Skip to content

Releases: hashicorp/vault-secrets-operator

v0.9.0

08 Oct 23:28
08a6e50
Compare
Choose a tag to compare

0.9.0 (October 8th, 2024)

Features:

Fix:

  • VC: update spec.timeout to be a string: GH-906

Improvements:

  • VSS(instant-updates): more stable event watcher: GH-898
  • Bump kube-rbac-proxy to 0.18.1: GH-909

Build:

  • Upgrade controller-gen to 0.16.3: GH-944
  • SEC-090: Automated trusted workflow pinning (2024-08-13): GH-888
  • SEC-090: Automated trusted workflow pinning (2024-08-19): GH-897
  • SEC-090: Automated trusted workflow pinning (2024-09-30): GH-937
  • Use dependabot groups for Go deps: GH-924
  • Conform to IPS-002: GH-947

Dependency Updates:

  • Bump the gomod-backward-compatible group across 1 directory with 14 updates: GH-943
  • Bump golang.org/x/crypto from 0.27.0 to 0.28.0 in the gomod-backward-compatible group: GH-945
  • Bump ubi9/ubi-micro from 9.4-13 to 9.4-15: GH-904
  • Bump ubi9/ubi-minimal from 9.4-1227.1725849298 to 9.4-1227.1726694542: GH-930

v0.8.1

29 Jul 18:44
c97a614
Compare
Choose a tag to compare

0.8.1 (July 29th, 2024)

Improvements:

  • Log build info on startup: GH-872
  • API: Support setting the Vault request timeout on a VaultConnection: GH-862

Fix:

  • Fix: encryption client deadlocking the factory: GH-868
  • Helm(hooks): honor imagePullPolicy and imagePullSecrets: GH-873

Build:

  • SEC-090: Automated trusted workflow pinning (2024-07-22): GH-866
  • SEC-090: Automated trusted workflow pinning (2024-07-17): GH-859

Dependency Updates:

  • Bump github.com/onsi/gomega from 1.33.1 to 1.34.0: GH-874
  • Bump google.golang.org/api from 0.188.0 to 0.189.0: GH-875
  • Bump k8s.io/apiextensions-apiserver from 0.30.2 to 0.30.3: GH-864
  • Bump k8s.io/client-go from 0.30.2 to 0.30.3: GH-865
  • Bump ubi9/ubi-micro from 9.4-9 to 9.4-13: GH-870
  • Bump ubi9/ubi-minimal from 9.4-1134 to 9.4-1194: GH-869

v0.8.0

22 Jul 21:12
ec467b0
Compare
Choose a tag to compare

0.8.0 (July 22nd, 2024)

Important

  • Helm: CRD schema changes are now automatically applied at upgrade time.

    See updating-crds for more details.

  • This release contains CRD schema changes which remove the field validation on most VaultAuth spec fields. That means invalid VaultAuth
    configurations will no longer be handled at resource application time. Please review the VSO logs and K8s
    events when troubleshooting Vault authentication issues.

Features:

Improvements:

  • VPS: add ca.crt from issuing CA for tls secret type: GH-848
  • Helm: support setting VaultAuthGlobalRef on VaultAuth: GH-851
  • Migrate to k8s.io/utils/ptr: GH-856
  • Core: update backoff option docs: GH-801

Fix:

  • VaultAuth: set valid status on VaultAuthGlobal deref error: GH-854
  • VDS: properly handle the clone cache key variant during client callback execution: GH-835
  • Core: delete resource status metrics upon object deletion: GH-815
  • VSS: use a constant backoff on some reconciliation errors: GH-811
  • VDS: work around Vault DB static creds TTL rollover bug: GH-730

Build:

  • CI: bump Vault versions: GH-797

Dependency Updates:

  • Bump cloud.google.com/go/compute/metadata from 0.4.0 to 0.5.0: GH-853
  • Bump github.com/gruntwork-io/terratest from 0.46.16 to 0.47.0: GH-852
  • Bump github.com/hashicorp/go-getter from 1.7.4 to 1.7.5: GH-834
  • Bump github.com/hashicorp/go-retryablehttp from 0.7.1 to 0.7.7: GH-833
  • Bump github.com/hashicorp/go-version from 1.6.0 to 1.7.0: GH-810
  • Bump golang.org/x/crypto from 0.24.0 to 0.25.0: GH-843
  • Bump google.golang.org/api from 0.186.0 to 0.188.0: GH-846
  • Bump google.golang.org/grpc from 1.64.0 to 1.64.1: GH-845
  • Bump k8s.io/api from 0.30.1 to 0.30.2: GH-822
  • Bump k8s.io/apiextensions-apiserver from 0.30.1 to 0.30.2: GH-828
  • Bump k8s.io/client-go from 0.30.1 to 0.30.2: GH-830
  • Bump sigs.k8s.io/controller-runtime from 0.18.3 to 0.18.4: GH-808
  • Bump ubi9/ubi-micro from 9.4-6.1716471860 to 9.4-9: GH-819
  • Bump ubi9/ubi-minimal from 9.4-949.1717074713 to 9.4-1134: GH-820

v0.7.1

30 May 22:35
bf1746f
Compare
Choose a tag to compare

0.7.1 (May 30th, 2024)

Fix:

  • Helm: fix invalid value name for telemetry.serviceMonitor.enabled (#786): GH-790

v0.7.0

27 May 22:51
54dde37
Compare
Choose a tag to compare

0.7.0 (May 27th, 2024)

Important: this release contains CRD schema changes that must be applied manually when deploying VSO with Helm.
Please see updating-crds for more details.

Behavioral changes:

  • Core: Controller logs are now JSON encoded by default.
  • Core: Secret source errors are now retried using an exponential backoff strategy. Previously the backoff was a constant duration with some added jitter.

Features:

  • Core: support argo.Rollout as a rolloutRestartTarget for all secret type custom resources: GH-702
  • Helm: add support for cluster role aggregates: GH-752
  • Helm: adds values for setting VSO logging options: GH-778
  • Helm: add support for configuring strategy on controller deployment : GH-709

Improvements:

  • CachingClientFactory: lock by client cache key: GH-716
  • Transformations: add support for the htpasswd Sprig function: GH-708
  • VPS: skip overwriting tls.crt and tls.key whenever transformation templates are configured: GH-659
  • Core: Use exponential backoff on secret source errors: GH-732

Fix:

  • Core: call VDS callbacks on VaultAuth and VaultConnection changes: GH-739
  • Core: skip LifetimeWatcher validation for non-renewable auth tokens: GH-722
  • Core: disable development logger mode by default: GH-751
  • VSS: that spec.hmacSecretData's value is honoured: GH-753
  • VDS: Selectively log calls to SyncRegistry.Delete(): GH-718

Build:

  • CI: test against vault-1.16.2: GH-715
  • Bump GH actions for node 16 obsolescence: GH-738

Dependency Updates:

  • Bump TF provider versions: GH-737
  • Bump github.com/go-logr/logr from 1.4.1 to 1.4.2: GH-775
  • Bump github.com/hashicorp/go-getter from 1.7.1 to 1.7.4: GH-711
  • Bump github.com/hashicorp/vault/api from 1.12.2 to 1.13.0: GH-725
  • Bump github.com/hashicorp/vault/sdk from 0.12.0 to 0.13.0: GH-773
  • Bump github.com/onsi/gomega from 1.33.0 to 1.33.1: GH-727
  • Bump github.com/prometheus/client_golang from 1.19.0 to 1.19.1: GH-741
  • Bump golang.org/x/crypto from 0.22.0 to 0.23.0: GH-744
  • Bump google.golang.org/api from 0.176.1 to 0.177.0: GH-724
  • Bump google.golang.org/api from 0.180.0 to 0.181.0: GH-758
  • Bump k8s.io/api from 0.30.0 to 0.30.1: GH-761
  • Bump k8s.io/client-go from 0.30.0 to 0.30.1: GH-760
  • Bump sigs.k8s.io/controller-runtime from 0.18.2 to 0.18.3: GH-772
  • Bump ubi9/ubi-micro from 9.3-15 to 9.4-6: GH-719
  • Bump ubi9/ubi-minimal from 9.4-949 to 9.4-949.1714662671: GH-728

v0.6.0

24 Apr 20:42
57b8739
Compare
Choose a tag to compare

Important: this release contains CRD schema changes that must be applied manually when deploying VSO with Helm. Please see updating-crds for more details.

0.6.0 (April 24th, 2024)

Fix:

  • VDS: reconcile instances on lifetimeWatcher done events and other Vault client rotation events: GH-665

Improvements:

  • Core: no longer restore all clients from storage: GH-684
  • Helm: lower min k8s version to 1.21: GH-656

Build:

  • Upgrade to go 1.22.2: GH-683
  • CI: fix tests in GKE: GH-675
  • OLM: remove the skips from the last release: GH-703

Dependency Updates:

  • Bump github.com/cenkalti/backoff/v4 from 4.2.1 to 4.3.0: GH-673
  • Bump github.com/gruntwork-io/terratest from 0.46.11 to 0.46.13: GH-669
  • Bump github.com/hashicorp/go-hclog from 1.6.2 to 1.6.3: GH-679
  • Bump github.com/hashicorp/vault/api from 1.12.1 to 1.12.2: GH-667
  • Bump github.com/hashicorp/vault/sdk from 0.11.1 to 0.12.0: GH-687
  • Bump github.com/onsi/gomega from 1.32.0 to 1.33.0: GH-696
  • Bump github.com/prometheus/client_model from 0.6.0 to 0.6.1: GH-678
  • Bump google.golang.org/api from 0.171.0 to 0.172.0: GH-672
  • Bump k8s.io/client-go from 0.29.2 to 0.29.3: GH-660
  • Bump sigs.k8s.io/controller-runtime from 0.17.2 to 0.17.3: GH-688

v0.5.2

13 Mar 20:44
787f43a
Compare
Choose a tag to compare

0.5.2 (March 13th, 2024)

Improvements:

  • VDS: support configuring an explicit sync delay for non-renewable leases without an explicit TTL: GH-641
  • OLM: add newly required ClusterServiceVersion annotations: GH-628
  • Helm: mention global transformation option env variable: GH-626

Fix:

  • API: make some required bool parameters optional: GH-650
  • VDS: make rotationSchedule status field optional: GH-621
  • VPS: return an error when the PKI secret is nil: GH-636
  • Core: ensure VaultConnection headers are set on the vault client: GH-629

Build:

Dependency Updates:

  • Bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.3: GH-646
  • Bump github.com/go-openapi/runtime from 0.27.1 to 0.28.0: GH-648
  • Bump github.com/go-openapi/strfmt from 0.22.1 to 0.23.0: GH-649
  • Bump github.com/prometheus/client_golang from 1.18.0 to 1.19.0: GH-634
  • Bump github.com/stretchr/testify from 1.8.4 to 1.9.0: GH-633
  • Bump google.golang.org/api from 0.167.0 to 0.169.0: GH-647
  • Bump google.golang.org/protobuf from 1.32.0 to 1.33.0: GH-642
  • Bump sigs.k8s.io/controller-runtime from 0.17.1 to 0.17.2: GH-625
  • Bump ubi9/ubi-micro from 9.3-13 to 9.3-15: GH-640
  • Bump ubi9/ubi-minimal from 9.3-1552 to 9.3-1612: GH-639

v0.5.1

20 Feb 23:09
96c71aa
Compare
Choose a tag to compare

0.5.1 (February 20th, 2024)

Fix:

  • Sync: mitigate potential schema validation failures by only adding finalizers after a status update: GH-609

Dependency Updates:

  • Bump github.com/prometheus/client_model from 0.5.0 to 0.6.0: GH-613
  • Bump google.golang.org/api from 0.163.0 to 0.165.0: GH-614
  • Bump k8s.io/api from 0.29.1 to 0.29.2: GH-612
  • Bump k8s.io/apimachinery from 0.29.1 to 0.29.2: GH-615
  • Bump k8s.io/client-go from 0.29.1 to 0.29.2: GH-611

v0.5.0

15 Feb 21:57
b1229b6
Compare
Choose a tag to compare

0.5.0 (February 15th, 2024)

Important: this release contains CRD schema changes that must be applied manually when deploying VSO with Helm. Please see updating-crds for more details.

