Merge pull request #662 from fluxcd/release/1.4.4

Release 1.4.4

.github/ISSUE_TEMPLATE/bug_report.md

@@ -17,7 +17,7 @@ please review <https://github.com/fluxcd/flux2/discussions/413>.
 
 As it will take longer until we get around to issues and PRs in
 Helm Operator v1, we strongly recommend that you start
-familiarising yourself with Flux v2: <https://toolkit.fluxcd.io/>
+familiarising yourself with Flux v2: <https://fluxcd.io/>
 
 This means that new features will only be added after very careful
 consideration, if at all. Refer to the links above for more detail.

.github/PULL_REQUEST_TEMPLATE.md

@@ -7,7 +7,7 @@ please review <https://github.com/fluxcd/flux2/discussions/413>.
 
 As it will take longer until we get around to issues and PRs in
 Helm Operator v1, we strongly recommend that you start
-familiarising yourself with Flux v2: <https://toolkit.fluxcd.io/>
+familiarising yourself with Flux v2: <https://fluxcd.io/>
 
 This means that new features will only be added after very careful
 consideration, if at all. Refer to the links above for more detail.

CHANGELOG.md

@@ -1,3 +1,23 @@
+## 1.4.4 (2022-09-01)
+
+This release of Helm Operator removes the telemetry collection in accordance
+with the CNCF's published policies against default telemetry. Some deprecation
+notices are now emitted by the installer, please upgrade to Flux v2 or open an
+issue if you are blocked.
+
+The Helm Operator has been rebuilt against a fresh base image and had its
+dependencies updated in order to mitigate upstream CVEs.
+
+### Maintenance
+
+- Release 1.4.4 [fluxcd/helm-operator#661][#661]
+
+> **Helm Operator and Flux v1 are in maintenance:**
+
+Please note, while we continue the Helm Operator support, there are some known issues in Helm Operator that cannot be addressed. Users are advised strongly to plan their infrastructure upgrades and [migrate to Flux v2 and Helm Controller](https://fluxcd.io/flux/migration/helm-operator-migration/) as soon as possible, as Helm Operator will soon [no longer be maintained](https://fluxcd.io/flux/migration/timetable/).
+
+[#661]: https://github.com/fluxcd/helm-operator/pull/661
+
 ## 1.4.3 (2022-07-27)
 
 This release of Helm Operator has no internal changes; the Helm Operator has been rebuilt against a fresh base image and had its dependencies updated in order to mitigate upstream CVEs.
@@ -8,7 +28,7 @@ This release of Helm Operator has no internal changes; the Helm Operator has bee
 
 > **Helm Operator and Flux v1 are in maintenance:**
 
-Please note, while we continue the Helm Operator support, there are some known issues in Helm Operator that cannot be addressed. Users are advised strongly to plan their infrastructure upgrades and [migrate to Flux v2 and Helm Controller](https://fluxcd.io/docs/migration/helm-operator-migration/) as soon as possible, as Helm Operator will soon [no longer be maintained](https://fluxcd.io/docs/migration/timetable/).
+Please note, while we continue the Helm Operator support, there are some known issues in Helm Operator that cannot be addressed. Users are advised strongly to plan their infrastructure upgrades and [migrate to Flux v2 and Helm Controller](https://fluxcd.io/flux/migration/helm-operator-migration/) as soon as possible, as Helm Operator will soon [no longer be maintained](https://fluxcd.io/flux/migration/timetable/).
 
 [#654]: https://github.com/fluxcd/helm-operator/pull/654
 
@@ -26,7 +46,7 @@ This release of Helm Operator has no internal changes; the Helm Operator has bee
 
 > **Helm Operator and Flux v1 are in maintenance:**
 
-Please note, while we continue the Helm Operator support, there are some known issues in Helm Operator that cannot be addressed. Users are advised strongly to plan their infrastructure upgrades and [migrate to Flux v2 and Helm Controller](https://fluxcd.io/docs/migration/helm-operator-migration/) as soon as possible, as Helm Operator will soon [no longer be maintained](https://fluxcd.io/docs/migration/timetable/).
+Please note, while we continue the Helm Operator support, there are some known issues in Helm Operator that cannot be addressed. Users are advised strongly to plan their infrastructure upgrades and [migrate to Flux v2 and Helm Controller](https://fluxcd.io/flux/migration/helm-operator-migration/) as soon as possible, as Helm Operator will soon [no longer be maintained](https://fluxcd.io/flux/migration/timetable/).
 
