Skip to content

Commit e73b093

Browse files
siyer-corpsiyer-corp
committed
Merge branch 'main' into VAULT-42860/optimize-websockets
2 parents 59113bb + 2ebb01d commit e73b093

12 files changed

Lines changed: 184 additions & 137 deletions

File tree

‎.github/actions/integration-test/action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,9 +56,9 @@ runs:
5656
fi
5757
[ -n "${{ inputs.version }}" ] || (echo "inputs.version not set" >&2 ; exit 1)
5858
# Checkout this repo.
59-
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
59+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
6060
- name: Setup go
61-
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
61+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
6262
with:
6363
go-version-file: .go-version
6464
- name: Create Kind Cluster

‎.github/workflows/build.yaml‎

Lines changed: 53 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
outputs:
2424
product-version: ${{ steps.get-product-version.outputs.product-version }}
2525
steps:
26-
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
26+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2727
- name: get product version
2828
id: get-product-version
2929
run: |
@@ -37,9 +37,9 @@ jobs:
3737
outputs:
3838
go-version: ${{ steps.setup-go.outputs.go-version }}
3939
steps:
40-
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
40+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
4141
- id: setup-go
42-
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
42+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
4343
with:
4444
go-version-file: .go-version
4545
- name: go mod download all
@@ -78,8 +78,8 @@ jobs:
7878
needs:
7979
- build-pre-checks
8080
steps:
81-
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
82-
- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
81+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
82+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
8383
with:
8484
go-version-file: .go-version
8585
- run: make ci-test
@@ -101,7 +101,7 @@ jobs:
101101
filepath: ${{ steps.generate-metadata-file.outputs.filepath }}
102102
steps:
103103
- name: Checkout directory
104-
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
104+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
105105
- name: Generate metadata file
106106
id: generate-metadata-file
107107
uses: hashicorp/actions-generate-metadata@v1
@@ -122,13 +122,13 @@ jobs:
122122
runs-on: ubuntu-latest
123123
strategy:
124124
matrix:
125-
arch: ["arm64", "amd64", "s390x"]
125+
arch: ["arm64", "amd64", "s390x", "ppc64le"]
126126
fail-fast: true
127127
steps:
128128
- name: Checkout
129-
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
129+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
130130
- name: Setup go
131-
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
131+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
132132
with:
133133
go-version-file: .go-version
134134
- name: Build binary
@@ -169,7 +169,7 @@ jobs:
169169
repo: ${{github.event.repository.name}}
170170
version: ${{needs.get-product-version.outputs.product-version}}
171171
steps:
172-
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
172+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
173173
- name: Setup scripts directory
174174
shell: bash
175175
run: |
@@ -207,19 +207,18 @@ jobs:
207207
runs-on: ubuntu-latest
208208
strategy:
209209
matrix:
210-
arch: ["arm64", "amd64", "s390x"]
210+
arch: ["arm64", "amd64"]
211211
env:
212212
repo: ${{github.event.repository.name}}
213213
version: ${{needs.get-product-version.outputs.product-version}}
214214
image_tag: ${{needs.get-product-version.outputs.product-version}}-ubi
215215
steps:
216-
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
216+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
217217
- name: Setup scripts directory
218218
shell: bash
219219
run: |
220220
make ci-build-scripts-dir GOARCH="${{ matrix.arch }}"
221221
- name: Docker Build (Action)
222-
if: ${{ matrix.arch != 's390x' }}
223222
uses: hashicorp/actions-docker-build@v2
224223
env:
225224
VERSION: ${{ needs.get-product-version.outputs.product-version }}
@@ -233,21 +232,7 @@ jobs:
233232
docker.io/hashicorp/${{env.repo}}:${{env.image_tag}}
234233
public.ecr.aws/hashicorp/${{env.repo}}:${{env.image_tag}}
235234
icr.io/cpopen/ibm-vault/${{env.repo}}:${{env.image_tag}}
236-
- name: Docker Build (Action) s390x
237-
if: ${{ matrix.arch == 's390x' }}
238-
uses: hashicorp/actions-docker-build@v2
239-
env:
240-
VERSION: ${{ needs.get-product-version.outputs.product-version }}
241-
GO_VERSION: ${{ needs.build-pre-checks.outputs.go-version }}
242-
with:
243-
version: ${{env.version}}
244-
target: release-ubi
245-
arch: ${{matrix.arch}}
246-
redhat_tag: quay.io/redhat-isv-containers/64b072322e2773c28d30d988:${{env.image_tag}}
247-
tags: |
248-
icr.io/cpopen/ibm-vault/${{env.repo}}:${{env.image_tag}}
249235
- name: Check binary version in container ${{ matrix.arch }}
250-
if: ${{ matrix.arch != 's390x' }}
251236
shell: bash
252237
run: |
253238
version_output=$(docker run --platform linux/${{matrix.arch}} hashicorp/${{env.repo}}:${{env.image_tag}} --version --output=json)
@@ -259,6 +244,39 @@ jobs:
259244
exit 1
260245
fi
261246
247+
build-docker-ubi-ibm:
248+
name: UBI IBM ${{ matrix.arch }} build
249+
needs:
250+
- get-product-version
251+
- build-pre-checks
252+
- build
253+
runs-on: ubuntu-latest
254+
strategy:
255+
matrix:
256+
arch: ["s390x", "ppc64le"]
257+
env:
258+
repo: ${{github.event.repository.name}}
259+
version: ${{needs.get-product-version.outputs.product-version}}
260+
image_tag: ${{needs.get-product-version.outputs.product-version}}-ubi
261+
steps:
262+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
263+
- name: Setup scripts directory
264+
shell: bash
265+
run: |
266+
make ci-build-scripts-dir GOARCH="${{ matrix.arch }}"
267+
- name: Docker Build (Action)
268+
uses: hashicorp/actions-docker-build@v2
269+
env:
270+
VERSION: ${{ needs.get-product-version.outputs.product-version }}
271+
GO_VERSION: ${{ needs.build-pre-checks.outputs.go-version }}
272+
with:
273+
version: ${{env.version}}
274+
target: release-ubi
275+
arch: ${{matrix.arch}}
276+
redhat_tag: quay.io/redhat-isv-containers/64b072322e2773c28d30d988:${{env.image_tag}}
277+
tags: |
278+
icr.io/cpopen/ibm-vault/${{env.repo}}:${{env.image_tag}}
279+
262280
chart-upgrade-tests:
263281
runs-on: ubuntu-latest
264282
needs:
@@ -288,6 +306,7 @@ jobs:
288306
- "1.2.0"
289307
- "1.3.0"
290308
- "1.4.0"
309+
- "1.4.1"
291310
steps:
292311
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
293312
with:
@@ -309,9 +328,9 @@ jobs:
309328
shell: bash
310329
run: |
311330
helm repo add hashicorp https://helm.releases.hashicorp.com
312-
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
331+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
313332
- name: Setup go
314-
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
333+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
315334
with:
316335
go-version-file: .go-version
317336
- name: Run tests
@@ -362,9 +381,9 @@ jobs:
362381
shell: bash
363382
run: |
364383
helm repo add hashicorp https://helm.releases.hashicorp.com
365-
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
384+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
366385
- name: Setup go
367-
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
386+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
368387
with:
369388
go-version-file: .go-version
370389
- name: Run tests
@@ -388,7 +407,7 @@ jobs:
388407
installation-method: [helm, kustomize]
389408
vault-enterprise: [true, false]
390409
steps:
391-
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
410+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
392411
- uses: ./.github/actions/integration-test
393412
name: vault:${{ matrix.vault-version }} kind:${{ matrix.k8s-version }}
394413
with:
@@ -425,7 +444,7 @@ jobs:
425444
installation-method: [kustomize]
426445
vault-enterprise: [true]
427446
steps:
428-
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
447+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
429448
- uses: ./.github/actions/integration-test
430449
name: vault:${{ matrix.vault-version }} kind:${{ matrix.k8s-version }}
431450
with:
@@ -451,6 +470,7 @@ jobs:
451470
- build
452471
- build-docker
453472
- build-docker-ubi
473+
- build-docker-ubi-ibm
454474
- chart-upgrade-tests
455475
- unit-tests
456476
- latest-vault

