Automates provisioning and generation of secrets in HashiCorp Vault and provides them to your apps

  • By youniqx Identity AG
  • Last update: Dec 15, 2022
  • Comments: 17

Heist

A Kubernetes Operator which takes care of provisioning and managing Secrets in Vault for your Applications. It allows you to define secrets and Vault functionality required by your application directly in your Helm chart! Heist enables declarative configuration of Vault Secrets, thus reduces the overhead to setup an application's secrets. This improves the overall security by discouraging reuse of Engines or Secrets.

It has been designed with Security by Design from the ground up, to make securely managing your applications secrets as easy as possible, while still allowing full hands-off automation right out of the box!

Concepts

Heist is meant to fully automate HashiCorp Vault secret and engine management for an application. It works according to these principles and features:

  • Applications can define secrets and secret engines they require in Kubernetes Custom Kubernetes Resources.
  • Heist integrates and utilizes existing environment and acts as a bridge between Kubernetes and HashiCorp Vault.
  • Heist provisions those secrets and secret engines in HashiCorp Vault. Heist currently supports these HashiCorp Vault engine types:
    • KV Engines
    • Transit Engines
    • PKI
  • Heist sets up Vault policies and roles for the applications to access those secrets and secret engines with their Kubernetes service account.
  • To ensure security and separation of access, Heist expects each Deployment, StatefulSet, etc., to have its own, unique service account.
  • It is possible to define dedicated secrets and secret engines for deployments reducing the overhead to setup an environment. This removes the need to reuse secret engines or even secrets for multiple purposes.
  • Heist isolates things based on their namespace and relies on HashiCorp Vault's authentication and authorization mechanisms to grant access to secrets. Additionally, two namespaces cannot share secrets or secret engines.
  • Heist can encrypt static secrets using a Transit Engine so that they can be securely stored and managed in git. Heist can also auto generate unique, secure random secret values generated by HashiCorp Vault.
  • Heist comes with an agent injector similar to the Vault Agent Injector that automatically handles injecting the secrets defined in the CRDs. This makes consuming any secrets easy and transparent for the application itself.

Roadmap

  • Dynamic secret provisioning

Getting Started

We have the following documentation to get you started with Heist:

CRD Documentation

To get an overview of the full CRD specification and descriptions of each property you can use docs.crds.dev.

Additionally, we also have usage guides:

Differences to existing projects

Bank-Vaults

Banzaicloud's Bank-Vaults helps you setup & maintain vault instances. Heist is primarily intended to manage and provision vault objects (secrets, PKIs, engines, ... ) with Kubernetes resources. Heist also allows you to store transit encrypted secrets in resources directly, which allows you to version the secrets with Git.

Vault Agent Sidecar injection

The official Vault Kubernetes injector can be used to expose vault secrets as files inside a container. It does this by adding another container to the pod that needs the secret and mounts a shared volume in both where the secrets will be stored temporarily. Heist has this functionality too, but also maintains, generates, decrypts already encrypted secrets, and provides access control to vault secrets and other Vault objects.

Contributing

We welcome contributions of any kind! A good starting point for your first pull request is our contribution documentation.

Download

heist.zip

Comments(17)

  • 1

    fix(deps): update module k8s.io/client-go to v11

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | k8s.io/client-go | require | major | v0.25.0 -> v11.0.0+incompatible |

    Release Notes

    kubernetes/client-go

    v11.0.0+incompatible

    Compare Source

    v10.0.0+incompatible

    Compare Source

    v9.0.0+incompatible

    Compare Source

    v8.0.0+incompatible

    Compare Source

    v7.0.0+incompatible

    Compare Source

    v6.0.0+incompatible

    Compare Source

    v5.0.1+incompatible

    Compare Source

    v5.0.0+incompatible

    Compare Source

    v4.0.0+incompatible

    Compare Source

    v3.0.0+incompatible

    Compare Source

    v2.0.0+incompatible

    Compare Source

    v1.5.2

    Compare Source

    v1.5.1

    Compare Source

    v1.5.0

    Compare Source

    v1.4.0

    Compare Source

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about this update again.

    • [ ] If you want to rebase/retry this PR, click this checkbox.

    This PR has been generated by Mend Renovate. View repository job log here.

  • 2

    fix(deps): update module k8s.io/client-go to v1

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | k8s.io/client-go | require | major | v0.25.0 -> v1.5.2 |

    Release Notes

    kubernetes/client-go

    v1.5.2

    Compare Source

    v1.5.1

    Compare Source

    v1.5.0

    Compare Source

    v1.4.0

    Compare Source

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about this update again.

    • [ ] If you want to rebase/retry this PR, click this checkbox.

    This PR has been generated by Mend Renovate. View repository job log here.

  • 3

    fix(deps): update module k8s.io/client-go to v1

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | k8s.io/client-go | require | major | v0.25.0 -> v1.5.2 |

    Release Notes

    kubernetes/client-go

    v1.5.2

    Compare Source

    v1.5.1

    Compare Source

    v1.5.0

    Compare Source

    v1.4.0

    Compare Source

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about this update again.

    • [ ] If you want to rebase/retry this PR, click this checkbox.

    This PR has been generated by Mend Renovate. View repository job log here.

