Sync common Makefile

.github/renovate.json

@@ -1,5 +1,5 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "schedule": "every weekend",
+  "schedule": "before 8am on Monday",
   "timezone": "America/New_York"
 }

api/v1beta1/policyautomation_types.go

@@ -53,7 +53,7 @@ type AutomationDef struct {
 	// is "1000".
 	//
 	// +kubebuilder:validation:Minimum=0
-	PolicyViolationsLimit *uint `json:"policyViolationsLimit,omitempty"`
+	PolicyViolationsLimit *uint16 `json:"policyViolationsLimit,omitempty"`
 }
 
 // PolicyAutomationSpec defines how and when automation is initiated for the referenced policy.

build/common/Makefile.common.mk

@@ -3,21 +3,21 @@
 
 ## CLI versions (with links to the latest releases)
 # https://github.com/kubernetes-sigs/controller-tools/releases/latest
-CONTROLLER_GEN_VERSION := v0.14.0
+CONTROLLER_GEN_VERSION := v0.16.3
 # https://github.com/kubernetes-sigs/kustomize/releases/latest
-KUSTOMIZE_VERSION := v5.3.0
+KUSTOMIZE_VERSION := v5.4.3
 # https://github.com/golangci/golangci-lint/releases/latest
 GOLANGCI_VERSION := v1.52.2
 # https://github.com/mvdan/gofumpt/releases/latest
-GOFUMPT_VERSION := v0.6.0
+GOFUMPT_VERSION := v0.7.0
 # https://github.com/daixiang0/gci/releases/latest
-GCI_VERSION := v0.13.4
+GCI_VERSION := v0.13.5
 # https://github.com/securego/gosec/releases/latest
-GOSEC_VERSION := v2.19.0
+GOSEC_VERSION := v2.21.3
 # https://github.com/kubernetes-sigs/kubebuilder/releases/latest
-KBVERSION := 3.14.1
+KBVERSION := 3.15.1
 # https://github.com/kubernetes/kubernetes/releases/latest
-ENVTEST_K8S_VERSION := 1.29.x
+ENVTEST_K8S_VERSION := 1.30.x
 
 LOCAL_BIN ?= $(error LOCAL_BIN is not set.)
 ifneq ($(findstring $(LOCAL_BIN), $(PATH)), $(LOCAL_BIN))

controllers/automation/policyautomation_controller.go

@@ -196,7 +196,7 @@ func (r *PolicyAutomationReconciler) getViolationContext(
 
 	policyViolationsLimit := policyAutomation.Spec.Automation.PolicyViolationsLimit
 	if policyViolationsLimit == nil {
-		policyViolationsLimit = new(uint)
+		policyViolationsLimit = new(uint16)
 		*policyViolationsLimit = policyv1beta1.DefaultPolicyViolationsLimit
 	}
 

controllers/encryptionkeys/encryptionkeys_controller.go

@@ -38,7 +38,7 @@ var (
 )
 
 // SetupWithManager sets up the controller with the Manager.
-func (r *EncryptionKeysReconciler) SetupWithManager(mgr ctrl.Manager, maxConcurrentReconciles uint) error {
+func (r *EncryptionKeysReconciler) SetupWithManager(mgr ctrl.Manager, maxConcurrentReconciles uint16) error {
 	return ctrl.NewControllerManagedBy(mgr).
 		// The work queue prevents the same item being reconciled concurrently:
 		// https://github.com/kubernetes-sigs/controller-runtime/issues/1416#issuecomment-899833144
@@ -55,7 +55,7 @@ var _ reconcile.Reconciler = &EncryptionKeysReconciler{}
 // for all managed clusters.
 type EncryptionKeysReconciler struct { //nolint:golint,revive
 	client.Client
-	KeyRotationDays uint
+	KeyRotationDays uint32
 	Scheme          *runtime.Scheme
 }
 

controllers/policymetrics/policymetrics_controller.go

@@ -24,7 +24,7 @@ const ControllerName string = "policy-metrics"
 var log = ctrl.Log.WithName(ControllerName)
 
 // SetupWithManager sets up the controller with the Manager.
-func (r *MetricReconciler) SetupWithManager(mgr ctrl.Manager, maxConcurrentReconciles uint) error {
+func (r *MetricReconciler) SetupWithManager(mgr ctrl.Manager, maxConcurrentReconciles uint16) error {
 	return ctrl.NewControllerManagedBy(mgr).
 		// The work queue prevents the same item being reconciled concurrently:
 		// https://github.com/kubernetes-sigs/controller-runtime/issues/1416#issuecomment-899833144

controllers/propagator/replicatedpolicy_setup.go

@@ -19,7 +19,7 @@ import (
 
 func (r *ReplicatedPolicyReconciler) SetupWithManager(
 	mgr ctrl.Manager,
-	maxConcurrentReconciles uint,
+	maxConcurrentReconciles uint16,
 	dependenciesSource source.Source,
 	updateSrc source.Source,
 	templateSrc source.Source,

controllers/propagator/rootpolicy_setup.go

@@ -28,7 +28,7 @@ import (
 //+kubebuilder:rbac:groups=*,resources=*,verbs=get;list;watch
 
