Merge branch 'fluxcd:main' into main

Author: quintonm

.github/workflows/build.yaml

@@ -23,7 +23,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.22.x
+          go-version: 1.23.x
           cache-dependency-path: |
             **/go.sum
             **/go.mod
@@ -45,7 +45,7 @@ jobs:
             exit 1
           fi
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         with:
           file: ./coverage.txt
       - name: Build container image

.github/workflows/e2e.yaml

@@ -39,14 +39,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Setup Kubernetes
-        uses: helm/kind-action@v1.10.0
+        uses: helm/kind-action@v1.12.0
         if: matrix.provider != 'skipper'
         with:
           version: v0.23.0
           cluster_name: kind
           node_image: kindest/node:v1.30.0@sha256:047357ac0cfea04663786a612ba1eaba9702bef25227a794b52890dd8bcd692e
       - name: Setup Kubernetes for skipper
-        uses: helm/kind-action@v1.10.0
+        uses: helm/kind-action@v1.12.0
         if: matrix.provider == 'skipper'
         with:
           version: v0.23.0

.github/workflows/push-ld.yml

@@ -17,7 +17,7 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@v4
-      - uses: sigstore/cosign-installer@v3.5.0
+      - uses: sigstore/cosign-installer@v3.7.0
       - name: Prepare
         id: prep
         run: |
@@ -45,7 +45,7 @@ jobs:
             type=raw,value=${{ steps.prep.outputs.VERSION }}
       - name: Publish image
         id: build-push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           push: true
           builder: ${{ steps.buildx.outputs.name }}

.github/workflows/release.yml

@@ -31,9 +31,9 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.22.x
+          go-version: 1.23.x
       - uses: fluxcd/flux2/action@main
-      - uses: sigstore/cosign-installer@v3.5.0
+      - uses: sigstore/cosign-installer@v3.7.0
       - name: Prepare
         id: prep
         run: |
@@ -67,7 +67,7 @@ jobs:
             type=raw,value=${{ steps.prep.outputs.VERSION }}
       - name: Publish image
         id: build-push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           sbom: true
           provenance: true
@@ -121,11 +121,11 @@ jobs:
       - uses: anchore/sbom-action/download-syft@v0
       - name: Create release and SBOM
         id: run-goreleaser
-        uses: goreleaser/goreleaser-action@v5
+        uses: goreleaser/goreleaser-action@v6
         if: startsWith(github.ref, 'refs/tags/v')
         with:
           version: latest
-          args: release --release-notes=notes.md --rm-dist --skip-validate
+          args: release --release-notes=notes.md --clean --skip=validate
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Generate SLSA metadata

.github/workflows/scan.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.22.x
+          go-version: 1.23.x
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
         with:

CHANGELOG.md

@@ -2,6 +2,61 @@
 
 All notable changes to this project are documented in this file.
 
+## 1.40.0
+
+**Release date:** 2024-12-17
+
+This release comes with support for Splunk Observability (formerly SignalFx) as a metrics provider.
+For more information on how to write `MetricTemplates` for Splunk, please see the
+[Splunk metrics tutorial](https://docs.flagger.app/usage/metrics#s#splunk).
+
+Starting with this version, Flagger is compatible with the
+[AWS Gateway API Controller](https://www.gateway-api-controller.eks.aws.dev/latest/).
+
+Both Flagger and the load tester Go dependencies have been updated to fix various CVEs.
+
+#### Improvements
+- Add Splunk as a metrics provider
+  [#1733](https://github.com/fluxcd/flagger/pull/1733)
+- Preserve HTTPRoute annotations injected by AWS Gateway API
+  [#1746](https://github.com/fluxcd/flagger/pull/1746)
+- Automate `zz_generated.deepcopy.go` updates with make codegen
+  [#1735](https://github.com/fluxcd/flagger/pull/1735)
+- Update dependencies
+  [#1744](https://github.com/fluxcd/flagger/pull/1744)
+
+## 1.39.0
+
+**Release date:** 2024-11-26
+
+This release comes with fixes and improvements. There is a new
+`.spec.analysis.webhooks[].disableTLS` field which disables TLS verification
+for that webhook request.
+A bug in the Gateway API provider was fixed which could lead to unecessary restarts.
+
+This release is built with Go 1.23. Lastly, all Go dependencies, Alpine and
+Kubernetes libraries were updated.
+
+#### Improvements
+- Add validation for `primaryScalerReplicas` field in the CRD
+  [#1702](https://github.com/fluxcd/flagger/pull/1702)
+- feat: add `disableTLS` option for webhooks request
+  [#1709](https://github.com/fluxcd/flagger/pull/1709)
+- Update dependencies to Kubernetes v1.31.3
+  [#1723](https://github.com/fluxcd/flagger/pull/1723)
+- Update generated client for Kubernetes 1.31
+  [#1725](https://github.com/fluxcd/flagger/pull/1725)
+- Build with Go 1.23
+  [#1726](https://github.com/fluxcd/flagger/pull/1726)
+
+#### Fixes
+- Gateway API: Sort header filters to avoid canary restarts
+  [#1713](https://github.com/fluxcd/flagger/pull/1713)
+- fix: fix codegen script and update generated code
+  [#1724](https://github.com/fluxcd/flagger/pull/1724)
+- fix(helm): podinfo fails to create the hpa object
+  [#1721](https://github.com/fluxcd/flagger/pull/1721)
+
 ## 1.38.0
 
