Sync with internal repo

.github/workflows/build.yaml

@@ -18,7 +18,7 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@v2
         with:
-          go-version: 1.21.13
+          go-version: 1.23.7
         id: go
 
       - name: Check out code into the Go module directory
@@ -31,10 +31,10 @@ jobs:
       - name: Run Unit Tests
         run: |
           go test -covermode=count -coverprofile=profile.cov.tmp  $(go list ./pkg/... | grep -v /server)
-          cat profile.cov.tmp | grep -v /pkg/util/testutil.go  > profile.cov
+          cat profile.cov.tmp | grep -v /pkg/util/testutil.go | grep -v /pkg/oci/client | grep -v /pkg/metric  > profile.cov
       - name: Send coverage
         env:
           COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          GO111MODULE=off go get github.com/mattn/goveralls
-          $(go env GOPATH)/bin/goveralls -coverprofile=profile.cov -service=github
+          go install github.com/mattn/goveralls@latest
+          goveralls -coverprofile=profile.cov -service=github

Dockerfile

@@ -6,7 +6,7 @@
 #
 
 # For open source
-FROM golang:1.21.13-alpine as builder
+FROM golang:1.23.7-alpine as builder
 
 WORKDIR /workspace
 

GettingStarted.md

@@ -56,6 +56,7 @@ Currently supported kubernetes versions are:
 - 1.29
 - 1.30
 - 1.31
+- 1.32
 
 We set up the cluster with either native pod networking or flannel CNI and update the security rules. 
 The documentation for NPN : [Doc Ref](https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengpodnetworking_topic-OCI_CNI_plugin.htm).
@@ -484,6 +485,7 @@ type: kubernetes.io/tls
 Note: If `ca.crt` field is missing/empty, the entire certificate chain is expected to be present in `tls.crt`. The server certificate MUST be first, followed by chain of CAs.
 For certificate renewals, update the secret with the renewed certificate contents.
 In case the certificate subject information like CN, SAN, Organization, etc. are changed, the secret must be recreated.
+Certificate resource clean-up can be enabled by setting the `certDeletionGracePeriodInDays` parameter in the helm chart's `value.yaml` file.
 
