github.com/fluxcd/source-controller

Release date: 2022-01-07

This prerelease comes with an update for github.com/containerd/containerd to v1.5.9 to please static security analysers and fix any warnings for CVE-2021-43816.

Improvements:

• Log the error when tmp cleanup fails #533
• Update containerd to v1.5.9 (fix CVE-2021-43816) #532

Release date: 2022-01-05

This prerelease comes with an update to the Kubernetes and controller-runtime dependencies to align them with the Kubernetes 1.23 release, including an update of Helm to v3.7.2.

In addition, the controller is now built with Go 1.17, and github.com/containerd/containerd was updated to v1.5.8 to please static security analysers and fix any warnings for GHSA-5j5w-g665-5m35.

Improvements:

• Update Go to v1.17 #473
• Update build dependencies #520
• Update containerd to v1.5.8 (fix GHSA-5j5w-g665-5m35) #529

Release date: 2021-12-09

This prerelease ensures the API resources are not prematurely marked as Ready by tools like kstatus, while the controller has not observed a newly created resource yet, by defaulting the ObservedGeneration in the status of the resource to -1.

In addition, it changes the faulty URL column for Bucket resources to Endpoint, and updates github.com/opencontainers/runc to v1.0.3 to please static security analysers and fix any warnings for CVE-2021-43784.

Improvements:

• crds: set default observedGeneration to -1 #517
• Update github.com/opencontainers/runc to v1.0.3 (fix CVE-2021-43784) #518

Fixes:

• Change bucket JSONPath from URL to endpoint #514

Release date: 2021-12-03

This prerelease changes the length of the SHA hex added to the SemVer metadata of a HelmChart, when ReconcileStrategy is set to Revision, to a short SHA hex of the first 12 characters. This is to prevent situations in which the SemVer would exceed the length limit of 63 characters when utilized in a Helm chart as a label value.

Concrete example: 1.2.3+a4303ff0f6fb560ea032f9981c6bd7c7f146d083.1 becomes 1.2.3+a4303ff0f6fb.1

:warning: There have been additional user reports about charts complaining about a + character in the label:

metadata.labels: Invalid value: "1.2.3+a4303ff0f6fb560ea032f9981c6bd7c7f146d083.1": a valid label must be an empty string or consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyValue', or 'my_value', or '12345', regex used for validation is '(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?')

Given the Helm chart best practices mention to replace this character with a _, we encourage you to patch this in your (upstream) chart. Pseudo example using template functions:

{{- replace "+" "_" .Chart.Version | trunc 63 }}

Fixes:

• controllers: use short SHA in chart SemVer meta #507

Release date: 2021-11-23

For this prerelease we focused on improving the logic around Helm resources, with as goal to be more efficient, and increase code and testing quality.

It contains breaking behavioral changes to HelmRepository and HelmChart resources:

• Helm repository index files and/or charts must not exceed the new declared runtime default limits to avoid out-of-memory crashes, overwriting the default configuration is possible.

  Type	Default max size (in MiB)	Option flag to overwrite
  Helm repository index	50MiB	--helm-index-max-size=<bytes>
  Helm chart	10MiB	--helm-chart-max-size=<bytes>
  Singe file from Helm chart	5MiB	--helm-chart-file-max-size=<bytes>

• Using ValuesFiles in a HelmChart will now append a .<Generation> to the SemVer metadata of the packaged chart and the revision of the Artifact. For example, v1.2.3+.5 for a HelmChart resource with generation 5. This ensures consumers of the chart are able to notice changes to the merged values without the underlying chart source (revision) changing.

While an optional ACL field has been added to the API resources, there is no implementation at time of release.

Improvements:

• helm: factor out logic from controller into package #485
• Add ACL option field to Source API #495
• Update various dependencies to mitigate CVE warning #493
• Update controller-runtime to v0.10.2 #497
• Update github.com/minio/minio-go to v7.0.15 #498
• internal/helm: LoadChartMetadataFromArchive improvements #502
• internal/helm: validate loaded chart metadata obj #503

Fixes:

• tests: ensure proper garbage collection #489
• controllers: Fix helmchart values file merge test #494
• Update test shield link #496
• controllers: absolute local path for cached chart #500
• Various small fixes across the code base #501

Release date: 2021-11-12

This prerelease changes the format of the artifact checksum from SHA1 to SHA256 to mitigate chosen-prefix and length extension attacks.

Improvements:

• storage: change Artifact checksum to SHA256 #487

Release date: 2021-11-04

This prerelease comes with a bug fix to ensure the libgit2 Git implementation respects the operation timeout specified in GitRepositorySpec.

Fixes:

• libgit2: ensure context timeout cancels transfer #477

Release date: 2021-10-30

This prerelease fixes a pointer error that was returned in v0.17.0 during the import of public keys to verify a commit.

Fixes:

• Fix pointer error during public key import #479

Release date: 2021-10-28

For this prerelease we focused on further improving the Git implementations, partly to increase stability and test coverage, partly to ensure they are prepared to be moved out into a separate module. With this work, it is now possible to define just a Git commit as a reference, which will result in an Artifact with a Revision format of HEAD/<commit SHA>.

For the go-git implementation, defining the branch and a commit reference will result in a more efficient shallow clone, and using this information when it is available to you is therefore encouraged.

Improvements:

• git: refactor authentication, checkout and verification #462

Fixes:

• libgit2: handle EOF in parseKnownHosts() #475

Release date: 2021-10-22

This prerelease adds support for GCP storage authentication using the GOOGLE_APPLICATION_CREDENTIALS environment variable available in the container, or by defining a secretRef with a serviceaccount JSON data blob. See #434 for more information.

In addition, several bug fixes and improvements have been made to the libgit2 Git implementation, ensuring the checkout logic is more rigorously tested.

During this work, it was discovered that both Git implementation had a minor bug resulting in v prefixed tags with metadata added to it (e.g. v0.1.0+build-1 and v0.1.0+build-2) were not properly sorted by their commit timestamp, which has been addressed as well.

Improvements:

• Add GCP storage authentication #434

Fixes:

• libgit2: correctly resolve (annotated) tags #457
• libgit2: add remaining checkout strategy tests #458
• git: ensure original tag is used for TS lookup #459

Release date: 2021-10-08

This prerelease improves the configuration of the libgit2 C library, solving most issues around private key formats (e.g. PKCS#8 and ED25519) by ensuring it is linked against OpenSSL and LibSSH2.

In addition, the HelmChart resource does now allow setting a ReconcileStrategy to define when a new artifact for a chart should be created for charts from Bucket and GitRepository sources. By setting this to Revision, you no longer have to bump the version in the Chart.yaml file, but a new chart will automatically be made available when the revision of the Source changes.

Fixes:

• Update containerd and runc to fix CVEs #446

Improvements:

• Add reconcile strategy for HelmCharts #308
• Update github.com/libgit2/git2go to v31.6.1 #437

Release date: 2021-08-05

This prerelease comes with a series of bug fixes, and updates the Kubernetes dependencies to v1.21.3 and Helm to v3.6.3.

Fixes:

• Fix tag checkout with libgit2 #394
• Take relative paths in account for Bucket revision #403
• Ensure rel path never traverses outside Storage #417
• Use same SemVer logic in both Git implementations #417
• storage: strip env specific data during archive #417

Improvements:

• e2e: Update Kubernetes to v1.21 #396
• Update Helm to v3.6.3 #400
• Add setup-envtest in Makefile #404
• Use ObjectKeyFromObject instead of ObjectKey #405
• Drop deprecated io/ioutil #409
• Update dependencies #416