08a633
Update controller-runtime to v0.21.0
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2025-05-23 17:29:01 +03:00
aff9ebde96
[RFC-0010] Introduce feature gate
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
2025-05-19 13:39:36 +01:00
e128d3b795
[RFC-0010] Introduce object-level workload identity for container registry APIs
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
2025-05-07 18:33:59 +01:00
2dde6bf536
Upgrade fluxcd/pkg cache, auth, git and gogit
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
2025-05-03 15:47:39 +01:00
5b1f0a6d71
Downgrade `Masterminds/semver` to v3.3.0
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2025-04-29 15:23:39 +03:00
3c7812d387
Update to Kubernetes 1.33.0 and Go 1.24.0
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2025-04-28 14:10:47 +03:00
c1b32514a3
Update `fluxcd/pkg/git` to v0.26.0
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2025-04-22 10:12:49 +03:00
0338a8e9ab
Update Helm to v3.17.3
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2025-04-09 22:42:28 +03:00
560dc5bc5f
Rename references to pkg/auth/github to pkg/git/github
...
Signed-off-by: Dipti Pai <diptipai89@outlook.com>
2025-03-13 13:53:18 -07:00
9593041b53
Introduce token cache and use it for GitHub App tokens
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
2025-03-12 14:45:48 +00:00
1939ffd40c
build(deps): bump the go-deps group across 1 directory with 3 updates
...
Bumps the go-deps group with 3 updates in the / directory: [github.com/minio/minio-go/v7](https://github.com/minio/minio-go ), [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang ) and [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore ).
Updates `github.com/minio/minio-go/v7` from 7.0.86 to 7.0.87
- [Release notes](https://github.com/minio/minio-go/releases )
- [Commits](https://github.com/minio/minio-go/compare/v7.0.86...v7.0.87 )
Updates `github.com/prometheus/client_golang` from 1.20.5 to 1.21.0
- [Release notes](https://github.com/prometheus/client_golang/releases )
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md )
- [Commits](https://github.com/prometheus/client_golang/compare/v1.20.5...v1.21.0 )
Updates `github.com/sigstore/sigstore` from 1.8.14 to 1.8.15
- [Release notes](https://github.com/sigstore/sigstore/releases )
- [Commits](https://github.com/sigstore/sigstore/compare/v1.8.14...v1.8.15 )
---
updated-dependencies:
- dependency-name: github.com/minio/minio-go/v7
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-deps
- dependency-name: github.com/prometheus/client_golang
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-deps
- dependency-name: github.com/sigstore/sigstore
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2025-02-21 02:45:16 +00:00
d293d4a0b7
build(deps): bump the go-deps group across 1 directory with 5 updates
...
Bumps the go-deps group with 3 updates in the / directory: [github.com/minio/minio-go/v7](https://github.com/minio/minio-go ), [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore ) and [golang.org/x/oauth2](https://github.com/golang/oauth2 ).
Updates `github.com/minio/minio-go/v7` from 7.0.84 to 7.0.86
- [Release notes](https://github.com/minio/minio-go/releases )
- [Commits](https://github.com/minio/minio-go/compare/v7.0.84...v7.0.86 )
Updates `github.com/sigstore/sigstore` from 1.8.12 to 1.8.14
- [Release notes](https://github.com/sigstore/sigstore/releases )
- [Commits](https://github.com/sigstore/sigstore/compare/v1.8.12...v1.8.14 )
Updates `golang.org/x/crypto` from 0.32.0 to 0.33.0
- [Commits](https://github.com/golang/crypto/compare/v0.32.0...v0.33.0 )
Updates `golang.org/x/oauth2` from 0.25.0 to 0.26.0
- [Commits](https://github.com/golang/oauth2/compare/v0.25.0...v0.26.0 )
Updates `golang.org/x/sync` from 0.10.0 to 0.11.0
- [Commits](https://github.com/golang/sync/compare/v0.10.0...v0.11.0 )
---
updated-dependencies:
- dependency-name: github.com/minio/minio-go/v7
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-deps
- dependency-name: github.com/sigstore/sigstore
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-deps
- dependency-name: golang.org/x/crypto
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-deps
- dependency-name: golang.org/x/oauth2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-deps
- dependency-name: golang.org/x/sync
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2025-02-17 02:28:18 +00:00
32e20898eb
Upgrade pkg/runtime
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
2025-02-11 11:49:46 +00:00
307edb989e
build(deps): bump github.com/fluxcd/pkg/oci
...