 // SetupWithManager sets up the controller with the Manager.
-func (r *RootPolicyReconciler) SetupWithManager(mgr ctrl.Manager, maxConcurrentReconciles uint) error {
+func (r *RootPolicyReconciler) SetupWithManager(mgr ctrl.Manager, maxConcurrentReconciles uint16) error {
 	return ctrl.NewControllerManagedBy(mgr).
 		WithOptions(controller.Options{MaxConcurrentReconciles: int(maxConcurrentReconciles)}).
 		Named("root-policy-spec").

controllers/rootpolicystatus/root_policy_status_controller.go

@@ -32,7 +32,7 @@ var log = ctrl.Log.WithName(ControllerName)
 // SetupWithManager sets up the controller with the Manager.
 func (r *RootPolicyStatusReconciler) SetupWithManager(
 	mgr ctrl.Manager,
-	maxConcurrentReconciles uint,
+	maxConcurrentReconciles uint16,
 	plrsEnabled bool,
 ) error {
 	ctrlBldr := ctrl.NewControllerManagedBy(mgr).

deploy/crds/kustomize/policy.open-cluster-management.io_policies.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: policies.policy.open-cluster-management.io
 spec:
   group: policy.open-cluster-management.io

deploy/crds/policy.open-cluster-management.io_placementbindings.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: placementbindings.policy.open-cluster-management.io
 spec:
   group: policy.open-cluster-management.io

deploy/crds/policy.open-cluster-management.io_policies.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: policies.policy.open-cluster-management.io
 spec:
   group: policy.open-cluster-management.io

deploy/crds/policy.open-cluster-management.io_policyautomations.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: policyautomations.policy.open-cluster-management.io
 spec:
   group: policy.open-cluster-management.io
@@ -116,6 +116,7 @@ spec:
                 type: string
             required:
             - automationDef
+            - eventHook
             - mode
             - policyRef
             type: object

deploy/crds/policy.open-cluster-management.io_policysets.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: policysets.policy.open-cluster-management.io
 spec:
   group: policy.open-cluster-management.io

deploy/operator.yaml

@@ -34,52 +34,6 @@ kind: ClusterRole
 metadata:
   name: governance-policy-propagator
 rules:
-- apiGroups:
-  - '*'
-  resources:
-  - '*'
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - apps.open-cluster-management.io
-  resources:
-  - placementrules
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - authorization.k8s.io
-  resources:
-  - subjectaccessreviews
-  verbs:
-  - create
-- apiGroups:
-  - authorization.k8s.io
-  resources:
-  - tokenreviews
-  verbs:
-  - create
-- apiGroups:
-  - cluster.open-cluster-management.io
-  resources:
-  - managedclusters
-  - placementdecisions
-  - placements
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - config.openshift.io
-  resourceNames:
-  - cluster
-  resources:
-  - dnses
-  verbs:
-  - get
 - apiGroups:
   - ""
   resources:
@@ -92,12 +46,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - create
 - apiGroups:
   - ""
   resourceNames:
@@ -122,76 +70,57 @@ rules:
 - apiGroups:
   - ""
   resources:
+  - secrets
   - serviceaccounts/token
   verbs:
   - create
 - apiGroups:
-  - policy.open-cluster-management.io
+  - '*'
   resources:
-  - placementbindings
+  - '*'
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
-  - policy.open-cluster-management.io
+  - apps.open-cluster-management.io
   resources:
-  - policies
+  - placementrules
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
-  - policy.open-cluster-management.io
-  resources:
-  - policies/finalizers
-  verbs:
-  - update
-- apiGroups:
-  - policy.open-cluster-management.io
+  - authorization.k8s.io
   resources:
-  - policies/status
+  - subjectaccessreviews
+  - tokenreviews
   verbs:
-  - get
-  - patch
-  - update
+  - create
 - apiGroups:
-  - policy.open-cluster-management.io
+  - cluster.open-cluster-management.io
   resources:
-  - policyautomations
+  - managedclusters
+  - placementdecisions
+  - placements
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
-  - policy.open-cluster-management.io
-  resources:
-  - policyautomations/finalizers
-  verbs:
-  - update
-- apiGroups:
-  - policy.open-cluster-management.io
+  - config.openshift.io
+  resourceNames:
+  - cluster
   resources:
-  - policyautomations/status
+  - dnses
   verbs:
   - get
-  - patch
-  - update
 - apiGroups:
   - policy.open-cluster-management.io
   resources:
+  - placementbindings
+  - policies
+  - policyautomations
   - policysets
   verbs:
   - create
@@ -204,12 +133,16 @@ rules:
 - apiGroups:
   - policy.open-cluster-management.io
   resources:
+  - policies/finalizers
+  - policyautomations/finalizers
   - policysets/finalizers
   verbs:
   - update
 - apiGroups:
   - policy.open-cluster-management.io
   resources:
+  - policies/status
+  - policyautomations/status
   - policysets/status
   verbs:
   - get