Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[FCP-3695] Sync with upstream v1.9.5 #15

Merged
merged 102 commits into from
Jan 17, 2024
Merged

[FCP-3695] Sync with upstream v1.9.5 #15

merged 102 commits into from
Jan 17, 2024

Conversation

wdq
Copy link
Member

@wdq wdq commented Jan 12, 2024 •
edited
Loading

Summary

Solves this Dependabot ticket:

Technical

Merge upstream kubernetes/ingress-nginx changes up to the latest stable version (v1.9.5) into our fork which resolves the security vulnerability.

How was this tested?

  • Tested in dev cluster by building v1.9.5 image, syncing a test branch in fleet-config, and migrating to new ingress node pool to have all of the pods rebuilt with new image.
  • Verified sites work, and that staging sites idle and unidle successfully.

Notes

Related PR:

strongjz and others added 30 commits October 26, 2023 07:34
@strongjz
Update TAG
5a63aaf
@strongjz
Merge pull request kubernetes#10576 from kubernetes/strongjz-patch-1
29a7541 
Update TAG
@dependabot
Bump github.com/prometheus/common from 0.44.0 to 0.45.0 (kubernetes#1…
2b42e3d 
…0547)

Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.44.0 to 0.45.0.
- [Release notes](https://github.com/prometheus/common/releases)
- [Commits](prometheus/common@v0.44.0...v0.45.0)

---
updated-dependencies:
- dependency-name: github.com/prometheus/common
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump google.golang.org/grpc from 1.58.3 to 1.59.0 (kubernetes#10549)
7e7001d 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.58.3 to 1.59.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.58.3...v1.59.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@migg24
Increase HSTS max-age to default to one year (kubernetes#10564)
8c3aeaa
@dependabot
Bump github.com/fsnotify/fsnotify from 1.6.0 to 1.7.0 (kubernetes#10579)
f59738c 
Bumps [github.com/fsnotify/fsnotify](https://github.com/fsnotify/fsnotify) from 1.6.0 to 1.7.0.
- [Release notes](https://github.com/fsnotify/fsnotify/releases)
- [Changelog](https://github.com/fsnotify/fsnotify/blob/main/CHANGELOG.md)
- [Commits](fsnotify/fsnotify@v1.6.0...v1.7.0)

---
updated-dependencies:
- dependency-name: github.com/fsnotify/fsnotify
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@Gacko
Admission Webhook: Truncate name. (kubernetes#10523)
0120a2d
@dependabot
Bump aquasecurity/trivy-action from 0.12.0 to 0.13.0 (kubernetes#10586)
ecbf185 
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.12.0 to 0.13.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@fbd1636...b77b85c)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump ossf/scorecard-action from 2.3.0 to 2.3.1 (kubernetes#10587)
cf156c7 
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.3.0 to 2.3.1.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@483ef80...0864cf1)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@Roberdvs
Fix typo (kubernetes#10594)
b37f860
@pierreozoux
feat(helm): add documentation about metric args (kubernetes#10590)
e805d49 
* feat(helm): add documentation about metric args

This helps documenting this issue:
kubernetes#8233

and relates to this documentation:
https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/monitoring.md#histogram-buckets

* fix
@Gacko
Chart: Improve kubernetes#10539. (kubernetes#10565)
9cb3919 
* Helpers: Align `ingress-nginx.namespace` to `ingress-nginx.name`.

* Templates: Remove quotes.

In alignment to others. Also does not make sense as `namespace` must conform to DNS.

* Admission Webhooks/Validating Webhook: Make use of `ingress-nginx.namespace`.

* KEDA: Remove comment.

