Merge pull request #370 from shiftstack/sync-main-1.35

UPSTREAM-SYNC: Sync main with latest upstream (release-1.35)

Author: openshift-merge-bot[bot]

Dockerfile

@@ -14,19 +14,19 @@
 ##                               BUILD ARGS                                   ##
 ################################################################################
 # This build arg allows the specification of a custom Golang image.
-ARG GOLANG_IMAGE=golang:1.25.1
+ARG GOLANG_IMAGE=golang:1.25.5
 
 # The distroless image on which the CPI manager image is built.
 #
 # Please do not use "latest". Explicit tags should be used to provide
 # deterministic builds. Follow what kubernetes uses to build
 # kube-controller-manager, for example for 1.27.x:
 # https://github.com/kubernetes/kubernetes/blob/release-1.27/build/common.sh#L99
-ARG DISTROLESS_IMAGE=registry.k8s.io/build-image/go-runner:v2.4.0-go1.25.1-bookworm.0
+ARG DISTROLESS_IMAGE=registry.k8s.io/build-image/go-runner:v2.4.0-go1.25.5-bookworm.0
 
 # We use Alpine as the source for default CA certificates and some output
 # images
-ARG ALPINE_IMAGE=alpine:3.22.1
+ARG ALPINE_IMAGE=alpine:3.23.2
 
 # cinder-csi-plugin uses Debian as a base image
 ARG DEBIAN_IMAGE=registry.k8s.io/build-image/debian-base:bookworm-v1.0.6

charts/cinder-csi-plugin/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v1
-appVersion: v1.34.0
+appVersion: v1.35.0
 description: Cinder CSI Chart for OpenStack
 name: openstack-cinder-csi
-version: 2.34.0
+version: 2.35.0
 home: https://github.com/kubernetes/cloud-provider-openstack
 icon: https://github.com/kubernetes/kubernetes/blob/master/logo/logo.png
 maintainers:

charts/cinder-csi-plugin/templates/nodeplugin-daemonset.yaml

@@ -23,6 +23,8 @@ spec:
       serviceAccount: csi-cinder-node-sa
       hostNetwork: true
       dnsPolicy: {{ .Values.csi.plugin.nodePlugin.dnsPolicy }}
+      securityContext:
+        {{- toYaml .Values.csi.plugin.nodePlugin.podSecurityContext | nindent 8 }}
       containers:
         - name: node-driver-registrar
           securityContext:

charts/cinder-csi-plugin/values.yaml

@@ -25,7 +25,7 @@ csi:
   snapshotter:
     image:
       repository: registry.k8s.io/sig-storage/csi-snapshotter
-      tag: v8.3.0
+      tag: v8.4.0
       pullPolicy: IfNotPresent
     resources: {}
     extraArgs: {}

charts/manila-csi-plugin/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v1
-appVersion: v1.34.0
+appVersion: v1.35.0
 description: Manila CSI Chart for OpenStack
 name: openstack-manila-csi
-version: 2.34.0
+version: 2.35.0
 home: http://github.com/kubernetes/cloud-provider-openstack
 icon: https://github.com/kubernetes/kubernetes/blob/master/logo/logo.png
 maintainers:

charts/manila-csi-plugin/values.yaml

@@ -100,7 +100,7 @@ controllerplugin:
   snapshotter:
     image:
       repository: registry.k8s.io/sig-storage/csi-snapshotter
-      tag: v8.3.0
+      tag: v8.4.0
       pullPolicy: IfNotPresent
     resources: {}
     extraEnv: []

charts/openstack-cloud-controller-manager/Chart.yaml

@@ -1,10 +1,10 @@
 apiVersion: v2
-appVersion: v1.34.0
+appVersion: v1.35.0
 description: Openstack Cloud Controller Manager Helm Chart
 icon: https://object-storage-ca-ymq-1.vexxhost.net/swift/v1/6e4619c416ff4bd19e1c087f27a43eea/www-images-prod/openstack-logo/OpenStack-Logo-Vertical.png
 home: https://github.com/kubernetes/cloud-provider-openstack
 name: openstack-cloud-controller-manager
-version: 2.34.0
+version: 2.35.0
 maintainers:
   - name: eumel8
     email: f.kloeker@telekom.de

charts/openstack-cloud-controller-manager/templates/clusterrolebinding-sm.yaml

@@ -10,7 +10,7 @@ metadata:
     {{- end }}
 subjects:
 - kind: User
-  name: system:serviceaccount:{{ .Release.Namespace }}:{{ include "occm.name" . }}
+  name: system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccountName }}
   apiGroup: rbac.authorization.k8s.io
 roleRef:
   kind: ClusterRole

charts/openstack-cloud-controller-manager/templates/daemonset.yaml

@@ -46,6 +46,10 @@ spec:
       containers:
         - name: openstack-cloud-controller-manager
           image: "{{ .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}"
+          {{- with .Values.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           args:
             - /bin/openstack-cloud-controller-manager
             - --v={{ .Values.logVerbosityLevel }}

charts/openstack-cloud-controller-manager/values.yaml

@@ -74,6 +74,16 @@ podSecurityContext:
   # seccompProfile:
   #   type: RuntimeDefault
 
+# Set security settings for the controller container
+# For all available options, see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core
+securityContext: {}
+# securityContext:
+#   capabilities:
+#     drop:
+#     - ALL
+#   readOnlyRootFilesystem: true
+#   allowPrivilegeEscalation: false
+
 # List of controllers should be enabled.
 # Use '*' to enable all controllers.
 # Prefix a controller with '-' to disable it.