Skip to content

v0.23.0

Latest

Choose a tag to compare

@github-actions github-actions released this 03 Nov 13:48
· 8 commits to master since this release
v0.23.0
874989d

Changes by Kind

Feature

  • Add trixie variant for kube-cross (#4556, @upodroid) [SIG Release]
  • Bump distroless-iptables to use Go 1.27.2/1.26.9 (#4573, @xmudrii) [SIG Release]
  • Bump distroless-iptables to use Go 1.27.3/1.26.10 (#4584, @palnabarun) [SIG Release]
  • Krel can now stage binaries to S3, --gcs-root has been deprecated in favour of a new flag called --bucket-root (#4590, @upodroid) [SIG Release]
  • Kubernetes releases publish their release artifacts SBOM as SPDX 3.0.1 JSON-LD too, as kubernetes-release.spdx3.json next to kubernetes-release.spdx. The release SBOM now references the package of the source SBOM that exists, instead of a missing one. (#4562, @saschagrunert) [SIG Release]
  • Revert removing kube-cross variant for v1.34 in order to build a kube-cross image for v1.34 with the latest Go version (#4574, @xmudrii) [SIG Release]
  • The provenance attestation published with each Kubernetes release (provenance.json on dl.k8s.io) is now a sigstore bundle signed as krel-staging@k8s-releng-prod.iam.gserviceaccount.com instead of an unsigned in-toto statement. (#4550, @saschagrunert) [SIG Release]
  • The staged Kubernetes images now carry signed SLSA provenance as OCI referrers, which the image promoter verifies for their verification summaries on registry.k8s.io. (#4551, @saschagrunert) [SIG Release]
  • Update Go images to use 1.27.2/1.26.9
    • Migrate away from N1_HIGHCPU_8 machine type in GCB jobs (#4570, @xmudrii) [SIG Release]
  • Update Go images to use 1.27.3/1.26.10 (#4582, @palnabarun) [SIG Release]
  • Update k8s-cloud-builder and k8s-ci-builder to Go 1.27.2/1.26.9 (#4575, @xmudrii) [SIG Release]
  • Update k8s-cloud-builder and k8s-ci-builder to Go 1.27.3/1.26.10 (#4587, @palnabarun) [SIG Release]
  • krel release verifies the signature, builder and source of the stage provenance with the SLSA verifier, and official releases fail when the provenance check fails. (#4555, @saschagrunert) [SIG Release]

Bug or Regression

  • Fixed krel release not publishing provenance.json since the stage provenance is a signed SLSA v1 sigstore bundle. (#4549, @saschagrunert) [SIG Release]
  • Fixed krel sign blobs failing at random with keyless signing, by bumping sigs.k8s.io/release-sdk to v0.13.1. (#4602, @saschagrunert) [SIG Release]

Other (Cleanup or Flake)

  • Krel release takes the Google service account to sign the provenance as from the new --signing-account flag, which defaults to GOOGLE_SERVICE_ACCOUNT_NAME. (#4594, @saschagrunert) [SIG Release]
  • Krel signs images and files with sigstore-go through release-sdk v0.13.0. The signatures keep their format and verify with cosign as before. (#4569, @saschagrunert) [SIG Release]

