forked from confidential-containers/cloud-api-adaptor
-
Notifications
You must be signed in to change notification settings - Fork 0
Sync upstream (98b37c7d) — needs conflict resolution #71
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
cloud-api-adaptor-upstream-sync
wants to merge
182
commits into
cohere
Choose a base branch
from
sync/upstream-2026-08-10-98b37c7d
base: cohere
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
182 commits
Select commit
Hold shift + click to select a range
eead66d
e2e: move the cluster provisioning using kind to byom
Amulyam24 d8ebae1
test: Add comprehensive unit tests for libvirt provider
chathuryaadapa 507a623
test: Add comprehensive cloudinit test coverage
chathuryaadapa d417390
test: Add comprehensive manager_test.go for libvirt provider
chathuryaadapa be9f467
build(deps): bump github.com/containerd/containerd
dependabot[bot] e3b88c2
podvm: Remove separate agent-ctl reference
stevenhorsman fdc8b01
versions: Bump kata-agent, trustee, GC
stevenhorsman 1a85baf
versions: Update kata-runtime go mod to 3.31.0
stevenhorsman 02bb592
versions: Pin kata-deploy version in Chart.yaml
stevenhorsman 89aa3b6
build(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6
dependabot[bot] b0d0965
deps: Bump golang.org/x/net to 0.55.0
stevenhorsman f5dd0b2
deps: Bump golang.org/x/crypto to 0.52.0
stevenhorsman a1633eb
release: pin CAA image for v0.21.0 in helm charts
stevenhorsman 7a8b043
release: Update the charts versions
stevenhorsman a7d4176
webhook: retry cert-manager apply on transient failures
BbolroC b11022e
ci: add artifact-metadata permission to podvm-ubuntu-mkosi job
stevenhorsman 64caf84
ci: add MKOSI_VERSION to workflows
stevenhorsman 63ac465
podvm: remove incompatible --image system argument for mkosi v26
stevenhorsman 1798467
podvm: normalize architecture names in cross-build-extras.sh
stevenhorsman 4faf402
aws: Add support for IAM Roles for Service Accounts (IRSA)
snir911 89392e4
aws: Add tests for EC2 client authentication methods
snir911 5695eb2
docs: Add IAM Roles for Service Accounts (IRSA) setup guide for AWS
snir911 ee30011
workflow: Update arm podvm to run natively
stevenhorsman 4a47ba0
podvm: map QEMU package names for cross-compilation
stevenhorsman ea3ea1f
release: Update charts to reflect 0.21.1 release
stevenhorsman 5f0bd43
Revert "release: pin CAA image for v0.21.0 in helm charts"
stevenhorsman 62d6714
Revert "versions: Pin kata-deploy version in Chart.yaml"
stevenhorsman d3d93d3
github: Update CITATION with release
stevenhorsman 17118c1
Dockerfile: add ca-certificates to release image
bpradipt feca8f1
build(deps): bump actions/stale from 10.2.0 to 10.3.0
dependabot[bot] c5c7784
build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0
dependabot[bot] a8e8570
build(deps): bump github/codeql-action from 4.35.4 to 4.36.0
dependabot[bot] d02f0de
build(deps): bump docker/build-push-action from 7.1.0 to 7.2.0
dependabot[bot] fcd9005
build(deps): bump docker/login-action from 4.1.0 to 4.2.0
dependabot[bot] 7932d96
fix: Resolved template injection vulnerabilities in e2e_docker workflow
pavithiran34 6b5237b
entrypoint: fix AWS auth validation logic
snir911 0a822a7
tests/provisioner: enforce IMDSv2 on CI-built podvm AMI
wainersm 640508a
fix: prevent template injection in webhook_image workflow
rafsal-rahim d9d80ef
SelectInstanceTypeToUse is called for determining the right size of V…
Qiang-Xu a34921c
podvm: Fix SSH host key generation for Ubuntu debug image
bpradipt 51db1e7
podvm: Fix SSH host key generation for Ubuntu sftp image