KNOWN ISSUES:

  • Upgrades via OperatorHub may fail due to some new required fields in VaultConnection and the Secret types as described in GH-631

Features:

  • Sync: add support for secret data transformation: GH-437

Improvements:

  • Core: set CLI options from VSO_ environment variables: GH-551
  • Sync: Reconcile on secret deletion: GH-587
  • Sync: support excluding _raw from the destination: GH-546
  • Sync: take ownership of an existing destination secret: GH-545
  • Sync: add support for userIDs in VaultPKISecret: GH-552
  • OLM: set OLM bundle to "Seamless Upgrades": GH-581
  • Helm: add annotations to the cleanup job: GH-284
  • Helm: support setting imagePullPolicy: GH-601
  • Helm: support setting VaultAuth allowedNamespaces: GH-602

Fix:

  • Sync: sync HCPVaultSecretsApp on lastGeneration change: GH-591
  • Sync: properly handle secret type changes: GH-605

Build:

  • Install the operator-sdk CLI and check sdk-generate in CI: GH-590
  • Bump some GH action versions: GH-583

Dependency Updates:

  • Bump github.com/go-openapi/runtime from 0.26.2 to 0.27.1: GH-572
  • Bump github.com/google/uuid from 1.5.0 to 1.6.0: GH-570
  • Bump github.com/gruntwork-io/terratest from 0.46.8 to 0.46.11: GH-550
  • Bump github.com/hashicorp/go-secure-stdlib/awsutil from 0.2.3-0.20230606170242-1a4b95565d57 to 0.3.0: GH-579
  • Bump github.com/hashicorp/vault/api from 1.11.0 to 1.12.0: GH-595
  • Bump github.com/hashicorp/vault/sdk from 0.10.2 to 0.11.0: GH-596
  • Bump github.com/onsi/gomega from 1.30.0 to 1.31.1: GH-558
  • Bump google.golang.org/api from 0.161.0 to 0.163.0: GH-594
  • Bump k8s.io/api from 0.29.0 to 0.29.1: GH-556
  • Bump k8s.io/client-go from 0.29.0 to 0.29.1: GH-554
  • Bump sigs.k8s.io/controller-runtime from 0.17.0 to 0.17.1: GH-597
  • Bump ubi9/ubi-micro from 9.3-9 to 9.3-13: GH-566
  • Bump ubi9/ubi-minimal from 9.3-1475 to 9.3-1552: GH-565

v0.4.3

11 Jan 01:45
a38583c
Compare
Choose a tag to compare

0.4.3 (January 10th, 2024)

Fix:

  • Helm: rename and truncate the pre-delete cleanup job to 63 characters: GH-506
  • VDS: remediate deleted destination secret: GH-532
  • Update paused deployment error message: GH-528
  • VC: provide default value for spec.skipTLSVerify: GH-527
  • CCS: ensure invalid storage objects are deleted: GH-525
  • VDS: Log and record Vault request failures: GH-508
  • VPS: Sync on any update: GH-479

Dependency Updates:

  • update go version to fix CVE-2023-45284,CVE-2023-39326,CVE-2023-48795: GH-541
  • Bump google.golang.org/api from 0.154.0 to 0.155.0: GH-542
  • Bump github.com/prometheus/client_golang from 1.17.0 to 1.18.0: GH-540
  • Bump github.com/go-openapi/strfmt from 0.21.9 to 0.22.0: GH-539
  • Bump github.com/go-logr/logr from 1.3.0 to 1.4.1: GH-536
  • Bump golang.org/x/crypto from 0.16.0 to 0.17.0: GH-524
  • Bump k8s.io/client-go from 0.28.4 to 0.29.0: GH-523
  • Bump google.golang.org/api from 0.153.0 to 0.154.0: GH-522
  • Bump github.com/hashicorp/go-hclog from 1.6.1 to 1.6.2: GH-521
  • Bump github.com/google/uuid from 1.4.0 to 1.5.0: GH-520
  • Bump ubi9/ubi-minimal from 9.3-1361.1699548032 to 9.3-1475: GH-516
  • Bump ubi9/ubi-micro from 9.3-6 to 9.3-9: GH-515
  • Bump github.com/go-openapi/strfmt from 0.21.8 to 0.21.9: GH-514
  • Bump github.com/hashicorp/go-hclog from 1.5.0 to 1.6.1: GH-513
  • Bump github.com/go-openapi/runtime from 0.26.0 to 0.26.2: GH-512
  • Bump github.com/gruntwork-io/terratest from 0.46.6 to 0.46.8: GH-497
  • Bump google.golang.org/api from 0.152.0 to 0.153.0: GH-496