fix: use predicates instead of checking status, update deps (#201)

* fix: use predicates instead of checking status, update deps
* add GC for orphaned secrets, while originally owning sops object exists

Author: isindir

.github/workflows/ci.yaml

@@ -17,9 +17,9 @@ jobs:
     env:
       # UPDATE_HERE
       # https://hub.docker.com/r/rancher/k3s/tags
-      K3S_VERSION: v1.31.5-k3s1
+      K3S_VERSION: v1.32.2-k3s1
       # https://github.com/helm-unittest/helm-unittest/releases
-      HELM_UNITTEST_VERSION: 0.7.2
+      HELM_UNITTEST_VERSION: 0.8.0
 
     steps:
 

.tool-versions

@@ -1,25 +1,25 @@
 # UPDATE_HERE
 # https://github.com/kubernetes-sigs/kubebuilder/releases
-kubebuilder 4.5.0
+kubebuilder 4.5.1
 # https://golang.org/dl/
-golang 1.23.6
+golang 1.24.1
 # https://github.com/mozilla/sops/releases
 sops 3.9.4
 # https://github.com/kubernetes-sigs/kustomize/releases
 kustomize 5.6.0
 # https://github.com/rancher/k3d/releases
-k3d 5.8.1
+k3d 5.8.3
 # https://github.com/kubernetes/kubernetes/releases
-kubectl 1.31.5
+kubectl 1.32.3
 # https://github.com/helm/helm/releases
-helm 3.17.0
+helm 3.17.2
 # https://github.com/norwoodj/helm-docs/releases
 helm-docs 1.14.2
 # https://github.com/yannh/kubeconform/releases
 kubeconform 0.6.7
 # https://github.com/git-chglog/git-chglog/releases
 git-chglog 0.15.4
 # https://github.com/golangci/golangci-lint/releases
-golangci-lint 1.63.4
+golangci-lint 1.64.8
 # https://github.com/cli/cli/releases
-github-cli 2.66.1
+github-cli 2.69.0

Makefile

@@ -1,20 +1,20 @@
 # UPDATE_HERE
 # !!!!!!! NOTE: GOEXPERIMENT=nocoverageredesign is temp until 1.23.x
 GO := GOEXPERIMENT=nocoverageredesign GOPROXY=https://proxy.golang.org go
-SOPS_SEC_OPERATOR_VERSION := 0.14.3
+SOPS_SEC_OPERATOR_VERSION := 0.15.0
 
 # https://github.com/kubernetes-sigs/controller-tools/releases
-CONTROLLER_GEN_VERSION := "v0.17.1"
+CONTROLLER_GEN_VERSION := "v0.17.2"
 # https://github.com/kubernetes-sigs/controller-runtime/releases
-CONTROLLER_RUNTIME_VERSION := "v0.20.1"
+CONTROLLER_RUNTIME_VERSION := "v0.20.3"
 # https://github.com/kubernetes-sigs/kustomize/releases
 KUSTOMIZE_VERSION := "v5.6.0"
 # use `setup-envtest list` to obtain the list of available versions
 # until fixed, can't use newer version, see:
 #   https://github.com/kubernetes-sigs/controller-runtime/issues/1571
 # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
 # https://storage.googleapis.com/kubebuilder-tools
-ENVTEST_K8S_VERSION := "1.30.0"
+ENVTEST_K8S_VERSION := "1.30.2"
 
 # Use existing cluster instead of starting processes
 USE_EXISTING_CLUSTER ?= true

README.md

@@ -23,6 +23,7 @@ encrypted files stored in `git` repository.
 
 | Kubernetes | Sops | Chart | Operator |
 |---|---|---|---|
+| v1.32.x | v3.9.4 | 0.21.0 | 0.15.0 |
 | v1.31.x | v3.9.4 | 0.20.5 | 0.14.3 |
 | v1.30.x | v3.9.0 | 0.19.4 | 0.13.3 |
 | v1.29.x | v3.8.1 | 0.18.6 | 0.12.6 |

chart/helm3/sops-secrets-operator/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 # UPDATE_HERE
-version: 0.20.5
-appVersion: 0.14.3
+version: 0.21.0
+appVersion: 0.15.0
 type: application
 description: Helm chart deploys sops-secrets-operator
 name: sops-secrets-operator

chart/helm3/sops-secrets-operator/Makefile

@@ -4,7 +4,7 @@ CHART_NAME?=$(shell cat Chart.yaml | awk 'BEGIN { FS=": " } $$0~/^name:/ { gsub(
 VERSION_TAG?=$(shell cat Chart.yaml | awk 'BEGIN { FS=": " } $$0~/^version/ { gsub(/['\'',]/, ""); print $$2; }')
 
 # UPDATE_HERE
-K8S_VERSION := "1.31.5"
+K8S_VERSION := "1.32.3"
 
 SHELL=/bin/bash
 

chart/helm3/sops-secrets-operator/README.md

@@ -134,7 +134,7 @@ The following table lists the configurable parameters of the Sops-secrets-operat
 | healthProbes.readiness | object | `{"initialDelaySeconds":5,"periodSeconds":10}` | Readiness probe configuration |
 | image.pullPolicy | string | `"Always"` | Operator image pull policy |
 | image.repository | string | `"isindir/sops-secrets-operator"` | Operator image name |
-| image.tag | string | `"0.14.3"` | Operator image tag |
+| image.tag | string | `"0.15.0"` | Operator image tag |
 | imagePullSecrets | list | `[]` | Secrets to pull image from private docker repository |
 | initImage.pullPolicy | string | `"Always"` | Init container image pull policy |
 | initImage.repository | string | `"ubuntu"` | Init container image name |

chart/helm3/sops-secrets-operator/tests/monitor_test.yaml

@@ -55,6 +55,6 @@ tests:
         app.kubernetes.io/instance: sops
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: sops-secrets-operator
-        app.kubernetes.io/version: "0.14.3"
-        helm.sh/chart: sops-secrets-operator-0.20.5
+        app.kubernetes.io/version: "0.15.0"
+        helm.sh/chart: sops-secrets-operator-0.21.0
         custom-label: custom-value

chart/helm3/sops-secrets-operator/tests/operator_test.yaml

@@ -30,8 +30,8 @@ tests:
         app.kubernetes.io/instance: sops
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: sops-secrets-operator
-        app.kubernetes.io/version: 0.14.3
-        helm.sh/chart: sops-secrets-operator-0.20.5
+        app.kubernetes.io/version: 0.15.0
+        helm.sh/chart: sops-secrets-operator-0.21.0
 
 # custom name
 - it: should correctly render custome name
@@ -169,7 +169,7 @@ tests:
   # UPDATE_HERE
   - equal:
       path: spec.template.spec.containers[0].image
-      value: isindir/sops-secrets-operator:0.14.3
+      value: isindir/sops-secrets-operator:0.15.0
   - equal:
       path: spec.template.spec.containers[0].imagePullPolicy
       value: Always

chart/helm3/sops-secrets-operator/tests/service_account_test.yaml

@@ -30,8 +30,8 @@ tests:
         app.kubernetes.io/instance: sops
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: sops-secrets-operator
-        app.kubernetes.io/version: 0.14.3
-        helm.sh/chart: sops-secrets-operator-0.20.5
+        app.kubernetes.io/version: 0.15.0
+        helm.sh/chart: sops-secrets-operator-0.21.0
 
 # custom name
 - it: should correctly render custome service account name