knative
/
client
mirror of https://github.com/knative/client.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

upgrade to latest dependencies (#1769) 

bumping knative.dev/eventing 9417125...7e899fd:
  > 7e899fd Reduce log noise in upgrade tests (# 6693)
bumping knative.dev/networking e9d3a55...db2bcbe:
  > db2bcbe Assert all the expected DNSNames are part of the HTTP01 challenge (# 757)
bumping knative.dev/serving 6b7e09a...897b61a:
  > 897b61a Change HTTP01 test DNS entry to *.{custom-domain} (# 13636)
  > 9004443 Allow challenges for hosts that don't match the route's host (# 13637)
  > 188dc1a Update net-certmanager nightly (# 13631)
  > 09bc85c Update net-kourier nightly (# 13634)
  > 87f5b62 Update net-contour nightly (# 13635)
  > 760b2f7 Update net-istio nightly (# 13632)
  > 8b28d41 Update net-gateway-api nightly (# 13633)
  > 550a6f5 Clean up `go_run` functions (# 13628)
  > d2d5723 Don't explicitly require a service account key for autotls dns tests (# 13627)
  > 6906c92 Refactor autoscaler TestContext (# 13618)
  > 8722a63 Update net-contour nightly (# 13624)
  > e05aa3a Add validation to warn about insecure SecurityContext defaults (# 13399)
  > 4a339c6 Update net-kourier nightly (# 13626)
  > b10db15 Update net-gateway-api nightly (# 13623)
  > 5b59ae0 Update net-certmanager nightly (# 13625)
  > 04df00a DomainMapping: Set Certificate.Spec.Domain (# 13620)
  > 94d23ac Set 'Domain' in kcert (# 13569)
  > a4fcb9d Update net-certmanager nightly (# 13619)

Signed-off-by: Knative Automation <automation@knative.team>

Signed-off-by: Knative Automation <automation@knative.team>
This commit is contained in:
knative-automation 2023-01-24 00:17:38 -05:00 committed by GitHub
parent 982711e2e3
commit 2a124bdc26
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 79 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
go.mod
View File

@ -20,11 +20,11 @@ require (
k8s.io/cli-runtime v0.25.2
k8s.io/client-go v0.25.4
k8s.io/code-generator v0.25.4
knative.dev/eventing v0.35.1-0.20230118083600-9417125b1468
knative.dev/eventing v0.35.1-0.20230120082502-7e899fd166de
knative.dev/hack v0.0.0-20230113013652-c7cfcb062de9
knative.dev/networking v0.0.0-20230118220600-e9d3a55facee
knative.dev/networking v0.0.0-20230123233838-db2bcbea2560
knative.dev/pkg v0.0.0-20230117181655-247510c00e9d
knative.dev/serving v0.35.1-0.20230119001800-6b7e09ac25e8
knative.dev/serving v0.35.1-0.20230123204038-897b61aaa91a
sigs.k8s.io/yaml v1.3.0
)

12
go.sum
View File

@ -1086,16 +1086,16 @@ k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1 h1:MQ8BAZPZlWk3S9K4a9NCkI
k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1/go.mod h1:C/N6wCaBHeBHkHUesQOQy2/MZqGgMAFPqGsGQLdbZBU=
k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2 h1:GfD9OzL11kvZN5iArC6oTS7RTj7oJOIfnislxYlqTj8=
k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
knative.dev/eventing v0.35.1-0.20230118083600-9417125b1468 h1:N6Nh3b46f+iAOuu/14P488TMBieF6/tC9NA+83LAxqM=
knative.dev/eventing v0.35.1-0.20230118083600-9417125b1468/go.mod h1:PqYrXKXhZU7rQaS5TQuZDSOd9jPX7AegF8uNNUY4kcU=
knative.dev/eventing v0.35.1-0.20230120082502-7e899fd166de h1:mTwmkYvaPsDCxzQaSjT9BKcf4BQ1zcFSkTIFVGHww3Y=
knative.dev/eventing v0.35.1-0.20230120082502-7e899fd166de/go.mod h1:PqYrXKXhZU7rQaS5TQuZDSOd9jPX7AegF8uNNUY4kcU=
knative.dev/hack v0.0.0-20230113013652-c7cfcb062de9 h1:CDa7s9KspEZqPhk7cN68ZypRLuAvSgr+knoOaXSsrHk=
knative.dev/hack v0.0.0-20230113013652-c7cfcb062de9/go.mod h1:yk2OjGDsbEnQjfxdm0/HJKS2WqTLEFg/N6nUs6Rqx3Q=
knative.dev/networking v0.0.0-20230118220600-e9d3a55facee h1:8KYvxZFaP/LgOE+zVvcG5SpdEK1b03eETvaCauoeCUs=
knative.dev/networking v0.0.0-20230118220600-e9d3a55facee/go.mod h1:rn1yRurhkxmSFkpqs/YdG7b9DiYj0VlmLFzBdOQjpOo=
knative.dev/networking v0.0.0-20230123233838-db2bcbea2560 h1:iprdS5tKTXtgV9dGryuwJJJTTdl5LusCHOelKdezR3I=
knative.dev/networking v0.0.0-20230123233838-db2bcbea2560/go.mod h1:rn1yRurhkxmSFkpqs/YdG7b9DiYj0VlmLFzBdOQjpOo=
knative.dev/pkg v0.0.0-20230117181655-247510c00e9d h1:pjKDcvHoMib8nRp56eISRmMj/pFMzJljnzvMvGCIReI=
knative.dev/pkg v0.0.0-20230117181655-247510c00e9d/go.mod h1:VO/fcEsq43seuONRQxZyftWHjpMabYzRHDtpSEQ/eoQ=
knative.dev/serving v0.35.1-0.20230119001800-6b7e09ac25e8 h1:9id7E3O0KkMFvtO4TbjYXXIJT7kr1JNiN/t14iMofLc=
knative.dev/serving v0.35.1-0.20230119001800-6b7e09ac25e8/go.mod h1:JSbgFN3qNLqEZhNtn6uZLIj7Aaut+hhYEcsyrkfEXTE=
knative.dev/serving v0.35.1-0.20230123204038-897b61aaa91a h1:EFgNwvcbmiswVuE+TNYl+UiiVM4Q+5FHvsKfpiJNWkI=
knative.dev/serving v0.35.1-0.20230123204038-897b61aaa91a/go.mod h1:WdVK1b42aahKc8WewW5YLPjp46QK4+D8R9lq3PNuRYg=
rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=

64
vendor/knative.dev/serving/pkg/apis/serving/k8s_validation.go vendored
View File

@ -341,6 +341,17 @@ func ValidatePodSpec(ctx context.Context, ps corev1.PodSpec) *apis.FieldError {
errs = errs.Also(ValidatePodSecurityContext(ctx, ps.SecurityContext).ViaField("securityContext"))
for i := range ps.Containers {
errs = errs.Also(
warnDefaultContainerSecurityContext(ctx, ps.SecurityContext, ps.Containers[i].SecurityContext).
ViaField("securityContext").ViaFieldIndex("containers", i))
}
for i := range ps.InitContainers {
errs = errs.Also(
warnDefaultContainerSecurityContext(ctx, ps.SecurityContext, ps.InitContainers[i].SecurityContext).
ViaField("securityContext").ViaFieldIndex("initContainers", i))
}
volumes, err := ValidateVolumes(ctx, ps.Volumes, AllMountedVolumes(append(ps.InitContainers, ps.Containers...)))
errs = errs.Also(err.ViaField("volumes"))
@ -872,6 +883,59 @@ func ValidatePodSecurityContext(ctx context.Context, sc *corev1.PodSecurityConte
return errs
}
// warnDefaultContainerSecurityContext warns about Kubernetes default
// SecurityContext values which are unset and thus insecure (i.e. the
// "restricted" profile forbids these values). Because securityContext values
// may also be set at the Pod level, the container-level settings need to be
// considered alongside the Pod-level settings.
//
// Note that this **explicitly** does not warn on dangerous SecurityContext
// settings, the purpose is to avoid accidentally-insecure settings, not to
// block deliberate use of dangerous settings.
func warnDefaultContainerSecurityContext(_ context.Context, psc *corev1.PodSecurityContext, sc *corev1.SecurityContext) *apis.FieldError {
if sc == nil {
sc = &corev1.SecurityContext{}
}
if psc == nil {
psc = &corev1.PodSecurityContext{}
}
insecureDefault := func(fieldPath string) *apis.FieldError {
return apis.ErrGeneric("Kubernetes default value is insecure, Knative may default this to secure in a future release", fieldPath).At(apis.WarningLevel)
}
var errs *apis.FieldError
if psc.RunAsNonRoot == nil && sc.RunAsNonRoot == nil {
errs = errs.Also(insecureDefault("runAsNonRoot"))
}
if sc.AllowPrivilegeEscalation == nil {
errs = errs.Also(insecureDefault("allowPrivilegeEscalation"))
}
if sc.SeccompProfile == nil && psc.SeccompProfile == nil {
errs = errs.Also(insecureDefault("seccompProfile"))
} else {
pscIsDefault := psc.SeccompProfile == nil || psc.SeccompProfile.Type == ""
scIsDefault := sc.SeccompProfile == nil || sc.SeccompProfile.Type == ""
if pscIsDefault && scIsDefault {
errs = errs.Also(insecureDefault("seccompProfile.type"))
}
}
if sc.Capabilities == nil {
errs = errs.Also(insecureDefault("capabilities"))
} else {
if sc.Capabilities.Drop == nil {
errs = errs.Also(insecureDefault("capabilities.drop"))
} else if len(sc.Capabilities.Drop) > 0 && sc.Capabilities.Drop[0] == "all" {
// Sometimes, people mis-spell "ALL" as "all", which does nothing.
errs = errs.Also(apis.ErrInvalidValue("all", "capabilities.drop", "Must be spelled as 'ALL'").At(apis.WarningLevel))
}
}
return errs
}
// This is attached to contexts as they are passed down through a user container
// being validated.
type userContainer struct{}

