🌱 Bump the dependencies group with 2 updates

[dependabot]

Bumps the dependencies group with 2 updates: github.com/vmware-tanzu/velero and sigs.k8s.io/cluster-api-addon-provider-helm.

Updates github.com/vmware-tanzu/velero from 1.13.2 to 1.14.0

Release notes

Sourced from github.com/vmware-tanzu/velero's releases.

v1.14.0-rc.3

v1.14

Download

https://github.com/vmware-tanzu/velero/releases/tag/v1.14.0

Container Image

velero/velero:v1.14.0

Documentation

https://velero.io/docs/v1.14/

Upgrading

https://velero.io/docs/v1.14/upgrade-to-1.14/

Highlights

The maintenance work for kopia/restic backup repositories is run in jobs

Since velero started using kopia as the approach for filesystem-level backup/restore, we've noticed an issue when velero connects to the kopia backup repositories and performs maintenance, it sometimes consumes excessive memory that can cause the velero pod to get OOM Killed. To mitigate this issue, the maintenance work will be moved out of velero pod to a separate kubernetes job, and the user will be able to specify the resource request in "velero install".

Volume Policies are extended to support more actions to handle volumes

In an earlier release, a flexible volume policy was introduced to skip certain volumes from a backup. In v1.14 we've made enhancement to this policy to allow the user to set how the volumes should be backed up. The user will be able to set "fs-backup" or "snapshot" as value of “action" in the policy and velero will backup the volumes accordingly. This enhancement allows the user to achieve a fine-grained control like "opt-in/out" without having to update the target workload. For more details please refer to https://velero.io/docs/v1.14/resource-filtering/#supported-volumepolicy-actions

Node Selection for Data Movement Backup

In velero the data movement flow relies on datamover pods, and these pods may take substantial resources and keep running for a long time. In v1.14, the user will be able to create a configmap to define the eligible nodes on which the datamover pods are launched. For more details refer to https://velero.io/docs/v1.14/data-movement-backup-node-selection/

VolumeInfo metadata for restored volumes

In v1.13, we introduced volumeinfo metadata for backup to help velero CLI and downstream adopter understand how velero handles each volume during backup. In v1.14, similar metadata will be persisted for each restore. velero CLI is also updated to bring more info in the output of "velero restore describe".

"Finalizing" phase is introduced to restores

The "Finalizing" phase is added to the state transition flow to restore, which helps us fix several issues: The labels added to PVs will be restored after the data in the PV is restored via volumesnapshotter. The post restore hook will be executed after datamovement is finished.

Certificate-based authentication support for Azure

Besides the service principal with secret(password)-based authentication, Velero introduces the new support for service principal with certificate-based authentication in v1.14.0. This approach enables you to adopt a phishing resistant authentication by using conditional access policies, which better protects Azure resources and is the recommended way by Azure.

Runtime and dependencies

• Golang runtime: v1.22.2
• kopia: v0.17.0

Limitations/Known issues

• For the external BackupItemAction plugins that take snapshots for PVs, such as vsphere plugin. If the plugin checks the value of the field "snapshotVolumes" in the backup spec as a criteria for snapshot, the settings in the volume policy will not take effect. For example, if the "snapshotVolumes" is set to False in the backup spec, but a volume meets the condition in the volume policy for "snapshot" action, because the plugin will not check the settings in the volume policy, the plugin will not take snapshot for the volume. For more details please refer to #7818

Breaking changes

• CSI plugin has been merged into velero repo in v1.14 release. It will be installed by default as an internal plugin, and should not be installed via "–plugins " parameter in "velero install" command.
• The default resource requests and limitations for node agent are removed in v1.14, to make the node agent pods have the QoS class of "BestEffort", more details please refer to #7391
• There's a change in namespace filtering behavior during backup: In v1.14, when the includedNamespaces/excludedNamespaces fields are not set and the labelSelector/OrLabelSelectors are set in the backup spec, the backup will only include the namespaces which contain the resources that match the label selectors, while in previous releases all namespaces will be included in the backup with such settings. More details refer to #7105
• Patching the PV in the "Finalizing" state may cause the restore to be in "PartiallyFailed" state when the PV is blocked in "Pending" state, while in the previous release the restore may end up being in "Complete" state. For more details refer to #7866

All Changes

• Fix backup log to show error string, not index (#7805, @​piny940)
• Modify the volume helper logic. (#7794, @​blackpiglet)
• Add documentation for extension of volume policy feature (#7779, @​shubham-pampattiwar)
• Surface errors when waiting for backupRepository and timeout occurs (#7762, @​kaovilai)
• Add existingResourcePolicy restore CR validation to controller (#7757, @​kaovilai)
• Fix condition matching in resource modifier when there are multiple rules (#7715, @​27149chen)

... (truncated)

Commits

• 2fc6300 Merge pull request #7860 from blackpiglet/update_e2e_for_1_14
• 200f16e Merge branch 'release-1.14' into update_e2e_for_1_14
• 0d36572 Merge pull request #7876 from reasonerjt/update-release-note-1.14
• 08fea6e Merge branch 'release-1.14' into update-release-note-1.14
• d20bd16 Skip parallel files upload and download test for Restic case.
• bf778c7 Merge pull request #7875 from reasonerjt/fix-restore-crash-1.14
• a650059 Update release note of 1.14
• f61c8b9 Add checks for csisnapshot for vol_info population
• 2136679 Merge pull request #7852 from reasonerjt/fix-7849-1.14
• f6367ca Use PVC to track the CSI snapshot in restore
• Additional commits viewable in compare view

Updates sigs.k8s.io/cluster-api-addon-provider-helm from 0.2.3 to 0.2.4

Release notes

Sourced from sigs.k8s.io/cluster-api-addon-provider-helm's releases.

v0.2.4

What's Changed

• 🌱 Use upstream cluster RESTConfig utility by @​jimmidyson in kubernetes-sigs/cluster-api-addon-provider-helm#248
• 🌱 Add log options from k8s.io/component-base/logs by @​sergeykonkin in kubernetes-sigs/cluster-api-addon-provider-helm#251
• 🐛 Fix OCI client configuration logic by @​jimmidyson in kubernetes-sigs/cluster-api-addon-provider-helm#252
• 🐛 pointer checks if user doesn't specify CASecret by @​faiq in kubernetes-sigs/cluster-api-addon-provider-helm#253

New Contributors

• @​sergeykonkin made their first contribution in kubernetes-sigs/cluster-api-addon-provider-helm#251
• @​faiq made their first contribution in kubernetes-sigs/cluster-api-addon-provider-helm#253

Full Changelog: kubernetes-sigs/cluster-api-addon-provider-helm@v0.2.3...v0.2.4

Commits

• 681ddfa Merge pull request #253 from faiq/fix-null-ptr-checks
• f801efc fix: pointer checks if user doesn't specify CASecret
• a95e8c5 Merge pull request #252 from jimmidyson/jimmi/fix-oci-ca-logic
• d949b28 🐛 Fix OCI client configuration logic
• 5eb79f5 Merge pull request #251 from sergeykonkin/add-log-options
• 689e7b0 add log options from component base
• d0f83a2 Merge pull request #248 from jimmidyson/jimmi/simplify-restconfig
• db42942 🌱 Use upstream cluster RESTConfig utility
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.