 [#642]: https://github.com/fluxcd/helm-operator/pull/642
 [#645]: https://github.com/fluxcd/helm-operator/pull/645
@@ -41,7 +61,7 @@ This release of Helm Operator has no code changes, only base image and dependenc
 
 > **Helm Operator and Flux v1 are in maintenance:**
 
-Please note, while we continue the Helm Operator support, there are some known issues in Helm Operator that cannot be addressed. Users are advised strongly to plan their infrastructure upgrades and [migrate to Flux v2 and Helm Controller](https://fluxcd.io/docs/migration/helm-operator-migration/) as soon as possible, as Helm Operator will soon [no longer be maintained](https://fluxcd.io/docs/migration/timetable/).
+Please note, while we continue the Helm Operator support, there are some known issues in Helm Operator that cannot be addressed. Users are advised strongly to plan their infrastructure upgrades and [migrate to Flux v2 and Helm Controller](https://fluxcd.io/flux/migration/helm-operator-migration/) as soon as possible, as Helm Operator will soon [no longer be maintained](https://fluxcd.io/flux/migration/timetable/).
 
 [#639]: https://github.com/fluxcd/helm-operator/pull/639
 
@@ -54,15 +74,15 @@ This release of Helm Operator will break compatibility with older releases of Ku
 The `v1beta1` release of `CustomResourceDefinition` as well as `Role`, `ClusterRole`, and role bindings, have been replaced by their `v1` counterparts, and will finally be removed.
 
 > **Helm Operator and Flux are in maintenance:**
-> Efforts have been focused on the next generation of Flux, also called the [GitOps Toolkit](https://toolkit.fluxcd.io), which has crossed the feature-parity milestone, and is already recommended for production use in many cases. The [helm-controller](https://toolkit.fluxcd.io/components/helm/controller/) is the replacement for Helm Operator. The roadmap for Flux v2 development including Helm Controller can be found [here](https://fluxcd.io/docs/roadmap/).
+> Efforts have been focused on the next generation of Flux, also called the [GitOps Toolkit](https://fluxcd.io), which has crossed the feature-parity milestone, and is already recommended for production use in many cases. The [helm-controller](https://fluxcd.io/flux/components/helm/) is the replacement for Helm Operator. The roadmap for Flux v2 development including Helm Controller can be found [here](https://fluxcd.io/roadmap/).
 >
-> We are eager to hear [feedback, suggestions, and/or feature requests](https://github.com/fluxcd/toolkit/discussions) for the helm-controller and other Toolkit components. The [migration timetable](https://fluxcd.io/docs/migration/timetable/) will be kept updated with developments regarding the ongoing support of Helm Operator.
+> We are eager to hear [feedback, suggestions, and/or feature requests](https://github.com/fluxcd/toolkit/discussions) for the helm-controller and other Toolkit components. The [migration timetable](https://fluxcd.io/flux/migration/timetable/) will be kept updated with developments regarding the ongoing support of Helm Operator.
 >
 > Users of Helm Operator should be planning or executing their migrations, and report any blocking issues so that they can be addressed as early as possible.
 
 NOTE: Make sure to update the CRD when upgrading from a previous version as they have been changed since the prior release.
 
-Please note, while we continue the Helm Operator support, there are some known issues in Helm Operator that cannot be addressed. Users are advised strongly to plan their infrastructure upgrades and [migrate to Flux v2 and Helm Controller](https://fluxcd.io/docs/migration/helm-operator-migration/) as soon as possible, as Helm Operator will soon [no longer be maintained](https://fluxcd.io/docs/migration/timetable/).
+Please note, while we continue the Helm Operator support, there are some known issues in Helm Operator that cannot be addressed. Users are advised strongly to plan their infrastructure upgrades and [migrate to Flux v2 and Helm Controller](https://fluxcd.io/flux/migration/helm-operator-migration/) as soon as possible, as Helm Operator will soon [no longer be maintained](https://fluxcd.io/flux/migration/timetable/).
 
 ### Maintenance
 
@@ -75,9 +95,9 @@ Please note, while we continue the Helm Operator support, there are some known i
 ## 1.3.0 (2021-07-07)
 
 > **Helm Operator and Flux are in maintenance:**
-> Efforts have been focused on the next generation of Flux, also called the [GitOps Toolkit](https://toolkit.fluxcd.io), which has crossed the feature-parity milestone, and is already recommended for production use in many cases. The [helm-controller](https://toolkit.fluxcd.io/components/helm/controller/) is the replacement for Helm Operator. The roadmap for Flux v2 development including Helm Controller can be found [here](https://fluxcd.io/docs/roadmap/).
+> Efforts have been focused on the next generation of Flux, also called the [GitOps Toolkit](https://fluxcd.io), which has crossed the feature-parity milestone, and is already recommended for production use in many cases. The [helm-controller](https://fluxcd.io/flux/components/helm/) is the replacement for Helm Operator. The roadmap for Flux v2 development including Helm Controller can be found [here](https://fluxcd.io/roadmap/).
 >
-> We are eager to hear [feedback, suggestions, and/or feature requests](https://github.com/fluxcd/toolkit/discussions) for the helm-controller and other Toolkit components. The [migration timetable](https://fluxcd.io/docs/migration/timetable/) will be kept updated with developments regarding the ongoing support of Helm Operator.
+> We are eager to hear [feedback, suggestions, and/or feature requests](https://github.com/fluxcd/toolkit/discussions) for the helm-controller and other Toolkit components. The [migration timetable](https://fluxcd.io/flux/migration/timetable/) will be kept updated with developments regarding the ongoing support of Helm Operator.
 >
 > Users of Helm Operator should be planning their migrations, and report any blocking issues so that they can be addressed as early as possible.
 
@@ -89,7 +109,7 @@ The next MINOR (1.4.0) release of Helm Operator will break compatibility with ol
 
 ([fluxcd/helm-operator#599][#599] and [fluxcd/helm-operator#618][#618] describe the breaking changes that are upcoming in Helm Operator 1.4.0.)
 
-Please note, this is a security update and while we continue the Helm Operator support, there are some known issues in Helm Operator that cannot be addressed. Users are advised strongly to plan their infrastructure upgrades and [migrate to Flux v2 and Helm Controller](https://fluxcd.io/docs/migration/helm-operator-migration/) as soon as possible, as Helm Operator will soon [no longer be maintained](https://fluxcd.io/docs/migration/timetable/).
+Please note, this is a security update and while we continue the Helm Operator support, there are some known issues in Helm Operator that cannot be addressed. Users are advised strongly to plan their infrastructure upgrades and [migrate to Flux v2 and Helm Controller](https://fluxcd.io/flux/migration/helm-operator-migration/) as soon as possible, as Helm Operator will soon [no longer be maintained](https://fluxcd.io/flux/migration/timetable/).
 
 ### Maintenance
 
@@ -174,10 +194,10 @@ Thanks to @Carles-Figuerola, @amit-handda, @bmalynovytch, @coultenholt, @dholbac
 
 > **Note on the future of the Helm Operator and Flux:**
 > We are working on a next generation Flux assembled from components
-> as part of a bigger [GitOps Toolkit](https://toolkit.fluxcd.io) project.
-> One of the components is the [helm-controller](https://toolkit.fluxcd.io/components/helm/controller/)
+> as part of a bigger [GitOps Toolkit](https://fluxcd.io) project.
+> One of the components is the [helm-controller](https://fluxcd.io/flux/components/helm/)
 > which eventually will replace the Helm Operator. The roadmap for this
-> can be found [here](https://toolkit.fluxcd.io/roadmap/#the-road-to-helm-operator-v2).
+> can be found [here](https://fluxcd.io/roadmap/#the-road-to-helm-operator-v2).
 >
 > We are eager to hear [feedback, suggestions, and/or feature requests](https://github.com/fluxcd/toolkit/discussions)
 > for the helm-controller and other Toolkit components.