  • 4

    fix(deps): update module k8s.io/client-go to v1

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | k8s.io/client-go | require | major | v0.25.0 -> v1.5.2 |

    Release Notes

    kubernetes/client-go

    v1.5.2

    Compare Source

    v1.5.1

    Compare Source

    v1.5.0

    Compare Source

    v1.4.0

    Compare Source

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about this update again.

    • [ ] If you want to rebase/retry this PR, click this checkbox.

    This PR has been generated by Mend Renovate. View repository job log here.

  • 5

    fix(deps): update module k8s.io/client-go to v1

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | k8s.io/client-go | require | major | v0.25.0 -> v1.5.2 |

    Release Notes

    kubernetes/client-go

    v1.5.2

    Compare Source

    v1.5.1

    Compare Source

    v1.5.0

    Compare Source

    v1.4.0

    Compare Source

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about this update again.

    • [ ] If you want to rebase/retry this PR, click this checkbox.

    This PR has been generated by Mend Renovate. View repository job log here.

  • 6

    fix(deps): update kubernetes packages to v0.25.5

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | k8s.io/api | require | patch | v0.25.4 -> v0.25.5 | | k8s.io/apimachinery | require | patch | v0.25.4 -> v0.25.5 | | k8s.io/client-go | require | patch | v0.25.4 -> v0.25.5 | | k8s.io/code-generator | require | patch | v0.25.4 -> v0.25.5 |

    Release Notes

    kubernetes/api

    v0.25.5

    Compare Source

    kubernetes/apimachinery

    v0.25.5

    Compare Source

    kubernetes/client-go

    v0.25.5

    Compare Source

    kubernetes/code-generator

    v0.25.5

    Compare Source

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about these updates again.

    • [ ] If you want to rebase/retry this PR, check this box

    This PR has been generated by Mend Renovate. View repository job log here.

  • 7

    fix(deps): update module github.com/masterminds/sprig to v3

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | github.com/Masterminds/sprig | require | major | v2.22.0+incompatible -> v3.2.2 |

    Release Notes

    Masterminds/sprig

    v3.2.2

    Compare Source

    This release is here simply to satisfy the Go module system. The code is precisely the same as v3.2.1.

    v3.2.1

    Compare Source

    This is a security release for Masterminds/goutils v1.1.1. See the Security Advisory.

    Changelog

    Release 3.2.1 (2021-02-04)

    Changed

    v3.2.0

    Compare Source

    Added
    Changed
    • Removed testing and support for Go 1.12. ed25519 support requires Go 1.13 or newer
    • Using semver 3.1.1 and mergo 0.3.11
    Fixed

    NOTE: The dependency github.com/imdario/mergo reverted the breaking change in 0.3.9 via 0.3.10 release.

    v3.1.0

    Compare Source

    NOTE: The dependency github.com/imdario/mergo made a behavior change in 0.3.9 that impacts sprig functionality. Do not use sprig with a version newer than 0.3.8.

    Added
    Changed
    Fixed

    v3.0.2

    Compare Source

    Fixed
    • #​220: Updating to semver v3.0.3 to fix issue with <= ranges
    • #​218: fix typo elyptical->elliptic in ecdsa key description (thanks @​laverya)

    v3.0.1

    Compare Source

    Fixed

    • #​212: Updated semver fixing broken constraint checking with ^0.0

    v3.0.0

    Compare Source

    Sprig v3 brings some changes while retaining the same Go API. This should enable projects to migrate to v3 with relative ease.

    You might be wondering, why increment the major version if the Go API didn't break? The reason for that is some edge case behavior changed. Most importantly the use of ^ while handling major version 0 use cases with semver. To be cautious, the major version of sprig was incremented to limit the number of surprises.

    Added
    Changed
    • #​186: Moving dependency management to Go modules
    • #​186: Updated semver to v3. This has changes in the way ^ is handled
    • #​194: Updated documentation on merging and how it copies. Added example using deepCopy
    • #​196: trunc now supports negative values (thanks @​Dean-Coakley)

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about this update again.

    • [ ] If you want to rebase/retry this PR, click this checkbox.

    This PR has been generated by Mend Renovate. View repository job log here.

  • 8

    fix(deps): update module github.com/onsi/gomega to v1.20.2

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | github.com/onsi/gomega | require | patch | v1.20.1 -> v1.20.2 |

    Release Notes

    onsi/gomega

    v1.20.2

    Compare Source

    1.20.2

    Fixes

    • label specs that rely on remote access; bump timeout on short-circuit test to make it less flaky [35eeadf]
    • gexec: allow more headroom for SIGABRT-related unit tests (#​581) [5b78f40]
    • Enable reading from a closed gbytes.Buffer (#​575) [061fd26]

    Maintenance

    • Bump github.com/onsi/ginkgo/v2 from 2.1.5 to 2.1.6 (#​583) [55d895b]
    • Bump github.com/onsi/ginkgo/v2 from 2.1.4 to 2.1.5 (#​582) [346de7c]

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about this update again.

    • [ ] If you want to rebase/retry this PR, click this checkbox.

    This PR has been generated by Mend Renovate. View repository job log here.