 Ingress Format: 
 ```

deploy/manifests/oci-native-ingress-controller/templates/deployment.yaml

@@ -18,10 +18,10 @@ metadata:
   name: oci-native-ingress-controller
   namespace: native-ingress-controller-system
   labels:
-    helm.sh/chart: oci-native-ingress-controller-1.4.1
+    helm.sh/chart: oci-native-ingress-controller-1.4.2
     app.kubernetes.io/name: oci-native-ingress-controller
     app.kubernetes.io/instance: oci-native-ingress-controller
-    app.kubernetes.io/version: "1.4.1"
+    app.kubernetes.io/version: "1.4.2"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -55,7 +55,7 @@ spec:
               drop:
               - ALL
             readOnlyRootFilesystem: true
-          image: "ghcr.io/oracle/oci-native-ingress-controller:v1.4.1"
+          image: "ghcr.io/oracle/oci-native-ingress-controller:v1.4.2"
           imagePullPolicy: Always
           args: 
           - --lease-lock-name=oci-native-ingress-controller
@@ -69,6 +69,9 @@ spec:
           - --metrics-backend=prometheus
           - --metrics-port=2223
           - --v=4
+          - --use-lb-compartment-for-certificates=false
+          - --emit-events=false
+          - --cert-deletion-grace-period-in-days=0
           env:
             - name: OCI_RESOURCE_PRINCIPAL_VERSION
               value: "2.2"

deploy/manifests/oci-native-ingress-controller/templates/rbac.yaml

@@ -11,15 +11,15 @@ kind: ClusterRole
 metadata:
   name: oci-native-ingress-controller-role
   labels:
-    helm.sh/chart: oci-native-ingress-controller-1.4.1
+    helm.sh/chart: oci-native-ingress-controller-1.4.2
     app.kubernetes.io/name: oci-native-ingress-controller
     app.kubernetes.io/instance: oci-native-ingress-controller
-    app.kubernetes.io/version: "1.4.1"
+    app.kubernetes.io/version: "1.4.2"
     app.kubernetes.io/managed-by: Helm
 rules:
-- apiGroups: [""]
+- apiGroups: ["", "events.k8s.io"]
   resources: [events]
-  verbs: [create, patch]
+  verbs: [create, patch, update]
 - apiGroups: [""]
   resources: [pods]
   verbs: [get, list, watch]
@@ -51,10 +51,10 @@ kind: ClusterRoleBinding
 metadata:
   name: oci-native-ingress-controller-rolebinding
   labels:
-    helm.sh/chart: oci-native-ingress-controller-1.4.1
+    helm.sh/chart: oci-native-ingress-controller-1.4.2
     app.kubernetes.io/name: oci-native-ingress-controller
     app.kubernetes.io/instance: oci-native-ingress-controller
-    app.kubernetes.io/version: "1.4.1"
+    app.kubernetes.io/version: "1.4.2"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -72,10 +72,10 @@ metadata:
   name: oci-native-ingress-controller-leader-election-role
   namespace: native-ingress-controller-system
   labels:
-    helm.sh/chart: oci-native-ingress-controller-1.4.1
+    helm.sh/chart: oci-native-ingress-controller-1.4.2
     app.kubernetes.io/name: oci-native-ingress-controller
     app.kubernetes.io/instance: oci-native-ingress-controller
-    app.kubernetes.io/version: "1.4.1"
+    app.kubernetes.io/version: "1.4.2"
     app.kubernetes.io/managed-by: Helm
 rules:
 - apiGroups: ["coordination.k8s.io"]
@@ -93,10 +93,10 @@ metadata:
   name: oci-native-ingress-controller-leader-election-rolebinding
   namespace: native-ingress-controller-system
   labels:
-    helm.sh/chart: oci-native-ingress-controller-1.4.1
+    helm.sh/chart: oci-native-ingress-controller-1.4.2
     app.kubernetes.io/name: oci-native-ingress-controller
     app.kubernetes.io/instance: oci-native-ingress-controller
-    app.kubernetes.io/version: "1.4.1"
+    app.kubernetes.io/version: "1.4.2"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io

deploy/manifests/oci-native-ingress-controller/templates/service.yaml

@@ -12,10 +12,10 @@ metadata:
   name: oci-native-ingress-controller
   namespace: native-ingress-controller-system
   labels:
-    helm.sh/chart: oci-native-ingress-controller-1.4.1
+    helm.sh/chart: oci-native-ingress-controller-1.4.2
     app.kubernetes.io/name: oci-native-ingress-controller
     app.kubernetes.io/instance: oci-native-ingress-controller
-    app.kubernetes.io/version: "1.4.1"
+    app.kubernetes.io/version: "1.4.2"
     app.kubernetes.io/managed-by: Helm
 spec:
   type: ClusterIP

deploy/manifests/oci-native-ingress-controller/templates/serviceaccount.yaml

@@ -12,8 +12,8 @@ metadata:
   name: oci-native-ingress-controller
   namespace: native-ingress-controller-system
   labels:
-    helm.sh/chart: oci-native-ingress-controller-1.4.1
+    helm.sh/chart: oci-native-ingress-controller-1.4.2
     app.kubernetes.io/name: oci-native-ingress-controller
     app.kubernetes.io/instance: oci-native-ingress-controller
-    app.kubernetes.io/version: "1.4.1"
+    app.kubernetes.io/version: "1.4.2"
     app.kubernetes.io/managed-by: Helm

deploy/manifests/oci-native-ingress-controller/templates/webhook.yaml

@@ -36,10 +36,10 @@ kind: MutatingWebhookConfiguration
 metadata:
   name: oci-native-ingress-controller-webhook
   labels:
-    helm.sh/chart: oci-native-ingress-controller-1.4.1
+    helm.sh/chart: oci-native-ingress-controller-1.4.2
     app.kubernetes.io/name: oci-native-ingress-controller
     app.kubernetes.io/instance: oci-native-ingress-controller
-    app.kubernetes.io/version: "1.4.1"
+    app.kubernetes.io/version: "1.4.2"
     app.kubernetes.io/managed-by: Helm
   annotations:
     cert-manager.io/inject-ca-from: native-ingress-controller-system/oci-native-ingress-controller-webhook-serving-cert

go.mod

@@ -5,7 +5,9 @@
 //
 module github.com/oracle/oci-native-ingress-controller
 
-go 1.19
+go 1.23.0
+
+toolchain go1.23.7
 
 require (
 	github.com/google/uuid v1.3.0
@@ -35,6 +37,7 @@ require (
 	github.com/go-openapi/swag v0.22.3 // indirect
 	github.com/gofrs/flock v0.8.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/gnostic v0.5.7-v3refs // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
@@ -52,14 +55,13 @@ require (
 	github.com/prometheus/procfs v0.9.0 // indirect
 	github.com/sony/gobreaker v0.5.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	golang.org/x/net v0.33.0 // indirect
-	golang.org/x/oauth2 v0.5.0 // indirect
-	golang.org/x/sys v0.28.0 // indirect
-	golang.org/x/term v0.27.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
+	golang.org/x/net v0.36.0 // indirect
+	golang.org/x/oauth2 v0.27.0 // indirect
+	golang.org/x/sys v0.30.0 // indirect
+	golang.org/x/term v0.29.0 // indirect
+	golang.org/x/text v0.22.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.3.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect