Skip to content

Commit ede6d8e

Browse files
csatib02csatib02
authored
chore: update go version and packages (#521)
* chore: bump go version and packages, deps Signed-off-by: Bence Csati <csatib02@gmail.com> chore: bump go version and packages, deps Signed-off-by: Bence Csati <csatib02@gmail.com> bump go version and packages Signed-off-by: Bence Csati <csatib02@gmail.com> bump go version and packages Signed-off-by: Bence Csati <csatib02@gmail.com> bump go version and packages Signed-off-by: Bence Csati <csatib02@gmail.com> bump go version and packages Signed-off-by: Bence Csati <csatib02@gmail.com> bump go version and packages Signed-off-by: Bence Csati <csatib02@gmail.com> bump go version and packages Signed-off-by: Bence Csati <csatib02@gmail.com> * chore: bump +1 Signed-off-by: Bence Csati <csatib02@gmail.com> * chore: +1 Signed-off-by: Bence Csati <csatib02@gmail.com> --------- Signed-off-by: Bence Csati <csatib02@gmail.com>
1 parent ae562bf commit ede6d8e

File tree

16 files changed

+592
-398
lines changed

16 files changed

+592
-398
lines changed

‎.github/workflows/ci.yaml

+1-13
Original file line numberDiff line numberDiff line change
@@ -49,18 +49,6 @@ jobs:
4949
test:
5050
name: Test
5151
runs-on: ubuntu-latest
52-
strategy:
53-
matrix:
54-
vault_version: ["1.11.12", "1.12.8", "1.13.4", "1.14.8"]
55-
56-
services:
57-
vault:
58-
image: hashicorp/vault:${{ matrix.vault_version }}
59-
env:
60-
SKIP_SETCAP: true
61-
VAULT_DEV_ROOT_TOKEN_ID: 227e1cce-6bf7-30bb-2d2a-acc854318caf
62-
ports:
63-
- 8200:8200
6452

6553
steps:
6654
- name: Checkout repository
@@ -226,7 +214,7 @@ jobs:
226214
needs: [artifacts]
227215
strategy:
228216
matrix:
229-
k8s_version: ["v1.24.15", "v1.25.11", "v1.26.6", "v1.27.3"]
217+
k8s_version: ["v1.28.9", "v1.29.4", "v1.30.0"]
230218
# vault_version: ["1.11.12", "1.12.8", "1.13.4", "1.14.8"]
231219

232220
steps:

‎.golangci.yaml

+10-1
Original file line numberDiff line numberDiff line change
@@ -12,16 +12,25 @@ linters-settings:
1212
misspell:
1313
locale: US
1414
nolintlint:
15-
allow-leading-space: false # require machine-readable nolint directives (with no leading space)
1615
allow-unused: false # report any unused nolint directives
1716
require-specific: false # don't require nolint directives to be specific about which linter is being skipped
1817
revive:
1918
confidence: 0
2019

2120
linters:
2221
enable:
22+
- bodyclose
23+
- errcheck
2324
- gci
25+
- gofmt
26+
- gofumpt
2427
- goimports
28+
- gosimple
29+
- ineffassign
2530
- misspell
2631
- nolintlint
2732
- revive
33+
- unconvert
34+
- unparam
35+
- unused
36+
- whitespace

‎Makefile

+16-15
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,10 @@ build: ## Build binary
4444
@mkdir -p build
4545
go build -race -o build/webhook .
4646

47+
.PHONY: artifacts
48+
artifacts: container-image helm-chart
49+
artifacts: ## Build docker image and helm chart
50+
4751
.PHONY: container-image
4852
container-image: ## Build container image
4953
docker build -t ${CONTAINER_IMAGE_REF} .
@@ -53,10 +57,6 @@ helm-chart: ## Build Helm chart
5357
@mkdir -p build
5458
$(HELM_BIN) package -d build/ deploy/charts/vault-secrets-webhook
5559

56-
.PHONY: artifacts
57-
artifacts: container-image helm-chart
58-
artifacts: ## Build docker image and helm chart
59-
6060
##@ Checks
6161

6262
.PHONY: check
@@ -80,7 +80,7 @@ lint: ## Run linters
8080

8181
.PHONY: lint-go
8282
lint-go:
83-
$(GOLANGCI_LINT_BIN) run $(if ${CI},--out-format github-actions,)
83+
$(GOLANGCI_LINT_BIN) run $(if ${CI},--out-format colored-line-number,)
8484

8585
.PHONY: lint-helm
8686
lint-helm:
@@ -94,15 +94,15 @@ lint-docker:
9494
lint-yaml:
9595
$(YAMLLINT_BIN) $(if ${CI},-f github,) --no-warnings .
9696

97+
.PHONY: fmt
98+
fmt: ## Format code
99+
$(GOLANGCI_LINT_BIN) run --fix
100+
97101
.PHONY: license-check
98102
license-check: ## Run license check
99103
$(LICENSEI_BIN) check
100104
$(LICENSEI_BIN) header
101105

102-
.PHONY: fmt
103-
fmt: ## Format code
104-
$(GOLANGCI_LINT_BIN) run --fix
105-
106106
##@ Autogeneration
107107

108108
.PHONY: generate
@@ -119,11 +119,12 @@ deps: bin/golangci-lint bin/licensei bin/kind bin/kurun bin/helm bin/helm-docs
119119
deps: ## Install dependencies
120120

121121
# Dependency versions
122-
GOLANGCI_VERSION = 1.53.3
123-
LICENSEI_VERSION = 0.8.0
124-
KIND_VERSION = 0.20.0
122+
GOLANGCI_LINT_VERSION = 1.61.0
123+
LICENSEI_VERSION = 0.9.0
124+
KIND_VERSION = 0.24.0
125125
KURUN_VERSION = 0.7.0
126-
HELM_DOCS_VERSION = 1.11.0
126+
HELM_VERSION = 3.16.1
127+
HELM_DOCS_VERSION = 1.14.2
127128

128129
# Dependency binaries
129130
GOLANGCI_LINT_BIN := golangci-lint
@@ -149,7 +150,7 @@ endif
149150

150151
bin/golangci-lint:
151152
@mkdir -p bin
152-
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | bash -s -- v${GOLANGCI_VERSION}
153+
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | bash -s -- v${GOLANGCI_LINT_VERSION}
153154

154155
bin/licensei:
155156
@mkdir -p bin
@@ -167,7 +168,7 @@ bin/kurun:
167168

168169
bin/helm:
169170
@mkdir -p bin
170-
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | USE_SUDO=false HELM_INSTALL_DIR=bin bash
171+
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | USE_SUDO=false HELM_INSTALL_DIR=bin DESIRED_VERSION=v$(HELM_VERSION) bash
171172
@chmod +x bin/helm
172173

173174
bin/helm-docs:

‎deploy/charts/vault-secrets-webhook/README.md

+11-11
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ vault.security.banzaicloud.io/vault-skip-verify: "true" # Container is missing T
2020
2121
Be mindful how you reference Vault secrets itself. For KV v2 secrets, you will need to add the `/data/` to the path of the secret.
2222

23-
```
23+
```bash
2424
$ vault kv get kv/rax/test
2525
====== Metadata ======
2626
Key Value
@@ -39,7 +39,7 @@ MYSQL_ROOT_PASSWORD s3cr3t
3939

4040
The secret shown above is referenced like this:
4141

42-
```
42+
```bash
4343
vault:[ENGINE]/data/[SECRET_NAME]#[KEY]
4444
vault:kv/rax/data/test#MYSQL_PASSWORD
4545
```
@@ -71,15 +71,15 @@ kubectl label namespace "${WEBHOOK_NS}" name="${WEBHOOK_NS}"
7171
### Install the chart
7272

7373
```bash
74-
$ helm install vswh --namespace vswh --wait oci://ghcr.io/bank-vaults/helm-charts/vault-secrets-webhook --create-namespace
74+
helm install vswh --namespace vswh --wait oci://ghcr.io/bank-vaults/helm-charts/vault-secrets-webhook --create-namespace
7575
```
7676

7777
### Openshift 4.3
7878

7979
For security reasons, the `runAsUser` must be in the range between 1000570000 and 1000579999. By setting the value of `securityContext.runAsUser` to `""`, OpenShift chooses a valid User.
8080

8181
```bash
82-
$ helm upgrade --namespace vswh --install vswh oci://ghcr.io/bank-vaults/helm-charts/vault-secrets-webhook --set-string securityContext.runAsUser="" --create-namespace
82+
helm upgrade --namespace vswh --install vswh oci://ghcr.io/bank-vaults/helm-charts/vault-secrets-webhook --set-string securityContext.runAsUser="" --create-namespace
8383
```
8484

8585
### About GKE Private Clusters
@@ -138,11 +138,11 @@ The following table lists the configurable parameters of the Helm chart.
138138
| `podAnnotations` | object | `{}` | Extra annotations to add to pod metadata |
139139
| `labels` | object | `{}` | Extra labels to add to the deployment and pods |
140140
| `resources` | object | `{}` | Resources to request for the deployment and pods |
141-
| `nodeSelector` | object | `{}` | Node labels for pod assignment. Check: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
142-
| `tolerations` | list | `[]` | List of node tolerations for the pods. Check: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
143-
| `affinity` | object | `{}` | Node affinity settings for the pods. Check: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ |
144-
| `topologySpreadConstraints` | object | `{}` | TopologySpreadConstraints to add for the pods. Check: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ |
145-
| `priorityClassName` | string | `""` | Assign a PriorityClassName to pods if set. Check: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/ |
141+
| `nodeSelector` | object | `{}` | Node labels for pod assignment. Check: <https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector> |
142+
| `tolerations` | list | `[]` | List of node tolerations for the pods. Check: <https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/> |
143+
| `affinity` | object | `{}` | Node affinity settings for the pods. Check: <https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/> |
144+
| `topologySpreadConstraints` | object | `{}` | TopologySpreadConstraints to add for the pods. Check: <https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/> |
145+
| `priorityClassName` | string | `""` | Assign a PriorityClassName to pods if set. Check: <https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/> |
146146
| `livenessProbe` | object | `{"failureThreshold":3,"initialDelaySeconds":30,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":1}` | Liveness and readiness probes for the webhook container |
147147
| `readinessProbe.failureThreshold` | int | `3` | |
148148
| `readinessProbe.periodSeconds` | int | `10` | |
@@ -162,7 +162,7 @@ The following table lists the configurable parameters of the Helm chart.
162162
| `configMapFailurePolicy` | string | `"Ignore"` | |
163163
| `podsFailurePolicy` | string | `"Ignore"` | |
164164
| `secretsFailurePolicy` | string | `"Ignore"` | |
165-
| `apiSideEffectValue` | string | `"NoneOnDryRun"` | Webhook sideEffect value Check: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#side-effects |
165+
| `apiSideEffectValue` | string | `"NoneOnDryRun"` | Webhook sideEffect value Check: <https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#side-effects> |
166166
| `namespaceSelector` | object | `{}` | Namespace selector to use, will limit webhook scope (K8s version 1.15+) |
167167
| `objectSelector` | object | `{}` | Object selector to use, will limit webhook scope (K8s version 1.15+) |
168168
| `secrets.objectSelector` | object | `{}` | Object selector for secrets (overrides `objectSelector`); Requires K8s 1.15+ |
@@ -192,7 +192,7 @@ The default option is to let helm generate the CA and TLS certificates on deploy
192192

193193
This will renew the certificates on each deployment.
194194

195-
```
195+
```yaml
196196
certificate:
197197
generate: true
198198
```

‎deploy/charts/vault-secrets-webhook/README.md.gotmpl

+5-5
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ vault.security.banzaicloud.io/vault-skip-verify: "true" # Container is missing T
2020

2121
Be mindful how you reference Vault secrets itself. For KV v2 secrets, you will need to add the `/data/` to the path of the secret.
2222

23-
```
23+
```bash
2424
$ vault kv get kv/rax/test
2525
====== Metadata ======
2626
Key Value
@@ -39,7 +39,7 @@ MYSQL_ROOT_PASSWORD s3cr3t
3939

4040
The secret shown above is referenced like this:
4141

42-
```
42+
```bash
4343
vault:[ENGINE]/data/[SECRET_NAME]#[KEY]
4444
vault:kv/rax/data/test#MYSQL_PASSWORD
4545
```
@@ -71,15 +71,15 @@ kubectl label namespace "${WEBHOOK_NS}" name="${WEBHOOK_NS}"
7171
### Install the chart
7272

7373
```bash
74-
$ helm install vswh --namespace vswh --wait oci://ghcr.io/bank-vaults/helm-charts/vault-secrets-webhook --create-namespace
74+
helm install vswh --namespace vswh --wait oci://ghcr.io/bank-vaults/helm-charts/vault-secrets-webhook --create-namespace
7575
```
7676

7777
### Openshift 4.3
7878

7979
For security reasons, the `runAsUser` must be in the range between 1000570000 and 1000579999. By setting the value of `securityContext.runAsUser` to `""`, OpenShift chooses a valid User.
8080

8181
```bash
82-
$ helm upgrade --namespace vswh --install vswh oci://ghcr.io/bank-vaults/helm-charts/vault-secrets-webhook --set-string securityContext.runAsUser="" --create-namespace
82+
helm upgrade --namespace vswh --install vswh oci://ghcr.io/bank-vaults/helm-charts/vault-secrets-webhook --set-string securityContext.runAsUser="" --create-namespace
8383
```
8484

8585
### About GKE Private Clusters
@@ -116,7 +116,7 @@ The default option is to let helm generate the CA and TLS certificates on deploy
116116

117117
This will renew the certificates on each deployment.
118118

119-
```
119+
```yaml
120120
certificate:
121121
generate: true
122122
```

‎deploy/charts/vault-secrets-webhook/values.yaml

+6-6
Original file line numberDiff line numberDiff line change
@@ -154,23 +154,23 @@ labels: {}
154154
resources: {}
155155

156156
# -- Node labels for pod assignment.
157-
# Check: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector
157+
# Check: <https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector>
158158
nodeSelector: {}
159159

160160
# -- List of node tolerations for the pods.
161-
# Check: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
161+
# Check: <https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/>
162162
tolerations: []
163163

164164
# -- Node affinity settings for the pods.
165-
# Check: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
165+
# Check: <https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/>
166166
affinity: {}
167167

168168
# -- TopologySpreadConstraints to add for the pods.
169-
# Check: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/
169+
# Check: <https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/>
170170
topologySpreadConstraints: {}
171171

172172
# -- Assign a PriorityClassName to pods if set.
173-
# Check: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/
173+
# Check: <https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/>
174174
priorityClassName: ""
175175

176176
# -- Liveness and readiness probes for the webhook container
@@ -230,7 +230,7 @@ podsFailurePolicy: Ignore
230230
secretsFailurePolicy: Ignore
231231

232232
# -- Webhook sideEffect value
233-
# Check: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#side-effects
233+
# Check: <https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#side-effects>
234234
apiSideEffectValue: NoneOnDryRun
235235

236236
# -- Namespace selector to use, will limit webhook scope (K8s version 1.15+)

0 commit comments

Comments
 (0)