Dependencies

Added
  • cel.dev/cel-go: v0.32.0
  • github.com/AliyunContainerService/ack-ram-tool/pkg/ecsmetadata: v0.0.10
  • github.com/carabiner-dev/deadrop: d95e9ea
  • github.com/carabiner-dev/ghrfs: v0.3.7
  • github.com/carabiner-dev/jsonl: v0.2.2
  • github.com/carabiner-dev/sbomfs: v0.2.0
  • github.com/carabiner-dev/stash: 008b3ba
  • github.com/docker/libtrust: aabc10e
  • github.com/eclipse-keypont/crypto11: v1.6.8
  • github.com/github/go-spdx/v2: v2.7.0
  • github.com/github/smimesign: v0.2.0
  • github.com/goccy/go-yaml: v1.19.2
  • github.com/gorilla/mux: v1.8.1
  • github.com/hjson/hjson-go/v4: v4.7.1
  • github.com/migueleliasweb/go-github-mock: v1.5.0
  • github.com/mozillazg/docker-credential-acr-helper/pkg/acr: v0.2.2
  • github.com/olareg/olareg: v0.2.2
  • github.com/ossf/osv-schema/bindings/go: 9509daa
  • github.com/owenrumney/go-sarif: v1.1.1
  • github.com/phuslu/lru: v1.0.18
  • github.com/policylabs/attestation: v0.3.0
  • github.com/policylabs/collector: v0.4.0
  • github.com/policylabs/policy: 55e5473
  • github.com/policylabs/predicates: v0.6.0
  • github.com/policylabs/signer: v0.6.5
  • github.com/regclient/regclient: v0.11.6
  • github.com/sigstore/gitsign: v0.17.1
  • github.com/slsa-framework/protos: 9fa868b
  • github.com/slsa-framework/source-tool: v0.7.0
  • github.com/slsa-framework/verifier: v0.1.0
  • github.com/sudo-bmitch/oci-digest: v0.1.2
  • github.com/zclconf/go-cty: v1.10.0
  • gitlab.com/gitlab-org/api/client-go/v3: v3.13.0
  • go.opentelemetry.io/otel/log: v1.47.0
  • golang.org/x/exp/typeparams: 2478ac8
Changed
Removed
  • buf.build/go/protoyaml: v0.6.0
  • chainguard.dev/go-grpc-kit: v0.17.17
  • chainguard.dev/sdk: v0.1.55
  • cloud.google.com/go/accessapproval: v1.13.0
  • cloud.google.com/go/accesscontextmanager: v1.15.0
  • cloud.google.com/go/analytics: v0.35.0
  • cloud.google.com/go/apigateway: v1.13.0
  • cloud.google.com/go/apigeeconnect: v1.12.0
  • cloud.google.com/go/apigeeregistry: v1.1.0
  • cloud.google.com/go/area120: v0.15.0
  • cloud.google.com/go/artifactregistry: v1.26.0
  • cloud.google.com/go/asset: v1.28.0
  • cloud.google.com/go/assuredworkloads: v1.19.0
  • cloud.google.com/go/automl: v1.21.0
  • cloud.google.com/go/baremetalsolution: v1.10.0
  • cloud.google.com/go/batch: v1.20.0
  • cloud.google.com/go/beyondcorp: v1.8.0
  • cloud.google.com/go/bigtable: v1.47.0
  • cloud.google.com/go/billing: v1.26.0
  • cloud.google.com/go/binaryauthorization: v1.16.0
  • cloud.google.com/go/certificatemanager: v1.15.0
  • cloud.google.com/go/channel: v1.27.0
  • cloud.google.com/go/cloudbuild: v1.32.0
  • cloud.google.com/go/clouddms: v1.14.0
  • cloud.google.com/go/compute: v1.62.0
  • cloud.google.com/go/contactcenterinsights: v1.23.0
  • cloud.google.com/go/datacatalog: v1.33.0
  • cloud.google.com/go/dataform: v1.2.0
  • cloud.google.com/go/datafusion: v1.14.0
  • cloud.google.com/go/datalabeling: v0.15.0
  • cloud.google.com/go/dataplex: v1.36.0
  • cloud.google.com/go/dataqna: v0.13.0
  • cloud.google.com/go/datastream: v1.21.0
  • cloud.google.com/go/deploy: v1.33.0
  • cloud.google.com/go/dialogflow: v1.84.0
  • cloud.google.com/go/dlp: v1.34.0
  • cloud.google.com/go/edgecontainer: v1.10.0
  • cloud.google.com/go/errorreporting: v0.9.0
  • cloud.google.com/go/essentialcontacts: v1.12.0
  • cloud.google.com/go/eventarc: v1.25.0
  • cloud.google.com/go/filestore: v1.16.0
  • cloud.google.com/go/firestore: v1.24.0
  • cloud.google.com/go/functions: v1.25.0
  • cloud.google.com/go/gkebackup: v1.14.0
  • cloud.google.com/go/gkeconnect: v1.0.0
  • cloud.google.com/go/gkehub: v0.22.0
  • cloud.google.com/go/gkemulticloud: v1.12.0
  • cloud.google.com/go/gsuiteaddons: v1.12.0
  • cloud.google.com/go/iap: v1.17.0
  • cloud.google.com/go/ids: v1.11.0
  • cloud.google.com/go/iot: v1.13.0
  • cloud.google.com/go/lifesciences: v0.16.0
  • cloud.google.com/go/managedidentities: v1.13.0
  • cloud.google.com/go/maps: v1.37.0
  • cloud.google.com/go/mediatranslation: v0.13.0
  • cloud.google.com/go/memcache: v1.17.0
  • cloud.google.com/go/metastore: v1.20.0
  • cloud.google.com/go/networkconnectivity: v1.27.0
  • cloud.google.com/go/networkmanagement: v1.30.0
  • cloud.google.com/go/networksecurity: v0.19.0
  • cloud.google.com/go/notebooks: v1.18.0
  • cloud.google.com/go/optimization: v1.12.0
  • cloud.google.com/go/orchestration: v1.17.0
  • cloud.google.com/go/orgpolicy: v1.20.0
  • cloud.google.com/go/osconfig: v1.22.0
  • cloud.google.com/go/oslogin: v1.18.0
  • cloud.google.com/go/phishingprotection: v0.13.0
  • cloud.google.com/go/policytroubleshooter: v1.16.0
  • cloud.google.com/go/privatecatalog: v0.16.0
  • cloud.google.com/go/pubsublite: v1.10.0
  • cloud.google.com/go/recaptchaenterprise/v2: v2.26.0
  • cloud.google.com/go/recommendationengine: v0.15.0
  • cloud.google.com/go/redis: v1.24.0
  • cloud.google.com/go/resourcemanager: v1.16.0
  • cloud.google.com/go/resourcesettings: v1.8.3
  • cloud.google.com/go/retail: v1.32.0
  • cloud.google.com/go/run: v1.22.0
  • cloud.google.com/go/scheduler: v1.16.0
  • cloud.google.com/go/secretmanager: v1.20.0
  • cloud.google.com/go/shell: v1.13.0
  • cloud.google.com/go/speech: v1.36.0
  • cloud.google.com/go/storagetransfer: v1.19.0
  • cloud.google.com/go/talent: v1.14.0
  • cloud.google.com/go/texttospeech: v1.22.0
  • cloud.google.com/go/tpu: v1.14.0
  • cloud.google.com/go/vision/v2: v2.15.0
  • cloud.google.com/go/vmmigration: v1.16.0
  • cloud.google.com/go/vmwareengine: v1.9.0
  • cloud.google.com/go/vpcaccess: v1.14.0
  • cloud.google.com/go/webrisk: v1.17.0
  • cloud.google.com/go/websecurityscanner: v1.12.0
  • cloud.google.com/go/workflows: v1.20.0
  • github.com/Azure/go-autorest/autorest/mocks: v0.4.2
  • github.com/Masterminds/sprig/v3: v3.3.0
  • github.com/NYTimes/gziphandler: v1.1.1
  • github.com/ThalesGroup/crypto11: v1.6.0
  • github.com/ThalesIgnite/crypto11: v1.2.5
  • github.com/alibabacloud-go/darabonba-string: v1.0.0
  • github.com/andreyvit/diff: c7f18ee
  • github.com/arbovm/levenshtein: 48b4e1c
  • github.com/bytecodealliance/wasmtime-go/v44: v44.0.0
  • github.com/containerd/stargz-snapshotter/estargz: v0.18.1
  • github.com/decred/dcrd/crypto/blake256: v1.1.0
  • github.com/dgryski/trifles: f50d829
  • github.com/docker/distribution: v2.8.3
  • github.com/fortytw2/leaktest: v1.3.0
  • github.com/foxcpp/go-mockdns: v1.2.0
  • github.com/frankban/quicktest: v1.14.6
  • github.com/go-chi/chi: v4.1.2
  • github.com/go-ini/ini: v1.67.0
  • github.com/go-jose/go-jose/v3: v3.0.5
  • github.com/go-quicktest/qt: v1.101.0
  • github.com/go-task/slim-sprig: 348f09d
  • github.com/google/cel-go: v0.27.0
  • github.com/gopherjs/gopherjs: fce0ec3
  • github.com/graph-gophers/graphql-go: v1.9.0
  • github.com/grpc-ecosystem/go-grpc-prometheus: 82c2437
  • github.com/hashicorp/go-hclog: v1.6.3
  • github.com/hpcloud/tail: v1.0.0
  • github.com/huandu/go-clone: v1.7.3
  • github.com/huandu/go-sqlbuilder: v1.41.0
  • github.com/jtolds/gls: v4.20.0
  • github.com/letsencrypt/boulder: v0.20260309.0
  • github.com/magiconair/properties: v1.8.10
  • github.com/oklog/ulid: v1.3.1
  • github.com/onsi/ginkgo: v1.16.5
  • github.com/pelletier/go-toml: v1.9.3
  • github.com/peterh/liner: v1.2.2
  • github.com/santhosh-tekuri/jsonschema/v6: v6.0.2
  • github.com/shopspring/decimal: v1.4.0
  • github.com/sigstore/cosign/v2: v2.6.5
  • github.com/smartystreets/assertions: v1.1.0
  • github.com/smartystreets/goconvey: v1.6.4
  • github.com/spf13/jwalterweatherman: v1.1.0
  • github.com/tetratelabs/wazero: v1.11.0
  • github.com/tink-crypto/tink-go-awskms/v2: v2.1.0
  • github.com/titanous/rocacheck: afe7314
  • github.com/vbatts/tar-split: v0.12.2
  • gitlab.com/gitlab-org/api/client-go: v1.46.0
  • go.mongodb.org/mongo-driver: v1.17.6
  • go.opentelemetry.io/contrib/bridges/prometheus: v0.68.0
  • go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc: v1.43.0
  • go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp: v1.43.0
  • go.uber.org/mock: v0.6.0
  • gopkg.in/fsnotify.v1: v1.4.7
  • gopkg.in/tomb.v1: dd63297
  • k8s.io/gengo/v2: ec3ebc5
  • oras.land/oras-go/v2: v2.6.0