Merge from upstream - #16
Open
a-kad wants to merge 514 commits into
Open
Conversation
Signed-off-by: Harry Li <harrymingh@gmail.com> Co-authored-by: Harry Li <bertram_li@163.com>
…oft-sh#3187) Co-authored-by: Sowmya viswam <sowmyaviswam@Sowmyas-MacBook-Pro.local>
…#3357) Add fqdn for svc as first entry in Pod host aliases.
* fix cert rotation for standalone Signed-off-by: Paweł Bojanowski <pawel.bojanowski@loft.sh> * log if setting namespace env var failed Signed-off-by: Paweł Bojanowski <pawel.bojanowski@loft.sh> --------- Signed-off-by: Paweł Bojanowski <pawel.bojanowski@loft.sh>
Co-authored-by: José Silva <josesilva@Joses-MacBook-Pro.local>
…sh#3373) * add a fallback command for checking helm binary version (v4.x) * add debug log statement to highlight the command error and subsequent attempt for better clarity.
* refactor: rename and export patchSecret func * Update pkg/certs/rotate.go Co-authored-by: Florian MEDJA <florian.medja@gmail.com> --------- Co-authored-by: Florian MEDJA <florian.medja@gmail.com>
…#3371) Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.20.9 to 0.20.10. - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@v0.20.9...v0.20.10) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-version: 0.20.10 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps): bump actions/checkout from 5 to 6 Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v5...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore(ci): shellcheck fixes --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Dmytro Sydorov <dmytro.sydorov@loft.sh>
…-sh#3385) * Skip admin email prompt when using new platform activation flow
…3349) Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 8 to 9. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@v8...v9) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-version: '9' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…3386) Removing the entire vcluster config parsing logic and replacing it with parsing a generic unstructured to get the sync.toHost.namespaces.enabled Co-authored-by: José Silva <josesilva@Joses-MacBook-Pro.local>
Bumps alpine from 3.22 to 3.23. --- updated-dependencies: - dependency-name: alpine dependency-version: '3.23' dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…h#3400) Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 7 to 8. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@v7...v8) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…h#3402) Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.20.10 to 0.20.11. - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@v0.20.10...v0.20.11) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-version: 0.20.11 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5 to 6. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v5...v6) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ommand as well (loft-sh#3405) * Revert "add a fallback command for checking helm binary version (v4.x) (loft-sh#3373)" This reverts commit 1256000. * remove client parameter from helm version check command as it is ignored/hidden since helm v3
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6 to 7. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v6...v7) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…t-sh#3404) Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files) from 47.0.0 to 47.0.1. - [Release notes](https://github.com/tj-actions/changed-files/releases) - [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md) - [Commits](tj-actions/changed-files@v47.0.0...v47.0.1) --- updated-dependencies: - dependency-name: tj-actions/changed-files dependency-version: 47.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…h#3855) Replace inline slackapi/slack-github-action step with loft-sh/github-actions notify-release workflow (release-notification/v2) using status=failure.
* chore(e2e-next): remove old tests * chore(e2e-next): remove build tests cache * chore(e2e-next): remove build cache
No references to hack/changelog/ found anywhere in the codebase. It's not used in any Makefile, CI workflow, shell script, or Go code. It appears to be dead code — a standalone Go tool that nothing invokes.
…sh#3861) Consolidates three places that did inline Helm packaging + cm-push into a single call to loft-sh/github-actions/.github/actions/publish-helm-chart@v1: 1. push-head-images.yaml push-head-chart job — 54 lines of inline yq + helm plugin install + helm repo add + yq Chart.yaml edits + package + cm-push replaced with the composite action. Produces the same two tarballs (0.0.0-latest + 0.0.0-<short-sha>) with the same chart name (vcluster-head), description, and appVersion (head-<sha>). Helm bumps from v3.20.0 to the action default v4.1.4. 2. release.yaml publish-chart job — previously delegated to the local publish-chart.yaml reusable workflow, which itself ran helm cm-push inline. The job is inlined here with a step-level call to the composite action, preserving the semver validation guard and the v-prefix-strip for chart version. 3. publish-chart.yaml — deleted. Its two callers (release.yaml is the only one in this repo) are now direct composite-action invocations. Refs DEVOPS-772
…-sh#3864) Replace inline go-licenses check and report workflows with the centralized go-licenses composite action from github-actions repo. Ref: DEVOPS-770
loft-sh#3839) * fix(pod-translator): rewrite kubelet sub-path hostPath volumes for HPM When Velero's node-agent or VGDP backupPod mounts a per-PVC hostPath volume such as /var/lib/kubelet/pods/<uid>/volumes/kubernetes.io~csi/<pvc>/, the pod translator only matched the exact KubeletPodPath root and left sub-paths unrewritten. With central HPM, the virtual kubelet path is under /tmp/vcluster/<ns>/<name>/kubelet/pods/, so these sub-path volumes pointed to real pod UIDs that the HPM symlink/bind-mount had not mapped, causing Velero to report "no such file or directory / got 0 matches". Extend the KubeletPodPath check in rewriteHostPaths to also match any path that starts with KubeletPodPath+"/", and rewrite the prefix via strings.Replace so the full sub-path is preserved under the virtual kubelet path. Fixes ENGNODE-308 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * test(pod-translator): add unit tests for translateKubeletSubPath and kubelet exact-match regression Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * address review comments --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: José Silva <josesilva@Joses-MacBook-Pro.local>
Fixes an issue when release workflow can not be triggered
…-sh#3834) * Fix Azure Blob support for auto-snapshots (loft-sh#3743) * fix: use DefaultAzureCredential for Azure snapshot listing Switch newContainerClient from NewClientWithNoCredential to DefaultAzureCredential, so snapshot list works with Azure service principal env vars without requiring a SAS token. * Bump github.com/loft-sh/api/v4 * Generate schema * feat: add storage key and service principal auth for Azure snapshots (cherry picked from commit e578440) # Conflicts: # go.mod * Fix unresolved (but merged) merge conflict --------- Co-authored-by: Nikola Prokopić <5638639+nprokopic@users.noreply.github.com> Co-authored-by: Nikola Prokopić <nikola.prokopic@loft.sh>
…3854) mirrors loft-enterprise PR #6418 — devops-team no longer needs code-review gating on workflow files in this repo.
