From a1d90b5e501958d910ff075513451d0928e3be7d Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Sun, 25 Oct 2026 19:47:59 +0000 Subject: [PATCH 1/3] chore(deps): bump fluxcd/pkg/apis/meta to v1.38.0 and k8s.io/utils - github.com/fluxcd/pkg/apis/meta v1.37.0 -> v1.38.0 - k8s.io/utils -> v0.0.0-20261023123148-ca04ba58ecab The Kubernetes libraries stay on v0.37.1: 1.38 has only alphas. Flux meta v1.38.0 is Flux's own numbering and still requires apimachinery v0.37.1. kustomize api/kyaml stay at v0.21.2 for the same reason as #440. Co-Authored-By: Claude Opus 5.5 (1M context) --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 7a0ecf68..08216ebb 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ require ( filippo.io/age v1.3.2 github.com/alicebob/miniredis/v2 v2.40.0 github.com/cespare/xxhash/v2 v2.3.0 - github.com/fluxcd/pkg/apis/meta v1.37.0 + github.com/fluxcd/pkg/apis/meta v1.38.0 github.com/go-git/go-billy/v6 v6.0.0-beta.1 github.com/go-git/go-git/v6 v6.0.0-beta.1 github.com/go-logr/logr v1.4.4 @@ -29,7 +29,7 @@ require ( k8s.io/apimachinery v0.37.1 k8s.io/apiserver v0.37.1 k8s.io/client-go v0.37.1 - k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 + k8s.io/utils v0.0.0-20261023123148-ca04ba58ecab sigs.k8s.io/cli-utils v0.37.2 sigs.k8s.io/controller-runtime v0.25.2 sigs.k8s.io/kustomize/api v0.21.2 diff --git a/go.sum b/go.sum index 06a4f582..244aa3af 100644 --- a/go.sum +++ b/go.sum @@ -49,8 +49,8 @@ github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjT github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM= github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc= github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE= -github.com/fluxcd/pkg/apis/meta v1.37.0 h1:gVwadRI8BrRrl4Rw0ZBJ/VSWh7qNpf7ShmTjDhcVf30= -github.com/fluxcd/pkg/apis/meta v1.37.0/go.mod h1:1MLvK2Xu3UdTKBzg+Q1Oj7H9PHeiKsUB1UW3uwxAwiM= +github.com/fluxcd/pkg/apis/meta v1.38.0 h1:7t6/DuGFAPx2LE4MsRh1jskjnVE6qELKfr/LrfG7KE8= +github.com/fluxcd/pkg/apis/meta v1.38.0/go.mod h1:lmdugeiZyt6w+DRm8ypkB+nwrzm+saMbqSfZKGBbTOE= github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho= github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo= github.com/fxamacker/cbor/v2 v2.9.3 h1:oQBnFATpNdY8gJHTndDDv5Xl4QqNaz51G5LLEPhng3Q= @@ -337,8 +337,8 @@ k8s.io/kube-openapi v0.0.0-20260821135717-be32def86098 h1:z5+pcu1jTyKK5mNTe2/+x+ k8s.io/kube-openapi v0.0.0-20260821135717-be32def86098/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I= k8s.io/streaming v0.37.1 h1:TpzVfQeFuVndn2g9mFqxy1UcUYPwDzqjUmwR/IzJCWc= k8s.io/streaming v0.37.1/go.mod h1:APlJR26ZWRcVy5bIEj0QRrKUXROtBHPcxl2NT7EAzPU= -k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 h1:jVkFFVfXdXP74B/zbO3hM3hpSFD0xvhQ5U686DPurkE= -k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3/go.mod h1:M2s5JB1lIYP3jzZdorPLHXIPJzt9vv2muW5a6L9DtNM= +k8s.io/utils v0.0.0-20261023123148-ca04ba58ecab h1:pjQrNLaF//ytZtWwCAHtW+pqwSKjtWDqzA8+TCX37RI= +k8s.io/utils v0.0.0-20261023123148-ca04ba58ecab/go.mod h1:DdQ0BJxlQtuMlKDqdg7X5IMMQCXIk2b3d1/4M9OhUYo= sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.36.0 h1:/YpDJ4vReG7ZmzSpBGxduXgywWkJU9zHubgJG03MT+Y= sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.36.0/go.mod h1:tJo1aepTXyR+8Xs3sUsGBDk4Ub2AM5dPAPKJx0mpm5c= sigs.k8s.io/cli-utils