Merge branch 'master' into feat/issue-25366-path-security

fsdkibe · web-flow · commit 76bcf07000ac · 2025-12-04T23:09:11.000+03:00
diff --git a/.github/workflows/ci-build.yaml b/.github/workflows/ci-build.yaml
@@ -304,7 +304,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Setup NodeJS
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
           # renovate: datasource=node-version packageName=node versioning=node
           node-version: '22.9.0'
diff --git a/docs/operator-manual/upgrading/3.2-3.3.md b/docs/operator-manual/upgrading/3.2-3.3.md
@@ -5,12 +5,19 @@
 Argo CD v3.3 upgrades the bundled Helm version to 3.19.2. There are no breaking changes in Helm 3.19.2 according to the
 [release notes](https://github.com/helm/helm/releases/tag/v3.19.0).
 
-## Kustomize Upgraded to 5.7.1
+## Kustomize Upgraded to 5.8.0
 
-Argo CD v3.3 upgrades the bundled Kustomize version to 5.7.1. There are no breaking changes in Kustomize 5.7.1 according
-to the [release notes](https://github.com/kubernetes-sigs/kustomize/releases/tag/kustomize%2Fv5.7.1).
-However, bear in mind that Kustomize 5.7.1 introduces code to replace the `shlex` library used for parsing arguments in the exec plugin. 
-If any existing manifests become corrupted, please follow the[release notes](https://github.com/kubernetes-sigs/kustomize/releases/tag/kustomize%2Fv5.7.1) instructions.
+Argo CD v3.3 upgrades the bundled Kustomize version from v5.7.0 to v5.8.0. According to the
+[5.7.1](https://github.com/kubernetes-sigs/kustomize/releases/tag/kustomize%2Fv5.7.1)
+and [5.8.0](https://github.com/kubernetes-sigs/kustomize/releases/tag/kustomize%2Fv5.8.0) release notes, there are no breaking changes.
+
+However, note that Kustomize 5.7.1 introduces code to replace the `shlex` library used for parsing arguments in exec plugins.
+If any existing manifests become corrupted, please follow the instructions in the
+[5.7.1 release notes](https://github.com/kubernetes-sigs/kustomize/releases/tag/kustomize%2Fv5.7.1).
+
+Kustomize 5.8.0 also resolves an issue where namespaces were not properly propagated to Helm charts.
+If you rely on Helm charts within kustomization files, please review the details in the associated fix:
+[kubernetes-sigs/kustomize#5940](https://github.com/kubernetes-sigs/kustomize/pull/5940).
 
 ## Breaking Changes
 
diff --git a/hack/installers/checksums/kustomize_5.8.0_darwin_amd64.tar.gz.sha256 b/hack/installers/checksums/kustomize_5.8.0_darwin_amd64.tar.gz.sha256
@@ -0,0 +1 @@
+2deaa6f96450c0b3204cccd9f159a22278eb6cf85ad545d212d608d2428aeb57  kustomize_5.8.0_darwin_amd64.tar.gz
diff --git a/hack/installers/checksums/kustomize_5.8.0_darwin_arm64.tar.gz.sha256 b/hack/installers/checksums/kustomize_5.8.0_darwin_arm64.tar.gz.sha256
@@ -0,0 +1 @@
+d098f62ecda500c752303163838af823f947d245927f3000b629199c1eeeae0f  kustomize_5.8.0_darwin_arm64.tar.gz
diff --git a/hack/installers/checksums/kustomize_5.8.0_linux_amd64.tar.gz.sha256 b/hack/installers/checksums/kustomize_5.8.0_linux_amd64.tar.gz.sha256
@@ -0,0 +1 @@
+4dfa8307358dd9284aa4d2b1d5596766a65b93433e8fa3f9f74498941f01c5ef  kustomize_5.8.0_linux_amd64.tar.gz
diff --git a/hack/installers/checksums/kustomize_5.8.0_linux_arm64.tar.gz.sha256 b/hack/installers/checksums/kustomize_5.8.0_linux_arm64.tar.gz.sha256
@@ -0,0 +1 @@
+a4f48b4c3d4ca97d748943e19169de85a2e86e80bcc09558603e2aa66fb15ce1  kustomize_5.8.0_linux_arm64.tar.gz
diff --git a/hack/installers/checksums/kustomize_5.8.0_linux_ppc64le.tar.gz.sha256 b/hack/installers/checksums/kustomize_5.8.0_linux_ppc64le.tar.gz.sha256
@@ -0,0 +1 @@
+4352a29912b6a15688598ec192e79b841ee8b128ba411592d1de68b585009ec7  kustomize_5.8.0_linux_ppc64le.tar.gz
diff --git a/hack/installers/checksums/kustomize_5.8.0_linux_s390x.tar.gz.sha256 b/hack/installers/checksums/kustomize_5.8.0_linux_s390x.tar.gz.sha256
@@ -0,0 +1 @@
+f7be07697c1ba872ff4e99806ac9a86faa7029e108a24ccfa7b47c04c1cc9c0d  kustomize_5.8.0_linux_s390x.tar.gz
diff --git a/hack/tool-versions.sh b/hack/tool-versions.sh
@@ -12,6 +12,6 @@
 # add-kustomize-checksums.sh to help download checksums.
 ###############################################################################
 helm3_version=3.19.2
-kustomize5_version=5.7.1
+kustomize5_version=5.8.0
 protoc_version=29.3
 oras_version=1.2.0
diff --git a/resource_customizations/_.crossplane.io/_/health.lua b/resource_customizations/_.crossplane.io/_/health.lua
@@ -1,4 +1,4 @@
--- Health check copied from here: https://github.com/crossplane/docs/blob/709889c5dbe6e5a2ea3dffd66fe276cf465b47b5/content/master/guides/crossplane-with-argo-cd.md
+-- Health check copied from here: https://github.com/crossplane/docs/blob/9fe744889fc150ca71e5298d90b4133f79ea20f2/content/master/guides/crossplane-with-argo-cd.md
 
