github.com/fluxcd/kustomize-controller

Release date: 2022-02-16

This prerelease comes with support for making the Kubernetes Secrets and ConfigMaps referenced in postBuild.substituteFrom optional. When substituteFrom.optional is set to true, the controller will ignore not found errors, and will substitute the variables with their default values.

Features:

• Tolerate absence of resources in post-build substitution #570

Release date: 2022-02-10

This prerelease comes with an update to the sigs.k8s.io/kustomize/api package, bringing the controller on par with the Kustomize v4.5.2 release.

Kustomize v4.5.2 contains a regression bug fix for pseudo git HTTP URLs.

Improvements:

• Update controller to kustomize v4.5.2 #567
• Clarify spec.path in API docs #566
• Fix typo in API docs #564

Release date: 2022-02-07

This prerelease comes with an update to the sigs.k8s.io/kustomize packages, bringing the controller on par with the Kustomize v4.5.1 release.

Improvements:

• Update controller to kustomize v4.5.1 #559

Fixes:

• Transfer ownership of the kubectl managed fields #562

Release date: 2022-02-01

This prerelease comes with security improvements for multi-tenant clusters:

• Platform admins can enforce impersonation across the cluster using the --default-service-account flag. When the flag is set, all Kustomizations, which don't have spec.serviceAccountName specified, use the service account name provided by --default-service-account=<SA Name> in the namespace of the object.
• Platform admins can disable cross-namespace references with the --no-cross-namespace-refs=true flag. When this flag is set, Kustomizations can only refer to sources (GitRepositories and Buckets) in the same namespace as the Kustomization object, preventing tenants from accessing another tenant's repositories.

The controller container images are signed with Cosign and GitHub OIDC, and a Software Bill of Materials in SPDX format has been published on the release page.

Starting with this version, the controller deployment conforms to the Kubernetes restricted pod security standard:

• all Linux capabilities were dropped
• the root filesystem was set to read-only
• the seccomp profile was set to the runtime default
• run as non-root was enabled
• the user and group ID was set to 65534

Breaking changes:

• The use of new seccomp API requires Kubernetes 1.19.
• The controller container is now executed under 65534:65534 (userid:groupid). This change may break deployments that hard-coded the user ID of 'controller' in their PodSecurityPolicy.
• When both spec.kubeConfig and spec.ServiceAccountName are specified, the controller will impersonate the service account on the target cluster, previously the controller ignored the service account.

Features:

• Allow setting a default service account for impersonation #550
• Allow disabling cross-namespace references #549
• SOPS: Add support for HashiCorp Vault token-based authentication #538

Improvements:

• Publish SBOM and sign release artifacts #541
• Drop capabilities, enable seccomp and enforce runAsNonRoot #539
• docs: Add var substitution operator escape syntax #537
• Update development documentation #540
• Refactor Fuzz implementation #536

Fixes:

• Revoke kubectl managed fields ownership #527
• Ensure object are finalized under impersonation #552
• Use patch instead of update when adding finalizers #535
• Fix preflight validation #544
• Fix the missing protocol for the first port in manager config #547