* Templates: Add forgotten namespace definitions.
@bodgit
fix: Validate x-forwarded-prefix annotation with RegexPathWithCapture (…
9cdd51d 
…kubernetes#10598)
@simon-wessel
fix: adjust unfulfillable validation check for session-cookie-samesit…
13d95d0 
…e annotation (kubernetes#10600)
@jeremy-cxf @netyaroze
remove unsupported bold release from README (kubernetes#10605)
7f45fab 
Co-authored-by: netyaroze <jeremy@jeremy.cx>
@iamleot
Ignore fake certificate for NGINXCertificateExpiry (kubernetes#10505)
dc659b2 
The fake certificate is only a fallback and it is okay-ish if it
expires.

Do not alert for its expiration.
@tamcore
chart: allow setting allocateLoadBalancerNodePorts (kubernetes#10585)
d6a0f46 
Signed-off-by: Philipp Born <git@pborn.eu>
@rikatz
Separate third party NGINX configuration (kubernetes#10470)
9ed0d7f 
* Document container separation

* Separate configurations
@rikatz
Deprecate opentracing (kubernetes#10615)
30820a5
@iamleot
Comment NGINXCertificateExpiry alert label matcher (kubernetes#10613)
870847a 
If a valid certificate is passed via `--default-ssl-certificate` it is
probably desiderable that we check its expiration!

Add a comment to explain that.
@dependabot
Bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (kubernetes#10625)
63cd83d 
Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.7.0 to 1.8.0.
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](spf13/cobra@v1.7.0...v1.8.0)

---
updated-dependencies:
- dependency-name: github.com/spf13/cobra
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump helm/chart-releaser-action from 1.5.0 to 1.6.0 (kubernetes#10621)
98b8f2e 
Bumps [helm/chart-releaser-action](https://github.com/helm/chart-releaser-action) from 1.5.0 to 1.6.0.
- [Release notes](https://github.com/helm/chart-releaser-action/releases)
- [Commits](helm/chart-releaser-action@be16258...a917fd1)

---
updated-dependencies:
- dependency-name: helm/chart-releaser-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump actions/dependency-review-action from 3.1.0 to 3.1.1 (kubernetes…
c32d426 
…#10619)

Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 3.1.0 to 3.1.1.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@6c5ccda...9f45b24)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump aquasecurity/trivy-action from 0.13.0 to 0.13.1 (kubernetes#10620)
0930782 
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.13.0 to 0.13.1.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@b77b85c...f78e9ec)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/opencontainers/runc from 1.1.9 to 1.1.10 (kubernetes#…
9f92ea2 
…10624)

Bumps [github.com/opencontainers/runc](https://github.com/opencontainers/runc) from 1.1.9 to 1.1.10.
- [Release notes](https://github.com/opencontainers/runc/releases)
- [Changelog](https://github.com/opencontainers/runc/blob/v1.1.10/CHANGELOG.md)
- [Commits](opencontainers/runc@v1.1.9...v1.1.10)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/runc
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@Gacko
Chart: Fix pod selectors in NOTES.txt. (kubernetes#10617)
6499a6b 
Also improve other `kubectl` commands.
@Gacko
Chart: Tighten securityContexts and Pod Security Policies. (kuberne…
8b026f4 
…tes#10491)

* Values: Fix docs of `controller.podSecurityContext` & `controller.sysctls`.

* Values: Add missing `controller.containerSecurityContext`.

Already in use, but has never been added to values.

* Values: Fix docs of `defaultBackend.podSecurityContext` & `defaultBackend.containerSecurityContext`.

* Helpers: Rename `controller.containerSecurityContext` to `ingress-nginx.controller.containerSecurityContext`.

Due to alignment with other templates.

* Helpers: Improve `extraModules`.

- Make `command` a multiline list.
- Fix `toYaml` usage.
- Remove `toYaml` where not necessary.

* Helpers: Move `ingress-nginx.defaultBackend.fullname`.

* Helpers: Add `ingress-nginx.defaultBackend.containerSecurityContext`.

Extracts the default backend `securityContext` into a template, as for the controller.

* Controller: Fix indentation of `controller.podSecurityContext` & `controller.sysctls`.

* Controller: Improve `controller.extraModules` & `controller.opentelemetry`.