 health_status = {
   status = "Progressing",
@@ -59,7 +59,6 @@ for i, condition in ipairs(obj.status.conditions) do
     if condition.status == "True" then
       health_status.status = "Healthy"
       health_status.message = "Resource is up-to-date."
-      return health_status
     end
   end
 end
diff --git a/resource_customizations/_.crossplane.io/_/health_test.yaml b/resource_customizations/_.crossplane.io/_/health_test.yaml
@@ -6,4 +6,8 @@ tests:
   - healthStatus:
       status: Healthy
       message: "Resource is up-to-date."
-    inputPath: testdata/configurationrevision_healthy.yaml
+    inputPath: testdata/configurationrevision_healthy.yaml
+  - healthStatus:
+      status: Degraded
+      message: "ActivePackageRevision UnhealthyPackageRevision"
+    inputPath: testdata/provider_degraded.yaml
diff --git a/resource_customizations/_.crossplane.io/_/testdata/provider_degraded.yaml b/resource_customizations/_.crossplane.io/_/testdata/provider_degraded.yaml
@@ -0,0 +1,33 @@
+apiVersion: pkg.crossplane.io/v1
+kind: Provider
+metadata:
+  name: upbound-provider-family-azure
+spec:
+  ignoreCrossplaneConstraints: false
+  package: xpkg.upbound.io/upbound/provider-family-azure:v2.2.0
+  packagePullPolicy: IfNotPresent
+  revisionActivationPolicy: Automatic
+  revisionHistoryLimit: 1
+  runtimeConfigRef:
+    apiVersion: pkg.crossplane.io/v1beta1
+    kind: DeploymentRuntimeConfig
+    name: default
+  skipDependencyResolution: false
+status:
+  conditions:
+  - lastTransitionTime: "2025-11-22T08:47:52Z"
+    message: 'Package runtime health is "False" with message: post establish xppkgruntime
+      hook failed for package: provider package deployment is unavailable with message:
+      Deployment does not have minimum availability.'
+    observedGeneration: 3
+    reason: UnhealthyPackageRevision
+    status: "False"
+    type: Healthy
+  - lastTransitionTime: "2025-11-22T08:45:44Z"
+    observedGeneration: 3
+    reason: ActivePackageRevision
+    status: "True"
+    type: Installed
+  currentIdentifier: xpkg.upbound.io/upbound/provider-family-azure:v2.2.0
+  currentRevision: upbound-provider-family-azure-04ba5ac3fc37
+  resolvedPackage: xpkg.upbound.io/upbound/provider-family-azure:v2.2.0
diff --git a/resource_customizations/_.upbound.io/_/health.lua b/resource_customizations/_.upbound.io/_/health.lua
@@ -1,4 +1,4 @@
--- Health check copied from here: https://github.com/crossplane/docs/blob/709889c5dbe6e5a2ea3dffd66fe276cf465b47b5/content/master/guides/crossplane-with-argo-cd.md
+-- Health check copied from here: https://github.com/crossplane/docs/blob/9fe744889fc150ca71e5298d90b4133f79ea20f2/content/master/guides/crossplane-with-argo-cd.md
 