bpradipt 97f9f1e
helm: remove docker provider from charts
Amulyam24 409ccff
gha: remove docker provider workflows
Amulyam24 41aa5a3
caa: remove docker provider
Amulyam24 22f14b8
test: remove docker e2e tests and provisioner
Amulyam24 20a4e3f
podvm: remove docker provider podvm files
Amulyam24 bbb6064
remove docker modules
Amulyam24 8916afe
govulncheck: do not run for modules missing go source files
Amulyam24 eb835da
Add focused unit tests for libvirt image management
chathuryaadapa de2c737
ci: remove csi-wrapper build and release workflows
stevenhorsman 20544ac
docs: remove csi-wrapper documentation and references
stevenhorsman 9e42c89
csi-wrapper: remove csi-wrapper component
stevenhorsman deb3d7e
ibmcloud: update import.sh to use oras artifacts
stevenhorsman b017231
ci: remove packer-based podvm workflow files
stevenhorsman cfb988b
build: remove podvm targets from Makefile
stevenhorsman 2730476
refactor: consolidate to mkosi-based podvm builds
stevenhorsman e82708e
aws: remove packer-based image build directory
stevenhorsman 622f3c4
podvm: remove packer-specific download-image.sh script
stevenhorsman a566f30
docs: update documentation to remove packer references
stevenhorsman 82deae1
test/azure: Update packer reference
stevenhorsman 0e7ef7e
build(deps): bump the libvirt group across 2 directories with 2 updates
dependabot[bot] 1a1870e
workflows: Update zizmor reporting
stevenhorsman c031205
ci: assert gh runners in provenance verification
mkulke 60df85e
versions: Bump golang to 1.25.11
stevenhorsman ac8fdb8
ci: remove azure gh action workflows
mkulke ec7195d
podvm: merge src/cloud-api-adaptor/podvm-{mkosi} folders (#3132)
Copilot ac86fac
libvirt: Add comprehensive unit tests for libvirt provider
chathuryaadapa a9ddb9a
libvirt: enable memory ballooning for s390x
ajaypvictor c6f7348
Add cloud-native volume passthrough for Peer Pods
mohammedadnan21 2b1320c
fix: Resolve template injection in e2e_libvirt
siddu-os 1044fa9
fix: Resolve template injection in podvm_mkosi
siddu-os 8776bd7
fix: Resolve additional template injection vulnerabilities
siddu-os fe51cb1
fix: Address zizmor security scan warnings and notices
siddu-os 8b44766
libvirt: set CPU host-model for s390x domain XML
ajaypvictor c4de470
build(deps): bump the aws-sdk-go-v2 group across 2 directories with 8…
dependabot[bot] 2fb9478
build(deps): bump github/codeql-action from 4.36.0 to 4.36.2
dependabot[bot] 2902380
build(deps): bump actions/checkout from 6.0.2 to 6.0.3
dependabot[bot] dfe4180
ci: fix podvm_mkosi concurrency group conflicts
stevenhorsman 962ad8e
test: add unit tests for streamIO wrapper
chathuryaadapa 3e23472
ci: Temporarily ignore the pull_request_target warning
stevenhorsman 6a72479
build(deps): bump the ibm-sdk group across 2 directories with 5 updates
dependabot[bot] 2642a92
build(deps): bump go.mongodb.org/mongo-driver in /src/cloud-providers
dependabot[bot] 7124c24
podvm: Fix OVMF boot configuration for Ubuntu 24.04 hosts
stevenhorsman d5a0800
build(deps): bump github.com/containerd/containerd
dependabot[bot] 928879f
providers: add Uint64WithEnv to FlagRegistrar
ajaypvictor 9d42940
libvirt: add configurable root disk size
ajaypvictor 4b9dcf2
config-extractor: handle typed numeric constants
ajaypvictor 23ea899
probe: bind startup probe server to localhost
thejasn 4e57385
tlsutil: promote k8s.io/component-base to direct dependency
thejasn e4f98e6
tlsutil: add tlsconfig package for TLS option parsing
thejasn 9d667a7
tlsutil: support dynamic TLS version and cipher suite configuration
thejasn 2e64532