‎.go-version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.26.4
1+
1.26.5

‎.release/security-scan.hcl‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ binary {
1919
// The required functionality was inadvertently dropped from
2020
// github.com/hashicorp/go-secure-stdlib/awsutil during the migration to aws-sdk-go-v2.
2121
"GO-2022-0635",
22+
// GO-2026-5932 flags the golang.org/x/crypto/openpgp subpackage as unmaintained/unsafe.
23+
// VSO does not import or call openpgp anywhere; confirmed via `go mod why` (package not
24+
// needed by the main module) and `govulncheck -mode=binary`, which found the symbol
25+
// unreachable in the built binary. False positive from module-level (non-symbol) matching.
26+
"GO-2026-5932",
2227
]
2328
}
2429
}

‎.release/vault-secrets-operator-artifacts.hcl‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,18 @@ artifacts {
77
"vault-secrets-operator_${version}_linux_amd64.zip",
88
"vault-secrets-operator_${version}_linux_arm64.zip",
99
"vault-secrets-operator_${version}_linux_s390x.zip",
10+
"vault-secrets-operator_${version}_linux_ppc64le.zip",
1011
]
1112
container = [
1213
"vault-secrets-operator_release-default_linux_amd64_${version}_${commit_sha}.docker.tar",
1314
"vault-secrets-operator_release-default_linux_arm64_${version}_${commit_sha}.docker.tar",
1415
"vault-secrets-operator_release-ubi_linux_amd64_${version}_${commit_sha}.docker.redhat.tar",
1516
"vault-secrets-operator_release-ubi_linux_arm64_${version}_${commit_sha}.docker.redhat.tar",
1617
"vault-secrets-operator_release-ubi_linux_s390x_${version}_${commit_sha}.docker.redhat.tar",
18+
"vault-secrets-operator_release-ubi_linux_ppc64le_${version}_${commit_sha}.docker.redhat.tar",
1719
"vault-secrets-operator_release-ubi_linux_amd64_${version}_${commit_sha}.docker.tar",
1820
"vault-secrets-operator_release-ubi_linux_arm64_${version}_${commit_sha}.docker.tar",
1921
"vault-secrets-operator_release-ubi_linux_s390x_${version}_${commit_sha}.docker.tar",
22+
"vault-secrets-operator_release-ubi_linux_ppc64le_${version}_${commit_sha}.docker.tar",
2023
]
2124
}

