diff --git a/go.mod b/go.mod index 9463899881..a26cf9cd73 100644 --- a/go.mod +++ b/go.mod @@ -99,7 +99,7 @@ require ( ) require ( - github.com/openshift/api v0.0.0-20260715165912-72066cc9718b + github.com/openshift/api v0.0.0-20260724065811-356624ff036f github.com/openshift/client-go v0.0.0-20260715172546-dac61734e0ec github.com/openshift/controller-runtime-common v0.0.0-20260428152732-64ee174f5e2e github.com/openshift/library-go v0.0.0-20260716164659-7926d144f96a diff --git a/go.sum b/go.sum index 55d1fbfedd..2233023b2c 100644 --- a/go.sum +++ b/go.sum @@ -200,8 +200,8 @@ github.com/onsi/ginkgo/v2 v2.28.2 h1:DTrMfpqxiNUyQ3Y0zhn1n3cOO2euFgQPYIpkWwxVFps github.com/onsi/ginkgo/v2 v2.28.2/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE= github.com/onsi/gomega v1.40.0 h1:Vtol0e1MghCD2ZVIilPDIg44XSL9l2QAn8ZNaljWcJc= github.com/onsi/gomega v1.40.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A= -github.com/openshift/api v0.0.0-20260715165912-72066cc9718b h1:gN3SihCYEwoIksD+f24wHhwiEgvaV0RxNjgmkDvBBeg= -github.com/openshift/api v0.0.0-20260715165912-72066cc9718b/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M= +github.com/openshift/api v0.0.0-20260724065811-356624ff036f h1:jGACG1DZvxDvRvH76Eh6SsXO1pVNsOqzMmvau1Oc4bc= +github.com/openshift/api v0.0.0-20260724065811-356624ff036f/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M= github.com/openshift/build-machinery-go v0.0.0-20260427155009-b879704ce51f h1:1BFlEUEcsxW1gNx64MxQQwgJDuuJxg5i7zUeOkla3QU= github.com/openshift/build-machinery-go v0.0.0-20260427155009-b879704ce51f/go.mod h1:8jcm8UPtg2mCAsxfqKil1xrmRMI3a+XU2TZ9fF8A7TE= github.com/openshift/client-go v0.0.0-20260715172546-dac61734e0ec h1:UDjX+mot5IVLpcChyBqLXG1oSB29s4UkqFmgNb0Xsqc= diff --git a/vendor/github.com/openshift/api/config/v1/types_infrastructure.go b/vendor/github.com/openshift/api/config/v1/types_infrastructure.go index 5d9f10374e..86c98664df 100644 --- a/vendor/github.com/openshift/api/config/v1/types_infrastructure.go +++ b/vendor/github.com/openshift/api/config/v1/types_infrastructure.go @@ -210,6 +210,21 @@ const ( DNSRecordsTypeInternal DNSRecordsType = "Internal" ) +// VIPManagementType defines which mechanism manages the API and Ingress +// VIPs on an on-premise cluster. +// +kubebuilder:validation:Enum=Keepalived;BGP +// +enum +type VIPManagementType string + +const ( + // VIPManagementTypeKeepalived means the VIPs are managed by the default + // keepalived/VRRP mechanism. + VIPManagementTypeKeepalived VIPManagementType = "Keepalived" + // VIPManagementTypeBGP means the VIPs are advertised via BGP by kube-vip + // (Routing Table Mode) and frr-k8s running as static pods. + VIPManagementTypeBGP VIPManagementType = "BGP" +) + // PlatformType is a specific supported infrastructure provider. // +kubebuilder:validation:Enum="";AWS;Azure;BareMetal;GCP;Libvirt;OpenStack;None;VSphere;oVirt;IBMCloud;KubeVirt;EquinixMetal;PowerVS;AlibabaCloud;Nutanix;External type PlatformType string @@ -1074,6 +1089,21 @@ type BareMetalPlatformStatus struct { // +optional LoadBalancer *BareMetalPlatformLoadBalancer `json:"loadBalancer,omitempty"` + // vipManagement indicates which VIP management mechanism is active + // on this cluster. + // Allowed values are `Keepalived`, `BGP`, and omitted. + // Once set to a non-empty value, this field is immutable. + // When set to `BGP`, kube-vip (Routing Table Mode) and frr-k8s are + // deployed as static pods to advertise VIPs via BGP, replacing the + // default keepalived/VRRP mechanism. + // When set to `Keepalived`, the default keepalived-based VIP + // management is used. + // When omitted, the default keepalived-based VIP management is used. + // +kubebuilder:validation:XValidation:rule="oldSelf == '' || self == oldSelf",message="vipManagement is immutable once set" + // +openshift:enable:FeatureGate=BGPBasedVIPManagement + // +optional + VIPManagement VIPManagementType `json:"vipManagement,omitempty"` + // dnsRecordsType determines whether records for api, api-int, and ingress // are provided by the internal DNS service or externally. // Allowed values are `Internal`, `External`, and omitted. diff --git a/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go b/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go index 6b58d9da49..0430a25cc3 100644 --- a/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go +++ b/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go @@ -181,6 +181,23 @@ type VaultKMSPluginConfig struct { // +optional VaultNamespace string `json:"vaultNamespace,omitempty"` + // vaultAuthNamespace specifies the Vault namespace to use for authentication. + // This is only applicable for Vault Enterprise installations where authentication + // and Transit operations may be in different namespaces. + // When this field is not set, the value of vaultNamespace is used for both + // authentication and Transit key operations. + // + // The value must be between 1 and 4096 characters. + // The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity. + // + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=4096 + // +kubebuilder:validation:XValidation:rule="!self.endsWith('/')",message="vaultAuthNamespace cannot end with a forward slash" + // +kubebuilder:validation:XValidation:rule="!self.contains(' ')",message="vaultAuthNamespace cannot contain spaces" + // +kubebuilder:validation:XValidation:rule="!(self in ['root', 'sys', 'audit', 'auth', 'cubbyhole', 'identity'])",message="vaultAuthNamespace cannot be a reserved string (root, sys, audit, auth, cubbyhole, identity)" + // +optional + VaultAuthNamespace string `json:"vaultAuthNamespace,omitempty"` + // tls contains the TLS configuration for connecting to the Vault server. // When this field is not set, system default TLS settings are used. // +optional @@ -191,7 +208,32 @@ type VaultKMSPluginConfig struct { // +required Authentication VaultAuthentication `json:"authentication,omitzero"` + // vaultKeyPath specifies the full path to the encryption key in Vault's Transit secrets engine, + // combining the Transit engine mount path and the key name separated by "/keys/". + // Format: /keys/ (e.g., transit/keys/my-key, myteam/transit/keys/production-key). + // + // The total path length must be between 8 and 1542 characters. + // The path cannot start or end with a forward slash, cannot contain consecutive forward slashes, + // must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) + // and forward slashes as path separators, and must not contain "." or ".." path segments. + // The key name must start and end with an alphanumeric character or underscore, and may contain + // alphanumeric characters, underscores, hyphens, and periods in the middle. + // + // +kubebuilder:validation:MinLength=8 + // +kubebuilder:validation:MaxLength=1542 + // +kubebuilder:validation:XValidation:rule="!self.startsWith('/')",message="vaultKeyPath cannot start with a forward slash" + // +kubebuilder:validation:XValidation:rule="!self.endsWith('/')",message="vaultKeyPath cannot end with a forward slash" + // +kubebuilder:validation:XValidation:rule="!self.contains('//')",message="vaultKeyPath cannot contain consecutive forward slashes" + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._~/-]+$')",message="vaultKeyPath must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) and forward slashes" + // +kubebuilder:validation:XValidation:rule="self.split('/').filter(s, s == '.' || s == '..').size() == 0",message="vaultKeyPath must not contain '.' or '..' path segments" + // +kubebuilder:validation:XValidation:rule=`self.matches('^[a-zA-Z0-9._~-]+(/[a-zA-Z0-9._~-]+)*/keys/[a-zA-Z0-9_]([a-zA-Z0-9_.-]*[a-zA-Z0-9_])?$')`,message="vaultKeyPath must follow the format /keys/ where the key name starts and ends with an alphanumeric character or underscore and may contain alphanumeric characters, underscores, hyphens, and periods" + // +required + VaultKeyPath string `json:"vaultKeyPath,omitempty"` + + // --- TOMBSTONE --- // transitMount specifies the mount path of the Vault Transit engine. + // It has been replaced by vaultKeyPath which combines the mount and key into a single path. + // The field name is reserved to prevent reuse. // // The transit mount must be between 1 and 1024 characters, cannot start or // end with a forward slash, cannot contain consecutive forward slashes, and @@ -205,10 +247,13 @@ type VaultKMSPluginConfig struct { // +kubebuilder:validation:XValidation:rule="!self.contains('//')",message="transitMount cannot contain consecutive forward slashes" // +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._~/-]+$')",message="transitMount must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) and forward slashes" // +required - TransitMount string `json:"transitMount,omitempty"` + // TransitMount string `json:"transitMount,omitempty"` + // --- TOMBSTONE --- // transitKey specifies the name of the encryption key in Vault's Transit engine. // This key is used to encrypt and decrypt data. + // It has been replaced by vaultKeyPath which combines the mount and key into a single path. + // The field name is reserved to prevent reuse. // // The transit key must be between 1 and 512 characters, cannot contain forward slashes, // and must only contain alphanumeric characters, hyphens, periods, and underscores. @@ -218,7 +263,7 @@ type VaultKMSPluginConfig struct { // +kubebuilder:validation:XValidation:rule="!self.contains('/')",message="transitKey cannot contain forward slashes" // +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._-]+$')",message="transitKey must only contain alphanumeric characters, hyphens, periods, and underscores" // +required - TransitKey string `json:"transitKey,omitempty"` + // TransitKey string `json:"transitKey,omitempty"` } // VaultTLSConfig contains TLS configuration for connecting to Vault. diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml index 76f78df82d..7707626383 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml @@ -397,6 +397,7 @@ infrastructures.config.openshift.io: - AWSClusterHostedDNSInstall - AWSDualStackInstall - AzureDualStackInstall + - BGPBasedVIPManagement - DualReplica - DyanmicServiceEndpointIBMCloud - MutableTopology diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go index 631f11a1b2..b763c1b531 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go @@ -1698,6 +1698,7 @@ var map_BareMetalPlatformStatus = map[string]string{ "ingressIPs": "ingressIPs are the external IPs which route to the default ingress controller. The IPs are suitable targets of a wildcard DNS record used to resolve default route host names. In dual stack clusters this list contains two IPs otherwise only one.", "nodeDNSIP": "nodeDNSIP is the IP address for the internal DNS used by the nodes. Unlike the one managed by the DNS operator, `NodeDNSIP` provides name resolution for the nodes themselves. There is no DNS-as-a-service for BareMetal deployments. In order to minimize necessary changes to the datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames to the nodes in the cluster.", "loadBalancer": "loadBalancer defines how the load balancer used by the cluster is configured.", + "vipManagement": "vipManagement indicates which VIP management mechanism is active on this cluster. Allowed values are `Keepalived`, `BGP`, and omitted. Once set to a non-empty value, this field is immutable. When set to `BGP`, kube-vip (Routing Table Mode) and frr-k8s are deployed as static pods to advertise VIPs via BGP, replacing the default keepalived/VRRP mechanism. When set to `Keepalived`, the default keepalived-based VIP management is used. When omitted, the default keepalived-based VIP management is used.", "dnsRecordsType": "dnsRecordsType determines whether records for api, api-int, and ingress are provided by the internal DNS service or externally. Allowed values are `Internal`, `External`, and omitted. When set to `Internal`, records are provided by the internal infrastructure and no additional user configuration is required for the cluster to function. When set to `External`, records are not provided by the internal infrastructure and must be configured by the user on a DNS server outside the cluster. Cluster nodes must use this external server for their upstream DNS requests. This value may only be set when loadBalancer.type is set to UserManaged. When omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default is `Internal`.", "machineNetworks": "machineNetworks are IP networks used to connect all the OpenShift cluster nodes.", } @@ -2501,14 +2502,14 @@ func (VaultConfigMapReference) SwaggerDoc() map[string]string { } var map_VaultKMSPluginConfig = map[string]string{ - "": "VaultKMSPluginConfig defines the KMS plugin configuration specific to Vault KMS", - "kmsPluginImage": "kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin.\n\nThe image must be a fully qualified OCI image pull spec with a SHA256 digest. The format is: host[:port][/namespace]/name@sha256: where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. The total length must be between 75 and 447 characters.\n\nShort names (e.g., \"vault-plugin\" or \"hashicorp/vault-plugin\") are not allowed. The registry hostname must be included and must contain at least one dot. Image tags (e.g., \":latest\", \":v1.0.0\") are not allowed.\n\nConsult the OpenShift documentation for compatible plugin versions with your cluster version, then obtain the image digest for that version from HashiCorp's container registry.\n\nFor disconnected environments, mirror the plugin image to an accessible registry and reference the mirrored location with its digest.", - "vaultAddress": "vaultAddress specifies the address of the HashiCorp Vault instance. The value must be a valid HTTPS URL containing only scheme, host, and optional port. Paths, user info, query parameters, and fragments are not allowed.\n\nFormat: https://hostname[:port] Example: https://vault.example.com:8200\n\nThe value must be between 1 and 512 characters.", - "vaultNamespace": "vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted. This is only applicable for Vault Enterprise installations. When this field is not set, no namespace is used.\n\nThe value must be between 1 and 4096 characters. The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity.", - "tls": "tls contains the TLS configuration for connecting to the Vault server. When this field is not set, system default TLS settings are used.", - "authentication": "authentication defines the authentication method used to authenticate with Vault.", - "transitMount": "transitMount specifies the mount path of the Vault Transit engine.\n\nThe transit mount must be between 1 and 1024 characters, cannot start or end with a forward slash, cannot contain consecutive forward slashes, and must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) and forward slashes as path separators.", - "transitKey": "transitKey specifies the name of the encryption key in Vault's Transit engine. This key is used to encrypt and decrypt data.