README.md

@@ -3,7 +3,7 @@
 > :warning: **Notice**
 > The [Helm Operator is in maintenance mode](https://github.com/fluxcd/helm-operator/issues/546),
 > while we are investing into the future of GitOps by
-> [re-architecting our tooling from the ground up](https://toolkit.fluxcd.io).
+> [re-architecting our tooling from the ground up](https://fluxcd.io).
 
 [![CircleCI](https://circleci.com/gh/fluxcd/helm-operator.svg?style=svg)](https://circleci.com/gh/fluxcd/helm-operator)
 [![GoDoc](https://godoc.org/github.com/fluxcd/helm-operator?status.svg)](https://godoc.org/github.com/fluxcd/helm-operator)

chart/helm-operator/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
-appVersion: "1.4.3"
-version: 1.4.3
+appVersion: "1.4.4"
+version: 1.4.4
 kubeVersion: ">=1.16.0-0"
 name: helm-operator
 description: Flux Helm Operator is a CRD controller for declarative helming

chart/helm-operator/values.yaml

@@ -5,7 +5,7 @@ fullnameOverride: ""
 
 image:
   repository: docker.io/fluxcd/helm-operator
-  tag: 1.4.3
+  tag: 1.4.4
   pullPolicy: IfNotPresent
   pullSecret:
 

deploy/deployment.yaml

@@ -78,7 +78,7 @@ spec:
         # There are no ":latest" images for helm-operator. Find the most recent
         # release or image version at https://hub.docker.com/r/fluxcd/helm-operator/tags
         # and replace the tag here.
-        image: docker.io/fluxcd/helm-operator:1.4.3
+        image: docker.io/fluxcd/helm-operator:1.4.4
         imagePullPolicy: IfNotPresent
         ports:
         - name: http

go.mod

@@ -3,41 +3,29 @@ module github.com/fluxcd/helm-operator
 go 1.16
 
 require (
-	github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d // indirect
-	github.com/bshuster-repo/logrus-logstash-hook v1.0.2 // indirect
-	github.com/bugsnag/panicwrap v1.2.0 // indirect
-	github.com/docker/go-metrics v0.0.1 // indirect
-	github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
-	github.com/fatih/color v1.9.0 // indirect
 	github.com/fluxcd/flux v1.17.2-0.20200121140732-3903cf8e71c3
 	github.com/fluxcd/helm-operator/pkg/install v0.0.0-00010101000000-000000000000
-	github.com/garyburd/redigo v1.6.0 // indirect
-	github.com/go-kit/kit v0.10.0
-	github.com/gofrs/uuid v3.2.0+incompatible // indirect
+	github.com/go-kit/kit v0.12.0
 	github.com/golang/protobuf v1.5.2
-	github.com/google/go-cmp v0.5.6
-	github.com/gorilla/mux v1.7.3
+	github.com/google/go-cmp v0.5.8
+	github.com/gorilla/mux v1.8.0
 	github.com/helm/helm-2to3 v0.8.2
-	github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0 // indirect
-	github.com/mattn/go-colorable v0.1.6 // indirect
 	github.com/ncabatoff/go-seq v0.0.0-20180805175032-b08ef85ed833
 	github.com/pkg/errors v0.9.1
-	github.com/prometheus/client_golang v1.11.1
+	github.com/prometheus/client_golang v1.12.2
 	github.com/shurcooL/vfsgen v0.0.0-20181202132449-6a9ea43bcacd
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.7.0
-	github.com/yvasiyarov/go-metrics v0.0.0-20150112132944-c25f46c4b940 // indirect
-	github.com/yvasiyarov/newrelic_platform_go v0.0.0-20160601141957-9c099fbc30e9 // indirect
-	google.golang.org/grpc v1.43.0
+	github.com/stretchr/testify v1.8.0
+	google.golang.org/grpc v1.47.0
 	helm.sh/helm/v3 v3.6.3
 	k8s.io/api v0.22.5
-	k8s.io/apiextensions-apiserver v0.21.14
+	k8s.io/apiextensions-apiserver v0.22.1
 	k8s.io/apimachinery v0.22.5
-	k8s.io/cli-runtime v0.21.14
+	k8s.io/cli-runtime v0.22.1
 	k8s.io/client-go v11.0.0+incompatible
 	k8s.io/helm v2.17.0+incompatible
 	k8s.io/klog v1.0.0
-	k8s.io/kubectl v0.21.14
+	k8s.io/kubectl v0.22.1
 	k8s.io/utils v0.0.0-20211116205334-6203023598ed
 	sigs.k8s.io/yaml v1.2.0
 )
@@ -55,7 +43,7 @@ replace (
 
 // Pin Flux to 1.18.0
 replace (
-	github.com/fluxcd/flux => github.com/fluxcd/flux v1.18.0
+	github.com/fluxcd/flux => github.com/fluxcd/flux v1.25.4
 	github.com/fluxcd/flux/pkg/install => github.com/fluxcd/flux/pkg/install v0.0.0-20200206191601-8b676b003ab0
 )
 
@@ -65,7 +53,7 @@ replace (
 //     +-> helm.sh/helm/[email protected]
 //     +-> helm.sh/[email protected]
 replace (
-	helm.sh/helm/v3 => helm.sh/helm/v3 v3.6.3
+	helm.sh/helm/v3 => helm.sh/helm/v3 v3.7.0
 	k8s.io/helm => k8s.io/helm v2.17.0+incompatible
 )
 
@@ -74,8 +62,8 @@ replace (
 //   CVE-2022-29162, CVE-2021-30465 and CVE-2016-9962.
 replace github.com/opencontainers/runc => github.com/opencontainers/runc v1.1.2
 
-// Mitigating: GHSA-crp2-qrr5-8pq7
-replace github.com/containerd/containerd => github.com/containerd/containerd v1.4.13
+// Mitigating: GHSA-crp2-qrr5-8pq7, CVE-2022-31030
+replace github.com/containerd/containerd => github.com/containerd/containerd v1.6.6
 
 // Mitigating: GHSA-77vh-xpmg-72qh
 replace github.com/opencontainers/image-spec => github.com/opencontainers/image-spec v1.0.2
@@ -86,16 +74,20 @@ replace github.com/docker/cli => github.com/docker/cli v20.10.9+incompatible
 // Mitigating: CVE-2022-21235
 replace github.com/Masterminds/vcs => github.com/Masterminds/vcs v1.13.3
 
-replace github.com/prometheus/client_golang => github.com/prometheus/client_golang v1.7.1
+// Mitigating: CVE-2022-21698
+replace github.com/prometheus/client_golang => github.com/prometheus/client_golang v1.11.1
 
 // Pin kubernetes dependencies to 1.21.*
 replace (
 	k8s.io/api => k8s.io/api v0.21.14
 	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.21.14
 	k8s.io/apimachinery => k8s.io/apimachinery v0.21.14
+	k8s.io/apiserver => k8s.io/apiserver v0.21.14
 	k8s.io/cli-runtime => k8s.io/cli-runtime v0.21.14
 	k8s.io/client-go => k8s.io/client-go v0.21.14
 	k8s.io/code-generator => k8s.io/code-generator v0.21.14
+	k8s.io/component-base => k8s.io/component-base v0.21.14
+	k8s.io/cri-api => k8s.io/cri-api v0.21.14
 	k8s.io/kubectl => k8s.io/kubectl v0.21.14
 )