Skip to content

Commit dc02939

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #783 from openshift-bot/synchronize-upstream
NO-ISSUE: Synchronize From Upstream Repositories
2 parents c921a18 + 4219fb9 commit dc02939

File tree

15 files changed

+48
-74
lines changed

15 files changed

+48
-74
lines changed

‎go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ require (
1515
github.com/mikefarah/yq/v3 v3.0.0-20201202084205-8846255d1c37
1616
github.com/onsi/ginkgo/v2 v2.19.0
1717
github.com/openshift/api v3.9.0+incompatible
18-
github.com/operator-framework/api v0.25.0
18+
github.com/operator-framework/api v0.26.0
1919
github.com/operator-framework/operator-lifecycle-manager v0.0.0-00010101000000-000000000000
2020
github.com/operator-framework/operator-registry v1.43.1
2121
github.com/sirupsen/logrus v1.9.3

‎manifests/0000_50_olm_00-catalogsources.crd.yaml

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1027,19 +1027,15 @@ spec:
10271027
SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the
10281028
right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod
10291029
Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be
1030-
run in PSA `baseline` or `privileged` namespaces. Currently if the SecurityContextConfig is unspecified, the default
1031-
value of `legacy` is used. Specifying a value other than `legacy` or `restricted` result in a validation error.
1032-
When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be
1033-
set to `legacy`.
1034-
1035-
1036-
In a future version will the default will be set to `restricted`, catalog maintainers should rebuild their catalogs
1037-
with a version of opm that supports running catalogSource pods in `restricted` mode to prepare for these changes.
1030+
run in PSA `baseline` or `privileged` namespaces. If the SecurityContextConfig is unspecified, the mode will be
1031+
determined by the namespace's PSA configuration. If the namespace is enforcing `restricted` mode, then the pod
1032+
will be configured as if `restricted` was specified. Otherwise, it will be configured as if `legacy` was
1033+
specified. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older
1034+
catalog images, which can not run in `restricted` mode, the SecurityContextConfig should be set to `legacy`.
10381035
10391036
10401037
More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/'
10411038
type: string
1042-
default: legacy
10431039
enum:
10441040
- legacy
10451041
- restricted

‎microshift-manifests/0000_50_olm_00-catalogsources.crd.yaml

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1027,19 +1027,15 @@ spec:
10271027
SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the
10281028
right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod
10291029
Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be
1030-
run in PSA `baseline` or `privileged` namespaces. Currently if the SecurityContextConfig is unspecified, the default
1031-
value of `legacy` is used. Specifying a value other than `legacy` or `restricted` result in a validation error.
1032-
When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be
1033-
set to `legacy`.
1034-
1035-
1036-
In a future version will the default will be set to `restricted`, catalog maintainers should rebuild their catalogs
1037-
with a version of opm that supports running catalogSource pods in `restricted` mode to prepare for these changes.
1030+
run in PSA `baseline` or `privileged` namespaces. If the SecurityContextConfig is unspecified, the mode will be
1031+
determined by the namespace's PSA configuration. If the namespace is enforcing `restricted` mode, then the pod
1032+
will be configured as if `restricted` was specified. Otherwise, it will be configured as if `legacy` was
1033+
specified. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older
1034+
catalog images, which can not run in `restricted` mode, the SecurityContextConfig should be set to `legacy`.
10381035
10391036
10401037
More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/'
10411038
type: string
1042-
default: legacy
10431039
enum:
10441040
- legacy
10451041
- restricted

‎staging/api/crds/operators.coreos.com_catalogsources.yaml

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1023,19 +1023,15 @@ spec:
10231023
SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the
10241024
right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod
10251025
Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be
1026-
run in PSA `baseline` or `privileged` namespaces. Currently if the SecurityContextConfig is unspecified, the default
1027-
value of `legacy` is used. Specifying a value other than `legacy` or `restricted` result in a validation error.
1028-
When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be
1029-
set to `legacy`.
1030-
1031-
1032-
In a future version will the default will be set to `restricted`, catalog maintainers should rebuild their catalogs
1033-
with a version of opm that supports running catalogSource pods in `restricted` mode to prepare for these changes.
1026+
run in PSA `baseline` or `privileged` namespaces. If the SecurityContextConfig is unspecified, the mode will be
1027+
determined by the namespace's PSA configuration. If the namespace is enforcing `restricted` mode, then the pod
1028+
will be configured as if `restricted` was specified. Otherwise, it will be configured as if `legacy` was
1029+
specified. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older
1030+
catalog images, which can not run in `restricted` mode, the SecurityContextConfig should be set to `legacy`.
10341031
10351032
10361033
More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/'
10371034
type: string
1038-
default: legacy
10391035
enum:
10401036
- legacy
10411037
- restricted

