Merge pull request #4310 from kubernetes-sigs/master

🌱 Rebase with master branch to do a patch release 4.3.1

.github/dependabot.yml

@@ -11,7 +11,7 @@ updates:
     # default location of `.github/workflows`
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "daily"
     commit-message:
       prefix: ":seedling:"
     labels:
@@ -21,48 +21,36 @@ updates:
   - package-ecosystem: "gomod"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "daily"
     commit-message:
       prefix: ":seedling:"
     labels:
       - "ok-to-test"
 
-  # Maintain dependencies for dockerfile in the branches
-  - package-ecosystem: docker
-    directory: "/build/thirdparty/darwin"
-    target-branch: "tools-releases"
-    schedule:
-      interval: daily
-    commit-message:
-      prefix: ":seedling:"
-  - package-ecosystem: docker
-    directory: "/build/thirdparty/linux"
-    target-branch: "tools-releases"
+  # Maintain dependencies for go
+  - package-ecosystem: "gomod"
+    directory: "/testdata/project-v4"
     schedule:
-      interval: "weekly"
+      interval: "daily"
     commit-message:
       prefix: ":seedling:"
+    labels:
+      - "ok-to-test"
 
   # Maintain dependencies for dockerfile scaffold in the projects
-  - package-ecosystem: docker
-    directory: "testdata/project-v3"
-    schedule:
-      interval: daily
-    commit-message:
-      prefix: ":seedling:"
   - package-ecosystem: docker
     directory: "testdata/project-v4"
     schedule:
-      interval: "weekly"
+      interval: daily
     commit-message:
       prefix: ":seedling:"
 
   # Maintain dependencies for go in external plugin sample
   - package-ecosystem: "gomod"
     directory: "docs/book/src/simple-external-plugin-tutorial/testdata/sampleexternalplugin/v1"
     schedule:
-      interval: "weekly"
+      interval: "daily"
     commit-message:
-      prefix: ":seedling:"
+      prefix: ":book:"
     labels:
       - "ok-to-test"

.github/workflows/codeql.yml

@@ -0,0 +1,54 @@
+name: "CodeQL Advanced"
+
+on:
+  # We are checking both `master` and `book-v4` branches:
+  # - `master` represents the latest development work.
+  # - `book-v4` is the latest stable release branch, which contains the latest published code,
+  #   ensuring that any issues in production are identified and addressed promptly.
+  schedule:
+    - cron: '30 20 * * 1'  # Runs every Monday at 8:30 PM
+
+jobs:
+  analyze:
+    name: Analyze Go
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.22'
+
+      - name: Build and install Kubebuilder CLI
+        run: make install
+
+      # Preparing the project-v4 sample for CodeQL analysis:
+      # - `go mod tidy` ensures dependencies are fully resolved.
+      # - `make manifests` generates required manifests for a complete project structure.
+      # - `make build` builds the project code, ensuring all components are ready for CodeQL analysis.
+      - name: Build project-v4 sample project
+        run: |
+          cd testdata/project-v4
+          go mod tidy
+          echo 'Running build commands for Go in project-v4'
+          make manifests
+          make build
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: go
+          build-mode: autobuild
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:go"

.github/workflows/external-plugin.yml

@@ -0,0 +1,74 @@
+name: External Plugin
+
+on:
+  push:
+    paths:
+      - 'pkg/'
+      - 'docs/book/src/simple-external-plugin-tutorial/testdata/sampleexternalplugin'
+      - '.github/workflows/external-plugin.yml'
+  pull_request:
+    paths:
+      - 'pkg/'
+      - 'docs/book/src/simple-external-plugin-tutorial/testdata/sampleexternalplugin'
+      - '.github/workflows/external-plugin.yml'
+
+jobs:
+  external:
+    name: Verify external plugin
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1  # Minimal history to avoid .git permissions issues
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.22.3'
+
+      - name: Build Sample External Plugin
+        working-directory: docs/book/src/simple-external-plugin-tutorial/testdata/sampleexternalplugin/v1
+        run: |
+          mkdir -p ./bin
+          make build
+
+      - name: Move Plugin Binary to Plugin Path
+        run: |
+          # Define the plugin destination for Linux (XDG_CONFIG_HOME path)
+          XDG_CONFIG_HOME="${HOME}/.config"
+          PLUGIN_DEST="$XDG_CONFIG_HOME/kubebuilder/plugins/sampleexternalplugin/v1"
+
+          # Ensure destination exists and move the built binary
+          mkdir -p "$PLUGIN_DEST"
+          mv docs/book/src/simple-external-plugin-tutorial/testdata/sampleexternalplugin/v1/bin/sampleexternalplugin "$PLUGIN_DEST/sampleexternalplugin"
+          chmod +x "$PLUGIN_DEST/sampleexternalplugin"  # Ensure the binary is executable
+
+      - name: Build Kubebuilder Binary and Setup Environment
+        env:
+          KUBEBUILDER_ASSETS: $GITHUB_WORKSPACE/bin
+        run: |
+          # Build Kubebuilder Binary
+          export kb_root_dir=$(pwd)
+          go build -o "${kb_root_dir}/bin/kubebuilder" ./cmd
+          chmod +x "${kb_root_dir}/bin/kubebuilder"  # Ensure kubebuilder binary is executable
+          echo "${kb_root_dir}/bin" >> $GITHUB_PATH  # Add to PATH
+
+      - name: Create Directory, Run Kubebuilder Commands, and Validate Results
+        env:
+          KUBEBUILDER_ASSETS: $GITHUB_WORKSPACE/bin
+        run: |
+          # Create a directory named testplugin for running kubebuilder commands
+          mkdir testplugin
+          cd testplugin
+          
+          # Run Kubebuilder commands inside the testplugin directory
+          kubebuilder init --plugins sampleexternalplugin/v1 --domain sample.domain.com
+          kubebuilder create api --plugins sampleexternalplugin/v1 --number=2 --group=example --version=v1alpha1 --kind=ExampleKind
+          kubebuilder create webhook --plugins sampleexternalplugin/v1 --hooked --group=example --version=v1alpha1 --kind=ExampleKind
+
+          # Validate generated file contents
+          grep "DOMAIN: sample.domain.com" ./initFile.txt || exit 1
+          grep "NUMBER: 2" ./apiFile.txt || exit 1
+          grep "HOOKED!" ./webhookFile.txt || exit 1

.github/workflows/lint.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Run linter
         uses: golangci/golangci-lint-action@v6
         with:
-          version: v1.59
+          version: v1.61
 
   yamllint:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -4,9 +4,13 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: write
+
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -20,10 +24,14 @@ jobs:
           go-version: '~1.22'
       - name: Clean dist directory
         run: rm -rf dist || true
+      - name: Install Syft to generate SBOMs
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b $HOME/bin
+          echo "$HOME/bin" >> $GITHUB_PATH
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:
-          version: v2.1.0
+          version: v2.3.2
           args: release -f ./build/.goreleaser.yml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test-e2e-samples.yml

@@ -82,8 +82,8 @@ jobs:
           sed -i '25s/^#//' $KUSTOMIZATION_FILE_PATH
           # Uncomment only ValidatingWebhookConfiguration
           # from cert-manager replaces
-          sed -i '50,80s/^#//' $KUSTOMIZATION_FILE_PATH
-          sed -i '144,177s/^#//' $KUSTOMIZATION_FILE_PATH
+          sed -i '50,116s/^#//' $KUSTOMIZATION_FILE_PATH
+          sed -i '148,177s/^#//' $KUSTOMIZATION_FILE_PATH
           cd testdata/project-v4-with-plugins/
           go mod tidy
 

.golangci.yml

@@ -68,7 +68,7 @@ linters:
   enable:
     - dupl
     - errcheck
-    - exportloopref
+    - copyloopvar
     - ginkgolinter
     - goconst
     - gocyclo

Makefile

@@ -104,7 +104,7 @@ GOLANGCI_LINT = $(shell pwd)/bin/golangci-lint
 golangci-lint:
 	@[ -f $(GOLANGCI_LINT) ] || { \
 	set -e ;\
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(shell dirname $(GOLANGCI_LINT)) v1.59.1 ;\
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(shell dirname $(GOLANGCI_LINT)) v1.61.0 ;\
 	}
 
 .PHONY: apidiff

README.md

@@ -39,7 +39,7 @@ See the [Getting Started](https://book.kubebuilder.io/quick-start.html) document
 
 ![Quick Start](docs/gif/kb-demo.v3.11.1.svg)
 
-Also, ensure that you check out the [Deploy Image](https://book.kubebuilder.io/plugins/deploy-image-plugin-v1-alpha.html)
+Also, ensure that you check out the [Deploy Image](./docs/book/src/plugins/available/deploy-image-plugin-v1-alpha.md)
 Plugin. This plugin allows users to scaffold API/Controllers to deploy and manage an
 Operand (image) on the cluster following the guidelines and best practices. It abstracts the
 complexities of achieving this goal while allowing users to customize the generated code.

build/.goreleaser.yml

@@ -68,3 +68,12 @@ release:
   github:
     owner: kubernetes-sigs
     name: kubebuilder
+
+# Add the SBOM configuration at the end to generate SBOM files
+sboms:
+  - id: kubebuilder-sbom
+    artifacts: binary
+    cmd: syft
+    args: ["$artifact", "--output", "cyclonedx-json=$document"]
+    documents:
+      - "{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.cyclonedx.sbom.json"

designs/code-generate-image-plugin.md

@@ -1,6 +1,6 @@
 | Authors       | Creation Date | Status      | Extra |
 |---------------|---------------|-------------|---|
-| @camilamacedo86 | 2021-02-14 | Implemented | [deploy-image-plugin-v1-alpha](https://book.kubebuilder.io/plugins/deploy-image-plugin-v1-alpha.html) |
+| @camilamacedo86 | 2021-02-14 | Implemented | [deploy-image-plugin-v1-alpha](../docs/book/src/plugins/available/deploy-image-plugin-v1-alpha.md) |
 
 # New Plugin (`deploy-image.go.kubebuilder.io/v1beta1`) to generate code
 

docs/book/install-and-build.sh

@@ -63,15 +63,15 @@ esac
 
 # grab mdbook
 # we hardcode linux/amd64 since rust uses a different naming scheme and it's a pain to tran
-echo "downloading mdBook-v0.4.34-${arch}-${target}.${ext}"
+echo "downloading mdBook-v0.4.40-${arch}-${target}.${ext}"
 set -x
-curl -sL -o /tmp/mdbook.${ext} https://github.com/rust-lang/mdBook/releases/download/v0.4.34/mdBook-v0.4.34-${arch}-${target}.${ext}
+curl -sL -o /tmp/mdbook.${ext} https://github.com/rust-lang/mdBook/releases/download/v0.4.40/mdBook-v0.4.40-${arch}-${target}.${ext}
 ${cmd} /tmp/mdbook.${ext}
 chmod +x /tmp/mdbook
 
 echo "grabbing the latest released controller-gen"
 go version
-go install sigs.k8s.io/controller-tools/cmd/[email protected].1
+go install sigs.k8s.io/controller-tools/cmd/[email protected].4
 
 # make sure we add the go bin directory to our path
 gobin=$(go env GOBIN)

docs/book/src/SUMMARY.md

@@ -8,6 +8,7 @@
 
 [Getting Started](./getting-started.md)
 
+[Versions Compatibility and Supportability](./versions_compatibility_supportability.md)
 ---
 
 - [Tutorial: Building CronJob](cronjob-tutorial/cronjob-tutorial.md)

docs/book/src/cronjob-tutorial/running.md

@@ -98,3 +98,5 @@ privileges or be logged in as admin. See [Prerequisites for using Kubernetes RBA
 
 If we list cronjobs again like we did before, we should see the controller
 functioning again!
+
+[pre-rbc-gke]: https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control#iam-rolebinding-bootstrap

docs/book/src/cronjob-tutorial/testdata/project/.github/workflows/lint.yml

@@ -20,4 +20,4 @@ jobs:
       - name: Run linter
         uses: golangci/golangci-lint-action@v6
         with:
-          version: v1.59
+          version: v1.61

docs/book/src/cronjob-tutorial/testdata/project/.golangci.yml

@@ -21,7 +21,7 @@ linters:
   enable:
     - dupl
     - errcheck
-    - exportloopref
+    - copyloopvar
     - ginkgolinter
     - goconst
     - gocyclo

docs/book/src/cronjob-tutorial/testdata/project/Makefile

@@ -174,10 +174,10 @@ ENVTEST ?= $(LOCALBIN)/setup-envtest
 GOLANGCI_LINT = $(LOCALBIN)/golangci-lint
 
 ## Tool Versions
-KUSTOMIZE_VERSION ?= v5.4.3
+KUSTOMIZE_VERSION ?= v5.5.0
 CONTROLLER_TOOLS_VERSION ?= v0.16.4
 ENVTEST_VERSION ?= release-0.19
-GOLANGCI_LINT_VERSION ?= v1.59.1
+GOLANGCI_LINT_VERSION ?= v1.61.0
 
 .PHONY: kustomize
 kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.

docs/book/src/cronjob-tutorial/testdata/project/cmd/main.go

@@ -118,26 +118,24 @@ func main() {
 
 	// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
 	// More info:
-	// - https://pkg.go.dev/sigs.k8s.io/[email protected].0/pkg/metrics/server
+	// - https://pkg.go.dev/sigs.k8s.io/[email protected].1/pkg/metrics/server
 	// - https://book.kubebuilder.io/reference/metrics.html
 	metricsServerOptions := metricsserver.Options{
 		BindAddress:   metricsAddr,
 		SecureServing: secureMetrics,
-		// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
-		// not provided, self-signed certificates will be generated by default. This option is not recommended for
-		// production environments as self-signed certificates do not offer the same level of trust and security
-		// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
-		// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
-		// to provide certificates, ensuring the server communicates using trusted and secure certificates.
-		TLSOpts: tlsOpts,
+		TLSOpts:       tlsOpts,
 	}
 
 	if secureMetrics {
 		// FilterProvider is used to protect the metrics endpoint with authn/authz.
 		// These configurations ensure that only authorized users and service accounts
 		// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
-		// https://pkg.go.dev/sigs.k8s.io/[email protected].0/pkg/metrics/filters#WithAuthenticationAndAuthorization
+		// https://pkg.go.dev/sigs.k8s.io/[email protected].1/pkg/metrics/filters#WithAuthenticationAndAuthorization
 		metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
+
+		// TODO(user): If CertDir, CertName, and KeyName are not specified, controller-runtime will automatically
+		// generate self-signed certificates for the metrics server. While convenient for development and testing,
+		// this setup is not recommended for production.
 	}
 
 	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{