Dependency updates

.golangci.yml

@@ -0,0 +1,27 @@
+run:
+  timeout: 5m
+  modules-download-mode: readonly
+
+linters-settings:
+  staticcheck:
+    checks: ["all", "-SA1019"]
+
+issues:
+  exclude-rules:
+    # Exclude SA1019 (deprecation warnings) for cloud.google.com/go/pubsub v1
+    # until we migrate to v2
+    - linters:
+        - staticcheck
+      text: '"cloud.google.com/go/pubsub" is deprecated'
+      source: '"cloud\.google\.com/go/pubsub"'
+
+linters:
+  enable:
+    - staticcheck
+    - govet
+    - errcheck
+    - gosimple
+    - ineffassign
+    - unused
+    - typecheck
+  disable: []

.tool-versions

@@ -1 +1 @@
-golang 1.24.1
+golang 1.24

charts/unleasherator-crds/templates/apitoken-crd.yaml

@@ -3,7 +3,7 @@ kind: CustomResourceDefinition
 metadata:
   name: apitokens.unleash.nais.io
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.18.0
   labels:
   {{- include "unleasherator-crds.labels" . | nindent 4 }}
 spec:

charts/unleasherator-crds/templates/remoteunleash-crd.yaml

@@ -3,7 +3,7 @@ kind: CustomResourceDefinition
 metadata:
   name: remoteunleashes.unleash.nais.io
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.18.0
   labels:
   {{- include "unleasherator-crds.labels" . | nindent 4 }}
 spec:

charts/unleasherator-crds/templates/unleash-crd.yaml

@@ -3,7 +3,7 @@ kind: CustomResourceDefinition
 metadata:
   name: unleashes.unleash.nais.io
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.18.0
   labels:
   {{- include "unleasherator-crds.labels" . | nindent 4 }}
 spec:
@@ -336,7 +336,7 @@ spec:
                         Cannot be updated.
                       items:
                         description: EnvFromSource represents the source of a set of
-                          ConfigMaps
+                          ConfigMaps or Secrets
                         properties:
                           configMapRef:
                             description: The ConfigMap to select from
@@ -356,8 +356,8 @@ spec:
                             type: object
                             x-kubernetes-map-type: atomic
                           prefix:
-                            description: An optional identifier to prepend to each key
-                              in the ConfigMap. Must be a C_IDENTIFIER.
+                            description: Optional text to prepend to the name of each
+                              environment variable. Must be a C_IDENTIFIER.
                             type: string
                           secretRef:
                             description: The Secret to select from
@@ -618,6 +618,12 @@ spec:
                               - port
                               type: object
                           type: object
+                        stopSignal:
+                          description: |-
+                            StopSignal defines which signal will be sent to a container when it is being stopped.
+                            If not specified, the default is defined by the container runtime in use.
+                            StopSignal can only be set for Pods with a non-empty .spec.os.name
+                          type: string
                       type: object
                     livenessProbe:
                       description: |-
@@ -2689,7 +2695,7 @@ spec:
                         The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                         The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                         The volume will be mounted read-only (ro) and non-executable files (noexec).
-                        Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
+                        Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
                         The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                       properties:
                         pullPolicy:

charts/unleasherator/templates/manager-rbac.yaml

@@ -14,9 +14,10 @@ rules:
   - create
   - patch
 - apiGroups:
-  - apps
+  - ""
   resources:
-  - deployments
+  - secrets
+  - services
   verbs:
   - create
   - delete
@@ -28,8 +29,14 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - secrets
-  - services
+  - secrets/finalizers
+  - services/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - apps
+  resources:
+  - deployments
   verbs:
   - create
   - delete
@@ -38,13 +45,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - ""
-  resources:
-  - secrets/finalizers
-  - services/finalizers
-  verbs:
-  - update
 - apiGroups:
   - monitoring.coreos.com
   resources:

config/crd/bases/unleash.nais.io_apitokens.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: apitokens.unleash.nais.io
 spec:
   group: unleash.nais.io

config/crd/bases/unleash.nais.io_remoteunleashes.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: remoteunleashes.unleash.nais.io
 spec:
   group: unleash.nais.io

config/crd/bases/unleash.nais.io_unleashes.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: unleashes.unleash.nais.io
 spec:
   group: unleash.nais.io
@@ -337,7 +337,7 @@ spec:
                         Cannot be updated.
                       items:
                         description: EnvFromSource represents the source of a set
-                          of ConfigMaps
+                          of ConfigMaps or Secrets
                         properties:
                           configMapRef:
                             description: The ConfigMap to select from
@@ -358,8 +358,8 @@ spec:
                             type: object
                             x-kubernetes-map-type: atomic
                           prefix:
-                            description: An optional identifier to prepend to each
-                              key in the ConfigMap. Must be a C_IDENTIFIER.
+                            description: Optional text to prepend to the name of each
+                              environment variable. Must be a C_IDENTIFIER.
                             type: string
                           secretRef:
                             description: The Secret to select from
@@ -622,6 +622,12 @@ spec:
                               - port
                               type: object
                           type: object
+                        stopSignal:
+                          description: |-
+                            StopSignal defines which signal will be sent to a container when it is being stopped.
+                            If not specified, the default is defined by the container runtime in use.
+                            StopSignal can only be set for Pods with a non-empty .spec.os.name
+                          type: string
                       type: object
                     livenessProbe:
                       description: |-
@@ -2698,7 +2704,7 @@ spec:
                         The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                         The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                         The volume will be mounted read-only (ro) and non-executable files (noexec).
-                        Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
+                        Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
                         The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                       properties:
                         pullPolicy:

config/rbac/role.yaml

@@ -12,9 +12,10 @@ rules:
   - create
   - patch
 - apiGroups:
-  - apps
+  - ""
   resources:
-  - deployments
+  - secrets
+  - services
   verbs:
   - create
   - delete
@@ -26,8 +27,14 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - secrets
-  - services
+  - secrets/finalizers
+  - services/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - apps
+  resources:
+  - deployments
   verbs:
   - create
   - delete
@@ -36,13 +43,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - ""
-  resources:
-  - secrets/finalizers
-  - services/finalizers
-  verbs:
-  - update
 - apiGroups:
   - monitoring.coreos.com
   resources: