chore: update nginx and controller-gen

.golangci.yml

@@ -3,6 +3,8 @@ run:
   tests: false
   allow-parallel-runners: true
 linters:
+  enable:
+    - wsl_v5
   default: all
   disable:
     - revive
@@ -26,6 +28,10 @@ linters:
     - varnamelen
     - wrapcheck
   settings:
+    wsl_v5:
+      allow-first-in-block: true
+      allow-whole-block: false
+      branch-max-lines: 2
     cyclop:
       max-complexity: 27
     dupl:

Makefile

@@ -317,7 +317,7 @@ helm-doc:
 # -- Tools
 ####################
 CONTROLLER_GEN         := $(LOCALBIN)/controller-gen
-CONTROLLER_GEN_VERSION ?= v0.20.0
+CONTROLLER_GEN_VERSION ?= v0.20.1
 CONTROLLER_GEN_LOOKUP  := kubernetes-sigs/controller-tools
 controller-gen:
 	@test -s $(CONTROLLER_GEN) && $(CONTROLLER_GEN) --version | grep -q $(CONTROLLER_GEN_VERSION) || \
@@ -364,7 +364,7 @@ nwa:
 	$(call go-install-tool,$(NWA),github.com/$(NWA_LOOKUP)@$(NWA_VERSION))
 
 GOLANGCI_LINT          := $(LOCALBIN)/golangci-lint
-GOLANGCI_LINT_VERSION  := v2.4.0
+GOLANGCI_LINT_VERSION  := v2.11.4
 GOLANGCI_LINT_LOOKUP   := golangci/golangci-lint
 golangci-lint: ## Download golangci-lint locally if necessary.
 	@test -s $(GOLANGCI_LINT) && $(GOLANGCI_LINT) -h | grep -q $(GOLANGCI_LINT_VERSION) || \

api/v1beta1/clusterresoure.go

@@ -5,6 +5,7 @@ package v1beta1
 
 import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
+// ClusterResourceOperation
 // +kubebuilder:validation:Enum=List;Update;Delete
 type ClusterResourceOperation string
 
@@ -16,6 +17,7 @@ const (
 	ClusterResourceOperationList ClusterResourceOperation = "List"
 )
 
+// ClusterResource Specification
 // +kubebuilder:object:generate=true
 type ClusterResource struct {
 	// APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against any resource listed will be allowed. '*' represents all resources. Empty string represents v1 api resources.
@@ -24,8 +26,9 @@ type ClusterResource struct {
 	// Resources is a list of resources this rule applies to. '*' represents all resources.
 	Resources []string `json:"resources"`
 
-	// Operations which can be executed on the selected resources.
 	// Deprecated: For all registered Routes only LIST ang GET requests will intercepted
+	//
+	// Operations which can be executed on the selected resources.
 	// Other permissions must be implemented via kubernetes native RBAC
 	Operations []ClusterResourceOperation `json:"operations,omitempty"`
 

charts/capsule-proxy/README.md

@@ -95,7 +95,7 @@ If you only need to make minor customizations, you can specify them on the comma
 | global.jobs.certs.image.pullPolicy | string | `"IfNotPresent"` | Set the image pull policy of the post install certgen job |
 | global.jobs.certs.image.registry | string | `"registry.k8s.io"` | Set the image repository of the post install certgen job |
 | global.jobs.certs.image.repository | string | `"ingress-nginx/kube-webhook-certgen"` | Set the image repository of the post install certgen job |
-| global.jobs.certs.image.tag | string | `"v1.6.7"` | Set the image tag of the post install certgen job |
+| global.jobs.certs.image.tag | string | `"v1.6.9"` | Set the image tag of the post install certgen job |
 | global.jobs.certs.nodeSelector | object | `{}` | Set the node selector |
 | global.jobs.certs.podSecurityContext | object | `{"enabled":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the job pods. |
 | global.jobs.certs.priorityClassName | string | `""` | Set a pod priorityClassName |

charts/capsule-proxy/crds/capsule.clastix.io_globalproxysettings.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
+    controller-gen.kubebuilder.io/version: v0.20.1
   name: globalproxysettings.capsule.clastix.io
 spec:
   group: capsule.clastix.io
@@ -50,6 +50,7 @@ spec:
                     clusterResources:
                       description: Cluster Resources for tenant Owner.
                       items:
+                        description: ClusterResource Specification
                         properties:
                           apiGroups:
                             description: APIGroups is the name of the APIGroup that
@@ -62,10 +63,12 @@ spec:
                             type: array
                           operations:
                             description: |-
-                              Operations which can be executed on the selected resources.
                               Deprecated: For all registered Routes only LIST ang GET requests will intercepted
+
+                              Operations which can be executed on the selected resources.
                               Other permissions must be implemented via kubernetes native RBAC
                             items:
+                              description: ClusterResourceOperation
                               enum:
                               - List
                               - Update

charts/capsule-proxy/crds/capsule.clastix.io_proxysettings.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.20.0
+    controller-gen.kubebuilder.io/version: v0.20.1
   name: proxysettings.capsule.clastix.io
 spec:
   group: capsule.clastix.io
@@ -48,6 +48,7 @@ spec:
                     clusterResources:
                       description: Cluster Resources for tenant Owner.
                       items:
+                        description: ClusterResource Specification
                         properties:
                           apiGroups:
                             description: APIGroups is the name of the APIGroup that
@@ -60,10 +61,12 @@ spec:
                             type: array
                           operations:
                             description: |-
-                              Operations which can be executed on the selected resources.
                               Deprecated: For all registered Routes only LIST ang GET requests will intercepted
+
+                              Operations which can be executed on the selected resources.
                               Other permissions must be implemented via kubernetes native RBAC
                             items:
+                              description: ClusterResourceOperation
                               enum:
                               - List
                               - Update

charts/capsule-proxy/values.yaml

@@ -68,7 +68,7 @@ global:
         # -- Set the image pull policy of the post install certgen job
         pullPolicy: IfNotPresent
         # -- Set the image tag of the post install certgen job
-        tag: "v1.6.7"
+        tag: "v1.6.9"
       # -- Annotations to add to the certgen job.
       annotations: {}
       # -- Set the restartPolicy

internal/authorization/middleware.go

@@ -79,6 +79,8 @@ func getAllResourceRules(proxyTenants []*tenant.ProxyTenant) []authorizationv1.R
 	for _, pt := range proxyTenants {
 		for _, cr := range pt.ClusterResources {
 			verbs := []string{}
+
+			//nolint:staticcheck
 			for _, op := range cr.Operations {
 				verbs = append(verbs, strings.ToLower(op.String()))
 			}

internal/controllers/role_bindings.go

@@ -56,7 +56,7 @@ func (r *RoleBindingReflector) GetUserNamespacesFromRequest(req request.Request)
 
 	userOwnerKind := capsuleapi.UserOwner
 
-	var userRoleBindings []interface{}
+	var userRoleBindings []any
 
 	if strings.HasPrefix(username, serviceaccount.ServiceAccountUsernamePrefix) {
 		userOwnerKind = capsuleapi.ServiceAccountOwner
@@ -108,7 +108,7 @@ func (r *RoleBindingReflector) Start(ctx context.Context) error {
 	return nil
 }
 
-func OwnerRoleBindingsIndexFunc(obj interface{}) (result []string, err error) {
+func OwnerRoleBindingsIndexFunc(obj any) (result []string, err error) {
 	//nolint:forcetypeassert
 	rb := obj.(*rbacv1.RoleBinding)
 

internal/indexer/global_proxy_setting.go

@@ -15,7 +15,7 @@ const (
 	GlobalKindField = "spec.subjects.ownerkind"
 )
 
-// ProxySetting is the indexer that allows retrieving the Capsule Proxy Settings
+// GlobalProxySetting is the indexer that allows retrieving the Capsule Proxy Settings
 // for a specific actor according to its kind.
 type GlobalProxySetting struct{}
 

internal/indexer/tenant_owner.go

@@ -32,7 +32,7 @@ func (o TenantOwnerReference) Func() client.IndexerFunc {
 			panic(fmt.Errorf("expected type *capsulev1beta2.Tenant, got %T", object))
 		}
 
-		var owners []string
+		owners := make([]string, 0, len(tnt.Status.Owners))
 		for _, owner := range tnt.Status.Owners {
 			owners = append(owners, fmt.Sprintf("%s:%s", owner.Kind.String(), owner.Name))
 		}

internal/modules/clusterscoped/utils.go

@@ -14,7 +14,7 @@ import (
 	"github.com/projectcapsule/capsule-proxy/internal/tenant"
 )
 
-// Calculate Requirements for a given GroupVersionKind based on the ProxyTenants clusterResource configurations.
+// GetClusterScopeRequirements calculates requirements for a given GroupVersionKind based on the ProxyTenants clusterResource configurations.
 func GetClusterScopeRequirements(gvk *schema.GroupVersionKind, proxyTenants []*tenant.ProxyTenant) (operations []v1beta1.ClusterResourceOperation, requirements []labels.Requirement) {
 	operations = []v1beta1.ClusterResourceOperation{}
 	requirements = []labels.Requirement{}
@@ -23,6 +23,7 @@ func GetClusterScopeRequirements(gvk *schema.GroupVersionKind, proxyTenants []*t
 		for _, cr := range pt.ClusterResources {
 			if matchResource(gvk, cr) {
 				// Append Operations
+				//nolint:staticcheck
 				operations = append(operations, cr.Operations...)
 
 				// Append Selector

internal/modules/utils/gvk.go

@@ -11,7 +11,7 @@ import (
 	"k8s.io/client-go/discovery"
 )
 
-// GetGVKByPlural returns the GroupVersionKind for a given plural name.
+// ReplacePluralWithKind returns the GroupVersionKind for a given plural name.
 func ReplacePluralWithKind(discoveryClient *discovery.DiscoveryClient, gvk *schema.GroupVersionKind) error {
 	resourceList, err := discoveryClient.ServerResourcesForGroupVersion(gvk.Group + "/" + gvk.Version)
 	if err != nil {
@@ -29,7 +29,7 @@ func ReplacePluralWithKind(discoveryClient *discovery.DiscoveryClient, gvk *sche
 	return fmt.Errorf("could not find GVK for plural name: %s", gvk.Kind)
 }
 
-// Since the URL is in the format /apis/{group}/{version}/{kind} or /api/{version}/{kind}, we can extract the GVK from the URL.
+// GetGVKFromURL since the URL is in the format /apis/{group}/{version}/{kind} or /api/{version}/{kind}, we can extract the GVK from the URL.
 // However the kind will be the plural form.
 func GetGVKFromURL(url string) *schema.GroupVersionKind {
 	parts := strings.Split(url, "/")

internal/webserver/middleware/user_in_group.go

@@ -6,6 +6,7 @@ package middleware
 import (
 	"net/http"
 	"regexp"
+	"slices"
 
 	"github.com/go-logr/logr"
 	"github.com/gorilla/mux"
@@ -25,13 +26,13 @@ func CheckUserInIgnoredGroupMiddleware(client client.Writer, log logr.Logger, cl
 					log.Error(err, "Cannot retrieve username and group from request")
 				}
 
-				for _, group := range groups {
-					if ignoredUserGroups.Has(group) {
-						log.V(5).Info("current user belongs to ignored groups", "user", user)
-						fn(writer, request)
+				if slices.ContainsFunc(groups, func(group string) bool {
+					return ignoredUserGroups.Has(group)
+				}) {
+					log.V(5).Info("current user belongs to ignored groups", "user", user)
+					fn(writer, request)
 
-						return
-					}
+					return
 				}
 			}
 
@@ -50,12 +51,12 @@ func CheckUserInCapsuleGroupMiddleware(client client.Writer, log logr.Logger, cl
 
 			log.V(10).Info("request groups", "groups", groups)
 
-			for _, group := range groups {
-				if controllers.CapsuleUserGroups.Has(group) {
-					next.ServeHTTP(writer, request)
+			if slices.ContainsFunc(groups, func(group string) bool {
+				return controllers.CapsuleUserGroups.Has(group)
+			}) {
+				next.ServeHTTP(writer, request)
 
-					return
-				}
+				return
 			}
 
 			if controllers.CapsuleUsers.Has(user) {

internal/webserver/webserver.go

@@ -215,12 +215,8 @@ func (n *kubeFilter) Start(ctx context.Context) error {
 				MinVersion:     tls.VersionTLS12,
 			}
 
-			for _, authType := range n.authTypes {
-				if authType == req.TLSCertificate {
-					tlsConfig.ClientAuth = tls.VerifyClientCertIfGiven
-
-					break
-				}
+			if slices.Contains(n.authTypes, req.TLSCertificate) {
+				tlsConfig.ClientAuth = tls.VerifyClientCertIfGiven
 			}
 
 			srv = &http.Server{
@@ -392,7 +388,6 @@ func (n *kubeFilter) authorizationMiddleware(next http.Handler) http.Handler {
 	})
 }
 
-//nolint:interfacer
 func (n *kubeFilter) handleRequest(request *http.Request, selector labels.Selector) {
 	req.SanitizeImpersonationHeaders(request)
 
@@ -680,7 +675,7 @@ func (n *kubeFilter) removingHopByHopHeaders(request *http.Request) {
 	}
 	// Removing connection headers
 	for _, f := range request.Header.Values(connectionHeaderName) {
-		for _, sf := range strings.Split(f, ",") {
+		for sf := range strings.SplitSeq(f, ",") {
 			if sf = textproto.TrimString(sf); sf != "" {
 				request.Header.Del(sf)
 			}