v0.37.2 h1:GOfKw5RV2HDQZDJlru5KkfLO1tbxqMoyn1IYUxqBpNg= From b9e97bb3019c07a9c8502aac4fbaa9648f44f655 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Sun, 25 Oct 2026 19:47:59 +0000 Subject: [PATCH 2/3] chore(deps): refresh the distroless digest, login-action, oras and vale - gcr.io/distroless/static:debug: current digest - docker/login-action v4.6.0 -> v4.7.0 (workflows and the docker-build action) - devcontainer: oras 1.3.6, vale 3.25.1 Vale 3.25.1 gives the same output as 3.24.0 on every file .docs-lint-scope gates. Co-Authored-By: Claude Opus 5.5 (1M context) --- .devcontainer/Dockerfile | 4 ++-- .github/actions/docker-build/action.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- Dockerfile | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index 30a4da4b..03ea3824 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -79,10 +79,10 @@ ENV PATH="/go/bin:/usr/local/go/bin:${PATH}" \ HADOLINT_VERSION=2.15.1 \ VALKEY_VERSION=9.1.2 \ COSIGN_VERSION=v3.1.4 \ - ORAS_VERSION=1.3.5 \ + ORAS_VERSION=1.3.6 \ NODE_MAJOR=24 \ MARKDOWNLINT_CLI2_VERSION=0.24.0 \ - VALE_VERSION=3.24.0 \ + VALE_VERSION=3.25.1 \ TRIVY_VERSION=0.76.1 # Fail early on unsupported architectures instead of producing a partial image. diff --git a/.github/actions/docker-build/action.yml b/.github/actions/docker-build/action.yml index 56d61766..4f8ab8c9 100644 --- a/.github/actions/docker-build/action.yml +++ b/.github/actions/docker-build/action.yml @@ -57,7 +57,7 @@ runs: - name: Log in to Container Registry if: ${{ inputs.login == 'true' }} - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ${{ inputs.registry }} username: ${{ inputs.username }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d37ac906..c65832e3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -67,7 +67,7 @@ jobs: - name: Login to GitHub Container Registry if: github.event_name != 'pull_request' - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 39b8529f..f08cadd1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -115,7 +115,7 @@ jobs: uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Login to registry - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} diff --git a/Dockerfile b/Dockerfile index 5986512b..8ce371cd 100644 --- a/Dockerfile +++ b/Dockerfile @@ -94,7 +94,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \ # Use distroless as minimal base image to package the manager binary # Refer to https://github.com/GoogleContainerTools/distroless for more details -FROM gcr.io/distroless/static:debug@sha256:11c839f18a0d7b91b093cda53a5d4cee84f23ec450a6f6e1bf17ab12bf296333 +FROM gcr.io/distroless/static:debug@sha256:6a5e9a4921c51d613ab8128402badf19d27b16627f92f97146f4597d2c593104 WORKDIR / COPY --from=builder /workspaces/manager . COPY --from=sops-builder /out/sops /usr/local/bin/sops From 7944c1dab6a1a20ac71d1d9440a40c1d80493440 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Sun, 25 Oct 2026 19:48:00 +0000 Subject: [PATCH 3/3] chore(deps): bump e2e cluster charts and Argo CD to v3.5.6 - cert-manager v1.21.2 -> v1.21.3 (e2e HelmRelease and the quickstart URL) - reflector 10.0.65 -> 10.0.68 - prometheus-operator CRDs v0.94.1 -> v0.94.2 - Argo CD chart 10.10.5 -> 10.11.1 (v3.5.5 -> v3.5.6) The four Argo CD facts the setup README asks to re-verify hold at v3.5.6: the four source files it names are unchanged from v3.5.5. The chart still leaves the tracking method and server-side apply unset, and its redis tag is still 8.6.4-alpine, so the mirror.gcr.io pin and digest stay. Co-Authored-By: Claude Opus 5.5 (1M context) --- docs/quickstart.md | 2 +- docs/spec/e2e-bi-directional-corner.md | 8 ++++---- test/e2e/Taskfile-e2e.yml | 2 +- test/e2e/setup/argocd/README.md | 2 +- test/e2e/setup/argocd/values.yaml | 2 +- test/e2e/setup/flux/releases/cert-manager.yaml | 2 +- test/e2e/setup/flux/releases/reflector.yaml | 2 +- test/e2e/setup/flux/repositories/prometheus-operator.yaml | 2 +- 8 files changed, 11 insertions(+), 11 deletions(-) diff --git a/docs/quickstart.md b/docs/quickstart.md index 2486e4c8..5e204126 100644 --- a/docs/quickstart.md +++ b/docs/quickstart.md @@ -25,7 +25,7 @@ you install the chart. (`--set servers.admission.enabled=false` drops the depend [chart README](../charts/gitops-reverser/README.md) covers bring-your-own certificates.) ```bash -kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.21.2/cert-manager.yaml +kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.21.3/cert-manager.yaml kubectl wait --for=condition=ready pod -l app.kubernetes.io/instance=cert-manager -n cert-manager --timeout=300s ``` diff --git a/docs/spec/e2e-bi-directional-corner.md b/docs/spec/e2e-bi-directional-corner.md index c28153a5..d107fc27 100644 --- a/docs/spec/e2e-bi-directional-corner.md +++ b/docs/spec/e2e-bi-directional-corner.md @@ -46,8 +46,8 @@ checked in source. **The install is pinned to `v3.4.5`**, the latest actual release (`v3.5.0` is master's next version and has no tag). Every fact in the tables below was re-verified at `v3.4.5` before pinning; line numbers cited are master's, and the -constants are unchanged between the two. The pin has since moved to `v3.5.5` -(chart `10.10.5`); the four facts the setup README lists were re-checked at that tag. +constants are unchanged between the two. The pin has since moved to `v3.5.6` +(chart `10.11.1`); the four facts the setup README lists were re-checked at that tag. ### Resource tracking @@ -274,9 +274,9 @@ chart**. `_argocd-installed` `helm pull`s the pinned chart into `.stamps/cluster//argocd/` (retryable network step) and `helm upgrade --install`s it with `values.yaml` and `--wait`, then gates on CRD establishment. -- `ARGOCD_CHART_VERSION` (e.g. `10.10.5`) lives in `test/e2e/Taskfile-e2e.yml` and pins +- `ARGOCD_CHART_VERSION` (e.g. `10.11.1`) lives in `test/e2e/Taskfile-e2e.yml` and pins the chart, which carries the Argo CD release the specs pin behaviour against (its - appVersion, e.g. `v3.5.5`). Unlike `FLUX_VERSION` it is not a devcontainer env + appVersion, e.g. `v3.5.6`). Unlike `FLUX_VERSION` it is not a devcontainer env var: nothing outside the cluster needs an `argocd` binary — the specs drive Argo through `kubectl` alone — so pinning it in the Taskfile avoids a container rebuild. - **Why `helm`, not a flat `kubectl apply`.