Skip to content

Commit f9713a9

Browse files
upgrade to latest dependencies (#413)
bumping knative.dev/client/pkg 6f59afe...a23801d: > a23801d upgrade to latest dependencies (# 2072) bumping knative.dev/serving 85563f5...62b04a0: > 62b04a0 Change SecurePodDefaults default from Disabled to Enabled (# 16042) > b2f3ee3 Update net-contour nightly (# 16133) > c4b10ef Update net-gateway-api nightly (# 16134) > d5d241f [main] Upgrade to latest dependencies (# 16131) > c26592a Update net-kourier nightly (# 16135) bumping knative.dev/eventing 9fe13ee...3f59df1: > 3f59df1 feat: Supporting using pod default credentials for Integration Source and Sink (# 8731) Signed-off-by: Knative Automation <[email protected]>
1 parent eea3ad1 commit f9713a9

File tree

9 files changed

+84
-27
lines changed

9 files changed

+84
-27
lines changed

go.mod

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ require (
1212
k8s.io/api v0.33.5
1313
k8s.io/apimachinery v0.33.5
1414
k8s.io/client-go v0.33.5
15-
knative.dev/client/pkg v0.0.0-20251008140714-6f59afe28d11
15+
knative.dev/client/pkg v0.0.0-20251009022514-a23801d4bdc2
1616
knative.dev/eventing-kafka-broker v0.46.1-0.20251008145913-06d47e7a1fb6
1717
knative.dev/hack v0.0.0-20250902153942-1499de21e119
1818
knative.dev/pkg v0.0.0-20251007184713-a624c759bede
@@ -106,9 +106,9 @@ require (
106106
k8s.io/klog/v2 v2.130.1 // indirect
107107
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
108108
k8s.io/utils v0.0.0-20241210054802-24370beab758 // indirect
109-
knative.dev/eventing v0.46.1-0.20251008070512-9fe13ee820cf // indirect
109+
knative.dev/eventing v0.46.1-0.20251008160113-3f59df18d8d5 // indirect
110110
knative.dev/networking v0.0.0-20251008015313-0e1a0aa62ad1 // indirect
111-
knative.dev/serving v0.46.1-0.20251008121813-85563f5d21ca // indirect
111+
knative.dev/serving v0.46.1-0.20251008225413-62b04a0c5d5e // indirect
112112
sigs.k8s.io/gateway-api v1.1.0 // indirect
113113
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
114114
sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3 // indirect

go.sum

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -747,10 +747,10 @@ k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUy
747747
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
748748
k8s.io/utils v0.0.0-20241210054802-24370beab758 h1:sdbE21q2nlQtFh65saZY+rRM6x6aJJI8IUa1AmH/qa0=
749749
k8s.io/utils v0.0.0-20241210054802-24370beab758/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
750-
knative.dev/client/pkg v0.0.0-20251008140714-6f59afe28d11 h1:2n36RjePcJqhZfTliakmA5wFf1VpZwKOSZUtmKlkU14=
751-
knative.dev/client/pkg v0.0.0-20251008140714-6f59afe28d11/go.mod h1:A9dCnjXXg9OwsxdVMfv4wkRol+rphfriVO4KY+BO++A=
752-
knative.dev/eventing v0.46.1-0.20251008070512-9fe13ee820cf h1:WB5f7+QLLYEBUzpNJroPq5q5Gn3yXjBPKnMSmY2DYTQ=
753-
knative.dev/eventing v0.46.1-0.20251008070512-9fe13ee820cf/go.mod h1:ME0N0ZEonRDClEWKCeKo7EeqWGLmalWfZ5B0VX8zdmA=
750+
knative.dev/client/pkg v0.0.0-20251009022514-a23801d4bdc2 h1:3WCIrPyLloKe62C+XpED5V2Qw4oKqTJFsyn9uyXnZ68=
751+
knative.dev/client/pkg v0.0.0-20251009022514-a23801d4bdc2/go.mod h1:YQ1JZudQayawjJZ5BVK+VSDVFXZMf/cOkvIlTCbhAE0=
752+
knative.dev/eventing v0.46.1-0.20251008160113-3f59df18d8d5 h1:+cAKlWQMKrY5jQYGLALeO4AsHIdQNVXBCDmDJWzx+y4=
753+
knative.dev/eventing v0.46.1-0.20251008160113-3f59df18d8d5/go.mod h1:ME0N0ZEonRDClEWKCeKo7EeqWGLmalWfZ5B0VX8zdmA=
754754
knative.dev/eventing-kafka-broker v0.46.1-0.20251008145913-06d47e7a1fb6 h1:lac46QLb6JrfBK6jJbDNK52HRXEV1M13UtgKOBQrR2U=
755755
knative.dev/eventing-kafka-broker v0.46.1-0.20251008145913-06d47e7a1fb6/go.mod h1:4nUBomNMoFOqtjPsUurPqbTADN1r6mZiE5VVB4GNq8Y=
756756
knative.dev/hack v0.0.0-20250902153942-1499de21e119 h1:NbQvjnFK1tL489LN0qAybWy0E17Jpziwcv/XIHwfp6M=
@@ -759,8 +759,8 @@ knative.dev/networking v0.0.0-20251008015313-0e1a0aa62ad1 h1:mmUlK6ogxaY1EEFHUY1
759759
knative.dev/networking v0.0.0-20251008015313-0e1a0aa62ad1/go.mod h1:VoeeRbQKTTnHZ5eNQ0hAMPBs/O12v++DPNmbPfKkErE=
760760
knative.dev/pkg v0.0.0-20251007184713-a624c759bede h1:ADQEXMQlfbjBjicJdou8R5WjPHm0/5FyyV58RQ9eYPU=
761761
knative.dev/pkg v0.0.0-20251007184713-a624c759bede/go.mod h1:pNETfvzYq5MmPTi+XGGIjjgvQSYvu4pxxLF1muKunhs=
762-
knative.dev/serving v0.46.1-0.20251008121813-85563f5d21ca h1:JvydL+ArWTsnU+6PJWSjyLiL46QVH1xNMZ+SrJqO1uM=
763-
knative.dev/serving v0.46.1-0.20251008121813-85563f5d21ca/go.mod h1:He+gUCV8wQCm2JY1+hVPoATFVbrdub7mNTTFmUJG920=
762+
knative.dev/serving v0.46.1-0.20251008225413-62b04a0c5d5e h1:RnOUSWtgmpxMpHdxOcEHMUE50XhSi+EcJWE8xhdu4kk=
763+
knative.dev/serving v0.46.1-0.20251008225413-62b04a0c5d5e/go.mod h1:DIHl/Cdn7bisvFjTAdVXcZ4zMtuzmqvX+jBVxHIsqoY=
764764
rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
765765
rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
766766
rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=

vendor/knative.dev/eventing/pkg/apis/common/integration/v1alpha1/auth.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,13 @@ type Auth struct {
2525

2626
// SecretKey is the AWS secret access key.
2727
SecretKey string `json:"secretKey,omitempty"`
28+
29+
ServiceAccountName string `json:"serviceAccountName,omitempty"`
2830
}
2931

3032
func (a *Auth) HasAuth() bool {
31-
return a != nil && a.Secret != nil &&
32-
a.Secret.Ref != nil && a.Secret.Ref.Name != ""
33+
return a != nil && ((a.Secret != nil &&
34+
a.Secret.Ref != nil && a.Secret.Ref.Name != "") || a.ServiceAccountName != "")
3335
}
3436

3537
type Secret struct {

vendor/knative.dev/serving/pkg/apis/config/features.go

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,9 @@ const (
3737
// Allowed neither explicitly disables or enables a behavior.
3838
// eg. allow a client to control behavior with an annotation or allow a new value through validation.
3939
Allowed Flag = "Allowed"
40+
// AllowRootBounded is used by secure-pod-defaults to apply secure defaults without enforcing strict policies;
41+
// sets RunAsNonRoot to true if not already specified
42+
AllowRootBounded Flag = "AllowRootBounded"
4043
)
4144

4245
// service annotations under features.knative.dev/*
@@ -124,7 +127,7 @@ func NewFeaturesConfigFromMap(data map[string]string) (*Features, error) {
124127
asFlag("multi-container-probing", &nc.MultiContainerProbing),
125128
asFlag("queueproxy.mount-podinfo", &nc.QueueProxyMountPodInfo),
126129
asFlag("queueproxy.resource-defaults", &nc.QueueProxyResourceDefaults),
127-
asFlag("secure-pod-defaults", &nc.SecurePodDefaults),
130+
asSecurePodDefaultsFlag("secure-pod-defaults", &nc.SecurePodDefaults),
128131
asFlag("tag-header-based-routing", &nc.TagHeaderBasedRouting),
129132
asFlag(FeatureContainerSpecAddCapabilities, &nc.ContainerSpecAddCapabilities),
130133
asFlag(FeaturePodSpecAffinity, &nc.PodSpecAffinity),
@@ -198,6 +201,7 @@ type Features struct {
198201
}
199202

200203
// asFlag parses the value at key as a Flag into the target, if it exists.
204+
// Only accepts Enabled, Disabled, and Allowed values.
201205
func asFlag(key string, target *Flag) cm.ParseFunc {
202206
return func(data map[string]string) error {
203207
if raw, ok := data[key]; ok {
@@ -211,3 +215,19 @@ func asFlag(key string, target *Flag) cm.ParseFunc {
211215
return nil
212216
}
213217
}
218+
219+
// asSecurePodDefaultsFlag parses the value at key as a Flag into the target, if it exists.
220+
// Accepts Enabled, Disabled, Allowed, and SecureDefaultsOverridable values.
221+
func asSecurePodDefaultsFlag(key string, target *Flag) cm.ParseFunc {
222+
return func(data map[string]string) error {
223+
if raw, ok := data[key]; ok {
224+
for _, flag := range []Flag{Disabled, AllowRootBounded, Enabled} {
225+
if strings.EqualFold(raw, string(flag)) {
226+
*target = flag
227+
return nil
228+
}
229+
}
230+
}
231+
return nil
232+
}
233+
}

vendor/knative.dev/serving/pkg/apis/serving/fieldmask.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ package serving
2121

2222
import (
2323
"context"
24+
"slices"
2425

2526
corev1 "k8s.io/api/core/v1"
2627
"knative.dev/serving/pkg/apis/config"
@@ -664,7 +665,7 @@ func PodSecurityContextMask(ctx context.Context, in *corev1.PodSecurityContext)
664665

665666
out := new(corev1.PodSecurityContext)
666667

667-
if config.FromContextOrDefaults(ctx).Features.SecurePodDefaults == config.Enabled {
668+
if slices.Contains([]config.Flag{config.Enabled, config.AllowRootBounded}, config.FromContextOrDefaults(ctx).Features.SecurePodDefaults) {
668669
// Allow to opt out of more-secure defaults if SecurePodDefaults is enabled.
669670
// This aligns with defaultSecurityContext in revision_defaults.go.
670671
if in.SeccompProfile != nil {
@@ -749,8 +750,8 @@ func CapabilitiesMask(ctx context.Context, in *corev1.Capabilities) *corev1.Capa
749750

750751
if config.FromContextOrDefaults(ctx).Features.ContainerSpecAddCapabilities == config.Enabled {
751752
out.Add = in.Add
752-
} else if config.FromContextOrDefaults(ctx).Features.SecurePodDefaults == config.Enabled {
753-
if len(in.Add) == 1 && in.Add[0] == "NET_BIND_SERVICE" {
753+
} else if slices.Contains([]config.Flag{config.Enabled, config.AllowRootBounded}, config.FromContextOrDefaults(ctx).Features.SecurePodDefaults) {
754+
if slices.Equal(in.Add, []corev1.Capability{"NET_BIND_SERVICE"}) {
754755
out.Add = in.Add
755756
} else {
756757
out.Add = nil

vendor/knative.dev/serving/pkg/apis/serving/k8s_validation.go

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"fmt"
2222
"math"
2323
"path"
24+
"slices"
2425
"strings"
2526

