Skip to content

Commit 30bd536

Browse files
rboyerrboyer
committed
backport of commit 7c192b6 
1 parent f860ed5 commit 30bd536

File tree

230 files changed

+9887
-7502
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

230 files changed

+9887
-7502
lines changed

‎.changelog/4152.txt

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
```release-note:improvement
2+
control-plane: Remove anyuid Security Context Constraints (SCC) requirement in OpenShift.
3+
```
4+
5+
```release-note:bug
6+
connect-inject: add NET_BIND_SERVICE capability when injecting consul-dataplane sidecar
7+
```

‎.changelog/4153.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:bug
2+
terminating-gateway: Fix generated acl policy for external services to include the namespace and partition block if they are enabled.
3+
```

‎.changelog/4154.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:security
2+
Upgrade go version to 1.22.5 to address [CVE-2024-24791](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24791)
3+
```

‎.changelog/4169.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:security
2+
Upgrade go-retryablehttp to v0.7.7 to address [GHSA-v6v8-xj6m-xwqh](https://github.com/advisories/GHSA-v6v8-xj6m-xwqh)
3+
```

‎.changelog/4184.txt

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
```release-note:improvement
2+
* helm: Adds `webhookCertManager.resources` field which can be configured to override the `resource` settings for the `webhook-cert-manager` deployment.
3+
* helm: Adds `connectInject.apiGateway.managedGatewayClass.resourceJob.resources` field which can be configured to override the `resource` settings for the `gateway-resources-job` job.
4+
```

‎.changelog/4210.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:bug
2+
helm: adds imagePullSecret to the gateway-resources job and the gateway-cleanup job, would fail before if the image was in a private registry
3+
```

‎.changelog/4213.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:bug
2+
Fixes install of Consul on GKE Autopilot where the option 'manageNonStandardCRDs' was not being used for the TCPRoute CRD.
3+
```

‎.changelog/4224.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:bug
2+
terminating-gateways: Fix bug where namespace field was not correctly set on ACL policies if using the `Registration` CRD with the service's namespace unset.
3+
```

‎.changelog/4227.txt

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
```release-note:bug
2+
openshift: order SecurityContextConstraint volumes alphabetically to match OpenShift behavior.
3+
This ensures that diff detection tools like ArgoCD consider the source and reconciled resources to be identical.
4+
```

‎.changelog/4228.txt

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
```release-note:security
2+
Upgrade Docker cli to use v.27.1. This addresses CVE
3+
[CVE-2024-41110](https://nvd.nist.gov/vuln/detail/CVE-2024-41110)```
4+
5+
```release-note:security
6+
Bump Go to 1.22.5 to address [CVE-2024-24791](https://nvd.nist.gov/vuln/detail/CVE-2024-24791)```

‎.changelog/4244.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:improvement
2+
helm: Kubernetes v1.30 is now supported. Minimum tested version of Kubernetes is now v1.27.
3+
```

‎.changelog/4247.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:bug
2+
api-gateway: fix nil pointer deref bug when the section name in a gateway policy is not specified
3+
```

‎.changelog/4255.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:bug
2+
sync-catalog: Enable the user to purge the registered services by passing parent node and necessary filters.
3+
```

‎.changelog/4256.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:improvement
2+
config-entry: add validate_clusters to mesh config entry
3+
```

‎.changelog/4266.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:bug
2+
sync-catalog: fix infinite retry loop when the catalog fails to connect to consul-server during the sync process
3+
```

‎.changelog/4287.txt

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
```release-note:enhancement
2+
docker: update go-discover binary
3+
```
4+
5+
```release-note:enhancement
6+
docker: update ubi base image to `ubi9-minimal:9.4`.
7+
```

‎.changelog/4307.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:improvement
2+
connect-inject: remove unnecessary resource permissions from connect-inject ClusterRole
3+
```

‎.changelog/4313.txt

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
```release-note:security
2+
Upgrade Go to use 1.22.7. This addresses CVE
3+
[CVE-2024-34155](https://nvd.nist.gov/vuln/detail/CVE-2024-34155)
4+
```

‎.changelog/4315.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:bug
2+
helm: fix issue where the API Gateway GatewayClassConfig tolerations can not be parsed by the Helm chart.
3+
```

‎.changelog/4316.txt

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
```release-note:bug
2+
api-gateway: `global.imagePullSecrets` are now configured on the `ServiceAccount` for `Gateways`.
3+
4+
Note: the referenced image pull Secret(s) must be present in the same namespace the `Gateway` is deployed to.
5+
```

‎.changelog/4333.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:improvement
2+
helm: Exclude gke namespaces from being connect-injected when the connect-inject: default: true value is set.
3+
```

‎.github/scripts/check_skip_ci.sh

-50
This file was deleted.