\n\nThe transit key must be between 1 and 512 characters, cannot contain forward slashes, and must only contain alphanumeric characters, hyphens, periods, and underscores.", + "": "VaultKMSPluginConfig defines the KMS plugin configuration specific to Vault KMS", + "kmsPluginImage": "kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin.\n\nThe image must be a fully qualified OCI image pull spec with a SHA256 digest. The format is: host[:port][/namespace]/name@sha256: where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. The total length must be between 75 and 447 characters.\n\nShort names (e.g., \"vault-plugin\" or \"hashicorp/vault-plugin\") are not allowed. The registry hostname must be included and must contain at least one dot. Image tags (e.g., \":latest\", \":v1.0.0\") are not allowed.\n\nConsult the OpenShift documentation for compatible plugin versions with your cluster version, then obtain the image digest for that version from HashiCorp's container registry.\n\nFor disconnected environments, mirror the plugin image to an accessible registry and reference the mirrored location with its digest.", + "vaultAddress": "vaultAddress specifies the address of the HashiCorp Vault instance. The value must be a valid HTTPS URL containing only scheme, host, and optional port. Paths, user info, query parameters, and fragments are not allowed.\n\nFormat: https://hostname[:port] Example: https://vault.example.com:8200\n\nThe value must be between 1 and 512 characters.", + "vaultNamespace": "vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted. This is only applicable for Vault Enterprise installations. When this field is not set, no namespace is used.\n\nThe value must be between 1 and 4096 characters. The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity.", + "vaultAuthNamespace": "vaultAuthNamespace specifies the Vault namespace to use for authentication. This is only applicable for Vault Enterprise installations where authentication and Transit operations may be in different namespaces. When this field is not set, the value of vaultNamespace is used for both authentication and Transit key operations.\n\nThe value must be between 1 and 4096 characters. The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity.", + "tls": "tls contains the TLS configuration for connecting to the Vault server. When this field is not set, system default TLS settings are used.", + "authentication": "authentication defines the authentication method used to authenticate with Vault.", + "vaultKeyPath": "vaultKeyPath specifies the full path to the encryption key in Vault's Transit secrets engine, combining the Transit engine mount path and the key name separated by \"/keys/\". Format: /keys/ (e.g., transit/keys/my-key, myteam/transit/keys/production-key).\n\nThe total path length must be between 8 and 1542 characters. The path cannot start or end with a forward slash, cannot contain consecutive forward slashes, must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) and forward slashes as path separators, and must not contain \".\" or \"..\" path segments. The key name must start and end with an alphanumeric character or underscore, and may contain alphanumeric characters, underscores, hyphens, and periods in the middle.", } func (VaultKMSPluginConfig) SwaggerDoc() map[string]string { diff --git a/vendor/github.com/openshift/api/envtest-releases.yaml b/vendor/github.com/openshift/api/envtest-releases.yaml index ea376ded55..4705c327e0 100644 --- a/vendor/github.com/openshift/api/envtest-releases.yaml +++ b/vendor/github.com/openshift/api/envtest-releases.yaml @@ -116,3 +116,16 @@ releases: envtest-v1.35.1-linux-arm64.tar.gz: hash: 309308f9c66f9e2e5192c65a333a388faaaa903841f26f8a96b8f13a5eb3039bcbb818ef6ddbb5803a9cfa9b25e37249a0aed5d472badb25539696569923f87f selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.35.1-linux-arm64.tar.gz + v1.36.2: + envtest-v1.36.2-darwin-amd64.tar.gz: + hash: ca924b4435784f12ac3c2513a78d9c6527bb83f2cece48e07d017616843cb67d2ec5836b7a83818f8817c3e0b4de1319c55ead061f3e41c05553a40bf240017a + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.36.2-darwin-amd64.tar.gz + envtest-v1.36.2-darwin-arm64.tar.gz: + hash: f5e45f660fb2abb05a55093bfd3f9594ca91b074a86126112b4645d463bc4b0e0b10261da26420c4dfbef18d189ab92da6c881c347159541481185e157d37d92 + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.36.2-darwin-arm64.tar.gz + envtest-v1.36.2-linux-amd64.tar.gz: + hash: 4322b73b1d43c7a16fb46819d2e8a95e34ab2412bcc502c75231c61bdd799a2b43916e12c11f5f0251573260e60a641e34f67e81da37d2726abfcca1720b1e73 + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.36.2-linux-amd64.tar.gz + envtest-v1.36.2-linux-arm64.tar.gz: + hash: bbe6810d76c91349cdee6daf65a6a9289010d48ddc2c42d9e163897a927b6ff7de9d0addc75bd54721cfa5048f8aafcac06a950efa59f4a686f037d1386811de + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.36.2-linux-arm64.tar.gz diff --git a/vendor/github.com/openshift/api/features.md b/vendor/github.com/openshift/api/features.md index c78d402696..8179ba4524 100644 --- a/vendor/github.com/openshift/api/features.md +++ b/vendor/github.com/openshift/api/features.md @@ -13,11 +13,13 @@ | KarpenterOperator| | | | Enabled | | | | | | MutableTopology| | | | Enabled | | | | | | AuthenticationComponentProxy| | | | Enabled | | | | Enabled | +| BGPBasedVIPManagement| | | Enabled | Enabled | | | | | | ClusterAPIComputeInstall| | | Enabled | Enabled | | | | | | ClusterAPIControlPlaneInstall| | | Enabled | Enabled | | | | | | ClusterUpdatePreflight| | | Enabled | Enabled | | | | | | ConfidentialCluster| | | Enabled | Enabled | | | | | | Example2| | | Enabled | Enabled | | | | | +| GCPSovereignCloudInstall| | | Enabled | Enabled | | | | | | MachineAPIMigrationVSphere| | | Enabled | Enabled | | | | | | NetworkConnect| | | Enabled | Enabled | | | | | | NewOLMBoxCutterRuntime| | | | Enabled | | | | Enabled | @@ -68,7 +70,6 @@ | HyperShiftOnlyDynamicResourceAllocation| Enabled | | Enabled | | Enabled | | Enabled | | | ImageModeStatusReporting| | | Enabled | Enabled | | | Enabled | Enabled | | IngressComponentRouteLabels| | | Enabled | Enabled | | | Enabled | Enabled | -| IngressControllerDynamicConfigurationManager| | | Enabled | Enabled | | | Enabled | Enabled | | IngressControllerMultipleHAProxyVersions| | | Enabled | Enabled | | | Enabled | Enabled | | IrreconcilableMachineConfig| | | Enabled | Enabled | | | Enabled | Enabled | | KMSEncryption| | | Enabled | Enabled | | | Enabled | Enabled | @@ -107,6 +108,7 @@ | ExternalOIDCWithUIDAndExtraClaimMappings| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | GatewayAPIWithoutOLM| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | ImageStreamImportMode| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | +| IngressControllerDynamicConfigurationManager| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | InsightsConfig| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | InsightsOnDemandDataGather| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | KMSv1| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | diff --git a/vendor/github.com/openshift/api/features/features.go b/vendor/github.com/openshift/api/features/features.go index b45bef7705..e59194f9d4 100644 --- a/vendor/github.com/openshift/api/features/features.go +++ b/vendor/github.com/openshift/api/features/features.go @@ -663,7 +663,7 @@ var ( contactPerson("miciah"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1687"). - enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). mustRegister() FeatureGateIngressComponentRouteLabels = newFeatureGate("IngressComponentRouteLabels"). @@ -888,6 +888,14 @@ var ( enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() + FeatureGateGCPSovereignCloudInstall = newFeatureGate("GCPSovereignCloudInstall"). + reportProblemsToJiraComponent("Installer"). + contactPerson("barbacbd"). + productScope(ocpSpecific). + enhancementPR("https://github.com/openshift/enhancements/pull/1977"). + enable(inDevPreviewNoUpgrade()). + mustRegister() + FeatureCBORServingAndStorage = newFeatureGate("CBORServingAndStorage"). reportProblemsToJiraComponent("kube-apiserver"). contactPerson("benluddy"). @@ -950,6 +958,14 @@ var ( enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() + FeatureGateBGPBasedVIPManagement = newFeatureGate("BGPBasedVIPManagement"). + reportProblemsToJiraComponent("Networking / On-Prem Networking"). + contactPerson("mkowalski"). + productScope(ocpSpecific). + enhancementPR("https://github.com/openshift/enhancements/pull/1982"). + enable(inDevPreviewNoUpgrade()). + mustRegister() + FeatureGateProvisioningRequestAvailable = newFeatureGate("ProvisioningRequestAvailable"). reportProblemsToJiraComponent("Cluster Autoscaler"). contactPerson("elmiko"). diff --git a/vendor/github.com/openshift/api/machineconfiguration/v1/types.go b/vendor/github.com/openshift/api/machineconfiguration/v1/types.go index 33c12be923..5c4f6804ee 100644 --- a/vendor/github.com/openshift/api/machineconfiguration/v1/types.go +++ b/vendor/github.com/openshift/api/machineconfiguration/v1/types.go @@ -113,6 +113,19 @@ type ControllerConfigSpec struct { // +required Images map[string]string `json:"images"` + // bgpVIPPeersJSON carries the BGP VIP peer configuration (the config.json + // payload of the bgp-vip-config ConfigMap) for rendering the frr-k8s + // static pod peer file on control plane nodes. Only set when BGP-based + // VIP management is enabled. + // When omitted, BGP-based VIP management is not configured and no + // frr-k8s peer file is rendered. + // When set, the value must be between 1 and 65536 characters long. + // +openshift:enable:FeatureGate=BGPBasedVIPManagement + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=65536 + // +optional + BGPVIPPeersJSON string `json:"bgpVIPPeersJSON,omitempty"` + // baseOSContainerImage is the new-format container image for operating system updates. // +required BaseOSContainerImage string `json:"baseOSContainerImage"` diff --git a/vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.featuregated-crd-manifests.yaml index 6eb9f97c6a..a7866043ce 100644 --- a/vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.featuregated-crd-manifests.yaml +++ b/vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.featuregated-crd-manifests.yaml @@ -33,6 +33,7 @@ controllerconfigs.machineconfiguration.openshift.io: - AWSDualStackInstall - AWSEuropeanSovereignCloudInstall - AzureDualStackInstall + - BGPBasedVIPManagement - DualReplica - DyanmicServiceEndpointIBMCloud - MutableTopology diff --git a/vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.swagger_doc_generated.go index aac65c9acb..198c2b9a6d 100644 --- a/vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.swagger_doc_generated.go @@ -162,6 +162,7 @@ var map_ControllerConfigSpec = map[string]string{ "pullSecret": "pullSecret is the default pull secret that needs to be installed on all machines.", "internalRegistryPullSecret": "internalRegistryPullSecret is the pull secret for the internal registry, used by rpm-ostree to pull images from the internal registry if present", "images": "images is map of images that are used by the controller to render templates under ./templates/", + "bgpVIPPeersJSON": "bgpVIPPeersJSON carries the BGP VIP peer configuration (the config.json payload of the bgp-vip-config ConfigMap) for rendering the frr-k8s static pod peer file on control plane nodes. Only set when BGP-based VIP management is enabled. When omitted, BGP-based VIP management is not configured and no frr-k8s peer file is rendered. When set, the value must be between 1 and 65536 characters long.", "baseOSContainerImage": "baseOSContainerImage is the new-format container image for operating system updates.", "baseOSExtensionsContainerImage": "baseOSExtensionsContainerImage is the matching extensions container for the new-format container", "osImageURL": "osImageURL is the old-format container image that contains the OS update payload.", diff --git a/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go b/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go index a5dcf7d334..e8c4b1c6f7 100644 --- a/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go +++ b/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go @@ -77,4 +77,74 @@ type KMSEncryptionStatus struct { // +listMapKey=nodeName // +listMapKey=keyId HealthReports []KMSPluginHealthReport `json:"healthReports,omitempty"` + + // preflight contains the state of KMS preflight validation for this operator. + // The preflight validates the KMS provider configuration before it is used + // to create a new encryption key, catching configuration issues early such + // as incorrect login credentials or an unreachable Vault service. + // When omitted, no preflight validation is in progress. + // +optional + Preflight KMSPreflightCheck `json:"preflight,omitzero"` +} + +// KMSPreflightCheck describes a preflight validation request and its result. +// +// +kubebuilder:validation:MinProperties=1 +type KMSPreflightCheck struct { + // observedConfigHash is a hash of the KMS provider configuration and + // its referenced resources that has been observed and requires preflight + // validation before a new encryption key can be created. + // The value must be exactly 8 characters. + // +kubebuilder:validation:MinLength=8 + // +kubebuilder:validation:MaxLength=8 + // +kubebuilder:validation:XValidation:rule="self.matches('^[A-Za-z0-9_-]*={0,2}$')",message="must be a valid base64url encoded value" + // +required + ObservedConfigHash string `json:"observedConfigHash,omitempty"` + + // result contains the outcome of the most recent preflight check. + // Preflight is considered passed when result.status is Succeeded and + // result.configHash matches observedConfigHash. + // When omitted, no preflight check result has been reported yet. + // +optional + Result KMSPreflightResult `json:"result,omitzero"` +} + +// +kubebuilder:validation:Enum=Succeeded;Failed +type KMSPreflightResultStatus string + +const ( + KMSPreflightResultSucceeded KMSPreflightResultStatus = "Succeeded" + + KMSPreflightResultFailed KMSPreflightResultStatus = "Failed" +) + +// KMSPreflightResult contains the outcome of a preflight validation. +// +// +openshift:compatibility-gen:level=1 +type KMSPreflightResult struct { + // status indicates the outcome of the preflight check. + // Succeeded means the KMS plugin responded to Status, Encrypt, and + // Decrypt calls successfully. + // Failed means the validation did not pass. + // +required + Status KMSPreflightResultStatus `json:"status,omitempty"` + + // configHash is the hash of the configuration that was validated. + // This is compared against observedConfigHash to confirm the result + // corresponds to the current configuration. + // The value must be exactly 8 characters. + // +kubebuilder:validation:MinLength=8 + // +kubebuilder:validation:MaxLength=8 + // +kubebuilder:validation:XValidation:rule="self.matches('^[A-Za-z0-9_-]*={0,2}$')",message="must be a valid base64url encoded value" + // +required + ConfigHash string `json:"configHash,omitempty"` + + // remoteKeyID is the remote key encryption key identifier from KMS v2 + // StatusResponse.key_id. This is not a cryptographic key, but a unique + // representation of the remote key used to encrypt data. + // The value must be between 1 and 1024 characters. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=1024 + // +required + RemoteKeyID string `json:"remoteKeyID,omitempty"` } diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-CustomNoUpgrade.crd.yaml index 57df5e1297..37b6831596 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-CustomNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-CustomNoUpgrade.crd.yaml @@ -254,6 +254,73 @@ spec: - nodeName - keyId x-kubernetes-list-type: map + preflight: + description: |- + preflight contains the state of KMS preflight validation for this operator. + The preflight validates the KMS provider configuration before it is used + to create a new encryption key, catching configuration issues early such + as incorrect login credentials or an unreachable Vault service. + When omitted, no preflight validation is in progress. + minProperties: 1 + properties: + observedConfigHash: + description: |- + observedConfigHash is a hash of the KMS provider configuration and + its referenced resources that has been observed and requires preflight + validation before a new encryption key can be created. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + result: + description: |- + result contains the outcome of the most recent preflight check. + Preflight is considered passed when result.status is Succeeded and + result.configHash matches observedConfigHash. + When omitted, no preflight check result has been reported yet. + properties: + configHash: + description: |- + configHash is the hash of the configuration that was validated. + This is compared against observedConfigHash to confirm the result + corresponds to the current configuration. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + remoteKeyID: + description: |- + remoteKeyID is the remote key encryption key identifier from KMS v2 + StatusResponse.key_id. This is not a cryptographic key, but a unique + representation of the remote key used to encrypt data. + The value must be between 1 and 1024 characters. + maxLength: 1024 + minLength: 1 + type: string + status: + description: |- + status indicates the outcome of the preflight check. + Succeeded means the KMS plugin responded to Status, Encrypt, and + Decrypt calls successfully. + Failed means the validation did not pass. + enum: + - Succeeded + - Failed + type: string + required: + - configHash + - remoteKeyID + - status + type: object + required: + - observedConfigHash + type: object type: object generations: description: generations are used to determine when an item needs diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-DevPreviewNoUpgrade.crd.yaml index 0371d90d7a..fa289dce14 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-DevPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-DevPreviewNoUpgrade.crd.yaml @@ -254,6 +254,73 @@ spec: - nodeName - keyId x-kubernetes-list-type: map + preflight: + description: |- + preflight contains the state of KMS preflight validation for this operator. + The preflight validates the KMS provider configuration before it is used + to create a new encryption key, catching configuration issues early such + as incorrect login credentials or an unreachable Vault service. + When omitted, no preflight validation is in progress. + minProperties: 1 + properties: + observedConfigHash: + description: |- + observedConfigHash is a hash of the KMS provider configuration and + its referenced resources that has been observed and requires preflight + validation before a new encryption key can be created. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + result: + description: |- + result contains the outcome of the most recent preflight check. + Preflight is considered passed when result.status is Succeeded and + result.configHash matches observedConfigHash. + When omitted, no preflight check result has been reported yet. + properties: + configHash: + description: |- + configHash is the hash of the configuration that was validated. + This is compared against observedConfigHash to confirm the result + corresponds to the current configuration. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + remoteKeyID: + description: |- + remoteKeyID is the remote key encryption key identifier from KMS v2 + StatusResponse.key_id. This is not a cryptographic key, but a unique + representation of the remote key used to encrypt data. + The value must be between 1 and 1024 characters. + maxLength: 1024 + minLength: 1 + type: string + status: + description: |- + status indicates the outcome of the preflight check. + Succeeded means the KMS plugin responded to Status, Encrypt, and + Decrypt calls successfully. + Failed means the validation did not pass. + enum: + - Succeeded + - Failed + type: string + required: + - configHash + - remoteKeyID + - status + type: object + required: + - observedConfigHash + type: object type: object generations: description: generations are used to determine when an item needs diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-TechPreviewNoUpgrade.crd.yaml index bdabdecd35..ea688ff422 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-TechPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_20_kube-apiserver_01_kubeapiservers-TechPreviewNoUpgrade.crd.yaml @@ -254,6 +254,73 @@ spec: - nodeName - keyId x-kubernetes-list-type: map + preflight: + description: |- + preflight contains the state of KMS preflight validation for this operator. + The preflight validates the KMS provider configuration before it is used + to create a new encryption key, catching configuration issues early such + as incorrect login credentials or an unreachable Vault service. + When omitted, no preflight validation is in progress. + minProperties: 1 + properties: + observedConfigHash: + description: |- + observedConfigHash is a hash of the KMS provider configuration and + its referenced resources that has been observed and requires preflight + validation before a new encryption key can be created. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + result: + description: |- + result contains the outcome of the most recent preflight check. + Preflight is considered passed when result.status is Succeeded and + result.configHash matches observedConfigHash. + When omitted, no preflight check result has been reported yet. + properties: + configHash: + description: |- + configHash is the hash of the configuration that was validated. + This is compared against observedConfigHash to confirm the result + corresponds to the current configuration. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + remoteKeyID: + description: |- + remoteKeyID is the remote key encryption key identifier from KMS v2 + StatusResponse.key_id. This is not a cryptographic key, but a unique + representation of the remote key used to encrypt data. + The value must be between 1 and 1024 characters. + maxLength: 1024 + minLength: 1 + type: string + status: + description: |- + status indicates the outcome of the preflight check. + Succeeded means the KMS plugin responded to Status, Encrypt, and + Decrypt calls successfully. + Failed means the validation did not pass. + enum: + - Succeeded + - Failed + type: string + required: + - configHash + - remoteKeyID + - status + type: object + required: + - observedConfigHash + type: object type: object generations: description: generations are used to determine when an item needs diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-CustomNoUpgrade.crd.yaml index 0a3beba5bf..d34b121d8e 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-CustomNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-CustomNoUpgrade.crd.yaml @@ -221,6 +221,73 @@ spec: - nodeName - keyId x-kubernetes-list-type: map + preflight: + description: |- + preflight contains the state of KMS preflight validation for this operator. + The preflight validates the KMS provider configuration before it is used + to create a new encryption key, catching configuration issues early such + as incorrect login credentials or an unreachable Vault service. + When omitted, no preflight validation is in progress. + minProperties: 1 + properties: + observedConfigHash: + description: |- + observedConfigHash is a hash of the KMS provider configuration and + its referenced resources that has been observed and requires preflight + validation before a new encryption key can be created. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + result: + description: |- + result contains the outcome of the most recent preflight check. + Preflight is considered passed when result.status is Succeeded and + result.configHash matches observedConfigHash. + When omitted, no preflight check result has been reported yet. + properties: + configHash: + description: |- + configHash is the hash of the configuration that was validated. + This is compared against observedConfigHash to confirm the result + corresponds to the current configuration. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + remoteKeyID: + description: |- + remoteKeyID is the remote key encryption key identifier from KMS v2 + StatusResponse.key_id. This is not a cryptographic key, but a unique + representation of the remote key used to encrypt data. + The value must be between 1 and 1024 characters. + maxLength: 1024 + minLength: 1 + type: string + status: + description: |- + status indicates the outcome of the preflight check. + Succeeded means the KMS plugin responded to Status, Encrypt, and + Decrypt calls successfully. + Failed means the validation did not pass. + enum: + - Succeeded + - Failed + type: string + required: + - configHash + - remoteKeyID + - status + type: object + required: + - observedConfigHash + type: object type: object generations: description: generations are used to determine when an item needs diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-DevPreviewNoUpgrade.crd.yaml index 89cb665ff4..7f1e255e78 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-DevPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-DevPreviewNoUpgrade.crd.yaml @@ -221,6 +221,73 @@ spec: - nodeName - keyId x-kubernetes-list-type: map + preflight: + description: |- + preflight contains the state of KMS preflight validation for this operator. + The preflight validates the KMS provider configuration before it is used + to create a new encryption key, catching configuration issues early such + as incorrect login credentials or an unreachable Vault service. + When omitted, no preflight validation is in progress. + minProperties: 1 + properties: + observedConfigHash: + description: |- + observedConfigHash is a hash of the KMS provider configuration and + its referenced resources that has been observed and requires preflight + validation before a new encryption key can be created. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + result: + description: |- + result contains the outcome of the most recent preflight check. + Preflight is considered passed when result.status is Succeeded and + result.configHash matches observedConfigHash. + When omitted, no preflight check result has been reported yet. + properties: + configHash: + description: |- + configHash is the hash of the configuration that was validated. + This is compared against observedConfigHash to confirm the result + corresponds to the current configuration. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + remoteKeyID: + description: |- + remoteKeyID is the remote key encryption key identifier from KMS v2 + StatusResponse.key_id. This is not a cryptographic key, but a unique + representation of the remote key used to encrypt data. + The value must be between 1 and 1024 characters. + maxLength: 1024 + minLength: 1 + type: string + status: + description: |- + status indicates the outcome of the preflight check. + Succeeded means the KMS plugin responded to Status, Encrypt, and + Decrypt calls successfully. + Failed means the validation did not pass. + enum: + - Succeeded + - Failed + type: string + required: + - configHash + - remoteKeyID + - status + type: object + required: + - observedConfigHash + type: object type: object generations: description: generations are used to determine when an item needs diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-TechPreviewNoUpgrade.crd.yaml index d380fa60f4..ee81770228 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-TechPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_30_openshift-apiserver_01_openshiftapiservers-TechPreviewNoUpgrade.crd.yaml @@ -221,6 +221,73 @@ spec: - nodeName - keyId x-kubernetes-list-type: map + preflight: + description: |- + preflight contains the state of KMS preflight validation for this operator. + The preflight validates the KMS provider configuration before it is used + to create a new encryption key, catching configuration issues early such + as incorrect login credentials or an unreachable Vault service. + When omitted, no preflight validation is in progress. + minProperties: 1 + properties: + observedConfigHash: + description: |- + observedConfigHash is a hash of the KMS provider configuration and + its referenced resources that has been observed and requires preflight + validation before a new encryption key can be created. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + result: + description: |- + result contains the outcome of the most recent preflight check. + Preflight is considered passed when result.status is Succeeded and + result.configHash matches observedConfigHash. + When omitted, no preflight check result has been reported yet. + properties: + configHash: + description: |- + configHash is the hash of the configuration that was validated. + This is compared against observedConfigHash to confirm the result + corresponds to the current configuration. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + remoteKeyID: + description: |- + remoteKeyID is the remote key encryption key identifier from KMS v2 + StatusResponse.key_id. This is not a cryptographic key, but a unique + representation of the remote key used to encrypt data. + The value must be between 1 and 1024 characters. + maxLength: 1024 + minLength: 1 + type: string + status: + description: |- + status indicates the outcome of the preflight check. + Succeeded means the KMS plugin responded to Status, Encrypt, and + Decrypt calls successfully. + Failed means the validation did not pass. + enum: + - Succeeded + - Failed + type: string + required: + - configHash + - remoteKeyID + - status + type: object + required: + - observedConfigHash + type: object type: object generations: description: generations are used to determine when an item needs diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-CustomNoUpgrade.crd.yaml index a1d80bd5d9..666a325396 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-CustomNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-CustomNoUpgrade.crd.yaml @@ -376,6 +376,73 @@ spec: - nodeName - keyId x-kubernetes-list-type: map + preflight: + description: |- + preflight contains the state of KMS preflight validation for this operator. + The preflight validates the KMS provider configuration before it is used + to create a new encryption key, catching configuration issues early such + as incorrect login credentials or an unreachable Vault service. + When omitted, no preflight validation is in progress. + minProperties: 1 + properties: + observedConfigHash: + description: |- + observedConfigHash is a hash of the KMS provider configuration and + its referenced resources that has been observed and requires preflight + validation before a new encryption key can be created. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + result: + description: |- + result contains the outcome of the most recent preflight check. + Preflight is considered passed when result.status is Succeeded and + result.configHash matches observedConfigHash. + When omitted, no preflight check result has been reported yet. + properties: + configHash: + description: |- + configHash is the hash of the configuration that was validated. + This is compared against observedConfigHash to confirm the result + corresponds to the current configuration. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + remoteKeyID: + description: |- + remoteKeyID is the remote key encryption key identifier from KMS v2 + StatusResponse.key_id. This is not a cryptographic key, but a unique + representation of the remote key used to encrypt data. + The value must be between 1 and 1024 characters. + maxLength: 1024 + minLength: 1 + type: string + status: + description: |- + status indicates the outcome of the preflight check. + Succeeded means the KMS plugin responded to Status, Encrypt, and + Decrypt calls successfully. + Failed means the validation did not pass. + enum: + - Succeeded + - Failed + type: string + required: + - configHash + - remoteKeyID + - status + type: object + required: + - observedConfigHash + type: object type: object latestAvailableRevision: description: |- diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-DevPreviewNoUpgrade.crd.yaml index 9e8ba13fd5..4852e6cbcf 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-DevPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-DevPreviewNoUpgrade.crd.yaml @@ -376,6 +376,73 @@ spec: - nodeName - keyId x-kubernetes-list-type: map + preflight: + description: |- + preflight contains the state of KMS preflight validation for this operator. + The preflight validates the KMS provider configuration before it is used + to create a new encryption key, catching configuration issues early such + as incorrect login credentials or an unreachable Vault service. + When omitted, no preflight validation is in progress. + minProperties: 1 + properties: + observedConfigHash: + description: |- + observedConfigHash is a hash of the KMS provider configuration and + its referenced resources that has been observed and requires preflight + validation before a new encryption key can be created. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + result: + description: |- + result contains the outcome of the most recent preflight check. + Preflight is considered passed when result.status is Succeeded and + result.configHash matches observedConfigHash. + When omitted, no preflight check result has been reported yet. + properties: + configHash: + description: |- + configHash is the hash of the configuration that was validated. + This is compared against observedConfigHash to confirm the result + corresponds to the current configuration. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + remoteKeyID: + description: |- + remoteKeyID is the remote key encryption key identifier from KMS v2 + StatusResponse.key_id. This is not a cryptographic key, but a unique + representation of the remote key used to encrypt data. + The value must be between 1 and 1024 characters. + maxLength: 1024 + minLength: 1 + type: string + status: + description: |- + status indicates the outcome of the preflight check. + Succeeded means the KMS plugin responded to Status, Encrypt, and + Decrypt calls successfully. + Failed means the validation did not pass. + enum: + - Succeeded + - Failed + type: string + required: + - configHash + - remoteKeyID + - status + type: object + required: + - observedConfigHash + type: object type: object latestAvailableRevision: description: |- diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-TechPreviewNoUpgrade.crd.yaml index 03b3daf02a..219c856cec 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-TechPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-TechPreviewNoUpgrade.crd.yaml @@ -376,6 +376,73 @@ spec: - nodeName - keyId x-kubernetes-list-type: map + preflight: + description: |- + preflight contains the state of KMS preflight validation for this operator. + The preflight validates the KMS provider configuration before it is used + to create a new encryption key, catching configuration issues early such + as incorrect login credentials or an unreachable Vault service. + When omitted, no preflight validation is in progress. + minProperties: 1 + properties: + observedConfigHash: + description: |- + observedConfigHash is a hash of the KMS provider configuration and + its referenced resources that has been observed and requires preflight + validation before a new encryption key can be created. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + result: + description: |- + result contains the outcome of the most recent preflight check. + Preflight is considered passed when result.status is Succeeded and + result.configHash matches observedConfigHash. + When omitted, no preflight check result has been reported yet. + properties: + configHash: + description: |- + configHash is the hash of the configuration that was validated. + This is compared against observedConfigHash to confirm the result + corresponds to the current configuration. + The value must be exactly 8 characters. + maxLength: 8 + minLength: 8 + type: string + x-kubernetes-validations: + - message: must be a valid base64url encoded value + rule: self.matches('^[A-Za-z0-9_-]*={0,2}$') + remoteKeyID: + description: |- + remoteKeyID is the remote key encryption key identifier from KMS v2 + StatusResponse.key_id. This is not a cryptographic key, but a unique + representation of the remote key used to encrypt data. + The value must be between 1 and 1024 characters. + maxLength: 1024 + minLength: 1 + type: string + status: + description: |- + status indicates the outcome of the preflight check. + Succeeded means the KMS plugin responded to Status, Encrypt, and + Decrypt calls successfully. + Failed means the validation did not pass. + enum: + - Succeeded + - Failed + type: string + required: + - configHash + - remoteKeyID + - status + type: object + required: + - observedConfigHash + type: object type: object latestAvailableRevision: description: |- diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml index 05d8a24423..4232835954 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml @@ -2198,6 +2198,37 @@ spec: If unset, the default timeout is 30s format: duration type: string + configurationManagement: + description: |- + configurationManagement specifies how OpenShift router should update + the HAProxy configuration. The following values are valid for this + field: + + * "ForkAndReload". + * "Dynamic". + + Omitting this field means that the user has no opinion and the + platform may choose a reasonable default. This default is subject to + change over time. The current default is "ForkAndReload". + + "ForkAndReload" means that OpenShift router should rewrite the + HAProxy configuration file and instruct HAProxy to fork and reload. + This is OpenShift router's traditional approach. + + "Dynamic" means that OpenShift router may use HAProxy's control + socket for some configuration updates and fall back to fork and + reload for other configuration updates. This is a newer approach, + which may be less mature than ForkAndReload. This setting can + improve load-balancing fairness and metrics accuracy and reduce CPU + and memory usage if HAProxy has frequent configuration updates for + route and endpoints updates. + + Note: The "Dynamic" option is currently experimental and should not + be enabled on production clusters. + enum: + - Dynamic + - ForkAndReload + type: string connectTimeout: description: |- connectTimeout defines the maximum time to wait for diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml index 2052c5f299..90b250d4a6 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml @@ -2198,6 +2198,37 @@ spec: If unset, the default timeout is 30s format: duration type: string + configurationManagement: + description: |- + configurationManagement specifies how OpenShift router should update + the HAProxy configuration. The following values are valid for this + field: + + * "ForkAndReload". + * "Dynamic". + + Omitting this field means that the user has no opinion and the + platform may choose a reasonable default. This default is subject to + change over time. The current default is "ForkAndReload". + + "ForkAndReload" means that OpenShift router should rewrite the + HAProxy configuration file and instruct HAProxy to fork and reload. + This is OpenShift router's traditional approach. + + "Dynamic" means that OpenShift router may use HAProxy's control + socket for some configuration updates and fall back to fork and + reload for other configuration updates. This is a newer approach, + which may be less mature than ForkAndReload. This setting can + improve load-balancing fairness and metrics accuracy and reduce CPU + and memory usage if HAProxy has frequent configuration updates for + route and endpoints updates. + + Note: The "Dynamic" option is currently experimental and should not + be enabled on production clusters. + enum: + - Dynamic + - ForkAndReload + type: string connectTimeout: description: |- connectTimeout defines the maximum time to wait for diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go index 3c244a9867..8f7441b6c7 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go @@ -2815,6 +2815,7 @@ func (in *KMSEncryptionStatus) DeepCopyInto(out *KMSEncryptionStatus) { (*in)[i].DeepCopyInto(&(*out)[i]) } } + out.Preflight = in.Preflight return } @@ -2845,6 +2846,39 @@ func (in *KMSPluginHealthReport) DeepCopy() *KMSPluginHealthReport { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *KMSPreflightCheck) DeepCopyInto(out *KMSPreflightCheck) { + *out = *in + out.Result = in.Result + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSPreflightCheck. +func (in *KMSPreflightCheck) DeepCopy() *KMSPreflightCheck { + if in == nil { + return nil + } + out := new(KMSPreflightCheck) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *KMSPreflightResult) DeepCopyInto(out *KMSPreflightResult) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSPreflightResult. +func (in *KMSPreflightResult) DeepCopy() *KMSPreflightResult { + if in == nil { + return nil + } + out := new(KMSPreflightResult) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *KubeAPIServer) DeepCopyInto(out *KubeAPIServer) { *out = *in diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go b/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go index 271665a7ec..13ab0c5f6f 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go @@ -625,6 +625,16 @@ func (in KMSPluginHealthReport) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.KMSPluginHealthReport" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in KMSPreflightCheck) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.KMSPreflightCheck" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in KMSPreflightResult) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.KMSPreflightResult" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in KubeAPIServer) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.KubeAPIServer" diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go index 114b5c7a68..1dbaf9d9b9 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go @@ -1390,6 +1390,7 @@ func (InsightsReport) SwaggerDoc() map[string]string { var map_KMSEncryptionStatus = map[string]string{ "healthReports": "healthReports contains all KMS plugin health reports. When omitted, no health reports are available. Each entry must have a unique combination of nodeName and keyId.", + "preflight": "preflight contains the state of KMS preflight validation for this operator. The preflight validates the KMS provider configuration before it is used to create a new encryption key, catching configuration issues early such as incorrect login credentials or an unreachable Vault service. When omitted, no preflight validation is in progress.", } func (KMSEncryptionStatus) SwaggerDoc() map[string]string { @@ -1409,6 +1410,27 @@ func (KMSPluginHealthReport) SwaggerDoc() map[string]string { return map_KMSPluginHealthReport } +var map_KMSPreflightCheck = map[string]string{ + "": "KMSPreflightCheck describes a preflight validation request and its result.", + "observedConfigHash": "observedConfigHash is a hash of the KMS provider configuration and its referenced resources that has been observed and requires preflight validation before a new encryption key can be created. The value must be exactly 8 characters.", + "result": "result contains the outcome of the most recent preflight check. Preflight is considered passed when result.status is Succeeded and result.configHash matches observedConfigHash. When omitted, no preflight check result has been reported yet.", +} + +func (KMSPreflightCheck) SwaggerDoc() map[string]string { + return map_KMSPreflightCheck +} + +var map_KMSPreflightResult = map[string]string{ + "": "KMSPreflightResult contains the outcome of a preflight validation.", + "status": "status indicates the outcome of the preflight check. Succeeded means the KMS plugin responded to Status, Encrypt, and Decrypt calls successfully. Failed means the validation did not pass.", + "configHash": "configHash is the hash of the configuration that was validated. This is compared against observedConfigHash to confirm the result corresponds to the current configuration. The value must be exactly 8 characters.", + "remoteKeyID": "remoteKeyID is the remote key encryption key identifier from KMS v2 StatusResponse.key_id. This is not a cryptographic key, but a unique representation of the remote key used to encrypt data. The value must be between 1 and 1024 characters.", +} + +func (KMSPreflightResult) SwaggerDoc() map[string]string { + return map_KMSPreflightResult +} + var map_KubeAPIServer = map[string]string{ "": "KubeAPIServer provides information to configure an operator to manage kube-apiserver.\n\nCompatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", "metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", diff --git a/vendor/modules.txt b/vendor/modules.txt index 6c3a588070..b7395ba2c3 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -247,7 +247,7 @@ github.com/onsi/gomega/matchers/support/goraph/edge github.com/onsi/gomega/matchers/support/goraph/node github.com/onsi/gomega/matchers/support/goraph/util github.com/onsi/gomega/types -# github.com/openshift/api v0.0.0-20260715165912-72066cc9718b +# github.com/openshift/api v0.0.0-20260724065811-356624ff036f ## explicit; go 1.26.0 github.com/openshift/api github.com/openshift/api/annotations