** The chart's `redis-secret-init` runs diff --git a/test/e2e/Taskfile-e2e.yml b/test/e2e/Taskfile-e2e.yml index fa4d21a9..f30e5a50 100644 --- a/test/e2e/Taskfile-e2e.yml +++ b/test/e2e/Taskfile-e2e.yml @@ -143,7 +143,7 @@ vars: # an argocd binary — the specs drive Argo through kubectl alone — so pinning it # here avoids a container rebuild. test/e2e/setup/argocd/README.md lists what to # re-verify when bumping. - ARGOCD_CHART_VERSION: '{{.ARGOCD_CHART_VERSION | default "10.10.5"}}' + ARGOCD_CHART_VERSION: '{{.ARGOCD_CHART_VERSION | default "10.11.1"}}' ARGOCD_HELM_REPO: '{{.ARGOCD_HELM_REPO | default "https://argoproj.github.io/argo-helm"}}' ARGOCD_NAMESPACE: '{{.ARGOCD_NAMESPACE | default "argocd"}}' ARGOCD_DIR: '{{.ARGOCD_DIR | default "test/e2e/setup/argocd"}}' diff --git a/test/e2e/setup/argocd/README.md b/test/e2e/setup/argocd/README.md index 06ca97b7..485ffaff 100644 --- a/test/e2e/setup/argocd/README.md +++ b/test/e2e/setup/argocd/README.md @@ -53,7 +53,7 @@ change turn a real behavioral regression into a silent pass. `ARGOCD_CHART_VERSION` lives in [`test/e2e/Taskfile-e2e.yml`](../../Taskfile-e2e.yml) and pins the chart, which carries a specific Argo CD release (its appVersion; e.g. -chart `10.10.5` ships `v3.5.5`). When bumping, re-verify against the upstream source +chart `10.11.1` ships `v3.5.6`). When bumping, re-verify against the upstream source **at the appVersion the chart ships** (a checkout lives at `external-sources/argo-cd`; read the tag, not master): diff --git a/test/e2e/setup/argocd/values.yaml b/test/e2e/setup/argocd/values.yaml index c4306a76..c1e0db88 100644 --- a/test/e2e/setup/argocd/values.yaml +++ b/test/e2e/setup/argocd/values.yaml @@ -41,7 +41,7 @@ notifications: # bi-directional leg failed in `_argocd-installed` on 8 CI runs between 2026-09-30 and 2026-10-19, # every one with argocd-redis in ImagePullBackOff on "429 Too Many Requests". mirror.gcr.io is # Google's Docker Hub cache and serves the same image: the tag pinned here is the chart's -# redis.image.tag (8.6.4-alpine for chart 10.10.5), by its mirror.gcr.io digest. Re-pin both on +# redis.image.tag (8.6.4-alpine for chart 10.11.1), by its mirror.gcr.io digest. Re-pin both on # an Argo CD chart bump. redis: image: diff --git a/test/e2e/setup/flux/releases/cert-manager.yaml b/test/e2e/setup/flux/releases/cert-manager.yaml index a9b70b5f..6f93205d 100644 --- a/test/e2e/setup/flux/releases/cert-manager.yaml +++ b/test/e2e/setup/flux/releases/cert-manager.yaml @@ -13,7 +13,7 @@ spec: kind: HelmRepository name: jetstack namespace: flux-system - version: v1.21.2 + version: v1.21.3 install: createNamespace: false crds: Create diff --git a/test/e2e/setup/flux/releases/reflector.yaml b/test/e2e/setup/flux/releases/reflector.yaml index d5c0d153..781d5915 100644 --- a/test/e2e/setup/flux/releases/reflector.yaml +++ b/test/e2e/setup/flux/releases/reflector.yaml @@ -10,7 +10,7 @@ spec: mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip" operation: copy ref: - semver: "10.0.65" + semver: "10.0.68" --- apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease diff --git a/test/e2e/setup/flux/repositories/prometheus-operator.yaml b/test/e2e/setup/flux/repositories/prometheus-operator.yaml index da60226b..04e55fcf 100644 --- a/test/e2e/setup/flux/repositories/prometheus-operator.yaml +++ b/test/e2e/setup/flux/repositories/prometheus-operator.yaml @@ -7,4 +7,4 @@ spec: interval: 30m url: https://github.com/prometheus-operator/prometheus-operator ref: - tag: v0.94.1 + tag: v0.94.2