2
vendor/knative.dev/serving/test/e2e-auto-tls-tests.sh vendored
View File

@ -86,7 +86,7 @@ function setup_http01_auto_tls() {
# Rely on the built-in naming (for logstream)
unset TLS_SERVICE_NAME
# The full host name of the Knative Service. This is used to configure the DNS record.
export AUTO_TLS_TEST_FULL_HOST_NAME="*.${TLS_TEST_NAMESPACE}.${CUSTOM_DOMAIN_SUFFIX}"
export AUTO_TLS_TEST_FULL_HOST_NAME="*.${CUSTOM_DOMAIN_SUFFIX}"
kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"

4
vendor/knative.dev/serving/test/e2e-common.sh vendored
View File

@ -592,10 +592,10 @@ function overlay_system_namespace() {
}
function run_ytt() {
run_go_tool github.com/vmware-tanzu/carvel-ytt/cmd/ytt ytt "$@"
go_run github.com/vmware-tanzu/carvel-ytt/cmd/ytt@v0.44.1 "$@"
}
function run_kapp() {
run_go_tool github.com/vmware-tanzu/carvel-kapp/cmd/kapp kapp "$@"
go_run github.com/vmware-tanzu/carvel-kapp/cmd/kapp@v0.54.1 "$@"
}

6
vendor/modules.txt vendored
View File

@ -917,7 +917,7 @@ k8s.io/utils/net
k8s.io/utils/pointer
k8s.io/utils/strings/slices
k8s.io/utils/trace
# knative.dev/eventing v0.35.1-0.20230118083600-9417125b1468
# knative.dev/eventing v0.35.1-0.20230120082502-7e899fd166de
## explicit; go 1.18
knative.dev/eventing/pkg/apis/config
knative.dev/eventing/pkg/apis/duck
@ -948,7 +948,7 @@ knative.dev/eventing/pkg/client/clientset/versioned/typed/sources/v1beta2/fake
# knative.dev/hack v0.0.0-20230113013652-c7cfcb062de9
## explicit; go 1.18
knative.dev/hack
# knative.dev/networking v0.0.0-20230118220600-e9d3a55facee
# knative.dev/networking v0.0.0-20230123233838-db2bcbea2560
## explicit; go 1.18
knative.dev/networking/pkg
knative.dev/networking/pkg/apis/networking
@ -1013,7 +1013,7 @@ knative.dev/pkg/tracing/config
knative.dev/pkg/tracing/propagation
knative.dev/pkg/tracing/propagation/tracecontextb3
knative.dev/pkg/tracker
# knative.dev/serving v0.35.1-0.20230119001800-6b7e09ac25e8
# knative.dev/serving v0.35.1-0.20230123204038-897b61aaa91a
## explicit; go 1.18
knative.dev/serving/pkg/apis/autoscaling
knative.dev/serving/pkg/apis/autoscaling/v1alpha1