forwarder: add MinTLSVersion and CipherSuites to APF user-data config
thejasn d45732c
adaptor: write MinTLSVersion and CipherSuites into peer pod user-data
thejasn 58fc995
cmd: add TLS min version and cipher suite flags
thejasn 3424a41
webhook: add configurable TLS profile via env vars
thejasn 75066e4
charts: add TLS min version and cipher suite configuration
thejasn c4e1ab9
webhook: secure metrics endpoint with native SecureServing
thejasn eb5c28d
docs: add TLS profile configuration guide for peer pod connections
thejasn 82ded93
build(deps): bump go.opentelemetry.io/otel/sdk to v1.40.0 in webhook
thejasn b4ba450
podvm: build podvm byom binaries image
Amulyam24 cc63a0b
gha: publish podvm byom binaries image for every release
Amulyam24 543b3bd
gha: move byom images to the e2e workflow
Amulyam24 d780061
ci: add govulncheck ignore list support
stevenhorsman 6d7531e
build(deps): bump actions/checkout from 6.0.2 to 7.0.0
dependabot[bot] a98b139
gha: do not set PUSH=true for building podvm binaries
Amulyam24 b5ed2fa
build(deps): bump the google-cloud group across 2 directories with 2 …
dependabot[bot] cce5c64
build(deps): bump google.golang.org/grpc in /src/webhook
dependabot[bot] 64fdad7
build(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7
dependabot[bot] bc57a8c
build(deps): bump aws-actions/configure-aws-credentials
dependabot[bot] 8ce182e
build(deps): bump docker/login-action from 3.3.0 to 4.2.0
dependabot[bot] 044f8a7
build(deps): bump docker/setup-buildx-action from 3.7.1 to 4.1.0
dependabot[bot] 62de244
build(deps): bump the aws-sdk-go-v2 group across 2 directories with 8…
dependabot[bot] 5a2ad09
podvm: Increase s390x boot partition from 256MiB to 512MiB
BbolroC ed6e530
build(deps): bump go.opentelemetry.io/otel in /src/webhook
dependabot[bot] c72ba1a
build(deps): bump go.opentelemetry.io/otel/sdk in /src/webhook
dependabot[bot] 8f14e6c
ci: add allow-unsafe-pr-checkout workaround for pull_request_target w…
stevenhorsman 9deff4c
chore: bump golang to 1.25.12
stevenhorsman 1cb6481
libvirt: close libvirt connection on provider teardown
ajaypvictor 8bc28e5
test: add unit tests for volume.go
supritai a7b639c
build(deps): bump raven-actions/actionlint from 2.1.2 to 2.2.0
dependabot[bot] 30298ee
ci: pass caa_image input to libvirt e2e test environment
stevenhorsman ae10749
config: remove csi-wrapper references from config files
snir911 596cb23
build(deps): bump docker/build-push-action from 7.2.0 to 7.3.0
dependabot[bot] c5f1187
build(deps): bump github/codeql-action/upload-sarif
dependabot[bot] 64a1f50
chore: group codeql-action updates in dependabot
stevenhorsman c29b188
build(deps): bump oras-project/setup-oras from 2.0.0 to 2.0.1
dependabot[bot] 8805ae4
build(deps): bump actions/setup-go from 6.4.0 to 6.5.0
dependabot[bot] 470f8ea
Remove fedora podvm build machinery, promote ubuntu to default
Copilot 56e5fbc
workflows: Remove fedora smoketest
stevenhorsman 7862d4f
workflows: Remove duplicate mkosi workflow
stevenhorsman 706576f
doc: Update README
stevenhorsman 4b9fe0b
podvm: remove PODVM_DISTRO variable now ubuntu is the only podvm distro
stevenhorsman 9cf9e3c
deps: bump golang.org/x/text to v0.39.0 to fix CVE
stevenhorsman 6860d4e
build(deps): bump docker/login-action from 4.2.0 to 4.4.0
dependabot[bot] a456b01
build(deps): bump aws-actions/configure-aws-credentials
dependabot[bot] 2ae0631
workflows: Remove libvirt_e2e_arch_prep job
stevenhorsman 28808b5
build(deps): bump google.golang.org/grpc in /src/cloud-api-adaptor
dependabot[bot] 7964468