Signed-off-by: Marcin Franczyk <marcin0franczyk@gmail.com>
Signed-off-by: Marcin Franczyk <marcin0franczyk@gmail.com>
…-sh#3872) Replace the local run-ginkgo-e2e action with loft-sh/github-actions run-ginkgo/v1. vcluster-specific setup (artifact downloads, syncer load, vcluster CLI install, bridge netfilter modules, docker prune) moves into the workflow files. The `|| pr` label append is now caller-side. The nightly workflow drops the manual ginkgo install and label-filter logic in favor of the shared action. Related to DEVOPS-769
* ci(auto-approve): use bot-approver pat and refresh v1 pin loft-bot authors backport PRs, so using its own GH_ACCESS_TOKEN to approve them fails GitHub's self-approval check. Switch to the dedicated BOT_APPROVER_PAT (vcluster-bot-approver identity) — the same pattern already running in vcluster-docs. Also refresh the v1 pin comment to a889ee9 to pick up the check-run dedupe + mergeable-retry fixes merged since the previous pin. References DEVOPS-714 * fix(auto-approve): scope to backport branches only trusted-authors: loft-bot also matches non-backport bot PRs (license updates, dependency bumps, PR-label helpers). Approving those defeats human review on changes that were not vetted on main first. Gate the job on head_ref starting with 'backport/' — the sorenlouv backport action uses that prefix exclusively, so this cleanly separates the reviewed-on-main case from other loft-bot activity. References DEVOPS-714
…ft-sh#3876) Repositions the project README around the current vcluster.com messaging ("Tenant Clusters for Production Kubernetes and AI Infrastructure — Virtual Control Planes, Real Isolation") and fills the three-version gap on What's New (v0.31, v0.32, v0.33). - Lead paragraph now frames vCluster around production AI infrastructure rather than dev/test isolation. - What's New table condensed to 5 rows — 4 latest stable releases plus a combined "Architecture Foundations" row for v0.27–v0.29. - Use Cases reordered so AI Factory leads; GPU Cloud Providers relabelled to AI Cloud Providers. - New "The vCluster Platform" section introduces vNode, vMetal, and the Netris integration (the four AI-factory layers: Certified Stacks, Tenant Isolation, Tenant Clusters, GPU Infrastructure Operations). - Quick Start gains a vind (vCluster in Docker) block and a Free Tier callout so new users have three paths to try vCluster. - Hero GIF regenerated from a real run on a Kubernetes cluster against vcluster 0.33.1 — every displayed command and log line is real CLI output. Hide/Show elides the pod-wait period. Tape checked in alongside the gif for future re-renders. - Terminology updated in prose to match current docs: Control Plane Cluster (was Host Cluster), Tenant Isolation (was Multi-Tenancy), Virtual Control Plane. Conference talk titles left untouched as direct external quotes. - Social counts refreshed (LinkedIn 28K, X 3.7K). - Old hero gif and the internal e2e-next linters section removed from the public README.
![bulwark-spectrocloud[bot]](https://avatars.githubusercontent.com/u/36211249?s=60&v=4){kind=small}
There was a problem hiding this comment.
- GO-2025-3922
- Module: github.com/ulikunitz/xz
- Found in: v0.5.14
- Fixed in: v0.5.15
- Example Traces:
1. pkg/server/filters/metrics.go:585:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.reader
2. pkg/cli/oci/extract.go:245:25: oci.ExtractFile calls io.Copy, which eventually calls lzma.init$1
3. pkg/config/validation.go:937:26: config.ValidateExperimentalProxyCustomResourcesConfig calls fmt.Sprintf, which eventually calls fmt.handleMethods
4. pkg/server/filters/metrics.go:585:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls io.Read
5. pkg/cli/oci/pull.go:45:21: oci.PullImage calls copy.Image, which eventually calls xz.Verify
- GO-2026-4762
- Module: google.golang.org/grpc
- Found in: v1.78.0
- Fixed in: v1.79.3
- Example Traces:
1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
Please review these findings and fix the issues before merging.
There was a problem hiding this comment.
-
- File:
vendor/modernc.org/sqlite/lib/sqlite_windows.go - Fingerprint:
bdc39fa43a759c8eddad57df3ba49e8be94df88a:vendor/modernc.org/sqlite/lib/sqlite_windows.go:generic-api-key:65030
- File:
-
- File:
vendor/modernc.org/sqlite/lib/sqlite_windows.go - Fingerprint:
bdc39fa43a759c8eddad57df3ba49e8be94df88a:vendor/modernc.org/sqlite/lib/sqlite_windows.go:generic-api-key:21949
- File:
-
- File:
vendor/modernc.org/sqlite/lib/sqlite_windows.go - Fingerprint:
bdc39fa43a759c8eddad57df3ba49e8be94df88a:vendor/modernc.org/sqlite/lib/sqlite_windows.go:generic-api-key:534
- File:
-
- File:
vendor/modernc.org/sqlite/lib/sqlite_windows.go - Fingerprint:
bdc39fa43a759c8eddad57df3ba49e8be94df88a:vendor/modernc.org/sqlite/lib/sqlite_windows.go:generic-api-key:12039
- File:
-
- File:
vendor/modernc.org/sqlite/lib/sqlite_windows.go - Fingerprint:
bdc39fa43a759c8eddad57df3ba49e8be94df88a:vendor/modernc.org/sqlite/lib/sqlite_windows.go:generic-api-key:65600
- File:
-
- File:
vendor/modernc.org/sqlite/lib/sqlite_windows.go - Fingerprint:
bdc39fa43a759c8eddad57df3ba49e8be94df88a:vendor/modernc.org/sqlite/lib/sqlite_windows.go:generic-api-key:65602
- File:
-
- File:
vendor/modernc.org/sqlite/lib/sqlite_windows.go - Fingerprint:
bdc39fa43a759c8eddad57df3ba49e8be94df88a:vendor/modernc.org/sqlite/lib/sqlite_windows.go:generic-api-key:65604
- File:
-
- File:
vendor/modernc.org/sqlite/lib/sqlite_windows.go - Fingerprint:
bdc39fa43a759c8eddad57df3ba49e8be94df88a:vendor/modernc.org/sqlite/lib/sqlite_windows.go:generic-api-key:65028
- File:
-
- File:
vendor/modernc.org/sqlite/lib/sqlite_windows.go - Fingerprint:
bdc39fa43a759c8eddad57df3ba49e8be94df88a:vendor/modernc.org/sqlite/lib/sqlite_windows.go:generic-api-key:65608
- File:
Please review these findings and remove any sensitive information before merging.
There was a problem hiding this comment.
- G115: integer overflow conversion rune -> byte, Severity: HIGH
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/util/patch/path.go:58:40
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/cli/oci/extract.go:240:85
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/cli/oci/extract.go:127:82
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controllers/resources/nodes/nodeservice/node_service.go:151:38
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/apiservice/generic.go:115:28
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/apiservice/generic.go:97:17
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/e2e-next/test_core/sync/test_pods.go:534:51
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/cmd/vcluster/cmd/portforward.go:209:84
-
- G404: Use of weak random number generator (math/rand or math/rand/v2 instead of crypto/rand), Severity: HIGH
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/util/random/rand.go:13:22
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/util/clihelper/clihelper.go:174:17
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/util/clihelper/clihelper.go:166:19
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/platform/random/random.go:13:22
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/certs/watcher.go:256:27
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/certs/watcher.go:97:26
-
- G402: TLS InsecureSkipVerify set to true., Severity: HIGH
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/util/http/transport.go:21:66
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/e2e-next/test_security/certs/helpers.go:322:35
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/cli/start/success.go:131:25
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/cli/start/login.go:71:52
-
- G109: Potential Integer overflow made by strconv.Atoi result conversion to int16/32, Severity: HIGH
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lifecycle/lifecycle.go:384:17
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lifecycle/lifecycle.go:338:17
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/cmd/vcluster/cmd/portforward.go:209:79
-
- G401: Use of weak cryptographic primitive, Severity: MEDIUM
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/snapshot/s3/store.go:182:11
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controllers/deploy/deploy.go:457:27
-
- G501: Blocklisted import crypto/md5: weak cryptographic primitive, Severity: MEDIUM
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/snapshot/s3/store.go:21:2
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controllers/deploy/deploy.go:5:2
-
Please review these findings and fix the issues before merging.
zulfilee
approved these changes
Apr 22, 2026
shubhamrajvanshi
approved these changes
May 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What issue type does this pull request address? (keep at least one, remove the others)
/kind bugfix
/kind enhancement
/kind feature
/kind documentation
/kind test
What does this pull request do? Which issues does it resolve? (use
resolves #<issue_number>if possible)resolves #
Please provide a short message that should be published in the vcluster release notes
Fixed an issue where vcluster ...
What else do we need to know?