‎staging/api/crds/zz_defs.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎staging/api/go.mod

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,15 @@ require (
88
github.com/blang/semver/v4 v4.0.0
99
github.com/go-bindata/go-bindata/v3 v3.1.3
1010
github.com/google/cel-go v0.17.8
11-
github.com/sirupsen/logrus v1.9.2
11+
github.com/sirupsen/logrus v1.9.3
1212
github.com/spf13/cobra v1.8.0
1313
github.com/stretchr/testify v1.9.0
1414
google.golang.org/genproto/googleapis/api v0.0.0-20240213162025-012b6fc9bca9
1515
k8s.io/api v0.30.1
1616
k8s.io/apiextensions-apiserver v0.30.1
1717
k8s.io/apimachinery v0.30.1
1818
k8s.io/client-go v0.30.1
19-
sigs.k8s.io/controller-runtime v0.18.2
19+
sigs.k8s.io/controller-runtime v0.18.4
2020
sigs.k8s.io/yaml v1.4.0
2121
)
2222

‎staging/api/go.sum

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -106,8 +106,8 @@ github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3c
106106
github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
107107
github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
108108
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
109-
github.com/sirupsen/logrus v1.9.2 h1:oxx1eChJGI6Uks2ZC4W1zpLlVgqB8ner4EuQwV4Ik1Y=
110-
github.com/sirupsen/logrus v1.9.2/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
109+
github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
110+
github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
111111
github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
112112
github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
113113
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
@@ -269,8 +269,8 @@ k8s.io/utils v0.0.0-20240102154912-e7106e64919e h1:eQ/4ljkx21sObifjzXwlPKpdGLrCf
269269
k8s.io/utils v0.0.0-20240102154912-e7106e64919e/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
270270
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.29.0 h1:/U5vjBbQn3RChhv7P11uhYvCSm5G2GaIi5AIGBS6r4c=
271271
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.29.0/go.mod h1:z7+wmGM2dfIiLRfrC6jb5kV2Mq/sK1ZP303cxzkV5Y4=
272-
sigs.k8s.io/controller-runtime v0.18.2 h1:RqVW6Kpeaji67CY5nPEfRz6ZfFMk0lWQlNrLqlNpx+Q=
273-
sigs.k8s.io/controller-runtime v0.18.2/go.mod h1:tuAt1+wbVsXIT8lPtk5RURxqAnq7xkpv2Mhttslg7Hw=
272+
sigs.k8s.io/controller-runtime v0.18.4 h1:87+guW1zhvuPLh1PHybKdYFLU0YJp4FhJRmiHvm5BZw=
273+
sigs.k8s.io/controller-runtime v0.18.4/go.mod h1:TVoGrfdpbA9VRFaRnKgk9P5/atA0pMwq+f+msb9M8Sg=
274274
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
275275
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
276276
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=

‎staging/api/pkg/operators/v1alpha1/catalogsource_types.go

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -133,18 +133,15 @@ type GrpcPodConfig struct {
133133
// SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the
134134
// right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod
135135
// Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be
136-
// run in PSA `baseline` or `privileged` namespaces. Currently if the SecurityContextConfig is unspecified, the default
137-
// value of `legacy` is used. Specifying a value other than `legacy` or `restricted` result in a validation error.
138-
// When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be
139-
// set to `legacy`.
140-
//
141-
// In a future version will the default will be set to `restricted`, catalog maintainers should rebuild their catalogs
142-
// with a version of opm that supports running catalogSource pods in `restricted` mode to prepare for these changes.
136+
// run in PSA `baseline` or `privileged` namespaces. If the SecurityContextConfig is unspecified, the mode will be
137+
// determined by the namespace's PSA configuration. If the namespace is enforcing `restricted` mode, then the pod
138+
// will be configured as if `restricted` was specified. Otherwise, it will be configured as if `legacy` was
139+
// specified. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older
140+
// catalog images, which can not run in `restricted` mode, the SecurityContextConfig should be set to `legacy`.
143141
//
144142
// More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/'
145143
// +optional
146144
// +kubebuilder:validation:Enum=legacy;restricted
147-
// +kubebuilder:default:=legacy
148145
SecurityContextConfig SecurityConfig `json:"securityContextConfig,omitempty"`
149146

150147
// MemoryTarget configures the $GOMEMLIMIT value for the gRPC catalog Pod. This is a soft memory limit for the server,

‎staging/operator-lifecycle-manager/deploy/chart/crds/0000_50_olm_00-catalogsources.crd.yaml

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1023,19 +1023,15 @@ spec:
10231023
SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the
10241024
right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod
10251025
Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be
1026-
run in PSA `baseline` or `privileged` namespaces. Currently if the SecurityContextConfig is unspecified, the default
1027-
value of `legacy` is used. Specifying a value other than `legacy` or `restricted` result in a validation error.
1028-
When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be
1029-
set to `legacy`.
1030-
1031-
1032-
In a future version will the default will be set to `restricted`, catalog maintainers should rebuild their catalogs
1033-
with a version of opm that supports running catalogSource pods in `restricted` mode to prepare for these changes.
1026+
run in PSA `baseline` or `privileged` namespaces. If the SecurityContextConfig is unspecified, the mode will be
1027+
determined by the namespace's PSA configuration. If the namespace is enforcing `restricted` mode, then the pod
1028+
will be configured as if `restricted` was specified. Otherwise, it will be configured as if `legacy` was
1029+
specified. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older
1030+
catalog images, which can not run in `restricted` mode, the SecurityContextConfig should be set to `legacy`.
10341031
10351032
10361033
More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/'
10371034
type: string
1038-
default: legacy
10391035
enum:
10401036
- legacy
10411037
- restricted

‎staging/operator-lifecycle-manager/go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ require (
2323
github.com/onsi/gomega v1.33.1
2424
github.com/openshift/api v3.9.0+incompatible
2525
github.com/openshift/client-go v0.0.0-20220525160904-9e1acff93e4a
26-
github.com/operator-framework/api v0.25.0
26+
github.com/operator-framework/api v0.26.0
2727
github.com/operator-framework/operator-registry v1.43.1
2828
github.com/otiai10/copy v1.14.0
2929
github.com/pkg/errors v0.9.1

‎staging/operator-lifecycle-manager/go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1817,8 +1817,8 @@ github.com/openshift/api v0.0.0-20221021112143-4226c2167e40 h1:PxjGCA72RtsdHWToZ
18171817
github.com/openshift/api v0.0.0-20221021112143-4226c2167e40/go.mod h1:aQ6LDasvHMvHZXqLHnX2GRmnfTWCF/iIwz8EMTTIE9A=
18181818
github.com/openshift/client-go v0.0.0-20221019143426-16aed247da5c h1:CV76yFOTXmq9VciBR3Bve5ZWzSxdft7gaMVB3kS0rwg=
18191819
github.com/openshift/client-go v0.0.0-20221019143426-16aed247da5c/go.mod h1:lFMO8mLHXWFzSdYvGNo8ivF9SfF6zInA8ZGw4phRnUE=
1820-
github.com/operator-framework/api v0.25.0 h1:pSQwFSoPmZaTIERadawxtCwicehLkC7i9n3w3+70SVI=
1821-
github.com/operator-framework/api v0.25.0/go.mod h1:PvyCQb0x53ytIqdTECH5e+iqv+am3uZ0qGsZWmL35gQ=
1820+
github.com/operator-framework/api v0.26.0 h1:YVntU2NkVl5zSLLwK5kFcH6P3oSvN9QDgTsY9mb4yUM=
1821+
github.com/operator-framework/api v0.26.0/go.mod h1:3IxOwzVUeGxYlzfwKCcfCyS+q3EEhWA/4kv7UehbeyM=
18221822
github.com/operator-framework/operator-registry v1.43.1 h1:ACahVHGIL/hINBXd3RKWqSFR5SmSM6L5/n9xXqpR51s=
18231823
github.com/operator-framework/operator-registry v1.43.1/go.mod h1:qhssAIYWXDIW+nTg0C5i4iD9zpMtiXtfXqGUuUmGz5c=
18241824
github.com/otiai10/copy v1.14.0 h1:dCI/t1iTdYGtkvCuBG2BgR6KZa83PTclw4U5n2wAllU=

‎vendor/github.com/operator-framework/api/crds/operators.coreos.com_catalogsources.yaml

Lines changed: 5 additions & 9 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/operator-framework/api/crds/zz_defs.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/operator-framework/api/pkg/operators/v1alpha1/catalogsource_types.go

Lines changed: 5 additions & 8 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/modules.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -710,7 +710,7 @@ github.com/openshift/client-go/config/informers/externalversions/config
710710
github.com/openshift/client-go/config/informers/externalversions/config/v1
711711
github.com/openshift/client-go/config/informers/externalversions/internalinterfaces
712712
github.com/openshift/client-go/config/listers/config/v1
713-
# github.com/operator-framework/api v0.25.0 => ./staging/api
713+
# github.com/operator-framework/api v0.26.0 => ./staging/api
714714
## explicit; go 1.22.0
715715
github.com/operator-framework/api/crds
716716
github.com/operator-framework/api/pkg/constraints

0 commit comments

Comments
 (0)