Merge pull request #1832 from OWASP/hotfix/minikube

Hotfix/minikube: update sealed secrets and vault version

.github/workflows/minikube-k8s-test.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Start minikube
         uses: medyagh/setup-minikube@master
         with:
-          minikube-version: 1.33.1
+          minikube-version: 1.35.0
           driver: docker
           kubernetes-version: v1.30.0
       - name: test script

.github/workflows/minikube-vault-test.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Start minikube
         uses: medyagh/setup-minikube@master
         with:
-          minikube-version: 1.33.1
+          minikube-version: 1.35.0
           driver: docker
           kubernetes-version: v1.30.0
       - name: Setup helm
@@ -45,7 +45,7 @@ jobs:
       - name: Start minikube
         uses: medyagh/setup-minikube@master
         with:
-          minikube-version: 1.33.1
+          minikube-version: 1.35.0
           driver: docker
           kubernetes-version: v1.30.0
       - name: Setup helm

aws/k8s-vault-aws-start.sh

@@ -42,7 +42,7 @@ else
 fi
 
 echo "Setting up the bitnami sealed secret controler"
-kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.27.0/controller.yaml
+kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.28.0/controller.yaml
 kubectl apply -f ../k8s/sealed-secret-controller.yaml
 kubectl apply -f ../k8s/main.key
 kubectl delete pod -n kube-system -l name=sealed-secrets-controller

aws/k8s/secret-challenge-vault-deployment.yml

@@ -61,8 +61,12 @@ spec:
         - image: jeroenwillemsen/wrongsecrets:1.10.2-k8s-vault
           imagePullPolicy: IfNotPresent
           name: secret-challenge
-          command: [ "/bin/sh" ]
-          args: [ "-c", "source /vault/secrets/challenge46 && source /vault/secrets/challenge47 && java -jar -Dspring.profiles.active=kubernetes-vault -Dspringdoc.swagger-ui.enabled=true -Dspringdoc.api-docs.enabled=true -D /application.jar" ]
+          command: ["/bin/sh"]
+          args:
+            [
+              "-c",
+              "source /vault/secrets/challenge46 && source /vault/secrets/challenge47 && java -jar -Dspring.profiles.active=kubernetes-vault -Dspringdoc.swagger-ui.enabled=true -Dspringdoc.api-docs.enabled=true -D /application/application.jar",
+            ]
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

azure/k8s-vault-azure-start.sh

@@ -45,7 +45,7 @@ else
 fi
 
 echo "Setting up the bitnami sealed secret controler"
-kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.27.0/controller.yaml
+kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.28.0/controller.yaml
 kubectl apply -f ../k8s/sealed-secret-controller.yaml
 kubectl apply -f ../k8s/main.key
 kubectl delete pod -n kube-system -l name=sealed-secrets-controller

azure/k8s/secret-challenge-vault-deployment.yml.tpl

@@ -65,7 +65,7 @@ spec:
           imagePullPolicy: IfNotPresent
           name: secret-challenge
           command: ["/bin/sh"]
-          args: ["-c", "source /vault/secrets/challenge46 && source /vault/secrets/challenge47 && java -jar -Dspring.profiles.active=kubernetes-vault -Dspringdoc.swagger-ui.enabled=true -Dspringdoc.api-docs.enabled=true -D /application.jar"]
+          args: ["-c", "source /vault/secrets/challenge46 && source /vault/secrets/challenge47 && java -jar -Dspring.profiles.active=kubernetes-vault -Dspringdoc.swagger-ui.enabled=true -Dspringdoc.api-docs.enabled=true -D /application/application.jar"]
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

gcp/k8s-vault-gcp-start.sh

@@ -29,7 +29,7 @@ else
 fi
 
 echo "Setting up the bitnami sealed secret controler"
-kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.27.0/controller.yaml
+kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.28.0/controller.yaml
 kubectl apply -f ../k8s/sealed-secret-controller.yaml
 kubectl apply -f ../k8s/main.key
 kubectl delete pod -n kube-system -l name=sealed-secrets-controller