‎.github/workflows/pr.yml

+31
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,34 @@ jobs:
2727
ref: main
2828
token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
2929
inputs: '{ "context":"${{ env.CONTEXT }}", "actor":"${{ github.actor }}", "repository":"${{ github.repository }}", "branch":"${{ env.BRANCH }}", "sha":"${{ env.SHA }}", "token":"${{ secrets.ELEVATED_GITHUB_TOKEN }}" }'
30+
31+
pass-required-checks-on-skip:
32+
needs: [ conditional-skip ]
33+
if: needs.conditional-skip.outputs.skip-ci == 'true'
34+
runs-on: ubuntu-latest
35+
strategy:
36+
matrix:
37+
include:
38+
# The required checks that should be "passed" when the CI is skipped
39+
- check-name: acceptance
40+
- check-name: acceptance-cni
41+
- check-name: acceptance-tproxy
42+
- check-name: Unit test helm templates
43+
- check-name: Unit test helm gen
44+
- check-name: Unit test enterprise control plane
45+
- check-name: Unit test control plane
46+
- check-name: Unit test cli
47+
- check-name: Unit test acceptance
48+
- check-name: Unit test helm gen
49+
steps:
50+
- name: Update final status
51+
uses: docker://ghcr.io/curtbushko/commit-status-action:e1d661c757934ab35c74210b4b70c44099ec747a
52+
env:
53+
INPUT_TOKEN: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
54+
INPUT_REPOSITORY: ${{ github.repository }}
55+
INPUT_CONTEXT: ${{ matrix.check-name }}
56+
INPUT_STATE: success
57+
INPUT_DESCRIPTION: "Skipped due to conditional-skip check"
58+
INPUT_SHA: ${{ env.SHA }}
59+
INPUT_DETAILS_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
60+
INPUT_OWNER: "hashicorp"

‎.github/workflows/reusable-conditional-skip.yml

+51-6
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,58 @@ jobs:
1212
runs-on: ubuntu-latest
1313
name: Check whether to skip build and tests
1414
outputs:
15-
skip-ci: ${{ steps.check-changed-files.outputs.skip-ci }}
16-
env:
17-
SKIP_CHECK_BRANCH: ${{ github.head_ref || github.ref_name }}
15+
skip-ci: ${{ steps.maybe-skip-ci.outputs.skip-ci }}
1816
steps:
17+
# We only allow use of conditional skip in two scenarios:
18+
# 1. PRs
19+
# 2. Pushes (merges) to protected branches (`main`, `release/**`)
20+
#
21+
# The second scenario is the only place we can be sure that checking just the
22+
# latest change on the branch is sufficient. In PRs, we need to check _all_ commits.
23+
# The ability to do this is ultimately determined by the triggers of the calling
24+
# workflow, since `base_ref` (the target branch of a PR) is only available in
25+
# `pull_request` events, not `push`.
26+
- name: Error if conditional check is not allowed
27+
if: ${{ !github.base_ref && !github.ref_protected }}
28+
run: |
29+
echo "Conditional skip requires a PR event with 'base_ref' or 'push' to a protected branch."
30+
echo "github.base_ref: ${{ github.base_ref }}"
31+
echo "github.ref_protected: ${{ github.ref_protected }}"
32+
echo "github.ref_name: ${{ github.ref_name }}"
33+
echo "Check the triggers of the calling workflow to ensure that these requirements are met."
34+
exit 1
1935
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
2036
with:
2137
fetch-depth: 0
22-
- name: Check changed files
23-
id: check-changed-files
24-
run: ./.github/scripts/check_skip_ci.sh
38+
- name: Check for skippable file changes
39+
id: changed-files
40+
uses: tj-actions/changed-files@e9772d140489982e0e3704fea5ee93d536f1e275 # v45.0.1
41+
with:
42+
# This is a multi-line YAML string with one match pattern per line.
43+
# Do not use quotes around values, as it's not supported.
44+
# See https://github.com/tj-actions/changed-files/blob/main/README.md#inputs-%EF%B8%8F
45+
# for usage, options, and more details on match syntax.
46+
files: |
47+
.github/workflows/reusable-conditional-skip.yml
48+
LICENSE
49+
.copywrite.hcl
50+
.gitignore
51+
**.md
52+
assets/**
53+
.changelog/**
54+
- name: Print changed files
55+
env:
56+
SKIPPABLE_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
57+
NON_SKIPPABLE_FILES: ${{ steps.changed-files.outputs.other_changed_files }}
58+
run: |
59+
echo "Skippable changed files:"
60+
for file in ${SKIPPABLE_CHANGED_FILES}; do echo " $file"; done
61+
echo
62+
echo "Non-skippable files:"
63+
for file in ${NON_SKIPPABLE_FILES}; do echo " $file"; done
64+
- name: Skip tests and build if only skippable files changed
65+
id: maybe-skip-ci
66+
if: ${{ steps.changed-files.outputs.only_changed == 'true' }}
67+
run: |
68+
echo "Skipping tests and build because only skippable files changed"
69+
echo "skip-ci=true" >> $GITHUB_OUTPUT

‎.github/workflows/security-scan.yml

+8-6
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
# This job runs a non-blocking informational security scan on the repository.
2+
# For release-blocking security scans, see .release/security-scan.hcl.
13
name: Security Scan
24

35
on:
@@ -9,20 +11,20 @@ on:
911
branches:
1012
- main
1113
- release/**
14+
# paths-ignore only works for non-required checks.
15+
# Jobs that are required for merge must use reusable-conditional-skip.yml.
16+
paths-ignore:
17+
- 'assets/**'
18+
- '.changelog/**'
1219

1320
# cancel existing runs of the same workflow on the same ref
1421
concurrency:
1522
group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
1623
cancel-in-progress: true
1724

1825
jobs:
19-
conditional-skip:
20-
uses: ./.github/workflows/reusable-conditional-skip.yml
21-
2226
get-go-version:
2327
# Cascades down to test jobs
24-
needs: [ conditional-skip ]
25-
if: needs.conditional-skip.outputs.skip-ci != 'true'
2628
uses: ./.github/workflows/reusable-get-go-version.yml
2729

2830
scan:
@@ -46,7 +48,7 @@ jobs:
4648
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
4749
with:
4850
repository: hashicorp/security-scanner
49-
token: ${{ secrets.HASHIBOT_PRODSEC_GITHUB_TOKEN }}
51+
token: ${{ secrets.PRODSEC_SCANNER_READ_ONLY }}
5052
path: security-scanner
5153
ref: main
5254

‎.github/workflows/weekly-acceptance-1-5-x.yml ‎.github/workflows/weekly-acceptance-1-4-0-rc1.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Dispatch to the consul-k8s-workflows with a weekly cron
22
#
33
# A separate file is needed for each release because the cron schedules are different for each release.
4-
name: weekly-acceptance-1-5-x
4+
name: weekly-acceptance-1-4-0-rc1
55
on:
66
schedule:
77
# * is a special character in YAML so you have to quote this string
@@ -10,7 +10,7 @@ on:
1010

1111
# these should be the only settings that you will ever need to change
1212
env:
13-
BRANCH: "release/1.5.x"
13+
BRANCH: "release/1.4.0-rc1"
1414
CONTEXT: "weekly"
1515

1616
jobs:

‎.go-version

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.22.4
1+
1.22.7

‎CHANGELOG.md

+51
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,54 @@
1+
## 1.5.3 (August 30, 2024)
2+
3+
SECURITY:
4+
5+
* Bump Go to 1.22.5 to address [CVE-2024-24791](https://nvd.nist.gov/vuln/detail/CVE-2024-24791) [[GH-4228](https://github.com/hashicorp/consul-k8s/issues/4228)]
6+
* Upgrade Docker cli to use v.27.1. This addresses CVE
7+
[CVE-2024-41110](https://nvd.nist.gov/vuln/detail/CVE-2024-41110) [[GH-4228](https://github.com/hashicorp/consul-k8s/issues/4228)]
8+
9+
IMPROVEMENTS:
10+
11+
* docker: update go-discover binary [[GH-4287](https://github.com/hashicorp/consul-k8s/issues/4287)]
12+
* docker: update ubi base image to `ubi9-minimal:9.4`. [[GH-4287](https://github.com/hashicorp/consul-k8s/issues/4287)]
13+
* helm: Adds `webhookCertManager.resources` field which can be configured to override the `resource` settings for the `webhook-cert-manager` deployment. [[GH-4184](https://github.com/hashicorp/consul-k8s/issues/4184)]
14+
* helm: Adds `connectInject.apiGateway.managedGatewayClass.resourceJob.resources` field which can be configured to override the `resource` settings for the `gateway-resources-job` job. [[GH-4184](https://github.com/hashicorp/consul-k8s/issues/4184)]
15+
* config-entry: add validate_clusters to mesh config entry [[GH-4256](https://github.com/hashicorp/consul-k8s/issues/4256)]
16+
* helm: Kubernetes v1.30 is now supported. Minimum tested version of Kubernetes is now v1.27. [[GH-4244](https://github.com/hashicorp/consul-k8s/issues/4244)]
17+
18+
BUG FIXES:
19+
20+
* Fixes install of Consul on GKE Autopilot where the option 'manageNonStandardCRDs' was not being used for the TCPRoute CRD. [[GH-4213](https://github.com/hashicorp/consul-k8s/issues/4213)]
21+
* api-gateway: fix nil pointer deref bug when the section name in a gateway policy is not specified [[GH-4247](https://github.com/hashicorp/consul-k8s/issues/4247)]
22+
* helm: adds imagePullSecret to the gateway-resources job and the gateway-cleanup job, would fail before if the image was in a private registry [[GH-4210](https://github.com/hashicorp/consul-k8s/issues/4210)]
23+
* openshift: order SecurityContextConstraint volumes alphabetically to match OpenShift behavior.
24+
This ensures that diff detection tools like ArgoCD consider the source and reconciled resources to be identical. [[GH-4227](https://github.com/hashicorp/consul-k8s/issues/4227)]
25+
* sync-catalog: fix infinite retry loop when the catalog fails to connect to consul-server during the sync process [[GH-4266](https://github.com/hashicorp/consul-k8s/issues/4266)]
26+
* terminating-gateways: Fix bug where namespace field was not correctly set on ACL policies if using the `Registration` CRD with the service's namespace unset. [[GH-4224](https://github.com/hashicorp/consul-k8s/issues/4224)]
27+
28+
## 1.5.2 (August 29, 2024)
29+
30+
Release redacted, use `1.5.3`
31+
32+
## 1.5.1 (July 16, 2024)
33+
34+
SECURITY:
35+
36+
* Upgrade go version to 1.22.5 to address [CVE-2024-24791](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24791) [[GH-4154](https://github.com/hashicorp/consul-k8s/issues/4154)]
37+
* Upgrade go-retryablehttp to v0.7.7 to address [GHSA-v6v8-xj6m-xwqh](https://github.com/advisories/GHSA-v6v8-xj6m-xwqh) [[GH-4169](https://github.com/hashicorp/consul-k8s/issues/4169)]
38+
39+
IMPROVEMENTS:
40+
41+
* api-gateways: Change security settings to make root file system read only and to not allow privilage escalation. [[GH-3959](https://github.com/hashicorp/consul-k8s/issues/3959)]
42+
* control-plane: Remove anyuid Security Context Constraints (SCC) requirement in OpenShift. [[GH-4152](https://github.com/hashicorp/consul-k8s/issues/4152)]
43+
* partition-init: Role no longer includes unnecessary access to Secrets resource. [[GH-4053](https://github.com/hashicorp/consul-k8s/issues/4053)]
44+
45+
BUG FIXES:
46+
47+
* api-gateway: fix issue where API Gateway specific acl roles/policy were not being cleaned up on deletion of an api-gateway [[GH-4060](https://github.com/hashicorp/consul-k8s/issues/4060)]
48+
* connect-inject: add NET_BIND_SERVICE capability when injecting consul-dataplane sidecar [[GH-4152](https://github.com/hashicorp/consul-k8s/issues/4152)]
49+
* endpoints-controller: graceful shutdown logic should not run on a new pod with the same name. Fixes a case where statefulset rollouts could get stuck in graceful shutdown when the new pods come up. [[GH-4059](https://github.com/hashicorp/consul-k8s/issues/4059)]
50+
* terminating-gateway: Fix generated acl policy for external services to include the namespace and partition block if they are enabled. [[GH-4153](https://github.com/hashicorp/consul-k8s/issues/4153)]
51+
152
## 1.5.0 (June 13, 2024)
253

354
> NOTE: Consul K8s 1.5.x is compatible with Consul 1.19.x and Consul Dataplane 1.5.x. Refer to our [compatibility matrix](https://developer.hashicorp.com/consul/docs/k8s/compatibility) for more info.

0 commit comments

Comments
 (0)