github.com/bitnami/sealed-secrets

• Bump Golang to 1.26.7 (#2029)
• Bump Golang to 1.26.6 (#2028)
• Bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#2026)
• Bump github.com/onsi/ginkgo/v2 from 2.32.0 to 2.32.1 (#2027)
• test(controller): fix flaky TestReadKey RSA key comparison (#2021)

• [Security] fix: stop /v1/verify from acting as a decryption oracle (#2019)
• fix(controller): start HTTP early for large additional-namespaces lists (#2018)
• Rate-limit the /v1/rotate endpoint (#1971)
• test(controller): poll for server readiness instead of sleeping (#2010)
• Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 (#2016)
• Bump k8s.io/code-generator from 0.36.2 to 0.36.3 (#2014)
• Bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 (#2011)
• Bump k8s.io/client-go from 0.36.2 to 0.36.3 (#2012)
• Bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 (#2009)
• Bump golang.org/x/crypto from 0.53.0 to 0.54.0 (#2007)
• Bump distroless/static from 3592aa8 to 9197324 in /docker (#2008)
• Allow setting hostUsers on deployment (#1978)
• Add --metrics-omit-secret-labels to skip per-SealedSecret labels on condition_info (#1972)
• Revert ArtifactHub repository metadata OCI push (#2005)

• Incomplete release for credentials problems

• Imcomplete release for credentials problems

• Publish Artifact Hub repository metadata for verified publisher status (#2000)
• Add Artifact Hub badge to README (#1999)
• Bump github.com/onsi/ginkgo/v2 from 2.30.0 to 2.32.0 (#1998)
• Bump github.com/onsi/gomega from 1.42.0 to 1.42.1 (#1997)
• Bump k8s.io/client-go from 0.36.1 to 0.36.2 (#1996)
• Bump k8s.io/api from 0.36.1 to 0.36.2 (#1994)
• Bump github.com/onsi/gomega from 1.41.0 to 1.42.0 (#1995)
• Bump k8s.io/code-generator from 0.36.1 to 0.36.2 (#1993)

• Incomplete release for credentials problems

• feat: add ppc64le architecture support (#1973)
• Adding default prometheusRule in helmChart to watch out of sync secrets (#1980)
• Update security context defaults to comply with restricted pod security standard profile (#1981)
• fix: add mutex locking to KeyRegistry to prevent data races (#1905)
• Bump Golang to 1.26.4 (#1987)
• Migrate all bitnami-labs references to bitnami org (#1983)
• Change oci registry for publishing the chart (#1970)
• Revert "Fix oci push" (#1979)
• Bump golang.org/x/crypto from 0.52.0 to 0.53.0 (#1984)
• Bump github.com/onsi/ginkgo/v2 from 2.29.0 to 2.30.0 (#1985)
• Bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#1977)
• Bump github.com/onsi/ginkgo/v2 from 2.28.3 to 2.29.0 (#1976)
• Bump github.com/onsi/gomega from 1.40.0 to 1.41.0 (#1975)

Big change for this release is the switch to per-key encrypted values.

• ("Keys" as in "object key/value", not as in "encryption key". English is hard.)*
• Previously we generated a single big encrypted blob for each Secret, now we encrypt each value in the Secret separately, with the keys in plain text. This allows:
  • Existing keys can now be renamed and deleted without re-encrypting the value(s).
  • New keys/values can be added to the SealedSecret without re-encrypting (or even having access to!) the existing values.
  • Note that (as before) the encrypted values are still tied to the namespace/name of the enclosing Secret/SealedSecret, so can't be moved to another Secret. (The cluster-wide annotation does allow this, with the corresponding caveats, as before)
• The kubeseal tool does not yet have an option to output just a single value, but you can safely mix+match the individual values from kubeseal output with an existing SealedSecret. Improving kubeseal support for this feature is still an open action item.
• Existing/older "all-in-one" SealedSecrets are declared deprecated, but will continue to be supported by the controller for the foreseeable future. New invocations of the kubeseal tool now produce per-key encrypted output - if you need to produce the older format, just use an older kubeseal. Please raise a github issue if you have a use-case that requires supporting "all-in-one" SealedSecrets going forward.
• Note the CRD schema used for server-side validation in k8s >=1.9 has been temporarily removed, because it was unable to support the new per-key structure correctly (see kubernetes/kubernetes#59485).
• Huge thanks to @sullerandras for the code and his persistence in getting this merged!

• Support "cluster wide" secrets, that are not restricted to the original namespace
  • Set sealedsecrets.bitnami.com/cluster-wide: "true" annotation
  • Warning: cluster-wide SealedSecrets can be decrypted by anyone who can create a SealedSecret in your cluster
• Move to client-go v5.0
• Move to bitnami-labs github org
• Fix bug in schema validation for k8s 1.9

Note: this version moves TPR/CRD definition into a separate file. To install, you need controller.yaml and either sealedsecret-tpr.yaml or sealedsecret-crd.yaml

• Add CRD definition and TPR->CRD migration documentation
• Add kubeseal --fetch-cert to dump server cert to stdout, for later offline use with kubeseal --cert
• Better sanitization of input object to kubeseal

(v0.5.1 fixes a travis/github release issue with v0.5.0)

• controller: deployment security hardening: non-root uid and read-only rootfs
• kubeseal: Include oidc and gcp auth provider plugins
• kubeseal: Add support for YAML output

• Add controller-norbac.yaml to the release build. This is controller.yaml without RBAC rules and related service account - for environments where RBAC is not yet supported, like Azure.
• Fix missing controller RBAC ClusterRoleBinding in v0.3.0

Rename everything to better represent project scope. Better to do this early (now) and apologies for the disruption.

• Rename repo and golang import path -> bitnami/sealed-secrets
• Rename cli tool -> kubeseal
• Rename SealedSecret apiGroup -> bitnami.com

• Fix invalid field resourceName in v0.2.0 controller.yaml (thanks @Globegitter)

• Client tool has better defaults, and can fetch the certificate automatically from the controller.
• Improve release process to include pre-built Linux and OSX x86-64 binaries.

Basic functionality is complete.

• Clean up controller.jsonnet
• Switch to quay.io (docker hub doesn't offer robot accounts??)
• Add deploy section to .travis.yml