 health_status = {
   status = "Progressing",
@@ -56,7 +56,6 @@ for i, condition in ipairs(obj.status.conditions) do
     if condition.status == "True" then
       health_status.status = "Healthy"
       health_status.message = "Resource is up-to-date."
-      return health_status
     end
   end
 end
diff --git a/resource_customizations/_.upbound.io/_/health_test.yaml b/resource_customizations/_.upbound.io/_/health_test.yaml
@@ -3,3 +3,7 @@ tests:
       status: Healthy
       message: "Resource is up-to-date."
     inputPath: testdata/providerconfig_healthy.yaml
+  - healthStatus:
+      status: Degraded
+      message: "update failed: async update failed: refuse to update the external resource because the following update requires replacing it: cannot change the value of the argument \"location\" from \"westeurope\" to \"switzerlandnorth\""
+    inputPath: testdata/managedresource_failedupdate_degraded.yaml
diff --git a/resource_customizations/_.upbound.io/_/testdata/managedresource_failedupdate_degraded.yaml b/resource_customizations/_.upbound.io/_/testdata/managedresource_failedupdate_degraded.yaml
@@ -0,0 +1,46 @@
+apiVersion: azure.m.upbound.io/v1beta1
+kind: ResourceGroup
+metadata:
+  annotations:
+    crossplane.io/external-create-pending: '2025-11-22T08:33:27Z'
+    crossplane.io/external-create-succeeded: '2025-11-22T08:33:27Z'
+    crossplane.io/external-name: example-resources
+  name: example-resources
+spec:
+  forProvider:
+    location: Switzerland North
+  initProvider: {}
+  managementPolicies:
+    - '*'
+  providerConfigRef:
+    kind: ClusterProviderConfig
+    name: default
+status:
+  atProvider:
+    id: >-
+      /subscriptions/uuid/resourceGroups/example-resources
+    location: westeurope
+    managedBy: ''
+  conditions:
+    - lastTransitionTime: '2025-11-22T08:33:40Z'
+      reason: Available
+      status: 'True'
+      type: Ready
+    - lastTransitionTime: '2025-11-22T08:36:12Z'
+      message: >-
+        update failed: async update failed: refuse to update the external
+        resource because the following update requires replacing it: cannot
+        change the value of the argument "location" from "westeurope" to
+        "switzerlandnorth"
+      observedGeneration: 3
+      reason: ReconcileError
+      status: 'False'
+      type: Synced
+    - lastTransitionTime: '2025-11-22T08:36:11Z'
+      message: >-
+        async update failed: refuse to update the external resource because the
+        following update requires replacing it: cannot change the value of the
+        argument "location" from "westeurope" to "switzerlandnorth"
+      reason: AsyncUpdateFailure
+      status: 'False'
+      type: LastAsyncOperation
diff --git a/test/e2e/kustomize_test.go b/test/e2e/kustomize_test.go
@@ -368,6 +368,7 @@ func TestKustomizeNamespaceOverride(t *testing.T) {
 		When().
 		AppSet("--kustomize-namespace", "does-not-exist").
 		Then().
-		// The app should go out of sync, because the resource's target namespace changed.
-		Expect(SyncStatusIs(SyncStatusCodeOutOfSync))
+		// The app should stay in synced status as per https://github.com/kubernetes-sigs/kustomize/pull/5940
+		// the transformer will not update a helm generated namespace.
+		Expect(SyncStatusIs(SyncStatusCodeSynced))
 }

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+2deaa6f96450c0b3204cccd9f159a22278eb6cf85ad545d212d608d2428aeb57 kustomize_5.8.0_darwin_amd64.tar.gz`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+d098f62ecda500c752303163838af823f947d245927f3000b629199c1eeeae0f kustomize_5.8.0_darwin_arm64.tar.gz`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+4dfa8307358dd9284aa4d2b1d5596766a65b93433e8fa3f9f74498941f01c5ef kustomize_5.8.0_linux_amd64.tar.gz`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+a4f48b4c3d4ca97d748943e19169de85a2e86e80bcc09558603e2aa66fb15ce1 kustomize_5.8.0_linux_arm64.tar.gz`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+4352a29912b6a15688598ec192e79b841ee8b128ba411592d1de68b585009ec7 kustomize_5.8.0_linux_ppc64le.tar.gz`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+f7be07697c1ba872ff4e99806ac9a86faa7029e108a24ccfa7b47c04c1cc9c0d kustomize_5.8.0_linux_s390x.tar.gz`