‎CHANGELOG.md‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,30 @@ Enhancements:
44
* VDS: Support [instant event-driven updates](https://developer.hashicorp.com/vault/docs/platform/k8s/vso/sources/vault#instant-updates) (`spec.syncConfig.instantUpdates`) for any Vault secret engine that supports Vault events, covering both static roles (`allowStaticCreds=true`) and dynamic leases: ([#1295](https://github.com/hashicorp/vault-secrets-operator/pull/1295))
55
* VSS/VDS: Attach `X-Vault-Index` header on event-triggered reconciles to prevent stale reads on Performance Standbys (Requires Vault 1.20+): ([#1285](https://github.com/hashicorp/vault-secrets-operator/pull/1285))
66

7-
Breaking Changes:
7+
Build:
8+
* Add `ppc64le` (IBM Power) architecture support: build and publish UBI-based images to `icr.io/cpopen/ibm-vault` and `quay.io/redhat-isv-containers` ([#1325](https://github.com/hashicorp/vault-secrets-operator/pull/1325))
9+
10+
## 1.5.0 (July 23rd, 2026)
11+
12+
BREAKING CHANGES:
813
* `VaultAuth`/`VaultAuthGlobal` AppRole `spec.appRole.secretIDPath` has been removed. Use
914
`spec.appRole.secretRef` instead, which references a Kubernetes Secret containing the AppRole
1015
Secret ID.
1116

17+
Dependency Updates:
18+
* Bump the gomod-backward-compatible group across 1 directory with 2 updates: ([#1302](https://github.com/hashicorp/vault-secrets-operator/pull/1302))
19+
* Bump the gomod-backward-compatible group across 1 directory with 5 updates (#1308)
20+
* Bump github.com/go-openapi/runtime from 0.32.5 to 0.32.6 in the gomod-backward-compatible group ([#1310](https://github.com/hashicorp/vault-secrets-operator/pull/1310)
21+
* Bump google.golang.org/grpc from 1.82.0 to 1.82.1 ([#1311](https://github.com/hashicorp/vault-secrets-operator/pull/1311)
22+
* Bump google.golang.org/api from 0.289.0 to 0.290.0 in the gomod-backward-compatible group across 1 directory ([#1313](https://github.com/hashicorp/vault-secrets-operator/pull/1313)
23+
24+
Build:
25+
* Build with Go 1.26.5
26+
* Test with Vault 2.0.3, 1.21.8, 1.20.13, 1.19.19
27+
* Test with Kind v0.32.0
28+
* Test with K8s 1.36.1, 1.35.5, 1.34.8, 1.33.12, 1.32.11
29+
30+
1231
## 1.4.1 (June 30th, 2026)
1332

1433
Build:

‎Makefile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,12 @@ BUNDLE_DIR ?= $(OPERATOR_BUILD_DIR)/bundle
2525
CHART_ROOT ?= chart
2626
CHART_CRDS_DIR ?= $(CHART_ROOT)/crds
2727

28-
VAULT_DOCS_VERSION ?= v1.21.x
28+
VAULT_DOCS_VERSION ?= v2.x
2929
VAULT_IMAGE_TAG ?= latest
3030
VAULT_IMAGE_REPO ?=
3131
K8S_VAULT_NAMESPACE ?= vault
32-
KIND_K8S_VERSION ?= v1.32.3
33-
VAULT_HELM_VERSION ?= 0.31.0
32+
KIND_K8S_VERSION ?= v1.36.1
33+
VAULT_HELM_VERSION ?= 0.34.0
3434
# Root directory to export kind cluster logs after each test run.
3535
EXPORT_KIND_LOGS_ROOT ?=
3636

‎chart/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33

44
apiVersion: v2
55
name: vault-secrets-operator
6-
version: 1.4.1
7-
appVersion: "1.4.1"
6+
version: 1.5.0
7+
appVersion: "1.5.0"
88
kubeVersion: ">=1.21.0-0"
99
description: Official Vault Secrets Operator Chart
1010
type: application

‎chart/values.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -197,7 +197,7 @@ controller:
197197
image:
198198
pullPolicy: IfNotPresent
199199
repository: hashicorp/vault-secrets-operator
200-
tag: 1.4.1
200+
tag: 1.5.0
201201

202202
# logging
203203
logging:

‎config/manager/kustomization.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,4 +16,4 @@ kind: Kustomization
1616
images:
1717
- name: controller
1818
newName: hashicorp/vault-secrets-operator
19-
newTag: 1.4.1
19+
newTag: 1.5.0

0 commit comments

Comments
 (0)