From a7d726df12c5f0cbebeb192ef35e770901624019 Mon Sep 17 00:00:00 2001 From: samidbb Date: Wed, 16 Sep 2026 09:39:58 +0200 Subject: [PATCH 1/2] trigger workflow --- apps/grafana/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/grafana/release.yaml b/apps/grafana/release.yaml index 6eb61b23..e5cfe286 100644 --- a/apps/grafana/release.yaml +++ b/apps/grafana/release.yaml @@ -266,4 +266,4 @@ spec: maxUnavailable: 25% prometheus-operator-crds: - enabled: false + enabled: false \ No newline at end of file From 0b9eca4f96a03e826399b2cd011d4ee750004317 Mon Sep 17 00:00:00 2001 From: samidbb Date: Wed, 16 Sep 2026 07:43:31 +0000 Subject: [PATCH 2/2] Update CRDs and render helm templates --- .../ConfigMap-atlantis-repo-config.yml | 2 +- apps/atlantis/manifests/Ingress-atlantis.yml | 2 +- .../PersistentVolumeClaim-atlantis-data.yml | 2 +- apps/atlantis/manifests/Service-atlantis.yml | 2 +- .../manifests/ServiceAccount-atlantis.yml | 2 +- .../manifests/StatefulSet-atlantis.yml | 4 +- apps/external-secrets/crds.yaml | 100 +++--- ...yment-external-secrets-cert-controller.yml | 2 +- .../Deployment-external-secrets-webhook.yml | 2 +- .../manifests/Deployment-external-secrets.yml | 2 +- ...nSet-grafana-k8s-monitoring-alloy-logs.yml | 4 +- apps/keda/crds.yaml | 309 ++++++++++++++++-- .../ClusterRole-keda-operator-webhook.yml | 7 + .../manifests/ClusterRole-keda-operator.yml | 2 + .../Deployment-keda-admission-webhooks.yml | 2 +- ...oyment-keda-operator-metrics-apiserver.yml | 8 +- .../manifests/Deployment-keda-operator.yml | 11 +- .../ServiceAccount-keda-metrics-server.yml | 1 - .../manifests/ServiceAccount-keda-webhook.yml | 1 - .../Deployment-snapshot-controller.yml | 2 +- 20 files changed, 373 insertions(+), 94 deletions(-) diff --git a/apps/atlantis/manifests/ConfigMap-atlantis-repo-config.yml b/apps/atlantis/manifests/ConfigMap-atlantis-repo-config.yml index 423ab00d..4a0488f0 100644 --- a/apps/atlantis/manifests/ConfigMap-atlantis-repo-config.yml +++ b/apps/atlantis/manifests/ConfigMap-atlantis-repo-config.yml @@ -7,7 +7,7 @@ metadata: namespace: atlantis labels: app: atlantis - chart: atlantis-6.10.1 + chart: atlantis-6.11.0 release: atlantis heritage: Helm data: diff --git a/apps/atlantis/manifests/Ingress-atlantis.yml b/apps/atlantis/manifests/Ingress-atlantis.yml index 0722c143..64b15001 100644 --- a/apps/atlantis/manifests/Ingress-atlantis.yml +++ b/apps/atlantis/manifests/Ingress-atlantis.yml @@ -7,7 +7,7 @@ metadata: namespace: atlantis labels: app: atlantis - chart: atlantis-6.10.1 + chart: atlantis-6.11.0 release: atlantis heritage: Helm spec: diff --git a/apps/atlantis/manifests/PersistentVolumeClaim-atlantis-data.yml b/apps/atlantis/manifests/PersistentVolumeClaim-atlantis-data.yml index 0afc05fd..e4108458 100644 --- a/apps/atlantis/manifests/PersistentVolumeClaim-atlantis-data.yml +++ b/apps/atlantis/manifests/PersistentVolumeClaim-atlantis-data.yml @@ -7,7 +7,7 @@ metadata: namespace: atlantis labels: app: atlantis - chart: atlantis-6.10.1 + chart: atlantis-6.11.0 release: atlantis heritage: Helm spec: diff --git a/apps/atlantis/manifests/Service-atlantis.yml b/apps/atlantis/manifests/Service-atlantis.yml index 5b182c66..8cf3051e 100644 --- a/apps/atlantis/manifests/Service-atlantis.yml +++ b/apps/atlantis/manifests/Service-atlantis.yml @@ -7,7 +7,7 @@ metadata: namespace: atlantis labels: app: atlantis - chart: atlantis-6.10.1 + chart: atlantis-6.11.0 release: atlantis heritage: Helm spec: diff --git a/apps/atlantis/manifests/ServiceAccount-atlantis.yml b/apps/atlantis/manifests/ServiceAccount-atlantis.yml index 48171b69..96c1576b 100644 --- a/apps/atlantis/manifests/ServiceAccount-atlantis.yml +++ b/apps/atlantis/manifests/ServiceAccount-atlantis.yml @@ -7,7 +7,7 @@ metadata: namespace: atlantis labels: app: atlantis - chart: atlantis-6.10.1 + chart: atlantis-6.11.0 release: atlantis heritage: Helm annotations: diff --git a/apps/atlantis/manifests/StatefulSet-atlantis.yml b/apps/atlantis/manifests/StatefulSet-atlantis.yml index a60a8ded..633a5436 100644 --- a/apps/atlantis/manifests/StatefulSet-atlantis.yml +++ b/apps/atlantis/manifests/StatefulSet-atlantis.yml @@ -7,7 +7,7 @@ metadata: namespace: atlantis labels: app: atlantis - chart: atlantis-6.10.1 + chart: atlantis-6.11.0 release: atlantis heritage: Helm spec: @@ -24,7 +24,7 @@ spec: release: atlantis annotations: checksum/config: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b - checksum/repo-config: 4ecac17b3cecc865922d12ddc46838eec3df9b6a87240fcff2c4317e139acb87 + checksum/repo-config: 0bde94a4f3c2b27cd978675afa0e5401d4a986f7f8af55a0f424caaf438a73f4 spec: hostNetwork: false serviceAccountName: atlantis diff --git a/apps/external-secrets/crds.yaml b/apps/external-secrets/crds.yaml index 7df2c771..7f03f9b0 100644 --- a/apps/external-secrets/crds.yaml +++ b/apps/external-secrets/crds.yaml @@ -607,15 +607,13 @@ spec: which secret (version/property/..) to fetch. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults to None when omitted. enum: - Auto - Base64 @@ -626,7 +624,6 @@ spec: description: Key is the key used in the Provider, mandatory type: string metadataPolicy: - default: None description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None enum: - None @@ -742,15 +739,13 @@ spec: Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults to None when omitted. enum: - Auto - Base64 @@ -761,7 +756,6 @@ spec: description: Key is the key used in the Provider, mandatory type: string metadataPolicy: - default: None description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None enum: - None @@ -788,15 +782,13 @@ spec: Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults to None when omitted. enum: - Auto - Base64 @@ -1240,13 +1232,15 @@ spec: default: Data description: |- Target specifies where to place the template result. - For Secret resources, common values are: "Data", "Annotations", "Labels". + For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; + any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data". type: string valuesDecodingStrategy: - default: None - description: Used to define a decoding Strategy for the rendered template values. + description: |- + Used to define a decoding Strategy for the rendered template values. + Defaults to None when omitted. enum: - Auto - Base64 @@ -5298,13 +5292,15 @@ spec: default: Data description: |- Target specifies where to place the template result. - For Secret resources, common values are: "Data", "Annotations", "Labels". + For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; + any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data". type: string valuesDecodingStrategy: - default: None - description: Used to define a decoding Strategy for the rendered template values. + description: |- + Used to define a decoding Strategy for the rendered template values. + Defaults to None when omitted. enum: - Auto - Base64 @@ -9649,6 +9645,12 @@ spec: Format: duration string (e.g., "5m", "1h", "30s") type: string type: object + environment: + description: |- + Environment defines the 1Password Environment ID to read variables from. + Environments are read-only: PushSecret, DeleteSecret, and SecretExists return an error when set. + Mutually exclusive with Vault. + type: string integrationInfo: description: |- IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK. @@ -9664,12 +9666,16 @@ spec: type: string type: object vault: - description: Vault defines the vault's name or uuid to access. Do NOT add op:// prefix. This will be done automatically. + description: |- + Vault defines the vault's name or uuid to access. Do NOT add op:// prefix. This will be done automatically. + Mutually exclusive with Environment. type: string required: - auth - - vault type: object + x-kubernetes-validations: + - message: at most one of the fields in [vault environment] may be set + rule: '[has(self.vault),has(self.environment)].filter(x,x==true).size() <= 1' openBao: description: OpenBao configures this store to sync secrets using the OpenBao provider. properties: @@ -16803,15 +16809,13 @@ spec: which secret (version/property/..) to fetch. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults to None when omitted. enum: - Auto - Base64 @@ -16822,7 +16826,6 @@ spec: description: Key is the key used in the Provider, mandatory type: string metadataPolicy: - default: None description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None enum: - None @@ -16938,15 +16941,13 @@ spec: Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults to None when omitted. enum: - Auto - Base64 @@ -16957,7 +16958,6 @@ spec: description: Key is the key used in the Provider, mandatory type: string metadataPolicy: - default: None description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None enum: - None @@ -16984,15 +16984,13 @@ spec: Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults to None when omitted. enum: - Auto - Base64 @@ -17436,13 +17434,15 @@ spec: default: Data description: |- Target specifies where to place the template result. - For Secret resources, common values are: "Data", "Annotations", "Labels". + For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; + any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data". type: string valuesDecodingStrategy: - default: None - description: Used to define a decoding Strategy for the rendered template values. + description: |- + Used to define a decoding Strategy for the rendered template values. + Defaults to None when omitted. enum: - Auto - Base64 @@ -19722,13 +19722,15 @@ spec: default: Data description: |- Target specifies where to place the template result. - For Secret resources, common values are: "Data", "Annotations", "Labels". + For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; + any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data". type: string valuesDecodingStrategy: - default: None - description: Used to define a decoding Strategy for the rendered template values. + description: |- + Used to define a decoding Strategy for the rendered template values. + Defaults to None when omitted. enum: - Auto - Base64 @@ -24191,6 +24193,12 @@ spec: Format: duration string (e.g., "5m", "1h", "30s") type: string type: object + environment: + description: |- + Environment defines the 1Password Environment ID to read variables from. + Environments are read-only: PushSecret, DeleteSecret, and SecretExists return an error when set. + Mutually exclusive with Vault. + type: string integrationInfo: description: |- IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK. @@ -24206,12 +24214,16 @@ spec: type: string type: object vault: - description: Vault defines the vault's name or uuid to access. Do NOT add op:// prefix. This will be done automatically. + description: |- + Vault defines the vault's name or uuid to access. Do NOT add op:// prefix. This will be done automatically. + Mutually exclusive with Environment. type: string required: - auth - - vault type: object + x-kubernetes-validations: + - message: at most one of the fields in [vault environment] may be set + rule: '[has(self.vault),has(self.environment)].filter(x,x==true).size() <= 1' openBao: description: OpenBao configures this store to sync secrets using the OpenBao provider. properties: diff --git a/apps/external-secrets/manifests/Deployment-external-secrets-cert-controller.yml b/apps/external-secrets/manifests/Deployment-external-secrets-cert-controller.yml index 186325a2..502daeab 100644 --- a/apps/external-secrets/manifests/Deployment-external-secrets-cert-controller.yml +++ b/apps/external-secrets/manifests/Deployment-external-secrets-cert-controller.yml @@ -38,7 +38,7 @@ spec: runAsUser: 1000 seccompProfile: type: RuntimeDefault - image: ghcr.io/external-secrets/external-secrets:v2.8.0 + image: ghcr.io/external-secrets/external-secrets:v2.9.0 imagePullPolicy: IfNotPresent args: - certcontroller diff --git a/apps/external-secrets/manifests/Deployment-external-secrets-webhook.yml b/apps/external-secrets/manifests/Deployment-external-secrets-webhook.yml index cf488150..08007923 100644 --- a/apps/external-secrets/manifests/Deployment-external-secrets-webhook.yml +++ b/apps/external-secrets/manifests/Deployment-external-secrets-webhook.yml @@ -38,7 +38,7 @@ spec: runAsUser: 1000 seccompProfile: type: RuntimeDefault - image: ghcr.io/external-secrets/external-secrets:v2.8.0 + image: ghcr.io/external-secrets/external-secrets:v2.9.0 imagePullPolicy: IfNotPresent args: - webhook diff --git a/apps/external-secrets/manifests/Deployment-external-secrets.yml b/apps/external-secrets/manifests/Deployment-external-secrets.yml index 0b6ae2cd..ec0327d6 100644 --- a/apps/external-secrets/manifests/Deployment-external-secrets.yml +++ b/apps/external-secrets/manifests/Deployment-external-secrets.yml @@ -38,7 +38,7 @@ spec: runAsUser: 1000 seccompProfile: type: RuntimeDefault - image: ghcr.io/external-secrets/external-secrets:v2.8.0 + image: ghcr.io/external-secrets/external-secrets:v2.9.0 imagePullPolicy: IfNotPresent args: - --concurrent=1 diff --git a/apps/grafana/manifests/DaemonSet-grafana-k8s-monitoring-alloy-logs.yml b/apps/grafana/manifests/DaemonSet-grafana-k8s-monitoring-alloy-logs.yml index 65bb12bf..8395e4fa 100644 --- a/apps/grafana/manifests/DaemonSet-grafana-k8s-monitoring-alloy-logs.yml +++ b/apps/grafana/manifests/DaemonSet-grafana-k8s-monitoring-alloy-logs.yml @@ -60,10 +60,10 @@ spec: timeoutSeconds: 1 resources: limits: - memory: 384Mi + memory: 512Mi requests: cpu: 50m - memory: 384Mi + memory: 512Mi volumeMounts: - name: config mountPath: /etc/alloy diff --git a/apps/keda/crds.yaml b/apps/keda/crds.yaml index fafc0e62..99556e9d 100644 --- a/apps/keda/crds.yaml +++ b/apps/keda/crds.yaml @@ -3,14 +3,14 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.21.0 labels: app.kubernetes.io/name: keda-operator - helm.sh/chart: keda-2.19.0 + helm.sh/chart: keda-2.20.2 app.kubernetes.io/component: operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: keda-operator - app.kubernetes.io/version: 2.19.0 + app.kubernetes.io/version: 2.20.2 name: cloudeventsources.eventing.keda.sh spec: group: eventing.keda.sh @@ -57,6 +57,9 @@ spec: properties: kind: description: Kind of the resource being referred to. Defaults to TriggerAuthentication. + enum: + - TriggerAuthentication + - ClusterTriggerAuthentication type: string name: type: string @@ -177,14 +180,14 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.21.0 labels: app.kubernetes.io/name: keda-operator - helm.sh/chart: keda-2.19.0 + helm.sh/chart: keda-2.20.2 app.kubernetes.io/component: operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: keda-operator - app.kubernetes.io/version: 2.19.0 + app.kubernetes.io/version: 2.20.2 name: clustercloudeventsources.eventing.keda.sh spec: group: eventing.keda.sh @@ -230,6 +233,9 @@ spec: properties: kind: description: Kind of the resource being referred to. Defaults to TriggerAuthentication. + enum: + - TriggerAuthentication + - ClusterTriggerAuthentication type: string name: type: string @@ -350,14 +356,14 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.21.0 labels: app.kubernetes.io/name: keda-operator - helm.sh/chart: keda-2.19.0 + helm.sh/chart: keda-2.20.2 app.kubernetes.io/component: operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: keda-operator - app.kubernetes.io/version: 2.19.0 + app.kubernetes.io/version: 2.20.2 name: clustertriggerauthentications.keda.sh spec: group: keda.sh @@ -494,6 +500,9 @@ spec: AuthPodIdentity allows users to select the platform native identity mechanism properties: + externalID: + description: ExternalID sets the External ID to be used when assuming an identity. This is only applicable when using AWS pod identity with a RoleArn. + type: string identityAuthorityHost: description: Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set type: string @@ -542,6 +551,7 @@ spec: - name - parameter type: object + minItems: 1 type: array required: - secrets @@ -596,6 +606,9 @@ spec: AuthPodIdentity allows users to select the platform native identity mechanism properties: + externalID: + description: ExternalID sets the External ID to be used when assuming an identity. This is only applicable when using AWS pod identity with a RoleArn. + type: string identityAuthorityHost: description: Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set type: string @@ -638,6 +651,7 @@ spec: - name - parameter type: object + minItems: 1 type: array vaultUri: type: string @@ -727,6 +741,9 @@ spec: AuthPodIdentity allows users to select the platform native identity mechanism properties: + externalID: + description: ExternalID sets the External ID to be used when assuming an identity. This is only applicable when using AWS pod identity with a RoleArn. + type: string identityAuthorityHost: description: Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set type: string @@ -769,6 +786,7 @@ spec: - id - parameter type: object + minItems: 1 type: array required: - secrets @@ -780,6 +798,9 @@ spec: type: string authentication: description: VaultAuthentication contains the list of Hashicorp Vault authentication methods + enum: + - token + - kubernetes type: string credential: description: Credential defines the Hashicorp Vault credentials depending on the authentication method @@ -826,23 +847,76 @@ spec: type: object type: description: VaultSecretType defines the type of vault secret + enum: + - "" + - secretV2 + - secret + - pki type: string required: - key - parameter - path type: object + minItems: 1 type: array required: - address - authentication - secrets type: object + oauth2: + properties: + clientId: + type: string + clientSecret: + properties: + valueFrom: + properties: + secretKeyRef: + properties: + key: + type: string + name: + type: string + required: + - key + - name + type: object + required: + - secretKeyRef + type: object + required: + - valueFrom + type: object + scopes: + items: + type: string + type: array + tokenUrl: + type: string + tokenUrlParams: + additionalProperties: + type: string + type: object + type: + default: clientCredentials + enum: + - clientCredentials + type: string + required: + - clientId + - tokenUrl + - type + type: object podIdentity: description: |- AuthPodIdentity allows users to select the platform native identity mechanism properties: + externalID: + description: ExternalID sets the External ID to be used when assuming an identity. This is only applicable when using AWS pod identity with a RoleArn. + type: string identityAuthorityHost: description: Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set type: string @@ -910,14 +984,14 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.21.0 labels: app.kubernetes.io/name: keda-operator - helm.sh/chart: keda-2.19.0 + helm.sh/chart: keda-2.20.2 app.kubernetes.io/component: operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: keda-operator - app.kubernetes.io/version: 2.19.0 + app.kubernetes.io/version: 2.20.2 name: scaledjobs.keda.sh spec: group: keda.sh @@ -984,6 +1058,7 @@ spec: type: string failedJobsHistoryLimit: format: int32 + minimum: 0 type: integer jobTargetRef: description: JobSpec describes how the job execution will look like. @@ -1060,9 +1135,6 @@ spec: by RFC 1123. All characters trailing the first "/" must be valid HTTP Path characters as defined by RFC 3986. The value cannot exceed 63 characters. This field is immutable. - - This field is beta-level. The job controller accepts setting the field - when the feature gate JobManagedBy is enabled (enabled by default). type: string manualSelector: description: |- @@ -1199,7 +1271,6 @@ spec: it is required that specified type equals the pod condition type. type: string required: - - status - type type: object type: array @@ -3088,7 +3159,9 @@ spec: type: integer type: object resizePolicy: - description: Resources resize policy for the container. + description: |- + Resources resize policy for the container. + This field cannot be set on ephemeral containers. items: description: ContainerResizePolicy represents resource resize policy for the container. properties: @@ -6163,7 +6236,9 @@ spec: type: integer type: object resizePolicy: - description: Resources resize policy for the container. + description: |- + Resources resize policy for the container. + This field cannot be set on ephemeral containers. items: description: ContainerResizePolicy represents resource resize policy for the container. properties: @@ -6924,8 +6999,8 @@ spec: will be made available to those containers which consume them by name. - This is an alpha field and requires enabling the - DynamicResourceAllocation feature gate. + This is a stable field but requires that the + DynamicResourceAllocation feature gate is enabled. This field is immutable. items: @@ -7377,9 +7452,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -8151,7 +8227,7 @@ spec: resources: description: |- resources represents the minimum resources the volume should have. - If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + Users are allowed to specify resource requirements that are lower than previous value but must still be higher than capacity recorded in the status field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources @@ -8986,6 +9062,24 @@ spec: signerName: description: Kubelet's generated CSRs will be addressed to this signer. type: string + userAnnotations: + additionalProperties: + type: string + description: |- + userAnnotations allow pod authors to pass additional information to + the signer implementation. Kubernetes does not restrict or validate this + metadata in any way. + + These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of + the PodCertificateRequest objects that Kubelet creates. + + Entries are subject to the same validation as object metadata annotations, + with the addition that all keys must be domain-prefixed. No restrictions + are placed on values, except an overall size limitation on the entire field. + + Signers should document the keys and values they support. Signers should + deny requests that contain keys they do not recognize. + type: object required: - keyType - signerName @@ -9395,6 +9489,42 @@ spec: x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map + workloadRef: + description: |- + WorkloadRef provides a reference to the Workload object that this Pod belongs to. + This field is used by the scheduler to identify the PodGroup and apply the + correct group scheduling policies. The Workload object referenced + by this field may not exist at the time the Pod is created. + This field is immutable, but a Workload object with the same name + may be recreated with different policies. Doing this during pod scheduling + may result in the placement not conforming to the expected policies. + properties: + name: + description: |- + Name defines the name of the Workload object this Pod belongs to. + Workload must be in the same namespace as the Pod. + If it doesn't match any existing Workload, the Pod will remain unschedulable + until a Workload object is created and observed by the kube-scheduler. + It must be a DNS subdomain. + type: string + podGroup: + description: |- + PodGroup is the name of the PodGroup within the Workload that this Pod + belongs to. If it doesn't match any existing PodGroup within the Workload, + the Pod will remain unschedulable until the Workload object is recreated + and observed by the kube-scheduler. It must be a DNS label. + type: string + podGroupReplicaKey: + description: |- + PodGroupReplicaKey specifies the replica key of the PodGroup to which this + Pod belongs. It is used to distinguish pods belonging to different replicas + of the same pod group. The pod group policy is applied separately to each replica. + When set, it must be a DNS label. + type: string + required: + - name + - podGroup + type: object required: - containers type: object @@ -9415,22 +9545,35 @@ spec: type: object maxReplicaCount: format: int32 + minimum: 1 type: integer minReplicaCount: format: int32 + minimum: 0 type: integer pollingInterval: format: int32 + minimum: 1 type: integer rollout: description: Rollout defines the strategy for job rollouts properties: propagationPolicy: + enum: + - foreground + - background type: string strategy: + enum: + - gradual + - immediate type: string type: object rolloutStrategy: + description: 'Deprecated: Use Rollout.Strategy instead (see https://github.com/kedacore/keda/issues/3596).' + enum: + - gradual + - immediate type: string scalingStrategy: description: ScalingStrategy defines the strategy of Scaling @@ -9441,16 +9584,27 @@ spec: customScalingRunningJobPercentage: type: string multipleScalersCalculation: + enum: + - min + - avg + - sum + - max type: string pendingPodConditions: items: type: string type: array strategy: + enum: + - default + - custom + - accurate + - eager type: string type: object successfulJobsHistoryLimit: format: int32 + minimum: 0 type: integer triggers: items: @@ -9463,6 +9617,9 @@ spec: properties: kind: description: Kind of the resource being referred to. Defaults to TriggerAuthentication. + enum: + - TriggerAuthentication + - ClusterTriggerAuthentication type: string name: type: string @@ -9476,6 +9633,7 @@ spec: name: type: string type: + minLength: 1 type: string useCachedMetrics: type: boolean @@ -9483,6 +9641,7 @@ spec: - metadata - type type: object + minItems: 1 type: array required: - jobTargetRef @@ -9546,14 +9705,14 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.21.0 labels: app.kubernetes.io/name: keda-operator - helm.sh/chart: keda-2.19.0 + helm.sh/chart: keda-2.20.2 app.kubernetes.io/component: operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: keda-operator - app.kubernetes.io/version: 2.19.0 + app.kubernetes.io/version: 2.20.2 name: scaledobjects.keda.sh spec: group: keda.sh @@ -9705,8 +9864,8 @@ spec: and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be triggered when the actual consumption falls below 95Mi or exceeds 101Mi. - This is an alpha field and requires enabling the HPAConfigurableTolerance - feature gate. + This is an beta field and requires the HPAConfigurableTolerance feature + gate to be enabled. pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true type: object @@ -9780,8 +9939,8 @@ spec: and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be triggered when the actual consumption falls below 95Mi or exceeds 101Mi. - This is an alpha field and requires enabling the HPAConfigurableTolerance - feature gate. + This is an beta field and requires the HPAConfigurableTolerance feature + gate to be enabled. pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true type: object @@ -9812,6 +9971,7 @@ spec: type: object cooldownPeriod: format: int32 + minimum: 0 type: integer fallback: description: Fallback is the spec for fallback options @@ -9823,12 +9983,15 @@ spec: - currentReplicas - currentReplicasIfHigher - currentReplicasIfLower + - scalingModifiers type: string failureThreshold: format: int32 + minimum: 0 type: integer replicas: format: int32 + minimum: 0 type: integer required: - failureThreshold @@ -9836,18 +9999,23 @@ spec: type: object idleReplicaCount: format: int32 + minimum: 0 type: integer initialCooldownPeriod: format: int32 + minimum: 0 type: integer maxReplicaCount: format: int32 + minimum: 1 type: integer minReplicaCount: format: int32 + minimum: 0 type: integer pollingInterval: format: int32 + minimum: 1 type: integer scaleTargetRef: description: ScaleTarget holds the reference to the scale target Object @@ -9859,6 +10027,7 @@ spec: kind: type: string name: + minLength: 1 type: string required: - name @@ -9874,6 +10043,9 @@ spec: properties: kind: description: Kind of the resource being referred to. Defaults to