gcp/k8s/secret-challenge-vault-deployment.yml.tpl

@@ -62,7 +62,7 @@ spec:
           imagePullPolicy: IfNotPresent
           name: secret-challenge
           command: ["/bin/sh"]
-          args: ["-c", "source /vault/secrets/challenge46 && source /vault/secrets/challenge47 && java -jar -Dspring.profiles.active=kubernetes-vault -Dspringdoc.swagger-ui.enabled=true -Dspringdoc.api-docs.enabled=true -D /application.jar"]
+          args: ["-c", "source /vault/secrets/challenge46 && source /vault/secrets/challenge47 && java -jar -Dspring.profiles.active=kubernetes-vault -Dspringdoc.swagger-ui.enabled=true -Dspringdoc.api-docs.enabled=true -D /application/application.jar"]
           ports:
             - containerPort: 8080
               protocol: TCP

k8s-vault-minikube-start.sh

@@ -9,7 +9,7 @@ checkCommandsAvailable helm minikube jq vault sed grep docker grep cat
 
 echo "This is only a script for demoing purposes. You can comment out line 22 and work with your own k8s setup"
 echo "This script is based on the steps defined in https://learn.hashicorp.com/tutorials/vault/kubernetes-minikube . Vault is awesome!"
-minikube start --kubernetes-version=v1.30.0
+minikube start --kubernetes-version=v1.30.0 --driver=docker
 
 echo "Patching default ns with new PSA; we should run as restricted!"
 kubectl apply -f k8s/workspace-psa.yml
@@ -21,7 +21,7 @@ else
   kubectl apply -f k8s/secrets-config.yml
 fi
 echo "Setting up the bitnami sealed secret controler"
-kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.27.0/controller.yaml
+kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.28.0/controller.yaml
 kubectl apply -f k8s/sealed-secret-controller.yaml
 kubectl apply -f k8s/main.key
 kubectl delete pod -n kube-system -l name=sealed-secrets-controller
@@ -41,10 +41,10 @@ helm list | grep 'vault' &> /dev/null
 if [ $? == 0 ]; then
    echo "Vault is already installed"
 else
-  helm repo add hashicorp https://helm.releases.hashicorp.com
+   helm repo add hashicorp https://helm.releases.hashicorp.com
 fi
 kubectl create ns vault
-helm upgrade --install vault hashicorp/vault --version 0.27.0 --namespace vault --values k8s/helm-vault-values.yml
+helm upgrade --install vault hashicorp/vault --version 0.29.1 --namespace vault --values k8s/helm-vault-values.yml
 
 isvaultrunning=$(kubectl get pods -n vault --field-selector=status.phase=Running)
 while [[ $isvaultrunning != *"vault-0"* ]]; do echo "waiting for Vault1" && sleep 2 && isvaultrunning=$(kubectl get pods -n vault --field-selector=status.phase=Running); done

k8s/secret-challenge-vault-deployment.yml

@@ -54,7 +54,11 @@ spec:
           imagePullPolicy: IfNotPresent
           name: secret-challenge
           command: ["/bin/sh"]
-          args: ["-c", "source /vault/secrets/challenge46 && source /vault/secrets/challenge47 && java -jar -Dspring.profiles.active=kubernetes-vault -Dspringdoc.swagger-ui.enabled=true -Dspringdoc.api-docs.enabled=true -D /application.jar"]
+          args:
+            [
+              "-c",
+              "source /vault/secrets/challenge46 && source /vault/secrets/challenge47 && java -jar -Dspring.profiles.active=kubernetes-vault -Dspringdoc.swagger-ui.enabled=true -Dspringdoc.api-docs.enabled=true -D /application/application.jar",
+            ]
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

scripts/install-vault.sh

@@ -7,8 +7,7 @@ else
   helm repo update hashicorp
 fi
 
-helm upgrade --install vault hashicorp/vault --version 0.28.0 --namespace vault --values ../k8s/helm-vault-values.yml --create-namespace
-
+helm upgrade --install vault hashicorp/vault --version 0.29.1 --namespace vault --values ../k8s/helm-vault-values.yml --create-namespace
 
 isvaultrunning=$(kubectl get pods -n vault --field-selector=status.phase=Running)
 while [[ $isvaultrunning != *"vault-0"* ]]; do echo "waiting for Vault0" && sleep 2 && isvaultrunning=$(kubectl get pods -n vault --field-selector=status.phase=Running); done