Create release workable-2.10.0 - #68
Open
mkousteris wants to merge 8 commits into
Open
Conversation
Aikido flagged actions/checkout leaving GITHUB_TOKEN in git config, readable by later steps. None of the jobs push commits, and unit-tests' git fetch works unauthenticated since the repo is public, so the token doesn't need to persist for any checkout in this workflow. #66 (comment)
go build -o external-secrets main.go had no -tags flag. Since v1.x, every provider registration lives behind a Go build constraint (pkg/register/<name>.go: //go:build <name> || all_providers, see AGENTS.md), so a bare go build compiles an empty pkg/register and zero providers register at runtime. Every ClusterSecretStore/SecretStore then fails reconciliation with: could not get provider client: failed to find registered store backend for type: vault, name: <store> Same root cause, same error shape as external-secrets#5807 (webhook provider, `make run` dev build), fixed there for the Makefile/ Tiltfile default in external-secrets#5851 - but that fix never touched Dockerfile.standalone, which still builds with no tags at all. Adds ARG PROVIDER=all_providers (matching the Makefile's own default) and passes it through as -tags, so a plain `docker build -f Dockerfile.standalone .` keeps working out of the box, while `--build-arg PROVIDER=vault` (or any other provider name) still lets you build a slimmer binary.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Address zizmor code-scanning alerts raised on the workable-2.10.0 release PR:
- lint job: disable actions/setup-go cache (cache-poisoning). The workflow
publishes images on workable-* tag pushes, so runtime caches must not be
restored into jobs gating a release.
- Build image: bump docker/build-push-action to v7.3.0. The previous pin
(4f58ea79) was actually v6.9.0 but labelled v6.9.1 (ref-version-mismatch).
v7 breaking changes (Node 24 runtime, removed build-summary envs) do not
affect the inputs used here.
- Push steps: pass the image tag via an IMAGE_TAG env var and reference
shell variables instead of expanding ${{ }} expressions inside run:
(template-injection).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SRE-7669
What
Upgrades external-secrets from
1.3.1to2.10.0by replaying the Workable fork commits on top of upstreamv2.10.0, plus CI workflow hardening to fix the zizmor findings.Workable fork changes (replayed from
workable-1.3.1)providers/v1/vault/symlink.go): applied cleanlyworkable-*tags), CODEOWNERS, Makefile tweaks: conflicts resolved, keeping Workable behaviour and upstream 2.10.0 action pinslintjob: golangci-lint version set explicitly tov2.12.2(upstream removedGOLANGCI_VERSION), matchinghack/tools/go.modDockerfile.standalone:-tags ${PROVIDER}re-applied on top of upstream'sgolang:1.27.0-alpinebuilderPin setup-envtest install to release-0.20: 2.10.0 installs setup-envtest from the pinnedhack/tools/go.modsetup-gocache disabled inlint(cache-poisoning),docker/build-push-action→v7.3.0(old pin was v6.9.0 labelled v6.9.1), image tag passed via env in push steps (template-injection)Main upstream changes (v1.3.1 → v2.10.0)
Breaking / upgrade notes
getHostByNamedropped from template functions (v2.3.0). Review templates using sprig functionsservice-account-tokentargets with the SA-name annotation, andbootstrap.kubernetes.io/tokentargets (v2.4.1)metadataPolicy,conversionStrategy,decodingStrategyare no longer server-side defaulted. Empty meansDefault(v2.9.0), so expect Flux diffs to disappearstartupProbe.useReadinessProbePort/startupProbe.portremoved. RBAC tightened (serviceaccounts/token, scoped RBAC defaults, cert-controller scope).webhook.failurePolicynow also applies to SecretStore webhooksOCIRepositoryusers (needslayerSelector), notGitRepositorysourcesv1served,v1beta1still not served (same as 1.3.1)Chart.yamlat thev2.10.0tag still readsversion: 2.9.0/appVersion: v2.9.0Providers
vault.enableTokenCache, defaultfalse),VaultRolefor TLS cert auth,VaultDynamicSecretparameters from spec, more KV v2 custom metadata, fix for secret data leaking injson.UnmarshalerrorsreplicationLocations, no IMDS fallback with explicit credentials, credentials redacted in logsSecretExists. PushSecret now replaces the whole remote secretGetAllSecrets, environmentsCore / controller
--leader-election-idand configurable lease timings for HA--metrics-auth,--metrics-secure, default off)SyncWindows,CreateOrMergecreation policy, SecretStorerefreshIntervalas a durationBuild/CI (upstream)
1.25.5→1.26.6(go.mod). Standalone image builder isgolang:1.27.0-alpinegcr.io/distroless/static(digest bump)Full upstream changelog: external-secrets/external-secrets@v1.3.1...v2.10.0