TriggerAuthentication. + enum: + - TriggerAuthentication + - ClusterTriggerAuthentication type: string name: type: string @@ -9892,6 +10064,7 @@ spec: name: type: string type: + minLength: 1 type: string useCachedMetrics: type: boolean @@ -9899,11 +10072,15 @@ spec: - metadata - type type: object + minItems: 1 type: array required: - scaleTargetRef - triggers type: object + x-kubernetes-validations: + - message: minReplicaCount must be less than or equal to maxReplicaCount + rule: '!has(self.minReplicaCount) || self.minReplicaCount <= (has(self.maxReplicaCount) ? self.maxReplicaCount : 100)' status: description: ScaledObjectStatus is the status for a ScaledObject resource properties: @@ -10007,14 +10184,14 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.21.0 labels: app.kubernetes.io/name: keda-operator - helm.sh/chart: keda-2.19.0 + helm.sh/chart: keda-2.20.2 app.kubernetes.io/component: operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: keda-operator - app.kubernetes.io/version: 2.19.0 + app.kubernetes.io/version: 2.20.2 name: triggerauthentications.keda.sh spec: group: keda.sh @@ -10148,6 +10325,9 @@ spec: AuthPodIdentity allows users to select the platform native identity mechanism properties: + externalID: + description: ExternalID sets the External ID to be used when assuming an identity. This is only applicable when using AWS pod identity with a RoleArn. + type: string identityAuthorityHost: description: Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set type: string @@ -10196,6 +10376,7 @@ spec: - name - parameter type: object + minItems: 1 type: array required: - secrets @@ -10250,6 +10431,9 @@ spec: AuthPodIdentity allows users to select the platform native identity mechanism properties: + externalID: + description: ExternalID sets the External ID to be used when assuming an identity. This is only applicable when using AWS pod identity with a RoleArn. + type: string identityAuthorityHost: description: Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set type: string @@ -10292,6 +10476,7 @@ spec: - name - parameter type: object + minItems: 1 type: array vaultUri: type: string @@ -10381,6 +10566,9 @@ spec: AuthPodIdentity allows users to select the platform native identity mechanism properties: + externalID: + description: ExternalID sets the External ID to be used when assuming an identity. This is only applicable when using AWS pod identity with a RoleArn. + type: string identityAuthorityHost: description: Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set type: string @@ -10423,6 +10611,7 @@ spec: - id - parameter type: object + minItems: 1 type: array required: - secrets @@ -10434,6 +10623,9 @@ spec: type: string authentication: description: VaultAuthentication contains the list of Hashicorp Vault authentication methods + enum: + - token + - kubernetes type: string credential: description: Credential defines the Hashicorp Vault credentials depending on the authentication method @@ -10480,23 +10672,76 @@ spec: type: object type: description: VaultSecretType defines the type of vault secret + enum: + - "" + - secretV2 + - secret + - pki type: string required: - key - parameter - path type: object + minItems: 1 type: array required: - address - authentication - secrets type: object + oauth2: + properties: + clientId: + type: string + clientSecret: + properties: + valueFrom: + properties: + secretKeyRef: + properties: + key: + type: string + name: + type: string + required: + - key + - name + type: object + required: + - secretKeyRef + type: object + required: + - valueFrom + type: object + scopes: + items: + type: string + type: array + tokenUrl: + type: string + tokenUrlParams: + additionalProperties: + type: string + type: object + type: + default: clientCredentials + enum: + - clientCredentials + type: string + required: + - clientId + - tokenUrl + - type + type: object podIdentity: description: |- AuthPodIdentity allows users to select the platform native identity mechanism properties: + externalID: + description: ExternalID sets the External ID to be used when assuming an identity. This is only applicable when using AWS pod identity with a RoleArn. + type: string identityAuthorityHost: description: Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set type: string diff --git a/apps/keda/manifests/ClusterRole-keda-operator-webhook.yml b/apps/keda/manifests/ClusterRole-keda-operator-webhook.yml index 45743924..b8e44205 100644 --- a/apps/keda/manifests/ClusterRole-keda-operator-webhook.yml +++ b/apps/keda/manifests/ClusterRole-keda-operator-webhook.yml @@ -40,3 +40,10 @@ rules: - limitranges