Bumps the go-deps group with 1 update in the / directory: [github.com/fluxcd/pkg/oci](https://github.com/fluxcd/pkg ).
Updates `github.com/fluxcd/pkg/oci` from 0.44.0 to 0.45.0
- [Commits](https://github.com/fluxcd/pkg/compare/oci/v0.44.0...oci/v0.45.0 )
---
updated-dependencies:
- dependency-name: github.com/fluxcd/pkg/oci
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2025-01-31 13:18:20 +00:00
0e363c9f08
Update dependencies
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2025-01-31 15:02:27 +02:00
615bb912dd
Upgrade runtime
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
2025-01-10 13:41:27 +00:00
6f8f2e0435
Update dependencies to Kubernetes 1.32.0 and Go 1.23.0
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2024-12-12 16:36:02 +02:00
892e7ccab4
Update Git dependencies
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2024-12-06 16:51:45 +02:00
32bc10cbd9
build(deps): bump the go-deps group across 1 directory with 3 updates
...
Bumps the go-deps group with 3 updates in the / directory: [github.com/minio/minio-go/v7](https://github.com/minio/minio-go ), [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang ) and [google.golang.org/api](https://github.com/googleapis/google-api-go-client ).
Updates `github.com/minio/minio-go/v7` from 7.0.76 to 7.0.77
- [Release notes](https://github.com/minio/minio-go/releases )
- [Commits](https://github.com/minio/minio-go/compare/v7.0.76...v7.0.77 )
Updates `github.com/prometheus/client_golang` from 1.20.3 to 1.20.4
- [Release notes](https://github.com/prometheus/client_golang/releases )
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md )
- [Commits](https://github.com/prometheus/client_golang/compare/v1.20.3...v1.20.4 )
Updates `google.golang.org/api` from 0.197.0 to 0.198.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases )
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md )
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.197.0...v0.198.0 )
---
updated-dependencies:
- dependency-name: github.com/minio/minio-go/v7
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-deps
- dependency-name: github.com/prometheus/client_golang
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-deps
- dependency-name: google.golang.org/api
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-09-25 02:32:15 +00:00
1e6ddbcc3a
Update dependencies to Kubernetes 1.31.1
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2024-09-16 09:49:55 +03:00
48417bdc8b
Enable Azure OIDC for Azure DevOps Respository
...
- Add a new provider field to GitRepository API spec which can be set to azure to enable passwordless authentication to Azure DevOps repositories.
- API docs for new provider field and guidance to setup Azure environment with workload identity.
- Controller changes to set the provider options in git authoptions to fetch credential while cloning the repository.
- Add unit tests for testing provider
Signed-off-by: Dipti Pai <diptipai89@outlook.com>
2024-09-13 13:41:18 -07:00
a5bdeb262b
Update Helm to v3.16.1
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2024-09-12 19:56:28 +03:00
58ef98c1b5
Update Helm to v3.16.0
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2024-09-12 14:45:27 +03:00
cc1762b2e5
Update `fluxcd/pkg/oci` to v0.41.0
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2024-09-10 18:53:40 +03:00
ef2c356124
Update notation-go to v1.2.1
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2024-09-05 15:09:58 +03:00
39c0c12410
Update docker to v27.2.0
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2024-09-04 09:42:03 +03:00
0e8d794cfd
build(deps): bump the go-deps group across 1 directory with 8 updates
...