  • 9

    fix(deps): update module github.com/masterminds/sprig to v3

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | github.com/Masterminds/sprig | require | major | v2.22.0+incompatible -> v3.2.2 |

    Release Notes

    Masterminds/sprig

    v3.2.2

    Compare Source

    This release is here simply to satisfy the Go module system. The code is precisely the same as v3.2.1.

    v3.2.1

    Compare Source

    This is a security release for Masterminds/goutils v1.1.1. See the Security Advisory.

    Changelog

    Release 3.2.1 (2021-02-04)

    Changed

    v3.2.0

    Compare Source

    Added
    Changed
    • Removed testing and support for Go 1.12. ed25519 support requires Go 1.13 or newer
    • Using semver 3.1.1 and mergo 0.3.11
    Fixed

    NOTE: The dependency github.com/imdario/mergo reverted the breaking change in 0.3.9 via 0.3.10 release.

    v3.1.0

    Compare Source

    NOTE: The dependency github.com/imdario/mergo made a behavior change in 0.3.9 that impacts sprig functionality. Do not use sprig with a version newer than 0.3.8.

    Added
    Changed
    Fixed

    v3.0.2

    Compare Source

    Fixed
    • #​220: Updating to semver v3.0.3 to fix issue with <= ranges
    • #​218: fix typo elyptical->elliptic in ecdsa key description (thanks @​laverya)

    v3.0.1

    Compare Source

    Fixed

    • #​212: Updated semver fixing broken constraint checking with ^0.0

    v3.0.0

    Compare Source

    Sprig v3 brings some changes while retaining the same Go API. This should enable projects to migrate to v3 with relative ease.

    You might be wondering, why increment the major version if the Go API didn't break? The reason for that is some edge case behavior changed. Most importantly the use of ^ while handling major version 0 use cases with semver. To be cautious, the major version of sprig was incremented to limit the number of surprises.

    Added
    Changed
    • #​186: Moving dependency management to Go modules
    • #​186: Updated semver to v3. This has changes in the way ^ is handled
    • #​194: Updated documentation on merging and how it copies. Added example using deepCopy
    • #​196: trunc now supports negative values (thanks @​Dean-Coakley)

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about this update again.

    • [ ] If you want to rebase/retry this PR, click this checkbox.

    This PR has been generated by Mend Renovate. View repository job log here.

  • 10

    fix(deps): update module github.com/onsi/gomega to v1.20.2

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | github.com/onsi/gomega | require | patch | v1.20.1 -> v1.20.2 |

    Release Notes

    onsi/gomega

    v1.20.2

    Compare Source

    1.20.2

    Fixes

    • label specs that rely on remote access; bump timeout on short-circuit test to make it less flaky [35eeadf]
    • gexec: allow more headroom for SIGABRT-related unit tests (#​581) [5b78f40]
    • Enable reading from a closed gbytes.Buffer (#​575) [061fd26]

    Maintenance

    • Bump github.com/onsi/ginkgo/v2 from 2.1.5 to 2.1.6 (#​583) [55d895b]
    • Bump github.com/onsi/ginkgo/v2 from 2.1.4 to 2.1.5 (#​582) [346de7c]

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about this update again.

    • [ ] If you want to rebase/retry this PR, click this checkbox.

    This PR has been generated by Mend Renovate. View repository job log here.

  • 11

    fix(deps): update module github.com/onsi/gomega to v1.20.2

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | github.com/onsi/gomega | require | patch | v1.20.1 -> v1.20.2 |

    Release Notes

    onsi/gomega

    v1.20.2

    Compare Source

    1.20.2

    Fixes

    • label specs that rely on remote access; bump timeout on short-circuit test to make it less flaky [35eeadf]
    • gexec: allow more headroom for SIGABRT-related unit tests (#​581) [5b78f40]
    • Enable reading from a closed gbytes.Buffer (#​575) [061fd26]

    Maintenance

    • Bump github.com/onsi/ginkgo/v2 from 2.1.5 to 2.1.6 (#​583) [55d895b]
    • Bump github.com/onsi/ginkgo/v2 from 2.1.4 to 2.1.5 (#​582) [346de7c]

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about this update again.

    • [ ] If you want to rebase/retry this PR, click this checkbox.

    This PR has been generated by Mend Renovate. View repository job log here.

  • 12

    fix(deps): update module github.com/hashicorp/vault/sdk to v0.6.2

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | github.com/hashicorp/vault/sdk | require | patch | v0.6.1 -> v0.6.2 |

    Release Notes

    hashicorp/vault

    v0.6.2

    Compare Source

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about this update again.

    • [ ] If you want to rebase/retry this PR, check this box

    This PR has been generated by Mend Renovate. View repository job log here.

  • 13

    fix(deps): update module sigs.k8s.io/controller-tools to v0.11.1

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | sigs.k8s.io/controller-tools | require | minor | v0.10.0 -> v0.11.1 |

    Release Notes

    kubernetes-sigs/controller-tools

    v0.11.1

    Compare Source

    What's Changed

    Full Changelog: https://github.com/kubernetes-sigs/controller-tools/compare/v0.11.0...v0.11.1

    v0.11.0

    Compare Source

    What's Changed

    New Contributors

    Full Changelog: https://github.com/kubernetes-sigs/controller-tools/compare/v0.10.0...v0.11.0

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about this update again.

