make generate

charts/cert-management/templates/cert.gardener.cloud_certificaterevocations.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: certificaterevocations.cert.gardener.cloud
 spec:
   group: cert.gardener.cloud

charts/cert-management/templates/cert.gardener.cloud_certificates.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: certificates.cert.gardener.cloud
 spec:
   group: cert.gardener.cloud

charts/cert-management/templates/cert.gardener.cloud_issuers.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: issuers.cert.gardener.cloud
 spec:
   group: cert.gardener.cloud

examples/11-dns.gardener.cloud_dnsentries.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.13.0
+    controller-gen.kubebuilder.io/version: v0.16.5
   name: dnsentries.dns.gardener.cloud
 spec:
   group: dns.gardener.cloud
@@ -80,23 +80,28 @@ spec:
       openAPIV3Schema:
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
             properties:
               cnameLookupInterval:
-                description: lookup interval for CNAMEs that must be resolved to IP
-                  addresses. Only used if `resolveTargetsToAddresses` is set to true
-                  or targets consists of multiple domain names.
+                description: |-
+                  lookup interval for CNAMEs that must be resolved to IP addresses.
+                  Only used if `resolveTargetsToAddresses` is set to true or targets consists of multiple domain names.
                 format: int64
                 type: integer
               dnsName:
@@ -118,10 +123,10 @@ spec:
                 - name
                 type: object
               resolveTargetsToAddresses:
-                description: enables translation of a target domain name in the resolved
-                  IPv4 and IPv6 addresses. If enabled, `A` and/or `AAAA` records are
-                  created instead of a `CNAME` record. If the target list contains
-                  multiple targets, it is enabled implicitly.
+                description: |-
+                  enables translation of a target domain name in the resolved IPv4 and IPv6 addresses.
+                  If enabled, `A` and/or `AAAA` records are created instead of a `CNAME` record.
+                  If the target list contains multiple targets, it is enabled implicitly.
                 type: boolean
               routingPolicy:
                 description: optional routing policy

hack/sast.sh

@@ -6,17 +6,24 @@
 
 set -e
 
-root_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )/.." &> /dev/null && pwd )"
+report_dir="$(git rev-parse --show-toplevel)"
 
 gosec_report="false"
 gosec_report_parse_flags=""
+exclude_dirs="hack"
 
 parse_flags() {
   while test $# -gt 1; do
     case "$1" in
       --gosec-report)
         shift; gosec_report="$1"
         ;;
+      --report-dir)
+        shift; report_dir="$1"
+        ;;
+      --exclude-dirs)
+        shift; exclude_dirs="$1"
+        ;;
       *)
         echo "Unknown argument: $1"
         exit 1
@@ -31,14 +38,14 @@ parse_flags "$@"
 echo "> Running gosec"
 gosec --version
 if [[ "$gosec_report" != "false" ]]; then
-  echo "Exporting report to $root_dir/gosec-report.sarif"
-  gosec_report_parse_flags="-track-suppressions -fmt=sarif -out=gosec-report.sarif -stdout"
+  echo "Exporting report to ${report_dir}/gosec-report.sarif"
+  gosec_report_parse_flags="-track-suppressions -fmt=sarif -out=${report_dir}/gosec-report.sarif -stdout"
 fi
 
 # Gardener uses code-generators https://github.com/kubernetes/code-generator and https://github.com/protocolbuffers/protobuf
 # which create lots of G103 (CWE-242: Use of unsafe calls should be audited) & G104 (CWE-703: Errors unhandled) errors.
-# However, those generators are best-pratice in Kubernetes environment and their results are tested well.
+# However, those generators are best-practice in Kubernetes environment and their results are tested well.
 # Thus, generated code is excluded from gosec scan.
 # Nested go modules are not supported by gosec (see https://github.com/securego/gosec/issues/501), so the ./hack folder
 # is excluded too. It does not contain productive code anyway.
-gosec -exclude-generated -exclude-dir=hack $gosec_report_parse_flags ./...
+gosec -exclude-generated $(echo "$exclude_dirs" | awk -v RS=',' '{printf "-exclude-dir %s ", $1}') $gosec_report_parse_flags ./...

pkg/apis/cert/crds/cert.gardener.cloud_certificaterevocations.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: certificaterevocations.cert.gardener.cloud
 spec:
   group: cert.gardener.cloud

pkg/apis/cert/crds/cert.gardener.cloud_certificates.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: certificates.cert.gardener.cloud
 spec:
   group: cert.gardener.cloud

pkg/apis/cert/crds/cert.gardener.cloud_issuers.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: issuers.cert.gardener.cloud
 spec:
   group: cert.gardener.cloud

pkg/apis/cert/crds/zz_generated_crds.go

@@ -19,7 +19,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: certificaterevocations.cert.gardener.cloud
 spec:
   group: cert.gardener.cloud
@@ -307,7 +307,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: certificates.cert.gardener.cloud
 spec:
   group: cert.gardener.cloud
@@ -708,7 +708,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: issuers.cert.gardener.cloud
 spec:
   group: cert.gardener.cloud

pkg/certman2/apis/cert/crd-cert.gardener.cloud_certificaterevocations.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: certificaterevocations.cert.gardener.cloud
 spec:
   group: cert.gardener.cloud

pkg/certman2/apis/cert/crd-cert.gardener.cloud_certificates.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: certificates.cert.gardener.cloud
 spec:
   group: cert.gardener.cloud

pkg/certman2/apis/cert/crd-cert.gardener.cloud_issuers.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: issuers.cert.gardener.cloud
 spec:
   group: cert.gardener.cloud