2627
"github.com/google/go-containerregistry/pkg/name"
@@ -985,14 +986,19 @@ func ValidatePodSecurityContext(ctx context.Context, sc *corev1.PodSecurityConte
985986
// Note that this **explicitly** does not warn on dangerous SecurityContext
986987
// settings, the purpose is to avoid accidentally-insecure settings, not to
987988
// block deliberate use of dangerous settings.
988-
func warnDefaultContainerSecurityContext(_ context.Context, psc *corev1.PodSecurityContext, sc *corev1.SecurityContext) *apis.FieldError {
989+
func warnDefaultContainerSecurityContext(ctx context.Context, psc *corev1.PodSecurityContext, sc *corev1.SecurityContext) *apis.FieldError {
989990
if sc == nil {
990991
sc = &corev1.SecurityContext{}
991992
}
992993
if psc == nil {
993994
psc = &corev1.PodSecurityContext{}
994995
}
995996

997+
// if the user has explicitly enabled the feature, we don't need to warn
998+
if slices.Contains([]config.Flag{config.Enabled, config.AllowRootBounded}, config.FromContextOrDefaults(ctx).Features.PodSpecSecurityContext) {
999+
return nil
1000+
}
1001+
9961002
insecureDefault := func(fieldPath string) *apis.FieldError {
9971003
return apis.ErrGeneric("Kubernetes default value is insecure, Knative may default this to secure in a future release", fieldPath).At(apis.WarningLevel)
9981004
}

vendor/knative.dev/serving/pkg/apis/serving/v1/revision_defaults.go

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,9 @@ limitations under the License.
1717
package v1
1818

1919
import (
20+
"cmp"
2021
"context"
22+
"slices"
2123
"strconv"
2224

2325
corev1 "k8s.io/api/core/v1"
@@ -203,10 +205,13 @@ func (*RevisionSpec) applyGRPCProbeDefaults(container *corev1.Container) {
203205

204206
// Upgrade SecurityContext for this container and the Pod definition to use settings
205207
// for the `restricted` profile when the feature flag is enabled.
206-
// This does not currently set `runAsNonRoot` for the restricted profile, because
207-
// that feels harder to default safely.
208+
// when the feature flag is enabled or AllowRootBounded:
209+
// `seccompProfile` is set to `RuntimeDefault` if its empty or nil
210+
// `capabilities` is set to `NET_BIND_SERVICE` if its empty or nil
211+
// when the feature flag is set to Enabled:
212+
// `runAsNonRoot` is set to true only if its empty or nil
208213
func (rs *RevisionSpec) defaultSecurityContext(psc *corev1.PodSecurityContext, container *corev1.Container, cfg *config.Config) {
209-
if cfg.Features.SecurePodDefaults != config.Enabled {
214+
if !slices.Contains([]config.Flag{config.Enabled, config.AllowRootBounded}, cfg.Features.SecurePodDefaults) {
210215
return
211216
}
212217

@@ -224,9 +229,7 @@ func (rs *RevisionSpec) defaultSecurityContext(psc *corev1.PodSecurityContext, c
224229
updatedSC.AllowPrivilegeEscalation = ptr.Bool(false)
225230
}
226231
if psc.SeccompProfile == nil || psc.SeccompProfile.Type == "" {
227-
if updatedSC.SeccompProfile == nil {
228-
updatedSC.SeccompProfile = &corev1.SeccompProfile{}
229-
}
232+
updatedSC.SeccompProfile = cmp.Or(updatedSC.SeccompProfile, &corev1.SeccompProfile{})
230233
if updatedSC.SeccompProfile.Type == "" {
231234
updatedSC.SeccompProfile.Type = corev1.SeccompProfileTypeRuntimeDefault
232235
}
@@ -247,8 +250,12 @@ func (rs *RevisionSpec) defaultSecurityContext(psc *corev1.PodSecurityContext, c
247250
}
248251
}
249252

250-
if psc.RunAsNonRoot == nil {
251-
updatedSC.RunAsNonRoot = ptr.Bool(true)
253+
if cfg.Features.SecurePodDefaults == config.Enabled {
254+
if psc.RunAsNonRoot == nil {
255+
if updatedSC.RunAsNonRoot == nil {
256+
updatedSC.RunAsNonRoot = ptr.Bool(true)
257+
}
258+
}
252259
}
253260

254261
if *updatedSC != (corev1.SecurityContext{}) {

vendor/knative.dev/serving/pkg/testing/v1/revision.go

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2525
"k8s.io/utils/clock"
2626
"knative.dev/pkg/kmeta"
27+
"knative.dev/pkg/ptr"
2728
"knative.dev/serving/pkg/apis/serving"
2829
v1 "knative.dev/serving/pkg/apis/serving/v1"
2930
)
@@ -246,9 +247,29 @@ func WithRevisionInitContainers() RevisionOption {
246247
r.Spec.InitContainers = []corev1.Container{{
247248
Name: "init1",
248249
Image: "initimage",
250+
SecurityContext: &corev1.SecurityContext{
251+
RunAsNonRoot: ptr.Bool(true),
252+
AllowPrivilegeEscalation: ptr.Bool(false),
253+
SeccompProfile: &corev1.SeccompProfile{
254+
Type: corev1.SeccompProfileTypeRuntimeDefault,
255+
},
256+
Capabilities: &corev1.Capabilities{
257+
Drop: []corev1.Capability{"ALL"},
258+
},
259+
},
249260
}, {
250261
Name: "init2",
251262
Image: "initimage",
263+
SecurityContext: &corev1.SecurityContext{
264+
RunAsNonRoot: ptr.Bool(true),
265+
AllowPrivilegeEscalation: ptr.Bool(false),
266+
SeccompProfile: &corev1.SeccompProfile{
267+
Type: corev1.SeccompProfileTypeRuntimeDefault,
268+
},
269+
Capabilities: &corev1.Capabilities{
270+
Drop: []corev1.Capability{"ALL"},
271+
},
272+
},
252273
}}
253274
}
254275
}

vendor/modules.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -855,7 +855,7 @@ k8s.io/utils/net
855855
k8s.io/utils/pointer
856856
k8s.io/utils/ptr
857857
k8s.io/utils/trace
858-
# knative.dev/client/pkg v0.0.0-20251008140714-6f59afe28d11
858+
# knative.dev/client/pkg v0.0.0-20251009022514-a23801d4bdc2
859859
## explicit; go 1.24.0
860860
knative.dev/client/pkg/apis/client
861861
knative.dev/client/pkg/apis/client/v1alpha1
@@ -882,7 +882,7 @@ knative.dev/client/pkg/util/errors
882882
knative.dev/client/pkg/util/mock
883883
knative.dev/client/pkg/util/test
884884
knative.dev/client/pkg/wait
885-
# knative.dev/eventing v0.46.1-0.20251008070512-9fe13ee820cf
885+
# knative.dev/eventing v0.46.1-0.20251008160113-3f59df18d8d5
886886
## explicit; go 1.24.0
887887
knative.dev/eventing/pkg/apis/common/integration/v1alpha1
888888
knative.dev/eventing/pkg/apis/config
@@ -996,7 +996,7 @@ knative.dev/pkg/test/logging
996996
knative.dev/pkg/test/spoof
997997
knative.dev/pkg/tracker
998998
knative.dev/pkg/webhook/resourcesemantics
999-
# knative.dev/serving v0.46.1-0.20251008121813-85563f5d21ca
999+
# knative.dev/serving v0.46.1-0.20251008225413-62b04a0c5d5e
10001000
## explicit; go 1.24.0
10011001
knative.dev/serving/pkg/apis/autoscaling
10021002
knative.dev/serving/pkg/apis/autoscaling/v1alpha1

0 commit comments

Comments
 (0)