Bumps the go-deps group with 8 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver ) | `3.2.1` | `3.3.0` |
| [github.com/minio/minio-go/v7](https://github.com/minio/minio-go ) | `7.0.75` | `7.0.76` |
| [github.com/notaryproject/notation-core-go](https://github.com/notaryproject/notation-core-go ) | `1.0.3` | `1.1.0` |
| [github.com/notaryproject/notation-go](https://github.com/notaryproject/notation-go ) | `1.1.1` | `1.2.0` |
| [github.com/onsi/gomega](https://github.com/onsi/gomega ) | `1.34.1` | `1.34.2` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang ) | `1.20.0` | `1.20.2` |
| [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore ) | `1.8.8` | `1.8.9` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client ) | `0.190.0` | `0.196.0` |
Updates `github.com/Masterminds/semver/v3` from 3.2.1 to 3.3.0
- [Release notes](https://github.com/Masterminds/semver/releases )
- [Changelog](https://github.com/Masterminds/semver/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Masterminds/semver/compare/v3.2.1...v3.3.0 )
Updates `github.com/minio/minio-go/v7` from 7.0.75 to 7.0.76
- [Release notes](https://github.com/minio/minio-go/releases )
- [Commits](https://github.com/minio/minio-go/compare/v7.0.75...v7.0.76 )
Updates `github.com/notaryproject/notation-core-go` from 1.0.3 to 1.1.0
- [Release notes](https://github.com/notaryproject/notation-core-go/releases )
- [Commits](https://github.com/notaryproject/notation-core-go/compare/v1.0.3...v1.1.0 )
Updates `github.com/notaryproject/notation-go` from 1.1.1 to 1.2.0
- [Release notes](https://github.com/notaryproject/notation-go/releases )
- [Changelog](https://github.com/notaryproject/notation-go/blob/main/RELEASE_CHECKLIST.md )
- [Commits](https://github.com/notaryproject/notation-go/compare/v1.1.1...v1.2.0 )
Updates `github.com/onsi/gomega` from 1.34.1 to 1.34.2
- [Release notes](https://github.com/onsi/gomega/releases )
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md )
- [Commits](https://github.com/onsi/gomega/compare/v1.34.1...v1.34.2 )
Updates `github.com/prometheus/client_golang` from 1.20.0 to 1.20.2
- [Release notes](https://github.com/prometheus/client_golang/releases )
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md )
- [Commits](https://github.com/prometheus/client_golang/compare/v1.20.0...v1.20.2 )
Updates `github.com/sigstore/sigstore` from 1.8.8 to 1.8.9
- [Release notes](https://github.com/sigstore/sigstore/releases )
- [Commits](https://github.com/sigstore/sigstore/compare/v1.8.8...v1.8.9 )
Updates `google.golang.org/api` from 0.190.0 to 0.196.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases )
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md )
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.190.0...v0.196.0 )
---
updated-dependencies:
- dependency-name: github.com/Masterminds/semver/v3
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-deps
- dependency-name: github.com/minio/minio-go/v7
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-deps
- dependency-name: github.com/notaryproject/notation-core-go
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-deps
- dependency-name: github.com/notaryproject/notation-go
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-deps
- dependency-name: github.com/onsi/gomega
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-deps
- dependency-name: github.com/prometheus/client_golang
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-deps
- dependency-name: github.com/sigstore/sigstore
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-deps
- dependency-name: google.golang.org/api
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-09-04 02:52:43 +00:00
cfccdb5491
Update cosign to v2.4.0
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2024-08-15 11:18:32 +03:00
93ad04b6c8
Update dependencies to Kubernetes v1.31.0
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2024-08-14 21:40:29 +03:00
4d9c87cf3f
Add support for .spec.proxySecretRef for generic provider of Bucket API
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
2024-07-03 15:10:47 +01:00
8598b8dd25
build(deps): bump google.golang.org/api
...
Bumps the go-deps group with 1 update in the / directory: [google.golang.org/api](https://github.com/googleapis/google-api-go-client ).
Updates `google.golang.org/api` from 0.172.0 to 0.177.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases )
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md )
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.172.0...v0.177.0 )
---
updated-dependencies:
- dependency-name: google.golang.org/api
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-05-02 21:13:24 +00:00
e72a645234
Update dependencies
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2024-05-02 16:35:39 +03:00
e590863286
Update dependencies to Kubernetes 1.30
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2024-04-26 11:36:15 +03:00
4d29266821
Update dependencies to cosign v2.2.4
...
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2024-04-11 08:08:02 +03:00
58f7d223ec
build(deps): bump the go-deps group with 1 update
...
Bumps the go-deps group with 1 update: [google.golang.org/api](https://github.com/googleapis/google-api-go-client ).
Updates `google.golang.org/api` from 0.163.0 to 0.172.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases )
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md )
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.163.0...v0.172.0 )
---
updated-dependencies:
- dependency-name: google.golang.org/api
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-04-02 14:20:09 +00:00
cappyzawa