ci: bump k8s versions

.github/workflows/build-pr.yml

@@ -16,12 +16,13 @@ jobs:
 
   call_test_e2e_basic:
     name: "run e2e on basic matrix"
+    if: ${{ ! (contains(github.event.pull_request.labels.*.name, 'safe to test') || github.event_name == 'workflow_dispatch') }}
     permissions:
       contents: read
     strategy:
       fail-fast: false
       matrix:
-        KUBERNETES_VERSION: ["1.27.7"]
+        KUBERNETES_VERSION: ["1.29.2"]
         GATEKEEPER_VERSION: ["3.15.0"]
     uses: ./.github/workflows/e2e-k8s.yml 
     with:
@@ -34,7 +35,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        KUBERNETES_VERSION: ["1.26.10", "1.27.7"]
+        KUBERNETES_VERSION: ["1.28.7", "1.29.2"]
         GATEKEEPER_VERSION: ["3.13.0", "3.14.0", "3.15.0"]
     uses: ./.github/workflows/e2e-k8s.yml 
     with:
@@ -50,7 +51,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        KUBERNETES_VERSION: ["1.26.10", "1.27.7"]
+        KUBERNETES_VERSION: ["1.27.9", "1.29.2"]
         GATEKEEPER_VERSION: ["3.13.0", "3.14.0", "3.15.0"]
     uses: ./.github/workflows/e2e-aks.yml
     with:

.github/workflows/e2e-aks.yml

@@ -9,7 +9,7 @@ on:
       k8s_version:
         description: 'Kubernetes version'
         required: true
-        default: '1.27.7'
+        default: '1.29.2'
         type: string
       gatekeeper_version:
         description: 'Gatekeeper version'

.github/workflows/e2e-k8s.yml

@@ -9,7 +9,7 @@ on:
       k8s_version:
         description: 'Kubernetes version'
         required: true
-        default: '1.27.7'
+        default: '1.29.2'
         type: string
       gatekeeper_version:
         description: 'Gatekeeper version'

.github/workflows/high-availability.yml

@@ -27,7 +27,7 @@ jobs:
       contents: read
     strategy:
       matrix:
-        DAPR_VERSION: ["1.11.1"]
+        DAPR_VERSION: ["1.13.2"]
     steps:
       - name: Check out code into the Go module directory
         uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4

.github/workflows/publish-dev-assets.yml

@@ -45,7 +45,7 @@ jobs:
       - name: docker build ratify-crds
         run: |
           docker buildx create --use
-          docker buildx build --build-arg KUBE_VERSION="1.27.7" -f crd.Dockerfile --platform linux/amd64,linux/arm64,linux/arm/v7 --label org.opencontainers.image.revision=${{ github.sha }} -t ${{ steps.prepare.outputs.crdref }}:${{ steps.prepare.outputs.version }} -t ${{ steps.prepare.outputs.crdref }} --push ./charts/ratify/crds
+          docker buildx build --build-arg KUBE_VERSION="1.29.2" -f crd.Dockerfile --platform linux/amd64,linux/arm64,linux/arm/v7 --label org.opencontainers.image.revision=${{ github.sha }} -t ${{ steps.prepare.outputs.crdref }}:${{ steps.prepare.outputs.version }} -t ${{ steps.prepare.outputs.crdref }} --push ./charts/ratify/crds
       - name: docker build ratify base
         run: |
           docker buildx create --use         

.github/workflows/publish-package.yml

@@ -44,7 +44,7 @@ jobs:
       - name: docker build ratify-crds
         run: |
           docker buildx create --use
-          docker buildx build --build-arg KUBE_VERSION="1.27.7" -f crd.Dockerfile --platform linux/amd64,linux/arm64,linux/arm/v7 --label org.opencontainers.image.revision=${{ github.sha }} -t ${{ steps.prepare.outputs.crdref }} --push ./charts/ratify/crds
+          docker buildx build --build-arg KUBE_VERSION="1.29.2" -f crd.Dockerfile --platform linux/amd64,linux/arm64,linux/arm/v7 --label org.opencontainers.image.revision=${{ github.sha }} -t ${{ steps.prepare.outputs.crdref }} --push ./charts/ratify/crds
       - name: docker build ratify base
         run: |
           docker buildx create --use         

.github/workflows/quick-start.yml

@@ -27,7 +27,7 @@ jobs:
       contents: read
     strategy:
       matrix:
-        KUBERNETES_VERSION: ["1.27.7"]
+        KUBERNETES_VERSION: ["1.29.2"]
     steps:
       - name: Checkout
         uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4

.github/workflows/run-full-validation.yml

@@ -26,7 +26,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        KUBERNETES_VERSION: ["1.26.10", "1.27.7"]
+        KUBERNETES_VERSION: ["1.28.7", "1.29.2"]
         GATEKEEPER_VERSION: ["3.13.0", "3.14.0", "3.15.0"]
     uses: ./.github/workflows/e2e-k8s.yml 
     with:
@@ -41,7 +41,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        KUBERNETES_VERSION: ["1.26.10", "1.27.7"]
+        KUBERNETES_VERSION: ["1.27.9", "1.29.2"]
         GATEKEEPER_VERSION: ["3.13.0", "3.14.0", "3.15.0"]
     uses: ./.github/workflows/e2e-aks.yml
     with:

CONTRIBUTING.md

@@ -162,7 +162,7 @@ export REGISTRY=yourregistry
 docker buildx create --use
 
 docker buildx build -f httpserver/Dockerfile --platform linux/amd64 --build-arg build_sbom=true --build-arg build_licensechecker=true --build-arg build_schemavalidator=true --build-arg build_vulnerabilityreport=true -t ${REGISTRY}/deislabs/ratify:yourtag .
-docker build --progress=plain --build-arg KUBE_VERSION="1.27.7" --build-arg TARGETOS="linux" --build-arg TARGETARCH="amd64" -f crd.Dockerfile -t ${REGISTRY}/localbuildcrd:yourtag ./charts/ratify/crds
+docker build --progress=plain --build-arg KUBE_VERSION="1.29.2" --build-arg TARGETOS="linux" --build-arg TARGETARCH="amd64" -f crd.Dockerfile -t ${REGISTRY}/localbuildcrd:yourtag ./charts/ratify/crds
 ```
 
 #### [Authenticate](https://docs.docker.com/engine/reference/commandline/login/#usage) with your registry,  and push the newly built image

Makefile

@@ -26,8 +26,8 @@ LDFLAGS += -X $(GO_PKG)/internal/version.GitTreeState=$(GIT_TREE_STATE)
 LDFLAGS += -X $(GO_PKG)/internal/version.GitTag=$(GIT_TAG)
 
 KIND_VERSION ?= 0.22.0
-KUBERNETES_VERSION ?= 1.27.7
-KIND_KUBERNETES_VERSION ?= 1.27.3
+KUBERNETES_VERSION ?= 1.29.2
+KIND_KUBERNETES_VERSION ?= 1.29.2
 GATEKEEPER_VERSION ?= 3.15.0
 DAPR_VERSION ?= 1.12.5
 COSIGN_VERSION ?= 2.2.3

dev.high-availability.helmfile.yaml

@@ -14,7 +14,7 @@ releases:
     namespace: dapr-system
     createNamespace: true
     chart: dapr/dapr
-    version: 1.11.1
+    version: 1.13.2
     wait: true
   - name: gatekeeper
     namespace: gatekeeper-system

scripts/azure-ci-test.sh

@@ -27,7 +27,7 @@ export AKS_NAME="${AKS_NAME:-ratify-aks-${SUFFIX}}"
 export KEYVAULT_NAME="${KEYVAULT_NAME:-ratify-akv-${SUFFIX}}"
 export USER_ASSIGNED_IDENTITY_NAME="${USER_ASSIGNED_IDENTITY_NAME:-ratify-e2e-identity-${SUFFIX}}"
 export LOCATION="eastus"
-export KUBERNETES_VERSION=${1:-1.27.7}
+export KUBERNETES_VERSION=${1:-1.29.2}
 GATEKEEPER_VERSION=${2:-3.15.0}
 TENANT_ID=$3
 export RATIFY_NAMESPACE=${4:-gatekeeper-system}

terraform/azure/main.tf

@@ -107,7 +107,7 @@ resource "azurerm_kubernetes_cluster" "aks" {
   location                  = azurerm_resource_group.rg.location
   resource_group_name       = azurerm_resource_group.rg.name
   dns_prefix                = "${var.cluster_name}-dns"
-  kubernetes_version        = "1.26.3"
+  kubernetes_version        = "1.29.2"
   workload_identity_enabled = true
   oidc_issuer_enabled       = true