 **Release date:** 2024-07-30
@@ -471,7 +526,7 @@ routed to the canary workload pods.
 
 **Release date:** 2022-12-15
 
-This release comes with support for Apachae APISIX. For more details see the
+This release comes with support for Apache APISIX. For more details see the
 [tutorial](https://fluxcd.io/flagger/tutorials/apisix-progressive-delivery).
 
 #### Improvements

Dockerfile

@@ -1,4 +1,11 @@
-FROM golang:1.22-alpine as builder
+ARG GO_VERSION=1.23
+ARG XX_VERSION=1.6.1
+
+FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS builder
+
+# copy build utilities
+COPY --from=xx / /
 
 ARG TARGETPLATFORM
 ARG REVISON
@@ -17,11 +24,12 @@ COPY cmd/ cmd/
 COPY pkg/ pkg/
 
 # build
-RUN CGO_ENABLED=0 go build \
+ENV CGO_ENABLED=0
+RUN xx-go build \
     -ldflags "-s -w -X github.com/fluxcd/flagger/pkg/version.REVISION=${REVISON}" \
     -a -o flagger ./cmd/flagger
 
-FROM alpine:3.20
+FROM alpine:3.21
 
 RUN apk --no-cache add ca-certificates
 

Dockerfile.loadtester

@@ -1,20 +1,20 @@
-FROM golang:1.22-alpine as builder
+FROM golang:1.23-alpine AS builder
 
 ARG TARGETPLATFORM
 ARG TARGETARCH
 ARG REVISION
 
 RUN apk --no-cache add alpine-sdk perl curl bash tar
 
-RUN HELM3_VERSION=3.15.3 && \
+RUN HELM3_VERSION=3.16.3 && \
 curl -sSL "https://get.helm.sh/helm-v${HELM3_VERSION}-linux-${TARGETARCH}.tar.gz" | tar xvz && \
 chmod +x linux-${TARGETARCH}/helm && mv linux-${TARGETARCH}/helm /usr/local/bin/helm
 
-RUN KUBECTL_VERSION=v1.29.7 &&  \
+RUN KUBECTL_VERSION=v1.31.3 &&  \
 curl -LO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl" && \
 chmod +x kubectl && mv kubectl /usr/local/bin/kubectl
 
-RUN GRPC_HEALTH_PROBE_VERSION=v0.4.28 && \
+RUN GRPC_HEALTH_PROBE_VERSION=v0.4.35 && \
 wget -qO /usr/local/bin/grpc_health_probe https://github.com/grpc-ecosystem/grpc-health-probe/releases/download/${GRPC_HEALTH_PROBE_VERSION}/grpc_health_probe-linux-${TARGETARCH} && \
 chmod +x /usr/local/bin/grpc_health_probe
 
@@ -39,7 +39,7 @@ COPY pkg/ pkg/
 # build
 RUN CGO_ENABLED=0 go build -o loadtester ./cmd/loadtester/*
 
-FROM bash:5.0
+FROM bash:5.2
 
 ARG TARGETPLATFORM
 
@@ -49,7 +49,7 @@ apk --no-cache add ca-certificates curl jq libgcc wrk hey git
 
 WORKDIR /home/app
 
-COPY --from=bats/bats:v1.1.0 /opt/bats/ /opt/bats/
+COPY --from=bats/bats:1.11.1 /opt/bats/ /opt/bats/
 RUN ln -s /opt/bats/bin/bats /usr/local/bin/
 
 COPY --from=builder /usr/local/bin/helm /usr/local/bin/

Makefile

@@ -6,7 +6,7 @@ build:
 	CGO_ENABLED=0 go build -a -o ./bin/flagger ./cmd/flagger
 
 tidy:
-	rm -f go.sum; go mod tidy -compat=1.22
+	rm -f go.sum; go mod tidy -compat=1.23
 
 vet:
 	go vet ./...