    • [ ] If you want to rebase/retry this PR, check this box

    This PR has been generated by Mend Renovate. View repository job log here.

  • 14

    fix(deps): update module sigs.k8s.io/kustomize/kustomize/v3 to v4

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | sigs.k8s.io/kustomize/kustomize/v3 | require | major | v3.10.0 -> v4.5.7 |

    Release Notes

    kubernetes-sigs/kustomize

    v4.5.7

    Due to an oversight, kustomize v4.5.6 has the golang testing library compiled in unnecessarily. This is a rerelease with the same functionality, but without the unnecessary additional library compiled in.

    Dependency changes

    #​4743: Pin to kyaml v0.13.9 #​4744: pin to cmd/config 0.10.9 #​4745: pin to api v0.12.1

    v4.5.6

    Due to an oversight, kustomize v4.5.6 has the golang testing library compiled in unnecessarily. It is advised that you upgrade to v4.5.7, which doesn't have the testing library compiled in.

    Small features

    #​4704: Option to customize NamespaceTransformer role binding subject handling #​4708: Option to customize NamespaceTransformer overwrite behaviour

    Bug fixes

    #​4700: Correctly detect ambiguity between potential referrers when targeting a name+namespace reference #​4703: Fix NameReference transformer handling of self-references in annotations #​4730: Emit a warning when env loading bug is being relied on #​4667: Replacements: fix issue with create: true option when there is an existing field

    Dependency Changes

    #​4736: Pin to kyaml v0.13.8 #​4737: Pin cmd/config 0.10.8 #​4738: Pin to api v0.12.0 #​4675: Update dependency github.com/xlab/treeprint to v1.1.0

    v4.5.5

    This release is expected to have significant performance improvements for a good portion of inputs, due to #​4568.

    Small features

    #​4209: [Address #​3937] Add labels to template/metadata if includeTemplates is true #​4364: Add tagsuffix to take image tag suffix #​4567: Add support for remote OpenAPI schema

    Bug fixes and performance improvements

    #​4568: openapi parsing performance improvement with protobuffer #​4489: Fix containerized function mounts issue #​4577: Fix error message using replacement wildcard and create option #​4565: Raise error for external generators or transformers

    Dependency changes

    #​4644: Update kyaml to v0.13.7 #​4645: Update cmd/config to v0.10.7 #​4646: Update api to v0.11.5

    v4.5.4

    #​4538: move to google/gnostic v0.5.7-v3refs (required for kubectl integration update) https://github.com/kubernetes-sigs/kustomize/pull/4545: Add more name refs to PodTemplate for ConfigMap and Secret #​4547: Update kyaml to v0.13.6 #​4549: Update cmd/config to v0.10.6 #​4550: Update api to api/v0.11.4

    v4.5.3

    Enhancements

    97de780 Support expanding anchor tags (#​4383) 26b9af0 Allow setting every array element in replacements (https://github.com/kubernetes-sigs/kustomize/pull/4424) d1d578c Support for multiple replacements in a single file (https://github.com/kubernetes-sigs/kustomize/pull/4485)

    Bug Fixes

    7b0ec99 Retain quotes in namespace transformer filter (#​4421) cb80659 Preserve scalar types when using the replacement filter (https://github.com/kubernetes-sigs/kustomize/pull/4494) 7a3c426 Fix image name parsing with tag and digest (https://github.com/kubernetes-sigs/kustomize/pull/4406) 3421fcf bump dependency cobra to pick up latest vulnerability solution

    v4.5.2

    2f17803 Fix regression: Support for pseudo git HTTP urls in the git cloner had broken in 59c8265 (#​4453) b73dfe7 Remove exclude statements from kustomize module (https://github.com/kubernetes-sigs/kustomize/pull/4387)

    v4.5.1

    Known issues:

    a86723c Fix regression #​4388 (introduced in kustomize 4.5.0), which changed the order of resources produced by kustomize build. (#​4445)

    v4.5.0

    Known issues
    New enhancements
    • New field in kustomization, buildMetadata. See docs here.
    • New command kustomize edit add buildmetadata (#​4413)
    • Refactor the PrefixSuffixTransformer into separate prefix- and suffix transformers, enabling the user to use the PrefixTransformer or SuffixTransformer individually in the transformers field. (#​4318)
    • kustomize build ... now completes file paths on ZSH. (#​4310)
    • New command kustomize edit add generator (https://github.com/kubernetes-sigs/kustomize/pull/4361)
    Deprecations
    • 2554d69 Deprecate enable-managedby-label flag in favor of a field (#​4377)

    v4.4.1

    This release restores the Windows binary and introduces ppc64le and s390x binaries.

    b6cb6c8 fix build annotations getting lost after applying JSON 6902 patch (#​4266) d8f406d Fix: replacements entries get source and targets with null value appended (#​4271) ef5f1d3 support label and annotation selection in replacement targets (#​4229) ba051c8 fix issue with quote being dropped in configmap generation (#​4242) 0d8c107 fix issue with openapi schema from components (#​4210)

    v4.4.0

    The headline feature of this release is improved support for YAML anchors and aliases, which will be expanded by default as of this version. (Issue #​3675; PRs #​4114 and #​4187)

    Additional features and fixes include:

    • 12c177a fixes 4123; added length check on originalFields of kustomizationFile to prevent panic when kustomization file began with a comment(or a blank line) followed by a document separator

    v4.3.0

    7b5e43d Feature: Add edit set annotation (#​4073) 0537b59 support yaml formatted openapi schema (#​4017) 1e1b9b4 exec function working dir is the kustomization that referenced it (#​4125) 38b2b33 update openapi to v1.21.2, fixing batch/v1 CronJob patching behavior (#​4112) e1804cb Retain field order after running any arbitrary functions on resources (#​4021) 78737f5 Updated ByteReader to allow white space and comments on the same line after --- and throw an error if anything else is detected (#​4014) 16dcc98 deprecate some cfg commands (#​4048 ) 3350c72 option for origin data as annotation (#​4065) 97e7cb1 remove annotations added by the kyaml reader (#​4091)

    v4.2.0

    New experimental command to automatically migrate vars to replacements: kustomize edit fix —vars. For details, run kustomize edit fix -h. Warning: converting vars to replacements will potentially overwrite many resource files and in rare scenarios may not produce the same output when kustomize build is run. We recommend doing this in a clean git repository where the change is easy to undo.

    a1746f2 Pin to api v0.8.11 bb6f83f Pin to cmd/config v0.9.13 aa92d83 Pin to kyaml (#​4020) 217e5c7 fix openapi command help page 7fae7d1 Move api/filesys to kyaml/filesys (#​3997) c19a972 expose --as-current-user via AddFunctionBasicsFlags 3b37fed convert vars to replacements: mapping value with dot f121e74 convert vars to replacements 24294d3 upgrade json-patch 4.11.0 a3ed120 Handle errors f6e6ac0 Back to development mode; unpin the modules

    v4.1.3

    • New experimental ReplacementTransformer, docs on the way: https://github.com/kubernetes-sigs/cli-experimental/pull/158 (will end up here ) This will replace the vars feature. Thanks @​natasha41575!
    • Fix for #​3705 (use k8s.io/kube-openapi instead of github.com/go-openapi/spec). Thanks @​gautierdelorme!
    • Allow pulls of openapi data from live API servers (openapi fetch command). Thanks @​natasha41575!
    • Remote git urls can specify a timeout parameter. Thanks to @​joshdk!
    • More examples of helm usage.
    • Speed up cluster-scoped type checks.
    • API changes towards 1.0
      • Gvk and Resid types moved to kyaml
      • Resource now inlines RNode rather than delegating to it
      • Resmap now accepts an kio.Filter visitor (that can change the ResMap size).

    afaf7c6 Pin to api v0.8.10 c24daec Pin to cmd/config v0.9.12 51605be Pin to kyaml v0.10.20 3f3d3b1 Replace pkger with embed.FS compatibility dca13a4 use assert statements for kustomize edit tests 3cf18ad fix test 2bec25b add new fields to ordered fields 6608472 Simplify gvk, speed up cluster-scoped checks. a4db686 Unpin everything. 5a8a4d4 More pinning. 1235047 Establish pin state. 1e7260b Pin to cmd/config v0.9.11 3a508da Pin to kyaml/v0.10.18 45fc670 update openapi fetch command bcbfa06 remove go-openapi/spec,validate,strfmt from kustomize/ 38e9c34 Back to dev mode; unpin the modules.

    v4.1.2

    This is a patch release to downgrade a dependency on github.com/imdario/mergo from v0.3.7 to v0.3.5. This is to avoid forcing downstream kubernetes to use a newer version of mergo than it currently has.

    End users of the CLI can stay with v4.1.0. See that release for user-facing changes.

    3f2b98f Pin to api v0.8.8 5ba45f1 Back to mergo v0.3.5 d8015d3 Back to development mode; unpin the modules

    v4.1.1

    This is a patch release to downgrade a dependency on github.com/imdario/mergo from v0.3.12 to v0.3.7.

    The newer version of mergo appears to cause a test failure in client-go, so we'll keep mergo dependencies lower than latest for now.

    59af495 Pin to api v0.8.7 162b8f3 Unpin the api

    v4.1.0

    Patch kind and metadata/name

    A patch can now change the kind or name of a resource, e.g. a Deployment can become a StatefulSet.

    These fields used to be a primary key for patch targetting, and thus couldn't be patched.

    See examples in the feature's patch regression coverage.

    labels without selectors

    A new labels field allows adding labels without also automatically injecting corresponding selectors:

    labels:
  pairs
    fruit: peach
    car: model-T
  includeSelectors: true # <-- false by default

    This can be used instead of the commonLabels field, which always adds selectors.

    Updated helm generator

    kustomize can use the helm command line to inflate charts as a resource generator, allowing a helm chart to define the base of any number of variants.

    The kustomization.yaml file has two new fields:

    helmGlobals *HelmGlobals  // helm config that's not chart specific.
helmCharts []HelmChart    // Chart instances.

    These fields are documented in helmchartargs.go.

    These fields replace the deprecated but still functional helmChartInflationGenerator field, which combined the above data and offered two fields that must now be ignored: helmBin and extraArgs. These latter fields are risky for people who already engage in the risky behavior of using remote configuration that they do not control.

    To use a helm chart as a kustomization base, define values for these fields and run:

    kustomize build --enable-helm {target}

    The --enable-helm flag is new, and required to allow kustomize to run a helm subprocess.

    Look here for a complete helm example.

    Requires user to have helm v3 installed.

    Use a custom OpenAPI schema file

    Kustomize uses OpenAPI data to get information about merge keys.

    To use a custom schema, specify what file to use via the openapi field.

    See the custom OpenAPI example for details.

    Misc issues fixed/touched
    • #​1009 support for common labels that don't get set on selectors
    • #​3394 allow patch removal of emptyDir{}
    • #​3620 disappearing ports
    • #​2825 CRD custom schema parsing
    Commits

    See the api v0.8.6 release notes for more commits in this version.

    e3ce616 Pin to api v0.8.6 6a708bc Pin to cmd/config v0.9.10 88911bb Pin to [email protected] 240cda0 Add flag --enable-helm aa5b481 upgrade to helm 3.5.4 and imdario/mergo v0.3.12 c632880 Pin to kyaml v0.10.16 3255c73 Loader FS and empty env fix ccb95ab add conflict check e77c284 Do no require exec/go plugin home to use fn plugins 5ed2067 Add labels field to kustomization 123a5d6 Remove the wrappy layer. f96ac2d allow general name and kind changes via an options field in patches ddfb4ff Unpin all modules (back to dev mode). e2e4950 Take provenance version into account for build test

    v4.0.5

    Candidate for kubectl integration

    4d66f9a Pin to api v0.8.5 243e7cc Pin to cmd/config v0.9.7 711b4ff Pin to kyaml v0.10.15

    a8b851f Reinstate configmap/secret generator env field (kustomization struct compatibility with v2.0.1) f3a958b Extract flags that enable alpha function features (no starlark) 60bd8d1 upgraded to yaml.v2 v2.4.0 e9c97a4 updated go version to 1.16 722b013 return error for duplicate keys rather than panicking

    v4.0.4

    To facilitate kubectl integration, update generated code and deps. No change in behavior.

    29bfdfc Pin to api v0.8.4 a45e90b Pin to cmd/config v0.9.5 4a2ed90 Pin to kyaml v0.10.13 be8d60f Unpin kyaml, cmd/config and api.

    v4.0.3

    Removed some code generation markers from copied code.

    7965195 Pin to api api/v0.8.3 03c77ce Pin to cmd/config v0.9.4 821b14b Pin to kyaml v0.10.12

    v4.0.2

    This release trims some unnecessary dependencies from kustomize, and pins to a version of kyaml that likewise has trimmed deps, to facilitate reintegration with kubectl.

    c9d9348 Drop commands replacement from go.mod 3da90db Pin to api v0.8.2 2b9c69f Pin to cmd/config v0.9.3 f96dfb5 Pin to kyaml v0.10.11 cd2b0fc Remove tool deps from shippable modules. 316e431 added experimental openapi fetch command to get schema from local cluster c04cf01 fix test 5614852 fix edit commands remove metadata c7a504c Add 4.0.1 to example tests and unpin.

    v4.0.1

    In flags, convert underscores to hyphens to be compatible with kubectl.

    These v4 flags are now incompatible with v3.

    81562a7 Pin for kustomize/v4.0.1 release. 6cf4844 Hyphenate flags and add more build command tests. d7b2945 Back to development mode; unpin the modules

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about this update again.

    • [ ] If you want to rebase/retry this PR, check this box

    This PR has been generated by Mend Renovate. View repository job log here.

  • 15

    fix(deps): update module github.com/onsi/ginkgo to v2

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | github.com/onsi/ginkgo | require | major | v1.16.5 -> v2.6.1 |

    Release Notes

    onsi/ginkgo

    v2.6.1

    Compare Source

    2.6.1

    Features
    • Override formatter colors from envvars - this is a new feature but an alternative approach involving config files might be taken in the future (#​1095) [60240d1]
    Fixes
    • GinkgoRecover now supports ignoring panics that match a specific, hidden, interface [301f3e2]
    Maintenance

    v2.6.0

    Compare Source

    2.6.0

    Features
    • ReportBeforeSuite provides access to the suite report before the suite begins.
    • Add junit config option for omitting leafnodetype (#​1088) [956e6d2]
    • Add support to customize junit report config to omit spec labels (#​1087) [de44005]
    Fixes
    • Fix stack trace pruning so that it has a chance of working on windows [2165648]

    v2.5.1

    Compare Source

    2.5.1

    Fixes
    Maintenance

    v2.5.0

    Compare Source

    2.5.0

    Ginkgo output now includes a timeline-view of the spec

    This commit changes Ginkgo's default output. Spec details are now presented as a timeline that includes events that occur during the spec lifecycle interleaved with any GinkgoWriter content. This makes is much easier to understand the flow of a spec and where a given failure occurs.

    The --progress, --slow-spec-threshold, --always-emit-ginkgo-writer flags and the SuppressProgressReporting decorator have all been deprecated. Instead the existing -v and -vv flags better capture the level of verbosity to display. However, a new --show-node-events flag is added to include node > Enter and < Exit events in the spec timeline.

    In addition, JUnit reports now include the timeline (rendered with -vv) and custom JUnit reports can be configured and generated using GenerateJUnitReportWithConfig(report types.Report, dst string, config JunitReportConfig)

    Code should continue to work unchanged with this version of Ginkgo - however if you have tooling that was relying on the specific output format of Ginkgo you may run into issues. Ginkgo's console output is not guaranteed to be stable for tooling and automation purposes. You should, instead, use Ginkgo's JSON format to build tooling on top of as it has stronger guarantees to be stable from version to version.

    Features
    • Provide details about which timeout expired [0f2fa27]
    Fixes
    • Add Support Policy to docs [c70867a]
    Maintenance

    v2.4.0

    Compare Source

    2.4.0

    Features
    Fixes
    Maintenance

    v2.3.1

    Compare Source

    2.3.1

    Fixes

    Several users were invoking ginkgo by installing the latest version of the cli via go install github.com/onsi/ginkgo/v2/ginkgo@latest. When 2.3.0 was released this resulted in an influx of issues as CI systems failed due to a change in the internal contract between the Ginkgo CLI and the Ginkgo library. Ginkgo only supports running the same version of the library as the cli (which is why both are packaged in the same repository).

    With this patch release, the ginkgo CLI can now identify a version mismatch and emit a helpful error message.

    • Ginkgo cli can identify version mismatches and emit a helpful error message [bc4ae2f]
    • further emphasize that a version match is required when running Ginkgo on CI and/or locally [2691dd8]

    Maintenance

    v2.3.0

    Compare Source

    2.3.0

    Interruptible Nodes and Timeouts

    Ginkgo now supports per-node and per-spec timeouts on interruptible nodes. Check out the documentation for all the details but the gist is you can now write specs like this:

    It("is interruptible", func(ctx SpecContext) { // or context.Context instead of SpecContext, both are valid.
    // do things until `ctx.Done()` is closed, for example:
    req, err := http.NewRequestWithContext(ctx, "POST", "/build-widgets", nil)
    Expect(err).NotTo(HaveOccured())
    _, err := http.DefaultClient.Do(req)
    Expect(err).NotTo(HaveOccured())

    Eventually(client.WidgetCount).WithContext(ctx).Should(Equal(17))
}, NodeTimeout(time.Second*20), GracePeriod(5*time.Second))

    and have Ginkgo ensure that the node completes before the timeout elapses. If it does elapse, or if an external interrupt is received (e.g. ^C) then Ginkgo will cancel the context and wait for the Grace Period for the node to exit before proceeding with any cleanup nodes associated with the spec. The ctx provided by Ginkgo can also be passed down to Gomega's Eventually to have all assertions within the node governed by a single deadline.

    Features
    • Ginkgo now records any additional failures that occur during the cleanup of a failed spec. In prior versions this information was quietly discarded, but the introduction of a more rigorous approach to timeouts and interruptions allows Ginkgo to better track subsequent failures.
    • SpecContext also provides a mechanism for third-party libraries to provide additional information when a Progress Report is generated. Gomega uses this to provide the current state of an Eventually().WithContext() assertion when a Progress Report is requested.
    • DescribeTable now exits with an error if it is not passed any Entries [a4c9865]

    Fixes

    • fixes crashes on newer Ruby 3 installations by upgrading github-pages gem dependency [92c88d5]
    • Make the outline command able to use the DSL import [1be2427]

    Maintenance

    • chore(docs): delete no meaning d [57c373c]
    • chore(docs): Fix hyperlinks [30526d5]
    • chore(docs): fix code blocks without language settings [cf611c4]
    • fix intra-doc link [b541bcb]

    v2.2.0

    Compare Source

    2.2.0

    Generate real-time Progress Reports [f91377c]

    Ginkgo can now generate Progress Reports to point users at the current running line of code (including a preview of the actual source code) and a best guess at the most relevant subroutines.

    These Progress Reports allow users to debug stuck or slow tests without exiting the Ginkgo process. A Progress Report can be generated at any time by sending Ginkgo a SIGINFO (^T on MacOS/BSD) or SIGUSR1.

    In addition, the user can specify --poll-progress-after and --poll-progress-interval to have Ginkgo start periodically emitting progress reports if a given node takes too long. These can be overriden/set on a per-node basis with the PollProgressAfter and PollProgressInterval decorators.

    Progress Reports are emitted to stdout, and also stored in the machine-redable report formats that Ginkgo supports.

    Ginkgo also uses this progress reporting infrastructure under the hood when handling timeouts and interrupts. This yields much more focused, useful, and informative stack traces than previously.

    Features

    • BeforeSuite, AfterSuite, SynchronizedBeforeSuite, SynchronizedAfterSuite, and ReportAfterSuite now support (the relevant subset of) decorators. These can be passed in after the callback functions that are usually passed into these nodes.

      As a result the signature of these methods has changed and now includes a trailing args ...interface{}. For most users simply using the DSL, this change is transparent. However if you were assigning one of these functions to a custom variable (or passing it around) then your code may need to change to reflect the new signature.

    Maintenance
    • Modernize the invocation of Ginkgo in github actions [0ffde58]
    • Update reocmmended CI settings in docs [896bbb9]
    • Speed up unnecessarily slow integration test [6d3a90e]

    v2.1.6

    Compare Source

    2.1.6

    Fixes
    • Add SuppressProgressReporting decorator to turn off --progress announcements for a given node [dfef62a]
    • chore: remove duplicate word in comments [7373214]

    v2.1.5

    Compare Source

    2.1.5

    Fixes
    • drop -mod=mod instructions; fixes #​1026 [6ad7138]
    • Ensure CurrentSpecReport and AddReportEntry are thread-safe [817c09b]
    • remove stale importmap gcflags flag test [3cd8b93]
    • Always emit spec summary [5cf23e2] - even when only one spec has failed
    • Fix ReportAfterSuite usage in docs [b1864ad]
    • fixed typo (#​997) [219cc00]
    • TrimRight is not designed to trim Suffix [71ebb74]
    • refactor: replace strings.Replace with strings.ReplaceAll (#​978) [143d208]
    • fix syntax in examples (#​975) [b69554f]
    Maintenance

    v2.1.4

    Compare Source

    Fixes
    • Numerous documentation typos
    • Prepend when when using When (this behavior was in 1.x but unintentionally lost during the 2.0 rewrite) [efce903]
    • improve error message when a parallel process fails to report back [a7bd1fe]
    • guard against concurrent map writes in DeprecationTracker [0976569]
    • Invoke reporting nodes during dry-run (fixes #​956 and #​935) [aae4480]
    • Fix ginkgo import circle [f779385]

    v2.1.3

    Compare Source

    See https://onsi.github.io/ginkgo/MIGRATING_TO_V2 for details on V2.

    Fixes
    • Calling By in a container node now emits a useful error. [ff12cee]

    v2.1.2

    Compare Source

    Fixes
    • Track location of focused specs correctly in ginkgo unfocus [a612ff1]
    • Profiling suites with focused specs no longer generates an erroneous failure message [8fbfa02]
    • Several documentation typos fixed. Big thanks to everyone who helped catch them and report/fix them!

    v2.1.1

    Compare Source

    See https://onsi.github.io/ginkgo/MIGRATING_TO_V2 for details on V2.

    Fixes
    • Suites that only import the new dsl packages are now correctly identified as Ginkgo suites [ec17e17]

    v2.1.0

    Compare Source

    See https://onsi.github.io/ginkgo/MIGRATING_TO_V2 for details on V2.

    2.1.0 is a minor release with a few tweaks:

    • Introduce new DSL packages to enable users to pick-and-choose which portions of the DSL to dot-import. [90868e2] More details here.
    • Add error check for invalid/nil parameters to DescribeTable [6f8577e]
    • Myriad docs typos fixed (thanks everyone!) [718542a, ecb7098, 146654c, a8f9913, 6bdffde, 03dcd7e]

    v2.0.0: Ginkgo v2.0.0

    Compare Source

    Ginkgo v2.0.0 is a major new release of Ginkgo.

    The changes to Ginkgo are substantial and wide-ranging, however care has been given to ensure that most users will experience a smooth migration from V1 to V2 with relatively little work. A combined changelog and migration guides is available here and the Ginkgo docs have been updated to capture the new functionality in V2.

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about this update again.

    • [ ] If you want to rebase/retry this PR, check this box

    This PR has been generated by Mend Renovate. View repository job log here.

  • 16

    fix(deps): update module k8s.io/client-go to v11

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | k8s.io/client-go | require | major | v0.26.0 -> v11.0.0+incompatible |

    Release Notes

    kubernetes/client-go

    v11.0.0+incompatible

    Compare Source

    v10.0.0+incompatible

    Compare Source

    v9.0.0+incompatible

    Compare Source

    v8.0.0+incompatible

    Compare Source

    v7.0.0+incompatible

    Compare Source

    v6.0.0+incompatible

    Compare Source

    v5.0.1+incompatible

    Compare Source

    v5.0.0+incompatible

    Compare Source

    v4.0.0+incompatible

    Compare Source

    v3.0.0+incompatible

    Compare Source

    v2.0.0+incompatible

    Compare Source

    v1.5.2

    Compare Source

    v1.5.1

    Compare Source

    v1.5.0

    Compare Source

    v1.4.0

    Compare Source

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about this update again.

    • [ ] If you want to rebase/retry this PR, check this box

    This PR has been generated by Mend Renovate. View repository job log here.

  • 17

    fix(deps): update kubernetes packages to v0.26.0

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | k8s.io/api | require | minor | v0.25.5 -> v0.26.0 | | k8s.io/apimachinery | require | minor | v0.25.5 -> v0.26.0 | | k8s.io/client-go | require | minor | v0.25.5 -> v0.26.0 | | k8s.io/code-generator | require | minor | v0.25.5 -> v0.26.0 |

    Release Notes

    kubernetes/api

    v0.26.0

    Compare Source

    kubernetes/apimachinery

    v0.26.0

    Compare Source

    kubernetes/client-go

    v0.26.0

    Compare Source

    kubernetes/code-generator

    v0.26.0

    Compare Source

    Configuration

    📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

    ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    🔕 Ignore: Close this PR and you won't be reminded about these updates again.

    • [ ] If you want to rebase/retry this PR, check this box

    This PR has been generated by Mend Renovate. View repository job log here.

Popular Tag

Related