github.com/fluxcd/source-controller

Release date: 2023-12-08

This patch release ensures the controller is built with the latest Go 1.21.x release, to mitigate multiple security vulnerabilities which were published shortly after the release of v1.2.0.

In addition, a small number of dependencies have been updated to their latest version.

Improvements:

• Update dependencies #1309

Release date: 2023-12-05

This minor release comes with API changes, bug fixes and several new features.

Bucket

A new field, .spec.prefix, has been added to the Bucket API, which enables server-side filtering of files if the object's .spec.provider is set to generic/aws/gcp.

OCIRepository and HelmChart

Two new fields, .spec.verify.matchOIDCIdentity.issuer and .spec.verify.matchOIDCIdentity.subject have been added to the HelmChart and OCIRepository APIs. If the image has been keylessly signed via Cosign, these fields can be used to verify the OIDC issuer of the Fulcio certificate and the OIDC identity's subject respectively.

HelmRepository

A new boolean field, .spec.insecure, has been introduced to the HelmRepository API, which allows connecting to a non-TLS HTTP container registry. It is only considered if the object's .spec.type is set to oci.

From this release onwards, HelmRepository objects of type OCI are treated as static objects, i.e. they have an empty status. Existing objects undergo a one-time automatic migration and new objects will be undergo a one-time reconciliation to remove any status fields.

Additionally, the controller now performs a shallow clone if the .spec.ref.name of the GitRepository object points to a branch or a tag.

Furthermore, a bug has been fixed, where the controller would try to authenticate against public OCI registries if the HelmRepository object has a reference to a Secret containing a CA certificate.

Lastly, dependencies have been updated to their latest version, including an update of Kubernetes to v1.28.4.

Fixes:

• Address miscellaneous issues throughout code base #1257
• helmrepo: only configure tls login option when required #1289
• oci: rename OCIChartRepository.insecure to insecureHTTP #1299
• Use bitnami Minio oci chart for e2e #1301

Improvements:

• build(deps): bump Go dependencies #1260 #1261 #1269 #1291
• build(deps): bump the ci group dependencies #1265 #1266 #1272 #1277 #1281 #1285 #1296 #1303
• bucket: Add prefix filtering capability #1228
• Static HelmRepository OCI #1243
• cosign: allow identity matching for keyless verification #1250
• Upgrade go-git to v5.10.0 #1271
• storage: change default file permissions #1276
• Update dependencies to Kubernetes v1.28 #1286
• Add .spec.insecure to HelmRepository for type: oci #1288
• Update Git dependencies #1300
• Update Go dependencies #1304

Release date: 2023-10-11

This patch release fixes a bug where OCIRepository objects can't be consumed when the OCI image layer contains symlinks.

Fixes:

• oci: Skip symlinks found in upstream artifacts #1246

Improvements:

• build(deps): bump the ci group with 1 update #1256

Release date: 2023-09-18

This is a patch release that fixes a regression introduced in v1.1.0 where HelmRepository objects would not be reconciled if they provided a TLS Secret using .spec.secretRef with a type other than Opaque or kubernetes.io/tls.

In addition, the URL lookup strategy for Buckets has been changed from path to auto, to widen support for S3-compatible object storage services.

Lastly, several dependencies have been updated to their latest versions.

Fixes:

• bucket: use auto lookup type #1222
• helmrepo: fix Secret type check for TLS via .spec.secretRef #1225
• Upgrade github.com/fluxcd/pkg/{git,git/gogit} #1236

Improvements:

• build(deps): bump the ci group dependencies #1213 #1224 #1230 #1235
• docs: Add missing pem-encoding reference #1216
• build(deps): bump github.com/cyphar/filepath-securejoin from 0.2.3 to 0.2.4 #1227

Release date: 2023-08-23

This minor release comes with API changes, bug fixes and several new features.

All APIs that accept TLS data have been modified to adopt Secrets of type kubernetes.io/tls. This includes:

• HelmRepository: The field .spec.secretRef has been deprecated in favor of a new field .spec.certSecretRef. This field is also supported by OCI HelmRepositories.
• OCIRepository: Support for thecaFile, keyFile and certFile keys in the Secret specified in .spec.certSecretRef have been deprecated in favor of ca.crt, tls.key and tls.crt. Also, the Secret now must be of type Opaque or kubernete.io/tls.
• GitRepository: CA certificate can now be provided in the Secret sepcified in .spec.secretRef using the ca.crt key, which takes precedence over the existing caFile key.

Furthermore, GitRepository has a couple of new features:

• Proxy support: A new field .spec.proxySecretRef has been introduced which can be used to specify the proxy configuration to use for all remote Git operations related to the particular object.
• Tag verification: The field .spec.verification.mode now supports the following values:
  • HEAD: Verify the HEAD of the Git repository.
  • Tag: Verify the tag specified in .spec.ref
  • TagAndHead: Verify the tag specified in .spec.ref and the commit it points to.

Starting with this version, the controller now stops exporting an object's metrics as soon as the object has been deleted.

In addition, the controller now consumes significantly less CPU and memory when reconciling Helm repository indexes.

Lastly, a new flag --interval-jitter-percentage has been introduced which can be used to specify a jitter to the reconciliation interval in order to distribute the load more evenly when multiple objects are set up with the same interval.

Improvements:

• gitrepo: Add support for specifying proxy per GitRepository #1109
• helmrepo: add .spec.certSecretRef for specifying TLS auth data #1160
• Update docs on Azure identity #1167
• gitrepo: document limitation of spec.ref.name with Azure Devops #1175
• ocirepo: add cosign support for insecure HTTP registries #1176
• Handle delete before adding finalizer #1177
• Store Helm indexes in JSON format #1178
• Unpin go-git and update to v5.8.1 #1179
• controller: jitter requeue interval #1184
• cache: ensure new expiration is persisted #1185
• gitrepo: add support for Git tag verification #1187
• Update dependencies #1191
• Adopt Kubernetes style TLS Secrets #1194
• Update dependencies #1196
• Helm OCI: Add support for TLS registries with self-signed certs #1197
• Update dependencies #1202
• Preserve url encoded path in normalized helm repository URL #1203
• Fix link ref in API docs #1204

Fixes:

• Fix the helm cache arguments #1170
• Delete stale metrics on object delete #1183
• Disable system-wide git config in tests #1192
• Fix links in API docs #1200

Release date: 2023-07-10

This is a patch release that fixes the AWS authentication for cross-region ECR repositories.

Fixes:

• Update fluxcd/pkg/oci to fix ECR cross-region auth #1158

Release date: 2023-07-03

This is the first stable release of the controller. From now on, this controller follows the Flux 2 release cadence and support pledge.

Starting with this version, the build, release and provenance portions of the Flux project supply chain provisionally meet SLSA Build Level 3.

This release includes several minor changes that primarily focus on addressing forgotten and obsolete bits in the logic related to GitRepository objects.

Including a removal of the OptimizedGitClones feature flag. If your Deployment is configured to disable this flag, you should remove it.

In addition, dependencies have been updated to their latest version, including an update of Kubernetes to v1.27.3.

For a comprehensive list of changes since v0.36.x, please refer to the changelog for v1.0.0-rc.1, v1.0.0-rc.3 and v1.0.0-rc.4.

Improvements:

• gitrepo: remove OptimizedGitClones as a feature gate #1124 #1126
• Update dependencies #1127 #1147
• Update Cosign to v2.1.0 #1132
• Align go.mod version with Kubernetes (Go 1.20) #1134
• Add the verification key to the GitRepository verified status condition
• #1136
• gitrepo: remove obsolete proxy docs #1144

Release date: 2023-06-01

This release candidate fixes a regression introduced in 1.0.0.-rc.4 where support for Git servers that exclusively use v2 of the wire protocol like Azure Devops and AWS CodeCommit was broken.

Lastly, the controller's dependencies were updated to mitigate CVE-2023-33199.

Improvements:

• build(deps): bump github.com/sigstore/rekor from 1.1.1 to 1.2.0 #1107

Fixes:

• Bump fluxcd/pkg/git/gogit to v0.12.0 #1111

Release date: 2023-05-26

This release candidate comes with support for Kubernetes v1.27 and Cosign v2. It also enables the use of annotated Git tags with .spec.ref.name in GitRepository. Furthermore, it fixes a bug related to accessing Helm OCI charts on ACR using OIDC auth.

Improvements:

• build(deps): bump helm/kind-action from 1.5.0 to 1.7.0 #1100
• build(deps): bump sigstore/cosign-installer from 3.0.3 to 3.0.5 #1101
• build(deps): bump actions/setup-go from 4.0.0 to 4.0.1 #1102
• Update cosign to v2 #1096
• build(deps): bump github.com/sigstore/rekor from 0.12.1-0.20220915152154-4bb6f441c1b2 to 1.1.1 #1083
• Update controller-runtime and Kubernetes dependencies #1104
• Update dependencies; switch to go-git/go-git and pkg/tar #1105

Release date: 2023-05-12

This release candidate introduces the verification of the Artifact digest in storage during reconciliation. This ensures that the Artifact is not tampered with after it was written to storage. When the digest does not match, the controller will emit a warning event and remove the file from storage, forcing the Artifact to be re-downloaded.

In addition, files with executable permissions are now archived with their mode set to 0o744 instead of 0o644. Allowing the extracted file to be executable by the user.

Lastly, the controller's dependencies were updated to mitigate CVE-2023-1732 and CVE-2023-2253, and the controller base image was updated to Alpine 3.18.

Improvements:

• Verify digest of Artifact in Storage #1088
• build(deps): bump github.com/cloudflare/circl from 1.3.2 to 1.3.3 #1092
• build(deps): bump github.com/docker/distribution from 2.8.1+incompatible to 2.8.2+incompatible #1093
• storage: set 0o744 for files with exec mode set #1094

Release date: 2023-05-09

This release candidate comes with various updates to the controller's dependencies, most notable, Helm was updated to v3.11.3.

Improvements:

• Update dependencies #1086
• Set RecoverPanic globally across controllers #1077
• Move controllers to internal/controller #1076