fix: GetLaunchSecurityType opens a redundant libvirt connection
chathuryaadapa 2a90d64
Merging pull request 3207
ldoktor 65e2e94
libvirt: free root volume handle after path lookup
ajaypvictor 06eb0fc
versions: Bump kata-agent, trustee, GC
stevenhorsman 523ae7f
caa: Update kata-runtime go mod to 4.0.0
stevenhorsman 6a8a61a
versions: Pin kata-deploy version in Chart.yaml
stevenhorsman 1259fae
doc: Remove the image-rs crate reference
stevenhorsman d0d5bab
test/provisioner: migrate kbs-client to --admin-token-file
stevenhorsman 61b1aba
test/provisioner: extract runKbsClientAdmin helper
stevenhorsman 4da058c
release: Get release-helper to update Makefile
stevenhorsman 60e2f0d
release: pin CAA image for v0.22.0 in helm charts
stevenhorsman 60be2d4
release: Update the charts versions
stevenhorsman 38d0fcf
cloud-provider: sync provider chart values for
stevenhorsman b813773
e2e-test: use hack/versions.py in checkout_kbs.sh
mkulke f7643fc
e2e-test: add TEST_E2E_PARALLEL variable
mkulke 93da3fb
provisioner: add wait for kata-deploy
mkulke 289bea7
build(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0
dependabot[bot] c83c3cf
deps: upgrade grpc to v1.82.1 to fix GO-2026-6061
stevenhorsman 987eb8e
build(deps): bump github.com/google/cel-go in /src/webhook
dependabot[bot] 800a13f
Revert "release: pin CAA image for v0.22.0 in helm charts"
stevenhorsman cd841db
Revert "versions: Pin kata-deploy version in Chart.yaml"
stevenhorsman b6c0098
github: Update CITATION with release
stevenhorsman fd0b254
workflow: Disable fail-fast in the smoke tests
stevenhorsman 4436a46
podvm: Switch Ubuntu image to 26.04 (Resolute)
stevenhorsman aac8ae8
podvm: add explicit dm-verity module config for mkosi v26
stevenhorsman 86ae1b3
podvm: use arch-specific configs for Ubuntu packages
stevenhorsman 1ab2658
podvm: add dm- modules to system image for LUKS support
stevenhorsman e6405ee
podvm: Add libseccomp2 to Ubuntu images for 24.04 host compatibility
stevenhorsman b8116c5
podvm: Increase VM RAM for scratch-space
stevenhorsman 6948376
podvm: add systemd-repart to Ubuntu 26.04 image packages
stevenhorsman 8658920
podvm: fix Ubuntu 26.04 smoke test for scratch-space mode
stevenhorsman 97b44d1
ci(libvirt): fix e2e passing caa_image input to libvirt.properties
thejasn 6aedaef
build(deps): bump actions/checkout from 7.0.0 to 7.0.1
dependabot[bot] c712312
build(deps): bump actions/attest from 4.1.0 to 4.2.0
dependabot[bot] 04b2525
byom: remove the redundant check for kata-runtime label
Amulyam24 2b28a59
podvm: rename PUSH to EXPORT_BINARIES
Amulyam24 3e897c3
gha: fix podvm byom binaries job
Amulyam24 62d8abb
caa: guard resource removal with owner annotation
thejasn e33c9f6
probe: set SO_REUSEPORT for restart and add shutdown
thejasn 01c398d
fix: prevent hypervisor socket deletion during CAA rolling restart
thejasn 5eed303
podvm: Add tee-platform input to podvm build wf
mkulke 9bbfca1
podvm: shorten image name to "podvm-..."
mkulke b2ba085
podvm: remove /kata-containers bindmnt
mkulke afa2119
podvm: Add auto-login drop-in for ttyS0
mkulke 98b37c7
gcp: avoid creating public IPs when not used
rtim75 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Stale Dependabot CSI path
Medium Severity
dependabot.ymlstill listssrc/csi-wrapperunder gomod directories, but this sync removes the CSI wrapper tree and related workflows. Dependabot will keep targeting a path that no longer exists, so updates for that module fail or are skipped while the rest of the cleanup treats CSI as gone.Reviewed by Cursor Bugbot for commit 98b37c7. Configure here.