github.com/hashicorp/vault-k8s

1.7.6 (August 6, 2026)

Changes:

• Building with Go 1.26.5
• Default Vault version updated to 2.0.4
• Test with Vault 2.0.4, 1.21.9, 1.20.14, 1.19.20
• Build linux/ppc64le UBI images and publish to ICR and Red Hat catalog

Dependency updates:

• Build(deps): bump ubi8/ubi-minimal from 1781701189 to 1785302650
• Build(deps): bump the gomod-backward-compatible group with 5 updates
  • Updates github.com/go-logr/logr from 1.4.3 to 1.4.4
  • Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.1
  • Updates k8s.io/api from 0.36.2 to 0.36.3
  • Updates k8s.io/apimachinery from 0.36.2 to 0.36.3
  • Updates k8s.io/client-go from 0.36.2 to 0.36.3
• Security: upgrade Go toolchain 1.26.4 => 1.26.5 (fixes GO-2026-5856, GO-2026-4970)
• CI: update GitHub Actions to latest versions
  • actions/checkout v7.0.0 => v7.0.1
  • actions/setup-go v6.5.0 => v7.0.0
  • actions/setup-node v6.4.0 => v7.0.0
  • actions/setup-python v6.3.0 => v7.0.0

Changes:

• Building with Go 1.26.5
• Default Vault version updated to 2.0.4
• Test with Vault 2.0.4, 1.21.9, 1.20.14, 1.19.20
• Build linux/ppc64le UBI images and publish to ICR and Red Hat catalog

Dependency updates:

• Build(deps): bump ubi8/ubi-minimal from 1781701189 to 1785302650
• Build(deps): bump the gomod-backward-compatible group with 5 updates
  • Updates github.com/go-logr/logr from 1.4.3 to 1.4.4
  • Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.1
  • Updates k8s.io/api from 0.36.2 to 0.36.3
  • Updates k8s.io/apimachinery from 0.36.2 to 0.36.3
  • Updates k8s.io/client-go from 0.36.2 to 0.36.3
• Security: upgrade Go toolchain 1.26.4 => 1.26.5 (fixes GO-2026-5856, GO-2026-4970)
• CI: update GitHub Actions to latest versions
  • actions/checkout v7.0.0 => v7.0.1
  • actions/setup-go v6.5.0 => v7.0.0
  • actions/setup-node v6.4.0 => v7.0.0
  • actions/setup-python v6.3.0 => v7.0.0

1.7.5 (June 29, 2026)

Changes:

• Building with Go 1.26.4
• Build linux/s390x images
• Default Vault version updated to 2.0.3
• Test with Vault 2.0.3, 1.21.8, 1.20.13, 1.19.19
• Test with Kind v0.32.0
• Test with K8s 1.36.1, 1.35.5, 1.34.8, 1.33.12, 1.32.11
• Dependency updates:
  • container image alpine 3.23.4 => 3.24.1
  • container image ubi8/ubi-minimal 8.10-1777392407 => 1781701189
  • k8s.io/api v0.35.2 => v0.36.2
  • k8s.io/apimachinery v0.35.2 => v0.36.2
  • k8s.io/client-go v0.35.2 => v0.36.2
  • k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 => v0.0.0-20260210185600-b8788abfbbc2
  • sigs.k8s.io/controller-runtime v0.23.3 => v0.24.1
  • github.com/prometheus/common v0.66.1 => v0.67.5
  • github.com/prometheus/procfs v0.16.1 => v0.19.2
  • golang.org/x/crypto v0.49.0 => v0.53.0
  • golang.org/x/net v0.52.0 => v0.56.0
  • golang.org/x/sys v0.42.0 => v0.46.0
  • golang.org/x/term v0.41.0 => v0.44.0
  • golang.org/x/text v0.35.0 => v0.38.0
• CI: update GitHub Actions to latest versions
  • actions/checkout v4.2.2 => v7.0.0
  • actions/setup-node v4.3.0 => v6.4.0
  • actions/setup-python v5.5.0 => v6.3.0
  • actions/setup-go v5.4.0 => v6.5.0
  • actions/upload-artifact v7.0.0 => v7.0.1
  • actions/download-artifact v4.2.1 => v8.0.1
  • helm/kind-action v1.12.0 => v1.14.0