verbs: - list + - apiGroups: + - events.k8s.io + resources: + - events + verbs: + - create + - patch diff --git a/apps/keda/manifests/ClusterRole-keda-operator.yml b/apps/keda/manifests/ClusterRole-keda-operator.yml index c68103a0..8d1b674a 100644 --- a/apps/keda/manifests/ClusterRole-keda-operator.yml +++ b/apps/keda/manifests/ClusterRole-keda-operator.yml @@ -25,6 +25,7 @@ rules: - list - watch - apiGroups: + - events.k8s.io - "" resources: - events @@ -77,6 +78,7 @@ rules: - apps resources: - deployments + - replicasets - statefulsets verbs: - get diff --git a/apps/keda/manifests/Deployment-keda-admission-webhooks.yml b/apps/keda/manifests/Deployment-keda-admission-webhooks.yml index f7c9c155..96c3667b 100644 --- a/apps/keda/manifests/Deployment-keda-admission-webhooks.yml +++ b/apps/keda/manifests/Deployment-keda-admission-webhooks.yml @@ -46,7 +46,7 @@ spec: readOnlyRootFilesystem: true seccompProfile: type: RuntimeDefault - image: "ghcr.io/kedacore/keda-admission-webhooks:2.19.0" + image: "ghcr.io/kedacore/keda-admission-webhooks:2.20.2" command: - /keda-admission-webhooks args: diff --git a/apps/keda/manifests/Deployment-keda-operator-metrics-apiserver.yml b/apps/keda/manifests/Deployment-keda-operator-metrics-apiserver.yml index 1253e7e6..42487e22 100644 --- a/apps/keda/manifests/Deployment-keda-operator-metrics-apiserver.yml +++ b/apps/keda/manifests/Deployment-keda-operator-metrics-apiserver.yml @@ -44,7 +44,7 @@ spec: readOnlyRootFilesystem: true seccompProfile: type: RuntimeDefault - image: "ghcr.io/kedacore/keda-metrics-apiserver:2.19.0" + image: "ghcr.io/kedacore/keda-metrics-apiserver:2.20.2" imagePullPolicy: Always livenessProbe: httpGet: @@ -77,6 +77,12 @@ spec: value: "3000" - name: KEDA_HTTP_MIN_TLS_VERSION value: TLS12 + - name: KEDA_HTTP_TLS_CIPHER_LIST + value: "" + - name: KEDA_SERVICE_MIN_TLS_VERSION + value: TLS13 + - name: KEDA_SERVICE_TLS_CIPHER_LIST + value: "" command: - /keda-adapter args: diff --git a/apps/keda/manifests/Deployment-keda-operator.yml b/apps/keda/manifests/Deployment-keda-operator.yml index c2429032..6dee9895 100644 --- a/apps/keda/manifests/Deployment-keda-operator.yml +++ b/apps/keda/manifests/Deployment-keda-operator.yml @@ -46,7 +46,7 @@ spec: readOnlyRootFilesystem: true seccompProfile: type: RuntimeDefault - image: "ghcr.io/kedacore/keda:2.19.0" + image: "ghcr.io/kedacore/keda:2.20.2" command: - "/keda" args: @@ -65,6 +65,9 @@ spec: - "--k8s-cluster-name=kubernetes-default" - "--k8s-cluster-domain=cluster.local" - "--enable-prometheus-metrics=false" + - "--http-max-idle-conns=0" + - "--http-max-idle-conns-per-host=1000" + - "--http-idle-conn-timeout=90s" imagePullPolicy: Always livenessProbe: httpGet: @@ -105,6 +108,12 @@ spec: value: "3000" - name: KEDA_HTTP_MIN_TLS_VERSION value: TLS12 + - name: KEDA_HTTP_TLS_CIPHER_LIST + value: "" + - name: KEDA_SERVICE_MIN_TLS_VERSION + value: TLS13 + - name: KEDA_SERVICE_TLS_CIPHER_LIST + value: "" volumeMounts: - mountPath: /certs name: certificates diff --git a/apps/keda/manifests/ServiceAccount-keda-metrics-server.yml b/apps/keda/manifests/ServiceAccount-keda-metrics-server.yml index 6e16db24..3eca3b85 100644 --- a/apps/keda/manifests/ServiceAccount-keda-metrics-server.yml +++ b/apps/keda/manifests/ServiceAccount-keda-metrics-server.yml @@ -9,7 +9,6 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: keda-operator app.kubernetes.io/instance: keda - annotations: name: keda-metrics-server namespace: keda automountServiceAccountToken: true diff --git a/apps/keda/manifests/ServiceAccount-keda-webhook.yml b/apps/keda/manifests/ServiceAccount-keda-webhook.yml index 3227aa8d..932ab170 100644 --- a/apps/keda/manifests/ServiceAccount-keda-webhook.yml +++ b/apps/keda/manifests/ServiceAccount-keda-webhook.yml @@ -9,7 +9,6 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: keda-operator app.kubernetes.io/instance: keda - annotations: name: keda-webhook namespace: keda automountServiceAccountToken: true diff --git a/apps/velero/external-snapshotter/manifests/Deployment-snapshot-controller.yml b/apps/velero/external-snapshotter/manifests/Deployment-snapshot-controller.yml index d6e0e08f..f9a67765 100644 --- a/apps/velero/external-snapshotter/manifests/Deployment-snapshot-controller.yml +++ b/apps/velero/external-snapshotter/manifests/Deployment-snapshot-controller.yml @@ -24,7 +24,7 @@ spec: - args: - --v=0 - --leader-election=true - image: registry.k8s.io/sig-storage/snapshot-controller:v8.5.0 + image: registry.k8s.io/sig-storage/snapshot-controller:v8.6.0 imagePullPolicy: IfNotPresent name: snapshot-controller serviceAccountName: snapshot-controller