artifacts/flagger/crd.yaml

@@ -129,9 +129,11 @@ spec:
                       type: object
                       properties:
                         minReplicas:
-                          type: number
+                          type: integer
+                          minimum: 1
                         maxReplicas:
-                          type: number
+                          type: integer
+                          minimum: 1
                 ingressRef:
                   description: Ingress selector
                   type: object
@@ -1135,6 +1137,9 @@ spec:
                           retries:
                             description: Number of retries for this webhook
                             type: number
+                          disableTLS:
+                            description: Disable TLS verification for this webhook
+                            type: boolean
                           metadata:
                             description: Metadata (key-value pairs) for this webhook
                             type: object
@@ -1299,6 +1304,7 @@ spec:
                         - graphite
                         - dynatrace
                         - keptn
+                        - splunk
                     address:
                       description: API address of this provider
                       type: string

artifacts/flagger/deployment.yaml

@@ -22,7 +22,7 @@ spec:
       serviceAccountName: flagger
       containers:
       - name: flagger
-        image: ghcr.io/fluxcd/flagger:1.38.0
+        image: ghcr.io/fluxcd/flagger:1.40.0
         imagePullPolicy: IfNotPresent
         ports:
         - name: http

charts/flagger/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 name: flagger
-version: 1.38.0
-appVersion: 1.38.0
+version: 1.40.0
+appVersion: 1.40.0
 kubeVersion: ">=1.19.0-0"
 engine: gotpl
 description: Flagger is a progressive delivery operator for Kubernetes

charts/flagger/crds/crd.yaml

@@ -129,9 +129,11 @@ spec:
                       type: object
                       properties:
                         minReplicas:
-                          type: number
+                          type: integer
+                          minimum: 1
                         maxReplicas:
-                          type: number
+                          type: integer
+                          minimum: 1
                 ingressRef:
                   description: Ingress selector
                   type: object
@@ -1135,6 +1137,9 @@ spec:
                           retries:
                             description: Number of retries for this webhook
                             type: number
+                          disableTLS:
+                            description: Disable TLS verification for this webhook
+                            type: boolean
                           metadata:
                             description: Metadata (key-value pairs) for this webhook
                             type: object
@@ -1299,6 +1304,7 @@ spec:
                         - graphite
                         - dynatrace
                         - keptn
+                        - splunk
                     address:
                       description: API address of this provider
                       type: string

charts/flagger/values.yaml

@@ -5,7 +5,7 @@
 
 image:
   repository: ghcr.io/fluxcd/flagger
-  tag: 1.38.0
+  tag: 1.40.0
   pullPolicy: IfNotPresent
   pullSecret:
 

charts/loadtester/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 name: loadtester
-version: 0.33.0
-appVersion: 0.33.0
+version: 0.34.0
+appVersion: 0.34.0
 kubeVersion: ">=1.19.0-0"
 engine: gotpl
 description: Flagger's load testing services based on rakyll/hey and bojand/ghz that generates traffic during canary analysis when configured as a webhook.

charts/loadtester/values.yaml

@@ -2,7 +2,7 @@ replicaCount: 1
 
 image:
   repository: ghcr.io/fluxcd/flagger-loadtester
-  tag: 0.33.0
+  tag: 0.34.0
   pullPolicy: IfNotPresent
   pullSecret:
 

charts/podinfo/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v1
-version: 6.1.3
+version: 6.1.4
 appVersion: 6.1.3
 name: podinfo
 engine: gotpl

charts/podinfo/templates/hpa.yaml

@@ -20,12 +20,16 @@ spec:
   - type: Resource
     resource:
       name: cpu
-      targetAverageUtilization: {{ .Values.hpa.cpu }}
+      target:
+        type: Utilization
+        averageUtilization: {{ .Values.hpa.cpu }}
   {{- end }}
   {{- if .Values.hpa.memory }}
   - type: Resource
     resource:
       name: memory
-      targetAverageValue: {{ .Values.hpa.memory }}
+      target:
+        type: AverageValue 
+        averageValue: {{ .Values.hpa.memory }}
   {{- end }}
 {{- end }}

cmd/loadtester/main.go

@@ -29,7 +29,7 @@ import (
 	"github.com/fluxcd/flagger/pkg/signals"
 )
 
-var VERSION = "0.33.0"
+var VERSION = "0.34.0"
 var (
 	logLevel          string
 	port              string