feat(container): update system upgrade controller group to v0.14.2 (minor)

[renovate]

This PR contains the following updates:

Package	Update	Change
docker.io/rancher/system-upgrade-controller	minor	v0.13.4 -> v0.14.2
rancher/system-upgrade-controller	minor	v0.13.4 -> v0.14.2

---

Release Notes

rancher/system-upgrade-controller (rancher/system-upgrade-controller)

v0.14.2

Compare Source

What's Changed

• bump go to 1.23 and k8s to 1.31.1 by @​jiaqiluo in https://github.com/rancher/system-upgrade-controller/pull/334

New Contributors

• @​jiaqiluo made their first contribution in https://github.com/rancher/system-upgrade-controller/pull/334

Full Changelog: rancher/system-upgrade-controller@v0.14.1...v0.14.2

v0.14.1

Compare Source

What's Changed

• Revert "fix(kustomize): Deploy latest system-upgrade-controller" by @​onno204 in https://github.com/rancher/system-upgrade-controller/pull/304

New Contributors

• @​onno204 made their first contribution in https://github.com/rancher/system-upgrade-controller/pull/304

Full Changelog: rancher/system-upgrade-controller@v0.14.0...v0.14.1

v0.14.0

Compare Source

What's Changed

• fix: Drop unneeded reorder surpression by @​SISheogorath in https://github.com/rancher/system-upgrade-controller/pull/296
• Update/fix README kustomize command by @​SISheogorath in https://github.com/rancher/system-upgrade-controller/pull/297
• Add GHA workflows by @​bfbachmann in https://github.com/rancher/system-upgrade-controller/pull/311
• Upgrade outdated golang dependencies by @​harsimranmaan in https://github.com/rancher/system-upgrade-controller/pull/326
• feat: allow pod replacement policy override by @​buroa in https://github.com/rancher/system-upgrade-controller/pull/328
• fix: system-upgrade-controller-drainer: add missing delete permission for pods in clusterrole by @​damdo in https://github.com/rancher/system-upgrade-controller/pull/320
• Bump golang.org/x/net from 0.17.0 to 0.23.0 in /pkg/apis by @​dependabot in https://github.com/rancher/system-upgrade-controller/pull/307
• Fix GHA release workflow by @​brandond in https://github.com/rancher/system-upgrade-controller/pull/330
• Fix image tag by @​brandond in https://github.com/rancher/system-upgrade-controller/pull/331
• Fix artifact permissions by @​brandond in https://github.com/rancher/system-upgrade-controller/pull/332

New Contributors

• @​bfbachmann made their first contribution in https://github.com/rancher/system-upgrade-controller/pull/311
• @​harsimranmaan made their first contribution in https://github.com/rancher/system-upgrade-controller/pull/326
• @​damdo made their first contribution in https://github.com/rancher/system-upgrade-controller/pull/320

Full Changelog: rancher/system-upgrade-controller@v0.13.4...v0.14.0

---

Configuration

📅 Schedule: Branch creation - "on saturday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[jsaveker]

Here is an automated review from ChatGPT of this pull request.

Based on the provided "git diff", the changes are mainly about updating the version of the system-upgrade-controller used, from v0.13.4 to v0.14.0, both in the Helm release (helmrelease.yaml.j2) and the Kustomization resources (kustomization.yaml.j2). There are no direct security vulnerabilities introduced by just updating version numbers in these configuration files. However, there are a few considerations and best practices to ensure this update does not indirectly introduce security issues:

1. Validate New Version Security:

• Issue: Without explicitly reviewing the security implications of the new version (v0.14.0), there's a risk if this version has known vulnerabilities that were not present in v0.13.4.

• Fix: Before adopting the new version, check the release notes and security advisories related to v0.14.0 of the system-upgrade-controller. This can be generally done via the project's GitHub repository or dedicated security advisories pages.

  #### Validation Steps:
  1. Review the [GitHub release notes](https://github.com/rancher/system-upgrade-controller/releases/tag/v0.14.0) for `v0.14.0`.
  2. Check the [GitHub Security Advisories page](https://github.com/rancher/system-upgrade-controller/security/advisories) for the project.
  3. Validate that the version does not introduce new, unresolved vulnerabilities.

2. Dependency Verification:

• Issue: Changing URLs in configuration files for downloading resources without verifying their authenticity exposes the risk of Man-in-the-Middle (MitM) attacks or downloading tampered resources.

• Fix: Ensure that the new resource URL (pointing to the new version of the CRD) is correct and comes from a trusted source. Additionally, if possible, verify the checksum or signature of the downloaded resource.

  #### Verification Steps:
  1. Verify the `crd.yaml` download URL is from the official [Rancher GitHub repository](https://github.com/rancher/system-upgrade-controller).
  2. If available, verify the checksum/signature of `crd.yaml` after download against officially provided cryptographic hashes to ensure integrity.

No Direct Security Vulnerabilities:

Based on the "git diff", there are no direct security vulnerabilities identified, provided the new version and resources have been properly validated for security and integrity as suggested. The changes are version updates, and the security posture would largely depend on the specific changes and security considerations of the version being adopted.

In Summary: No explicit security issues are identified from the diffs themselves, but ensuring the security and integrity of the versions and resources being updated is crucial.