Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Pinned GitHub workflows by SHA #8334

Merged
merged 1 commit into from
Mar 14, 2022
Merged

Pinned GitHub workflows by SHA #8334

merged 1 commit into from
Mar 14, 2022

Conversation

naveensrinivasan
Copy link
Contributor

What this PR does / why we need it:

Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies
Included permissions for some of the actions. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

Dependabot is aware of these pinned versions and can upgrade versions.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation only

Which issue/s this PR fixes

How Has This Been Tested?

Checklist:

  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I've read the CONTRIBUTION guide
  • I have added tests to cover my changes.
  • All new and existing tests passed.

@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Mar 14, 2022
@k8s-ci-robot
Copy link
Contributor

Welcome @naveensrinivasan!

It looks like this is your first PR to kubernetes/ingress-nginx 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/ingress-nginx has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

@k8s-ci-robot
Copy link
Contributor

Hi @naveensrinivasan. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. needs-kind Indicates a PR lacks a `kind/foo` label and requires one. needs-priority size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Mar 14, 2022
@naveensrinivasan
Copy link
Contributor Author

/assign @strongjz

@strongjz
Copy link
Member

/kind feature
/priority important-longterm
/ok-to-test
/triage accepted

Thanks for the update.

@k8s-ci-robot k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. needs-kind Indicates a PR lacks a `kind/foo` label and requires one. needs-priority needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Mar 14, 2022
@strongjz
Copy link
Member

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 14, 2022
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: naveensrinivasan, strongjz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 14, 2022
@k8s-ci-robot k8s-ci-robot merged commit 974d038 into kubernetes:main Mar 14, 2022
@naveensrinivasan naveensrinivasan deleted the naveen/feat/pin-actions branch March 14, 2022 15:41
@naveensrinivasan
Copy link
Contributor Author

Thank you @strongjz!

kundan2707 added a commit to kundan2707/ingress-nginx that referenced this pull request Mar 17, 2022
@kundan2707
kubectl code overview info
b347d86 
remove 0.46.0 from supported versions table (kubernetes#8258)

Minor fix for missing pathType property (kubernetes#8244)

Updated confusing error (kubernetes#8262)

Add a certificate info metric (kubernetes#8253)

When the ingress controller loads certificates  (new ones or following a
secret update), it performs a series of check to ensure its validity.

In our systems, we detected a case where, when the secret object is
compromised, for example when the certificate does not match the secret
key, different pods of the ingress controller are serving a different
version of the certificate.

This behaviour is due to the cache mechanism of the ingress controller,
keeping the last known certificate in case of corruption. When this
happens, old ingress-controller pods will keep serving the old one,
while new pods, by failing to load the corrupted certificates, would
use the default certificate, causing invalid certificates for its
clients.

This generates a random error on the client side, depending on the
actual pod instance it reaches.

In order to allow detecting occurences of those situations, add a metric
to expose, for all ingress controlller pods, detailed informations of
the currently loaded certificate.

This will, for example, allow setting an alert when there is a
certificate discrepency across all ingress controller pods using a query
similar to `sum(nginx_ingress_controller_ssl_certificate_info{host="name.tld"})by(serial_number)`

This also allows to catch other exceptions loading certificates (failing
to load the certificate from the k8s API, ...

Co-authored-by: Daniel Ricart <[email protected]>

Co-authored-by: Daniel Ricart <[email protected]>

Issue#8241 (kubernetes#8273)

* replace daemon set for deployment manifest

* nit

Start Release process for v1.1.2 (kubernetes#8275)

Signed-off-by: Jintao Zhang <[email protected]>

Add fsGroup value to admission-webhooks/job-patch charts (kubernetes#8267)

* added fsGroup to admission createSecret and patchWebhook job

* added fsGroup to admission createSecret and patchWebhook job

* modified helm/README.md to add value for fsGroup

* fixed patch job values ordering

* remove manually edited README for replacement with helm-docs generated version

* re-adding charts/README.md generated by helm-docs

Add OpenSSF Best practices badge (kubernetes#8277)

fix: deny locations with invalid auth-url annotation (kubernetes#8256)

* fix: deny locations with invalid auth-url annotation

Signed-off-by: m.nabokikh <[email protected]>

* Delete duplicate test

Signed-off-by: m.nabokikh <[email protected]>

force prow job by changing something in images/ot dir (kubernetes#8281)

Images dir was merged in before the test-infra prow job, so the image was never built.

kubernetes#8013 Jan 16

https://github.com/kubernetes/test-infra/pull/25344/files Prow job 4 days ago.

Fix OpenTelemetry sidecar image build (kubernetes#8286)

* fix wrong checksum for nginx image

* fix wrong platform. Arm64 has grpc, when arm doesn't

update tag for image (kubernetes#8290)

remove git tag env from cloud build

the latest git tag is from helm, so force the make file use of TAG ?=v$(shell date +%m%d%Y)-$(shell git rev-parse --short HEAD)

release-v1.1.2-continued (kubernetes#8294)

* v1.1.2 release

Signed-off-by: Jintao Zhang <[email protected]>

* release-v1.1.2-continued

Co-authored-by: Jintao Zhang <[email protected]>

docs: fix changelog formatting (kubernetes#8302)

leaving it the git tag (kubernetes#8311)

fixing the git tag for the image version, it is what it is .

Missing annotations (kubernetes#8288)

Not quite sure but It seems that `nginx.ingress.kubernetes.io/canary-by-header` is missing.

Names cannot contain _ (underscore)! So I changed it to -. (kubernetes#8300)

* The name can't use _(underscore)! So fix it!

The name can't use _(underscore)! So fix it!

* Fix configMap name can't use _(underscore)

Fix configMap name can't use _(underscore)

Pinned GitHub workflows by SHA (kubernetes#8334)

- Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies
- Included permissions for some of the actions. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

Dependabot can upgrade pinned version of actions.

Update monitoring.md (kubernetes#8324)

Added missing repo on "helm upgrade" command

Add the shareProcessNamespace as a configurable setting. (kubernetes#8287)

Nginx v1.19.10 (kubernetes#8307)

kubectl code overview info
rchshld pushed a commit to joomcode/ingress-nginx that referenced this pull request May 19, 2023
@naveensrinivasan @rchshld
Pinned GitHub workflows by SHA (kubernetes#8334)
6314867 
- Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies
- Included permissions for some of the actions. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

Dependabot can upgrade pinned version of actions.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rikatz rikatz Awaiting requested review from rikatz

@strongjz strongjz Awaiting requested review from strongjz

Assignees

@strongjz strongjz

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@naveensrinivasan @k8s-ci-robot @strongjz