Changes:

• Building with Go 1.26.4
• Build linux/s390x images
• Default Vault version updated to 2.0.3
• Test with Vault 2.0.3, 1.21.8, 1.20.13, 1.19.19
• Test with Kind v0.32.0
• Test with K8s 1.36.1, 1.35.5, 1.34.8, 1.33.12, 1.32.11
• Dependency updates:
  • container image alpine 3.23.4 => 3.24.1
  • container image ubi8/ubi-minimal 8.10-1777392407 => 1781701189
  • k8s.io/api v0.35.2 => v0.36.2
  • k8s.io/apimachinery v0.35.2 => v0.36.2
  • k8s.io/client-go v0.35.2 => v0.36.2
  • k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 => v0.0.0-20260210185600-b8788abfbbc2
  • sigs.k8s.io/controller-runtime v0.23.3 => v0.24.1
  • github.com/prometheus/common v0.66.1 => v0.67.5
  • github.com/prometheus/procfs v0.16.1 => v0.19.2
  • golang.org/x/crypto v0.49.0 => v0.53.0
  • golang.org/x/net v0.52.0 => v0.56.0
  • golang.org/x/sys v0.42.0 => v0.46.0
  • golang.org/x/term v0.41.0 => v0.44.0
  • golang.org/x/text v0.35.0 => v0.38.0
• CI: update GitHub Actions to latest versions
  • actions/checkout v4.2.2 => v7.0.0
  • actions/setup-node v4.3.0 => v6.4.0
  • actions/setup-python v5.5.0 => v6.3.0
  • actions/setup-go v5.4.0 => v6.5.0
  • actions/upload-artifact v7.0.0 => v7.0.1
  • actions/download-artifact v4.2.1 => v8.0.1
  • helm/kind-action v1.12.0 => v1.14.0

1.7.4 (April 30, 2026)

Changes:

• Building with Go 1.26.2
• Default Vault version updated to 2.0.0
• Dependency updates:
  • container image alpine 3.23.3 => 3.23.4
  • container image ubi8/ubi-minimal 8.10-1772599255 => 8.10-1777392407
  • github.com/hashicorp/vault/sdk v0.23.0 => v0.25.1
  • sigs.k8s.io/controller-runtime v0.23.1 => v0.23.3

Changes:

• Building with Go 1.26.2
• Default Vault version updated to 2.0.0
• Dependency updates:
  • container image alpine 3.23.3 => 3.23.4
  • container image ubi8/ubi-minimal 8.10-1772599255 => 8.10-1777392407
  • github.com/hashicorp/vault/sdk v0.23.0 => v0.25.1
  • sigs.k8s.io/controller-runtime v0.23.1 => v0.23.3

1.7.3 (March 5, 2026)

Changes:

• Tested with Kubernetes versions 1.35-1.31
• Test with Kind v0.31.0
• Building with Go 1.25.7
• Default Vault version updated to 1.21.4
• Dependency updates:
  • container image alpine 3.23.2 => 3.23.3
  • container image ubi8/ubi-minimal 8.10-1765178706 => 8.10-1772599255
  • github.com/hashicorp/vault/sdk v0.20.0 => v0.23.0
  • k8s.io/api v0.34.3 => v0.35.2
  • k8s.io/apimachinery v0.34.3 => v0.35.2
  • k8s.io/client-go v0.34.3 => v0.35.2
  • k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 => v0.0.0-20251002143259-bc988d571ff4
  • sigs.k8s.io/controller-runtime v0.22.4 => v0.23.1

Changes:

• Tested with Kubernetes versions 1.35-1.31
• Test with Kind v0.31.0
• Building with Go 1.25.7
• Default Vault version updated to 1.21.4
• Dependency updates:
  • container image alpine 3.23.2 => 3.23.3
  • container image ubi8/ubi-minimal 8.10-1765178706 => 8.10-1772599255
  • github.com/hashicorp/vault/sdk v0.20.0 => v0.23.0
  • k8s.io/api v0.34.3 => v0.35.2
  • k8s.io/apimachinery v0.34.3 => v0.35.2
  • k8s.io/client-go v0.34.3 => v0.35.2
  • k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 => v0.0.0-20251002143259-bc988d571ff4
  • sigs.k8s.io/controller-runtime v0.22.4 => v0.23.1

1.7.2 (December 18, 2025)

Changes:

• Building with Go 1.25.5
• Dependency updates:
  • container image alpine 3.22.2 => 3.23.2
  • container image ubi8/ubi-minimal 8.10-1764046129 => 8.10-1765178706
  • k8s.io/api v0.34.2 => v0.34.3
  • k8s.io/apimachinery v0.34.2 => v0.34.3
  • k8s.io/client-go v0.34.2 => v0.34.3

Changes:

• Building with Go 1.25.5
• Dependency updates:
  • container image alpine 3.22.2 => 3.23.2
  • container image ubi8/ubi-minimal 8.10-1764046129 => 8.10-1765178706
  • k8s.io/api v0.34.2 => v0.34.3
  • k8s.io/apimachinery v0.34.2 => v0.34.3
  • k8s.io/client-go v0.34.2 => v0.34.3

1.7.1 (November 20, 2025)

Changes:

• Building with Go 1.25.4
• Default Vault version updated to 1.21.1
• Dependency updates:
  • Docker image ubi8/ubi-minimal 8.10-1295.1749680713 => 8.10-1763613452
  • github.com/hashicorp/vault/sdk v0.18.0 => v0.20.0
  • github.com/operator-framework/operator-lib v0.18.0 => v0.19.0
  • github.com/prometheus/client_golang v1.22.0 => v1.23.2
  • github.com/stretchr/testify v1.10.0 => v1.11.1
  • k8s.io/api v0.33.2 => v0.34.2
  • k8s.io/apimachinery v0.33.2 => v0.34.2
  • k8s.io/client-go v0.33.2 => v0.34.2
  • k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 => v0.0.0-20250604170112-4c0f3b243397
  • sigs.k8s.io/controller-runtime v0.21.0 => v0.22.4

Improvements:

• Add arm64 to the UBI container builds GH-799

Changes:

• Building with Go 1.25.4
• Default Vault version updated to 1.21.1
• Dependency updates:
  • Docker image alpine 3.22.0 => 3.22.2
  • Docker image ubi8/ubi-minimal 8.10-1295.1749680713 => 8.10-1764046129
  • github.com/hashicorp/vault/sdk v0.18.0 => v0.20.0
  • github.com/operator-framework/operator-lib v0.18.0 => v0.19.0
  • github.com/prometheus/client_golang v1.22.0 => v1.23.2
  • github.com/stretchr/testify v1.10.0 => v1.11.1
  • k8s.io/api v0.33.2 => v0.34.2
  • k8s.io/apimachinery v0.33.2 => v0.34.2
  • k8s.io/client-go v0.33.2 => v0.34.2
  • k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 => v0.0.0-20250604170112-4c0f3b243397
  • sigs.k8s.io/controller-runtime v0.21.0 => v0.22.4

Improvements:

• Add arm64 to the UBI container builds GH-799

1.7.0 (June 24, 2025)

Changes:

• Building with Go 1.24.4
• Default Vault version updated to 1.19.5
• Testing with K8s versions 1.29 - 1.33
• Dependency updates:
  • Docker image alpine 3.21.3 => 3.22.0
  • Docker image ubi8/ubi-minimal 8.10-1179.1739286367 => 8.10-1295.1749680713
  • github.com/go-logr/logr v1.4.2 => v1.4.3
  • github.com/hashicorp/go-secure-stdlib/parseutil v0.1.9 => v0.2.0
  • github.com/hashicorp/vault/sdk v0.15.0 => v0.18.0
  • github.com/operator-framework/operator-lib v0.17.0 => v0.18.0
  • github.com/prometheus/client_golang v1.21.0 => v1.22.0
  • k8s.io/api v0.32.2 => v0.33.2
  • k8s.io/apimachinery v0.32.2 => v0.33.2
  • k8s.io/client-go v0.32.2 => v0.33.2
  • sigs.k8s.io/controller-runtime v0.20.2 => v0.21.0

Features:

• Add support for setting template_config.lease_renewal_threshold in Agent config GH-761

Changes:

• Building with Go 1.24.4
• Default Vault version updated to 1.19.5
• Testing with K8s versions 1.29 - 1.33
• Dependency updates:
  • Docker image alpine 3.21.3 => 3.22.0
  • Docker image ubi8/ubi-minimal 8.10-1179.1739286367 => 8.10-1295.1749680713
  • github.com/go-logr/logr v1.4.2 => v1.4.3
  • github.com/hashicorp/go-secure-stdlib/parseutil v0.1.9 => v0.2.0
  • github.com/hashicorp/vault/sdk v0.15.0 => v0.18.0
  • github.com/operator-framework/operator-lib v0.17.0 => v0.18.0
  • github.com/prometheus/client_golang v1.21.0 => v1.22.0
  • k8s.io/api v0.32.2 => v0.33.2
  • k8s.io/apimachinery v0.32.2 => v0.33.2
  • k8s.io/client-go v0.32.2 => v0.33.2
  • sigs.k8s.io/controller-runtime v0.20.2 => v0.21.0

Features:

• Add support for setting template_config.lease_renewal_threshold in Agent config GH-761

1.6.2 (February 26, 2025)

Changes:

• Building with Go 1.23.6
• Default Vault version updated to 1.18.5
• Testing with K8s versions 1.28 - 1.32
• Dependency updates:
  • Docker image alpine 3.21.0 => 3.21.3
  • Docker image ubi8/ubi-minimal 8.10-1130 => 8.10-1179.1739286367
  • github.com/evanphx/json-patch v5.9.0+incompatible => v5.9.11+incompatible
  • github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 => v0.1.9
  • github.com/hashicorp/vault/sdk v0.14.0 => v0.15.0
  • github.com/operator-framework/operator-lib v0.15.0 => v0.17.0
  • golang.org/x/crypto v0.31.0 => v0.35.0
  • golang.org/x/net v0.32.0 => v0.35.0
  • golang.org/x/oauth2 v0.21.0 => v0.27.0
  • golang.org/x/sys v0.28.0 => v0.30.0
  • golang.org/x/term v0.27.0 => v0.29.0
  • golang.org/x/text v0.21.0 => v0.22.0
  • k8s.io/api v0.31.3 => v0.32.2
  • k8s.io/apimachinery v0.31.3 => v0.32.2
  • k8s.io/client-go v0.31.3 => v0.32.2
  • k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 => v0.0.0-20241104100929-3ea5e8cea738
  • sigs.k8s.io/controller-runtime v0.19.2 => v0.20.2

Bugs:

• Update webhook CA bundle verification log message GH-739

Changes:

• Building with Go 1.23.6
• Default Vault version updated to 1.18.5
• Testing with K8s versions 1.28 - 1.32
• Dependency updates:
  • Docker image alpine 3.21.0 => 3.21.3
  • Docker image ubi8/ubi-minimal 8.10-1130 => 8.10-1179.1739286367
  • github.com/evanphx/json-patch v5.9.0+incompatible => v5.9.11+incompatible
  • github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 => v0.1.9
  • github.com/hashicorp/vault/sdk v0.14.0 => v0.15.0
  • github.com/operator-framework/operator-lib v0.15.0 => v0.17.0
  • golang.org/x/crypto v0.31.0 => v0.35.0
  • golang.org/x/net v0.32.0 => v0.35.0
  • golang.org/x/oauth2 v0.21.0 => v0.27.0
  • golang.org/x/sys v0.28.0 => v0.30.0
  • golang.org/x/term v0.27.0 => v0.29.0
  • golang.org/x/text v0.21.0 => v0.22.0
  • k8s.io/api v0.31.3 => v0.32.2
  • k8s.io/apimachinery v0.31.3 => v0.32.2
  • k8s.io/client-go v0.31.3 => v0.32.2
  • k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 => v0.0.0-20241104100929-3ea5e8cea738
  • sigs.k8s.io/controller-runtime v0.19.2 => v0.20.2

Bugs:

• Update webhook CA bundle verification log message GH-739

1.6.1 (December 16, 2024)

Changes:

• Dependency updates:
  • Docker image alpine 3.20.3 => 3.21.0
  • golang.org/x/crypto v0.30.0 => v0.31.0

Bugs:

• Fix metrics sidecar injection false positives GH-716

Changes:

• Dependency updates:
  • Docker image alpine 3.20.3 => 3.21.0
  • golang.org/x/crypto v0.30.0 => v0.31.0

Bugs:

• Fix metrics sidecar injection false positives GH-716

1.6.0 (December 5, 2024)

Changes:

• Building with Go 1.22.10
• Default Vault version updated to 1.18.2
• Dependency updates:
  • Docker image ubi8/ubi-minimal 8.10-1086 => 8.10-1130
  • github.com/stretchr/testify v1.9.0 => v1.10.0
  • golang.org/x/crypto v0.28.0 => v0.30.0
  • golang.org/x/net v0.30.0 => v0.32.0
  • golang.org/x/sys v0.26.0 => v0.28.0
  • golang.org/x/term v0.25.0 => v0.27.0
  • golang.org/x/text v0.19.0 => v0.21.0
  • k8s.io/api v0.31.2 => v0.31.3
  • k8s.io/apimachinery v0.31.2 => v0.31.3
  • k8s.io/client-go v0.31.2 => v0.31.3
  • sigs.k8s.io/controller-runtime v0.19.1 => v0.19.2

Features:

• Agent injection telemetry GH-703 GH-709

Improvements:

• Support AGENT_INJECT_TLS_CA_CERT_FILE env option when using manual TLS GH-679

Changes:

• Building with Go 1.22.10
• Default Vault version updated to 1.18.2
• Dependency updates:
  • Docker image ubi8/ubi-minimal 8.10-1086 => 8.10-1130
  • github.com/stretchr/testify v1.9.0 => v1.10.0
  • golang.org/x/crypto v0.28.0 => v0.30.0
  • golang.org/x/net v0.30.0 => v0.32.0
  • golang.org/x/sys v0.26.0 => v0.28.0
  • golang.org/x/term v0.25.0 => v0.27.0
  • golang.org/x/text v0.19.0 => v0.21.0
  • k8s.io/api v0.31.2 => v0.31.3
  • k8s.io/apimachinery v0.31.2 => v0.31.3
  • k8s.io/client-go v0.31.2 => v0.31.3
  • sigs.k8s.io/controller-runtime v0.19.1 => v0.19.2

Features:

• Agent injection telemetry GH-703 GH-709

Improvements:

• Support AGENT_INJECT_TLS_CA_CERT_FILE env option when using manual TLS GH-679

Changes:

• Building with Go 1.22.8
• Default Vault version updated to 1.18.1
• Testing with Vault 1.16 - 1.18
• Testing with K8s versions 1.27 - 1.31
• Dependency updates:
  • Docker image alpine 3.20.1 => 3.20.3
  • Docker image ubi8/ubi-minimal 8.10-1018 => 8.10-1086
  • github.com/hashicorp/vault/sdk v0.13.0 => v0.14.0
  • github.com/operator-framework/operator-lib v0.14.0 => v0.15.0
  • github.com/prometheus/client_golang v1.19.1 => v1.20.5
  • golang.org/x/crypto v0.26.0 => v0.28.0
  • golang.org/x/net v0.28.0 => v0.30.0
  • golang.org/x/sys v0.24.0 => v0.26.0
  • golang.org/x/term v0.23.0 => v0.25.0
  • golang.org/x/text v0.17.0 => v0.19.0
  • k8s.io/api v0.30.2 => v0.31.2
  • k8s.io/apimachinery v0.30.2 => v0.31.2
  • k8s.io/client-go v0.30.2 => v0.31.2
  • k8s.io/utils v0.0.0-20240502163921-fe8a2dddb1d0 => v0.0.0-20240711033017-18e509b52bc8
  • sigs.k8s.io/controller-runtime v0.18.4 => v0.19.1

Features:

• Add annotations for customizing template delimiters GH-664

Bugs:

• Disable handling update on pods GH-619

Changes:

• Building with Go 1.22.5
• Default Vault version updated to 1.17.1
• Testing with Vault 1.15 - 1.17
• Dependency updates:
  • Docker image alpine 3.19.1 => 3.20.1
  • Docker image ubi8/ubi-minimal 8.9-1161 => 8.10-1018
  • github.com/go-logr/logr v1.4.1 => v1.4.2
  • github.com/hashicorp/vault/sdk v0.11.1 => v0.13.0
  • github.com/operator-framework/operator-lib v0.12.0 => v0.14.0
  • github.com/prometheus/client_golang v1.19.0 => v1.19.1
  • golang.org/x/crypto v0.22.0 => v0.24.0
  • golang.org/x/net v0.24.0 => v0.26.0
  • golang.org/x/sys v0.19.0 => v0.21.0
  • golang.org/x/term v0.19.0 => v0.21.0
  • golang.org/x/text v0.14.0 => v0.16.0
  • k8s.io/api v0.29.3 => v0.30.2
  • k8s.io/apimachinery v0.29.3 => v0.30.2
  • k8s.io/client-go v0.29.3 => v0.30.2
  • k8s.io/utils v0.0.0-20230726121419-3b25d923346b => v0.0.0-20240502163921-fe8a2dddb1d0
  • sigs.k8s.io/controller-runtime v0.17.2 => v0.18.4

Changes:

• Building with Go 1.22.2
• Default Vault version updated to 1.16.1
• Dependency updates:
  • Docker UBI image ubi8/ubi-minimal 8.9-1137 => 8.9-1161
  • github.com/cenkalti/backoff/v4 v4.2.1 => v4.3.0
  • github.com/go-logr/logr v1.3.0 => v1.4.1
  • github.com/hashicorp/go-hclog v1.6.2 => v1.6.3
  • github.com/hashicorp/vault/sdk v0.11.0 => v0.11.1
  • golang.org/x/crypto v0.18.0 => v0.22.0
  • golang.org/x/net v0.20.0 => v0.24.0
  • golang.org/x/sys v0.16.0 => v0.19.0
  • golang.org/x/term v0.16.0 => v0.19.0
  • k8s.io/api v0.29.2 => v0.29.3
  • k8s.io/apimachinery v0.29.2 => v0.29.3
  • k8s.io/client-go v0.29.2 => v0.29.3
  • sigs.k8s.io/controller-runtime v0.16.3 => v0.17.2

Bugs:

• Enable logging from operator-lib's leader election (used during auto-tls certificate generation) GH-608

Features:

• Add support for max_connections_per_host within Agent injector GH-579
• Add support for error_on_missing_key within Agent injector GH-441

Changes:

• Default Vault version updated to 1.15.6
• Building with Go 1.21.7
• Testing with K8s versions 1.25-1.29
• Dependency updates:
  • Docker UBI image ubi8/ubi-minimal 8.8-1072.1697626218 => 8.9-1137
  • Docker alpine version 3.18.4 => 3.19.1
  • k8s.io/api v0.28.3 => v0.29.2
  • k8s.io/apimachinery v0.28.3 => v0.29.2
  • k8s.io/client-go v0.28.3 => v0.29.2
  • k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 => v0.0.0-20230726121419-3b25d923346b`
  • github.com/hashicorp/go-hclog v1.5.0 => v1.6.2
  • github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2 => v0.1.3
  • github.com/hashicorp/vault/sdk v0.10.2 => v0.11.0
  • github.com/prometheus/client_golang v1.17.0 => v1.19.0
  • github.com/operator-framework/operator-lib v0.11.0 => v0.12.0
  • github.com/evanphx/json-patch v5.7.0 => v5.9.0
  • github.com/stretchr/testify v1.8.4 => v1.9.0

Changes:

• Default Vault version updated to 1.15.1
• Building with Go 1.21.3
• Testing with K8s versions 1.24-1.28
• Dependency updates:
  • Docker UBI image ubi8/ubi-minimal 8.8-1037 -> 8.8-1072.1697626218
  • Docker alpine version 3.18.3 -> 3.18.4
  • golang.org/x/crypto v0.11.0 => v0.14.0
  • golang.org/x/net v0.13.0 => v0.17.0
  • golang.org/x/sys v0.10.0 => v0.13.0
  • golang.org/x/term v0.10.0 => v0.13.0
  • golang.org/x/text v0.11.0 => v0.13.0
  • k8s.io/api v0.27.4 => v0.28.3
  • k8s.io/apimachinery v0.27.4 => v0.28.3
  • k8s.io/client-go v0.27.4 => v0.28.3
  • github.com/hashicorp/vault/sdk v0.9.2 => v0.10.2
  • github.com/prometheus/client_golang v1.16.0 => v1.17.0
  • github.com/evanphx/json-patch v5.6.0 => v5.7.0

Improvements:

• Injector can set CA certificate for injected pods via AGENT_INJECT_VAULT_CACERT_BYTES env var or -vault-cacert-bytes flag GH-507
• Remove refs to deprecated io/ioutil GH-516

Improvements:

• Add NAMESPACE, HOST_IP, and POD_IP environment variables to Agent container using downward API GH-486

Changes:

• Templated secrets no longer require the -secret annotation GH-505
• Only inject Pods that are Pending GH-501
• Default to Vault 1.14.1
• Building with Go 1.20.7
• Testing with K8s versions 1.23-1.27
• Dependency updates:
  • github.com/cenkalti/backoff/v4 v4.2.0 -> v4.2.1
  • github.com/hashicorp/vault/sdk v0.8.1 -> v0.9.2
  • github.com/stretchr/testify v1.8.2 -> v1.8.4
  • github.com/prometheus/client_golang v1.14.0 -> v1.16.0
  • k8s.io/apimachinery v0.26.3 -> v0.27.4
  • k8s.io/api v0.26.3 -> v0.27.4
  • k8s.io/client-go v0.26.3 -> v0.27.4
  • golang.org/x/net v0.7.0 -> v0.13.0
  • golang.org/x/sys v0.5.0 -> v0.10.0
  • golang.org/x/term v0.5.0 -> v0.10.0
  • golang.org/x/text v0.7.0 -> v0.11.0
  • Docker alpine version 3.17.3 -> 3.18.3
  • Docker UBI image ubi8/ubi-minimal 8.7-1107 -> 8.8-1037

Bugs:

• Prevent auth-config-token-path from being overridden when another serviceaccount volume is present GH-457

Changes:

• Default to Vault 1.13.1
• Building with Go 1.20.3
• Dependency updates:
  • github.com/cenkalti/backoff/v4 v4.1.3 -> v4.2.0
  • github.com/hashicorp/go-hclog v1.3.1 -> v1.5.0
  • github.com/hashicorp/vault/sdk v0.6.1 -> v0.8.1
  • golang.org/x/net v0.4.0 -> v0.7.0
  • golang.org/x/sys v0.3.0 -> v0.5.0
  • golang.org/x/term v0.3.0 -> v0.5.0
  • golang.org/x/text v0.5.0 -> v0.7.0
  • k8s.io/api v0.25.4 -> v0.26.3
  • k8s.io/apimachinery v0.25.4 -> v0.26.3
  • k8s.io/client-go v0.25.4 -> v0.26.3
  • k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed -> v0.0.0-20230406110748-d93618cff8a2
  • Docker UBI image ubi8/ubi-minimal 8.7 -> 8.7-1107
  • Used fixed Docker alpine version: 3.17.3

Bugs:

• Don't override shareProcessNamespace if an annotation is not present GH-445

Changes:

• Building with Go 1.19.5
• Update golang.org/x/net to v0.4.0 GH-409
• Default to Vault v1.12.3

Features:

• Add support for enabling sharedProcessNamespace on the Pod spec GH-408
• Add agent-telemetry annotation GH-413

Improvements:

• Set Kubernetes user-agent to include vault-k8s version GH-411

Bugs:

• Preserve metadata when updating the cert secret GH-401

Changes:

• Building with go 1.19.3
• Default to Vault v1.12.1

Features:

• Allow modifying agent and agent-init containers with json-patch GH-399
• Support for setting exit_on_err in the agent auto-auth method config GH-400.

Improvements:

• Dependency updates:
  • github.com/cenkalti/backoff/v4 v4.1.1 => v4.1.3
  • github.com/hashicorp/go-hclog v1.0.0 => v1.3.1
  • github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.1 => v0.1.2
  • github.com/hashicorp/vault/sdk v0.2.1 => v0.6.1
  • github.com/mitchellh/cli v1.1.4 => v1.1.5
  • github.com/operator-framework/operator-lib v0.8.0 => v0.11.0
  • github.com/prometheus/client_golang v1.11.1 => v1.12.1
  • github.com/stretchr/testify v1.8.0 => v1.8.1
  • k8s.io/api v0.22.2 => v0.25.4
  • k8s.io/apimachinery v0.22.2 => v0.25.4
  • k8s.io/client-go v0.22.2 => v0.25.4

Changes:

• Default to Vault v1.12.0

Bugs:

• Default ephemeral storage resources to unset for injected containers GH-386

Improvements:

• Upgrade dependency golang.org/x/net from v0.0.0-20220708220712-1185a9018129 to v0.0.0-20221004154528-8021a29435af
• Upgrade dependency golang.org/x/sys from v0.0.0-20220520151302-bc2c85ada10a to v0.0.0-20220728004956-3c1f35247d10
• Upgrade dependency golang.org/x/text from v0.3.7 to v0.3.8

Changes:

• Upgrade Docker base image to alpine:3.16.2 GH-382
• Default to Vault v1.11.3

Features:

• Support for setting disable_keep_alives in the agent config GH-376
• Added flags, envs and annotations to control ephemeral storage resources for injected containers GH-360

Features:

• Support for setting disable_idle_connections in the agent config GH-366

Improvements:

• Added support to configure default vault namespace on the agent config GH-345

Bugs:

• Properly return admission errors GH-363

Improvements:

• ConfigMap with missing vault section should default to env vars GH-353
• Wait for certificate before starting HTTP listener GH-354
• Update example injector mutating webhook config to exclude agent pod GH-351

Bugs:

• Certificate watcher timer deadlock fix GH-350

Features:

• Add agent-enable-quit annotation GH-330
• Add go-max-procs annotation GH-333
• Add min and max auth backoff annotations and environment variables GH-341

Improvements:

• Add a name to the service port GH-262

Changes:

• Only update webhook CA bundles when needed GH-336

Features:

• Add agent-inject-containers annotation GH-313

Changes:

• Build with go 1.17.8
• Default to Vault v1.9.4