Skip to content

Latest commit

 

History

History
393 lines (317 loc) · 21.5 KB

CHANGELOG.md

File metadata and controls

393 lines (317 loc) · 21.5 KB

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Unreleased

[1.7.3] - 2025-01-10

Security

  • Upgrade multiple dependencies

[1.7.2] - 2024-12-30

Security

  • Upgrade golang.org/x/net to 0.33.0 to address CVE-2024-45338

[1.7.1] - 2024-12-04

Fixed

  • The sentinel file is updated correctly when multiple K8s secrets are defined so the liveness probe container restart behaves as expected in K8s secrets mode (CNJR-7253)

1.7.0 - 2024-11-07

Added

1.6.5 - 2024-07-24

Security

  • Upgrade golang.org/x/net to v0.24.0 (CONJSE-1863)

1.6.4 - 2024-04-08

Changed

  • Testing and CI improvements (CNJR-4550)

1.6.3 - 2024-03-21

Changed

  • Use updated RedHat preflight scan tool v1.9.1 (CNJR-3914)
  • Updated Go to 1.22 (CONJSE-1842)

1.6.2 - 2024-03-20

Security

1.6.1 - 2023-07-27

Security

1.6.0 - 2023-07-19

Added

  • Log level is now configurable using the LOG_LEVEL environment variable or conjur.org/log-level annotation. The existing DEBUG environment variable and conjur.org/debug-logging annotation is deprecated and will be removed in a future update. cyberark/secrets-provider-for-k8s#534

Security

1.5.1 - 2023-05-26

Security

  • Forced github.com/emicklei/go-restful/v3 to use v3.10.2 to remove PRISMA-2022-0227 (found in Twistlock scan) and updated versions of gotelemetry.io/otel (to 1.16.0), github.com/stretchr/testify (to 1.8.3), and the k8s.io libraries (to 0.27.2) cyberark/secrets-provider-for-k8s#526

1.5.0 - 2023-04-12

Added

1.4.6 - 2023-01-26

Security

1.4.5 - 2022-09-26

Changed

Security

1.4.4 - 2022-07-12

Changed

Security

Fixed

  • Fixes the following error seen on boot up when the status volumemount is not added "open /conjur/status/conjur-secrets-unchanged.sh: no such file or directory" cyberark/secrets-provider-for-k8s#479

1.4.3 - 2022-07-07

Removed

Security

1.4.2 - 2022-05-03

Changed

  • Updated dependencies in go.mod (github.com/stretchr/testify -> v1.7.2, go.opentelemetry.io/otel -> 1.7.0, gopkg.in/yaml.v3 -> v3.0.1, k8s.io/api -> 0.24.1, k8s.io/apimachinery -> 0.24.1, k8s.io/client-go -> 0.24.1). cyberark/secrets-provider-for-k8s#468

1.4.1 - 2022-04-01

Changed

Added

  • Secrets files are written in an atomic operation. cyberark/secrets-provider-for-k8s#440
  • Secret files are deleted when secrets are removed from Conjur or access is revoked. Can be disabled with annotation. cyberark/secrets-provider-for-k8s#447
  • Kubernetes Secrets are cleared when secrets are removed from Conjur or access is revoked. Can be disabled with annotation. cyberark/secrets-provider-for-k8s#449
  • Secrets Provider allows for its status to be monitored through the creation of a couple of empty sentinel files: CONJUR_SECRETS_PROVIDED and CONJUR_SECRETS_UPDATED. The first file is created when SP has completed its first round of providing secrets via secret files / Kubernetes Secrets. It creates/recreates the second file whenever it has updated secret files / Kubernetes Secrets. If desirable, application containers can mount these files via a shared volume. cyberark/secrets-provider-for-k8s#450
  • Adds support for secrets rotation with Kubernetes Secrets. cyberark/secrets-provider-for-k8s#448

1.4.0 - 2022-02-15

Added

1.3.0 - 2022-01-03

Added

Changed

  • Secrets Provider run in Push-to-File mode using a custom secret file template requires annotation conjur.org/secret-file-format.{secret-group} to be set to template. This is a breaking change. cyberark/secrets-provider-for-k8s#393

Fixed

  • If the Secrets Provider is run in Push-to-File mode, it no longer errors out if it finds any pre-existing secret files. This is helpful when the Secrets Provider is being run multiple times. cyberark/secrets-provider-for-k8s#397
  • If the Secrets Provider is run in Push-to-File mode, it no longer errors out if either (a) multiple secret groups use the same secret path, or (b) there are no secrets that need to be retrieved. cyberark/secrets-provider-for-k8s#404

1.2.0 - 2021-11-30

Added

Changed

  • Push-to-File supports more intuitive output filepaths. Filepaths are no longer required to contain the hard-coded mount path /conjur/secrets, and can specify intermediate directories. cyberark/secrets-provider-for-k8s#381

1.1.6 - 2021-10-29

Added

1.1.5 - 2021-08-13

Added

Security

1.1.4 - 2021-06-30

Changed

1.1.3 - 2021-03-01

Added

Changed

  • Updated k8s authenticator client version to 0.19.1, which streamlines the parsing of authentication responses, updates the project Golang version to v1.15, and improves error messaging.

1.1.2 - 2020-01-29

Added

Fixed

  • The Secrets Provider helm templates are updated to correctly refer to Release.Namespace instead of Release.namespace. Previously, the namespace value wasn't being interpolated correctly because its name is case sensitive. cyberark/secrets-provider-for-k8s#290

Deprecated

Security

1.1.1 - 2020-11-24

Added

Changed

Fixed

1.1.0 - 2020-09-15

Added

Changed

1.0.0 - 2020-05-19

Changed

Fixed

  • Fixed issue with providing complex Conjur secrets. The secrets-provider now updates k8s secrets using update instead of patch so the service-account needs to have that permission cyberark/secrets-provider-for-k8s#79

0.4.0 - 2020-01-23

Changed

  • Using a new conjur-authn-k8s-client version that enables authentication of hosts that have their application identity defined in annotations.

0.3.0 - 2019-12-26

Changed

  • Using a new authn-client version that sends the full host-id in the CSR equest so we have this capability in this project. This enables users to authenticate with hosts that are defined anywhere in the policy tree.

0.2.0 - 2019-09-19

Added

  • Logs
    • Logging in different log levels (info, debug, warn)
    • Capability to Enable debug logs via the env
    • More messages to increase UX and supportability
    • An end-to-end integration test

Changed

  • Escape secrets with backslashes before patching in k8s