From ac1bf94465a173a2f7632ecd18c544ae34f7c8a6 Mon Sep 17 00:00:00 2001 From: Aziz Ahmad Date: Thu, 16 Apr 2026 14:57:34 +0100 Subject: [PATCH 1/4] ENH: Bump default Kubernetes image for CAPI clusters to the latest v1.34 release available. --- user-values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user-values.yaml b/user-values.yaml index fabb6ad..87e63a7 100644 --- a/user-values.yaml +++ b/user-values.yaml @@ -25,9 +25,9 @@ controlPlane: # The Kubernetes version of the cluster # This should match the version of kubelet and kubeadm in the image # and will be automatically updated by us -kubernetesVersion: "1.34.3" +kubernetesVersion: "1.34.6" # The name of the image to use for cluster machines -machineImage: "capi-ubuntu-2204-kube-v1.34.3" +machineImage: "capi-ubuntu-2204-kube-v1.34.6" addons: # Monitoring sets up kube-prometheus-stack and loki-stack. From 311d426b858630551cd36c2f5a2dd4f62892603b Mon Sep 17 00:00:00 2001 From: RyanH-STFC Date: Fri, 24 Apr 2026 10:56:35 +0100 Subject: [PATCH 2/4] Change tags to SHAs -Changed the tags from actions to SHAs as it is a defence against supply chain attacks --- .github/workflows/pull-request-actions.yaml | 4 ++-- .github/workflows/update-deps.yaml | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/pull-request-actions.yaml b/.github/workflows/pull-request-actions.yaml index cbbbd62..f67882e 100644 --- a/.github/workflows/pull-request-actions.yaml +++ b/.github/workflows/pull-request-actions.yaml @@ -11,8 +11,8 @@ jobs: name: Shellcheck runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2 - name: Run ShellCheck - uses: ludeeus/action-shellcheck@master + uses:ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 #v2.0.0 with: check_together: 'yes' diff --git a/.github/workflows/update-deps.yaml b/.github/workflows/update-deps.yaml index d0908b9..3cf779a 100644 --- a/.github/workflows/update-deps.yaml +++ b/.github/workflows/update-deps.yaml @@ -18,20 +18,20 @@ jobs: steps: - name: "Setup Github Token" - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 #v3.1.1 id: app-token with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.PRIVATE_KEY }} - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2 with: ref: staging - name: Get latest upstream chart version id: capi-helm-chart - uses: azimuth-cloud/github-actions/helm-latest-version@master + uses: azimuth-cloud/github-actions/helm-latest-version@9ae9839de21f5dd3ede65728eda0019db8b692f5 #v0.23.0 with: repository: "https://azimuth-cloud.github.io/capi-helm-charts" chart: "openstack-cluster" @@ -39,7 +39,7 @@ jobs: # TODO: once azimuth-cloud/capi-helm-charts provides their own pinned k-orc installation method, we pick up the latest version - name: "Get latest Openstack Resource Controller (K-orc) version" id: get-k-orc-version - uses: pozetroninc/github-action-get-latest-release@master + uses: pozetroninc/github-action-get-latest-release@2a61c339ea7ef0a336d1daa35ef0cb1418e7676c #v0.8.0 with: repository: k-orc/openstack-resource-controller excludes: prerelease, draft @@ -60,7 +60,7 @@ jobs: - name: "Create Pull Request for updating dependencies if changed" id: make-pr - uses: peter-evans/create-pull-request@v8 + uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 #v8.1.0 env: pr-title: "Update Build Dependencies to match upstream" with: From 96992c3de50d184a266a48fbd736d179f687f5c6 Mon Sep 17 00:00:00 2001 From: RyanH-STFC Date: Fri, 24 Apr 2026 10:58:01 +0100 Subject: [PATCH 3/4] Add Read only permissions to actions - adding read only permissions as some actions may use token to read the repo and we shouldnt give them write permissions at the same time. --- .github/workflows/pull-request-actions.yaml | 3 +++ .github/workflows/update-deps.yaml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/pull-request-actions.yaml b/.github/workflows/pull-request-actions.yaml index f67882e..5b8071a 100644 --- a/.github/workflows/pull-request-actions.yaml +++ b/.github/workflows/pull-request-actions.yaml @@ -1,4 +1,7 @@ +permissions: +  contents: read + name: Pull Request Jobs on: diff --git a/.github/workflows/update-deps.yaml b/.github/workflows/update-deps.yaml index 3cf779a..a15ac40 100644 --- a/.github/workflows/update-deps.yaml +++ b/.github/workflows/update-deps.yaml @@ -1,4 +1,7 @@ +permissions: +  contents: read + name: Sync Dependencies with upstream on: From 1d500415f8f6d7a8063261b7757ec350775dae8c Mon Sep 17 00:00:00 2001 From: Aziz Ahmad Date: Tue, 19 May 2026 16:24:35 +0100 Subject: [PATCH 4/4] Bump capi image version to the latest available in OpenStack --- user-values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user-values.yaml b/user-values.yaml index 87e63a7..4865134 100644 --- a/user-values.yaml +++ b/user-values.yaml @@ -25,9 +25,9 @@ controlPlane: # The Kubernetes version of the cluster # This should match the version of kubelet and kubeadm in the image # and will be automatically updated by us -kubernetesVersion: "1.34.6" +kubernetesVersion: "1.34.8" # The name of the image to use for cluster machines -machineImage: "capi-ubuntu-2204-kube-v1.34.6" +machineImage: "capi-ubuntu-2204-kube-v1.34.8" addons: # Monitoring sets up kube-prometheus-stack and loki-stack.