- Add `controller.extraModules.distroless` & `controller.extraModules.resources`.
- Add `controller.opentelemetry.name` & `controller.opentelemetry.distroless`.
- Align `extraModules` inclusion for `controller.extraModules` & `controller.opentelemetry`.
- Remove redundant whitespaces.

* Controller/PSP: Align indentation.

* Controller/PSP: Remove quotes.

* Controller/PSP: Improve comments.

* Controller/PSP: Reorder fields.

See https://v1-24.docs.kubernetes.io/docs/concepts/security/pod-security-policy.

* Admission Webhooks: Fix indentation of `controller.admissionWebhooks.patch.securityContext`.

* Admission Webhooks/PSP: Align indentation.

* Admission Webhooks/PSP: Reorder fields.

* Admission Webhooks/PSP: Align condition.

* Admission Webhooks/ClusterRole: Align PSP rule.

* Default Backend/PSP: Align indentation.

* Default Backend/PSP: Reorder fields.

See https://v1-24.docs.kubernetes.io/docs/concepts/security/pod-security-policy.

* Values: Tighten `controller.image`.

Due to recent changes, the controller image can be run without privilege escalation:

- kubernetes#8499
- kubernetes#7449

* Values: Tighten `controller.extraModules.containerSecurityContext`.

* Values: Tighten `controller.opentelemetry.containerSecurityContext`.

* Values: Tighten `controller.admissionWebhooks.*.securityContext`.

Moves the pod `securityContext` to the containers to not interfere with injected containers.

* Values: Tighten `defaultBackend.image`.
@ardikabs
fix(cors): ensure trailing comma treated as empty value to be ignored (…
da51393 
…kubernetes#10616)

* fix(cors): ensure trailing comma treated as empty value to be ignored

Signed-off-by: Ardika Bagus <me@ardikabs.com>

* test(cors): add e2e test

Signed-off-by: Ardika Bagus <me@ardikabs.com>

---------

Signed-off-by: Ardika Bagus <me@ardikabs.com>
@dependabot
Bump actions/dependency-review-action from 3.1.1 to 3.1.2 (kubernetes…
211e8d8 
…#10641)

Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 3.1.1 to 3.1.2.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@9f45b24...fde92ac)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump aquasecurity/trivy-action from 0.13.1 to 0.14.0 (kubernetes#10642)
4ccdf66 
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.13.1 to 0.14.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@f78e9ec...2b6a709)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
clauspruefer and others added 25 commits December 9, 2023 20:31
@clauspruefer
Update Documentation for Client-Cert Authentication misleading kubern…
14d8be4 
…etes#10687 (kubernetes#10705)

* Update README.md

Update / restructure "Client Cert Authentication" Documentation sub-section

* Update README.md

* Update README.md

* Update README.md

* Update README.md

Add openssl subjectAltName and remark for future releases.

* Update README.md

Moved subjectAltName to new topic "Remarks", i think it is not annotation / ingress related

* Update README.md

Typo
@dependabot
Bump aquasecurity/trivy-action from 0.14.0 to 0.16.0 (kubernetes#10746)
737c75d 
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.14.0 to 0.16.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@2b6a709...91713af)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@strongjz
supdate images from golang upgrade (kubernetes#10750)
759ac63
@Gacko
Deployment/DaemonSet: Remove distroless from extraModules templat…
97d4a83 
…ing. (kubernetes#10742)
@pan3793
Docs: Keep title in navbar in upcase (kubernetes#10755)
6ff70f0
@stafot @Gacko
Add more unit tests to helm chart (kubernetes#10731)
be7f508 
* Add more unit tests to helm chart

Signed-off-by: Stavros Foteinopoulos <stafot@gmail.com>

* Apply suggestions from code review

Co-authored-by: Marco Ebert <marco_ebert@icloud.com>

* Apply suggestions from code review

Co-authored-by: Marco Ebert <marco_ebert@icloud.com>

* Apply suggestions from code review

Co-authored-by: Marco Ebert <marco_ebert@icloud.com>

* Use upstream helm-unittest repository

Signed-off-by: Stavros Foteinopoulos <stafot@gmail.com>

* Remove non existing value from controller unittest

Signed-off-by: Stavros Foteinopoulos <stafot@gmail.com>

* fix unit test

Signed-off-by: Stavros Foteinopoulos <stafot@gmail.com>

* Apply suggestions from code review

Co-authored-by: Marco Ebert <marco_ebert@icloud.com>

* Apply suggestions from code review

Co-authored-by: Marco Ebert <marco_ebert@icloud.com>

---------

Signed-off-by: Stavros Foteinopoulos <stafot@gmail.com>
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
@Gacko
CI: Replace chart-testing image by e2e-test-runner. (kubernetes#1…
648cb8b 
…0761)
@AhmedGrati
fix: disable cluster wide controller role permissions (kubernetes#10659)
6c876bb 
Signed-off-by: AhmedGrati <ahmedgrati1999@gmail.com>
@dependabot
Bump golang.org/x/crypto from 0.16.0 to 0.17.0 (kubernetes#10775)
e285680 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.16.0 to 0.17.0.
- [Commits](golang/crypto@v0.16.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@Gacko
Chart: Improve kubernetes#10673.
2f7f4d7
@strongjz
Merge pull request kubernetes#10721 from Gacko/k4as9
97a0483 
Chart: Improve kubernetes#10673.
@dependabot
Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /magefiles (kuberne…
78e6377 
…tes#10774)

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.14.0 to 0.17.0.
- [Commits](golang/crypto@v0.14.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump actions/stale from 8.0.0 to 9.0.0 (kubernetes#10747)
fdebb38 
Bumps [actions/stale](https://github.com/actions/stale) from 8.0.0 to 9.0.0.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@1160a22...28ca103)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@jongwooo
Fix minor typos in bug_report.md (kubernetes#10767)
7e7c213 
Signed-off-by: Jongwoo Han <jongwooo.han@gmail.com>
@dependabot
Bump github/codeql-action from 2 to 3 (kubernetes#10770)
ae53d0c 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2 to 3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Commits](github/codeql-action@v2...v3)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump google.golang.org/grpc from 1.59.0 to 1.60.1 (kubernetes#10777)
b3682ee 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.59.0 to 1.60.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.59.0...v1.60.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@jongwooo
Correct typo from 'gingko' to 'ginkgo' (kubernetes#10780)
0e5681d 
Signed-off-by: Jongwoo Han <jongwooo.han@gmail.com>
@strongjz
release plugin on controller release (kubernetes#10787)
f019bf2 
Signed-off-by: James Strong <strong.james.e@gmail.com>
@Gacko
Chart: Revert verion 4.8.4.
0e12525
@strongjz
Merge pull request kubernetes#10789 from Gacko/o896f
784bf82 
Chart: Revert verion `4.8.4`.
@joshsleeper
fix(labels): use complete labels variable on default-backend deployme…
707a5a0 
…nt (kubernetes#10317)
@sathieu
Add controller.metrics.serviceMonitor.annotations in Helm chart (kube…
9db2eb9 
…rnetes#9677)

Signed-off-by: Mathieu Parent <math.parent@gmail.com>
@strongjz
release 1.9.5 docs
0e47bfb 
Signed-off-by: James Strong <strong.james.e@gmail.com>
@strongjz
Merge pull request kubernetes#10795 from strongjz/release-1.9.5
be46124 
release 1.9.5 docs
@wdq
Merge branch 'main' into controller-v195
29b6695
@wdq wdq marked this pull request as ready for review January 16, 2024 20:50
@wdq wdq requested a review from a team as a code owner January 16, 2024 20:50
@wdq wdq merged commit 35c1813 into main Jan 17, 2024
36 checks passed
@wdq wdq deleted the controller-v195 branch January 17, 2024 15:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@freddyesteban freddyesteban freddyesteban approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone