Merge pull request #37 from cybozu-go/k8s-1.27

Support Kubernetes 1.27
cybozu-go · Jul 5, 2023 · f5ff95b · f5ff95b
2 parents 069f77f + 304150a
commit f5ff95b
Show file tree

Hide file tree

Showing 8 changed files with 171 additions and 549 deletions.
diff --git a/Makefile b/Makefile
@@ -1,4 +1,4 @@
-ENVTEST_K8S_VERSION = 1.25.0
+ENVTEST_K8S_VERSION = 1.27.1
 
 # Set the shell used to bash for better error handling.
 SHELL = /bin/bash

diff --git a/RELEASE.md b/RELEASE.md
@@ -3,60 +3,22 @@ Release procedure
 
 This document describes how to release a new version of pod-security-admission.
 
-Versioning
-----------
+## Labeling
 
-Follow [semantic versioning 2.0.0][semver] to choose the new version number.
-
-Prepare change log entries
---------------------------
-
-Add notable changes since the last release to [CHANGELOG.md](CHANGELOG.md).
-It should look like:
-
-```markdown
-(snip)
-## [Unreleased]
-
-### Added
-- Implement ... (#35)
-
-### Changed
-- Fix a bug in ... (#33)
+Release notes are automatically generated based on PRs included in the release.
+Those PRs are categorized based on the label assigned to them.
+Please refer to `.github/release.yml` for the kind of labels.
 
-### Removed
-- Deprecated `-option` is removed ... (#39)
+## Versioning
 
-(snip)
-```
-
-Bump version
-------------
-
-1. Determine a new version number. Then set `VERSION` variable.
-
-    ```console
-    # Set VERSION and confirm it. It should not have "v" prefix.
-    $ VERSION=x.y.z
-    $ echo $VERSION
-    ```
+Follow [semantic versioning 2.0.0][semver] to choose the new version number.
 
-1. Checkout `main` branch.
-1. Make a branch to release, for example by `git neco dev "bump-$VERSION"`
-1. Edit `CHANGELOG.md` for the new version ([example][]).
-1. Edit `version.go` for the new version.
-1. Edit `config/manager/kustomization.yaml` and update newTag value for the new version.
-1. Commit the change and push it.
+## Bump version
 
-    ```console
-    $ git commit -a -m "Bump version to $VERSION"
-    $ git neco review
-    ```
-1. Merge this branch.
 1. Add a git tag to the main HEAD, then push it.
 
     ```console
-    # Set VERSION again.
+    # Set VERSION and confirm it. It should not have "v" prefix.
     $ VERSION=x.y.z
     $ echo $VERSION
 
@@ -70,14 +32,4 @@ Bump version
     $ git push origin "v$VERSION"
     ```
 
-Now the version is bumped up and the latest container image is uploaded to [quay.io](https://quay.io/cybozu/pod-security-admission).
-
-Publish GitHub release page
----------------------------
-
-Go to https://github.com/cybozu-go/pod-security-admission/releases and edit the tag.
-Finally, press `Publish release` button.
-
-
 [semver]: https://semver.org/spec/v2.0.0.html
-[example]: https://github.com/cybozu-go/etcdpasswd/commit/77d95384ac6c97e7f48281eaf23cb94f68867f79
diff --git a/aqua.yaml b/aqua.yaml
@@ -4,6 +4,6 @@ registries:
   - type: standard
     ref: v4.23.0 # renovate: depName=aquaproj/aqua-registry
 packages:
-  - name: kubernetes-sigs/kustomize@kustomize/v4.5.7
-  - name: kubernetes-sigs/controller-tools/controller-gen@v0.11.3
+  - name: kubernetes-sigs/kustomize@kustomize/v5.1.0
+  - name: kubernetes-sigs/controller-tools/controller-gen@v0.12.0
   - name: goreleaser/goreleaser@v1.19.1
diff --git a/cmd/sub/run.go b/cmd/sub/run.go
@@ -41,7 +41,7 @@ func run(addr string, port int, profs []hooks.SecurityProfile) error {
 
 	// register webhook handlers
 	// admission.NewDecoder never returns non-nil error
-	dec, _ := admission.NewDecoder(scheme)
+	dec := admission.NewDecoder(scheme)
 	wh := mgr.GetWebhookServer()
 	for _, prof := range profs {
 		wh.Register("/mutate-"+prof.Name, hooks.NewPodMutator(mgr.GetClient(), ctrl.Log.WithName("mutate-"+prof.Name), dec, prof))

diff --git a/docs/maintenance.md b/docs/maintenance.md
@@ -0,0 +1,15 @@
+# Maintenance
+
+## How to update supported Kubernetes
+
+pod-security-admission supports the three latest Kubernetes versions.
+If a new Kubernetes is released, please update the following files.
+
+- Update Kubernetes version in `Makefile`.
+- Update `k8s.io/*` and `sigs.k8s.io/controller-runtime` packages version in `go.mod`.
+
+If Kubernetes or controller-runtime API has changed, please fix the relevant source code.
+
+## How to update dependencies
+
+TBD.
diff --git a/go.mod b/go.mod
@@ -3,75 +3,73 @@ module github.com/cybozu-go/pod-security-admission
 go 1.20
 
 require (
-	github.com/go-logr/logr v1.2.3
-	github.com/onsi/ginkgo/v2 v2.8.3
-	github.com/onsi/gomega v1.27.1
-	github.com/spf13/cobra v1.6.1
-	k8s.io/api v0.25.9
-	k8s.io/apimachinery v0.25.9
-	k8s.io/client-go v0.25.9
-	k8s.io/klog/v2 v2.90.0
-	k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5
-	sigs.k8s.io/controller-runtime v0.13.1
+	github.com/go-logr/logr v1.2.4
+	github.com/onsi/ginkgo/v2 v2.11.0
+	github.com/onsi/gomega v1.27.8
+	github.com/spf13/cobra v1.7.0
+	k8s.io/api v0.27.3
+	k8s.io/apimachinery v0.27.3
+	k8s.io/client-go v0.27.3
+	k8s.io/klog/v2 v2.100.1
+	k8s.io/utils v0.0.0-20230505201702-9f6742963106
+	sigs.k8s.io/controller-runtime v0.15.0
 	sigs.k8s.io/yaml v1.3.0
 )
 
 require (
-	github.com/PuerkitoBio/purell v1.1.1 // indirect
-	github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cespare/xxhash/v2 v2.1.2 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/emicklei/go-restful/v3 v3.8.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
 	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
-	github.com/fsnotify/fsnotify v1.5.4 // indirect
-	github.com/go-logr/zapr v1.2.3 // indirect
-	github.com/go-openapi/jsonpointer v0.19.5 // indirect
-	github.com/go-openapi/jsonreference v0.19.5 // indirect
-	github.com/go-openapi/swag v0.19.14 // indirect
-	github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 // indirect
+	github.com/fsnotify/fsnotify v1.6.0 // indirect
+	github.com/go-logr/zapr v1.2.4 // indirect
+	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonreference v0.20.1 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/gnostic v0.5.7-v3refs // indirect
 	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/gofuzz v1.1.0 // indirect
-	github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 // indirect
-	github.com/google/uuid v1.1.2 // indirect
-	github.com/imdario/mergo v0.3.12 // indirect
-	github.com/inconshreveable/mousetrap v1.0.1 // indirect
+	github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/imdario/mergo v0.3.6 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/mailru/easyjson v0.7.6 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/prometheus/client_golang v1.12.2 // indirect
-	github.com/prometheus/client_model v0.2.0 // indirect
-	github.com/prometheus/common v0.32.1 // indirect
-	github.com/prometheus/procfs v0.7.3 // indirect
+	github.com/prometheus/client_golang v1.15.1 // indirect
+	github.com/prometheus/client_model v0.4.0 // indirect
+	github.com/prometheus/common v0.42.0 // indirect
+	github.com/prometheus/procfs v0.9.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/multierr v1.6.0 // indirect
-	go.uber.org/zap v1.21.0 // indirect
-	golang.org/x/net v0.7.0 // indirect
-	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
-	golang.org/x/sys v0.5.0 // indirect
-	golang.org/x/term v0.5.0 // indirect
-	golang.org/x/text v0.7.0 // indirect
-	golang.org/x/time v0.0.0-20220609170525-579cf78fd858 // indirect
-	golang.org/x/tools v0.6.0 // indirect
-	gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
+	go.uber.org/zap v1.24.0 // indirect
+	golang.org/x/net v0.10.0 // indirect
+	golang.org/x/oauth2 v0.5.0 // indirect
+	golang.org/x/sys v0.9.0 // indirect
+	golang.org/x/term v0.8.0 // indirect
+	golang.org/x/text v0.9.0 // indirect
+	golang.org/x/time v0.3.0 // indirect
+	golang.org/x/tools v0.9.3 // indirect
+	gomodules.xyz/jsonpatch/v2 v2.3.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.28.0 // indirect
+	google.golang.org/protobuf v1.30.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.25.0 // indirect
-	k8s.io/component-base v0.25.9 // indirect
-	k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1 // indirect
-	sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
+	k8s.io/apiextensions-apiserver v0.27.2 // indirect
+	k8s.io/component-base v0.27.2 // indirect
+	k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
 )