Bump the github-actions group with 4 updates

Bumps the github-actions group with 4 updates: [depends-on/depends-on-action](https://github.com/depends-on/depends-on-action), [actions/checkout](https://github.com/actions/checkout), [actions/setup-python](https://github.com/actions/setup-python) and [actions/stale](https://github.com/actions/stale).


Updates `depends-on/depends-on-action` from 0.16.0 to 0.17.0
- [Release notes](https://github.com/depends-on/depends-on-action/releases)
- [Commits](https://github.com/depends-on/depends-on-action/compare/826c144163ac67bf08347590a5f81afd45da63ca...c7ac9a6932a7069e83aef80c202d9f60f91e43fd)

Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1)

Updates `actions/setup-python` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...5fda3b95a4ea91299a34e894583c3862153e4b97)

Updates `actions/stale` from 10.3.0 to 11.0.0
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...4391f3da665fdf50b6810c1a66712fb9ba21aa93)

---
updated-dependencies:
- dependency-name: depends-on/depends-on-action
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/stale
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -9,15 +9,6 @@ updates:
       github-actions:
         patterns:
           - "*"
-  - package-ecosystem: github-actions
-    directory: '/'
-    target-branch: "release-0.17"
-    schedule:
-      interval: monthly
-    groups:
-      github-actions:
-        patterns:
-          - "*"
   - package-ecosystem: github-actions
     directory: '/'
     target-branch: "release-0.18"
@@ -54,3 +45,30 @@ updates:
       github-actions:
         patterns:
           - "*"
+  - package-ecosystem: github-actions
+    directory: '/'
+    target-branch: "release-0.22"
+    schedule:
+      interval: monthly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+  - package-ecosystem: github-actions
+    directory: '/'
+    target-branch: "release-0.23"
+    schedule:
+      interval: monthly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+  - package-ecosystem: github-actions
+    directory: '/'
+    target-branch: "release-0.24"
+    schedule:
+      interval: monthly
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/dependent-issues.yml

@@ -2,27 +2,15 @@
 name: PR Dependencies
 
 on:
-  issues:
-    types:
-      - opened
-      - edited
-      - closed
-      - reopened
-      - synchronize
   pull_request_target:
     types:
       - opened
       - edited
-      - closed
       - reopened
       - synchronize
-  schedule:
-    - cron: '0 0/6 * * *'  # every 6 hours
 
 permissions:
-  issues: write
   pull-requests: write
-  statuses: write
 
 jobs:
   check:
@@ -30,15 +18,7 @@ jobs:
     if: github.repository_owner == 'submariner-io'
     runs-on: ubuntu-latest
     steps:
-      - uses: z0al/dependent-issues@950226e7ca8fc43dc209a7febf67c655af3bdb43
+      - uses: depends-on/depends-on-action@c7ac9a6932a7069e83aef80c202d9f60f91e43fd  # v0.17.0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          # The label to use to mark dependent issues
+          token: ${{ secrets.GITHUB_TOKEN }}
-          label: dependent
+          check-unmerged-pr: true
-
-          # Enable checking for dependencies in issues.
-          check_issues: on
-
-          # A comma-separated list of keywords to mark dependency.
-          keywords: depends on, Depends on

.github/workflows/e2e-full.yml

@@ -26,7 +26,7 @@ jobs:
           - k8s_version: 'k8s-oldest-supported'
     steps:
       - name: Check out the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Run E2E deployment and tests
         uses: submariner-io/shipyard/gh-actions/e2e@devel

.github/workflows/e2e.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Run E2E deployment and tests
         uses: submariner-io/shipyard/gh-actions/e2e@devel

.github/workflows/flake_finder.yml

@@ -21,7 +21,7 @@ jobs:
         lighthouse: ['', 'lighthouse']
     steps:
       - name: Check out the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Run E2E deployment and tests
         uses: submariner-io/shipyard/gh-actions/e2e@devel

.github/workflows/linting.yml

@@ -38,20 +38,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310
         with:
           version: v3.6.0
 
       - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.13.x'
 
       - name: Set up helm/chart-testing
-        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b
+        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f
 
       - name: Set up local helm repo
         run: make local-helm-repo
@@ -64,7 +64,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
       - name: Run gitlint
@@ -75,7 +75,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Run helm-docs and verify docs are up-to-date
         run: make helm-docs
@@ -85,7 +85,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Run markdown-link-check
         uses: gaurav-nelson/github-action-markdown-link-check@3c3b66f1f7d0900e37b71eca45b63ea9eedfce31
@@ -99,7 +99,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: Run markdownlint
         run: make markdownlint
 
@@ -108,6 +108,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: Run yamllint
         run: make yamllint

.github/workflows/periodic.yml

@@ -16,7 +16,7 @@ jobs:
       issues: write
     steps:
       - name: Check out the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Run markdown-link-check
         uses: gaurav-nelson/github-action-markdown-link-check@3c3b66f1f7d0900e37b71eca45b63ea9eedfce31

.github/workflows/release.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 

.github/workflows/stale.yml

@@ -16,7 +16,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93
         with:
           days-before-issue-stale: 120
           days-before-pr-stale: 14

.markdownlint.yml

@@ -2,6 +2,9 @@
 # Breaks reusing MD snippets extracted to files
 first-line-heading: false
 
+# Accept any consistent table column style
+table-column-style: false
+
 # Set maximum line Length to 140c to match Go linting
 line-length:
   line_length: 140

Makefile

@@ -17,7 +17,7 @@ endif
 export DEPLOYTOOL = helm
 GH_URL=https://submariner-io.github.io/submariner-charts/charts
 CHARTS_DIR=charts
-CHARTS_VERSION=0.22.0-m2
+CHARTS_VERSION=0.25.0-m0
 HELM_DOCS_VERSION=0.15.0
 REPO_URL=$(shell git config remote.origin.url)
 

generate-yamls.sh

@@ -93,9 +93,13 @@ add_service_acct_ns ${RBAC_BASE}/lighthouse-coredns/cluster_role_binding.yaml
 cat ${RBAC_BASE}/lighthouse-agent/service_account.yaml \
     ${RBAC_BASE}/lighthouse-agent/cluster_role.yaml \
     ${RBAC_BASE}/lighthouse-agent/cluster_role_binding.yaml \
+    ${RBAC_BASE}/lighthouse-agent/role.yaml \
+    ${RBAC_BASE}/lighthouse-agent/role_binding.yaml \
     ${RBAC_BASE}/lighthouse-coredns/service_account.yaml \
     ${RBAC_BASE}/lighthouse-coredns/cluster_role.yaml \
-    ${RBAC_BASE}/lighthouse-coredns/cluster_role_binding.yaml >> ${SERVICE_DISC_RBAC_YAML}
+    ${RBAC_BASE}/lighthouse-coredns/cluster_role_binding.yaml \
+    ${RBAC_BASE}/lighthouse-coredns/role.yaml \
+    ${RBAC_BASE}/lighthouse-coredns/role_binding.yaml >> ${SERVICE_DISC_RBAC_YAML}
 echo '{{- end -}}' >> ${SERVICE_DISC_RBAC_YAML}
 
 # Generate the openshift monitoring rbac yaml for the operator chart

submariner-k8s-broker/README.md

@@ -6,9 +6,9 @@ Submariner Kubernetes Broker
 
 ## Maintainers
 
-| Name | Email | Url |
+ | Name | Email | Url |
-| ---- | ------ | --- |
+ | ---- | ------ | --- |
-| Contributors to the Submariner project | submariner-dev@googlegroups.com | https://submariner.io/ |
+ | Contributors to the Submariner project | submariner-dev@googlegroups.com | https://submariner.io/ |
 
 ## Source Code
 

submariner-operator/README.md

@@ -6,9 +6,9 @@ Submariner enables direct networking between Pods and Services in different Kube
 
 ## Maintainers
 
-| Name | Email | Url |
+ | Name | Email | Url |
-| ---- | ------ | --- |
+ | ---- | ------ | --- |
-| Contributors to the Submariner project | submariner-dev@googlegroups.com | https://submariner.io/ |
+ | Contributors to the Submariner project | submariner-dev@googlegroups.com | https://submariner.io/ |
 
 ## Source Code
 
@@ -16,41 +16,43 @@ Submariner enables direct networking between Pods and Services in different Kube
 
 ## Values
 
-| Key | Type | Default | Description |
+ | Key | Type | Default | Description |
-|-----|------|---------|-------------|
+ | ----- | ------ | --------- | ------------- |
-| broker.ca | string | `""` |  |
+ | broker.ca | string | `""` |  |
-| broker.globalnet | bool | `false` |  |
+ | broker.globalnet | bool | `false` |  |
-| broker.insecure | bool | `false` |  |
+ | broker.insecure | bool | `false` |  |
-| broker.namespace | string | `"xyz"` |  |
+ | broker.namespace | string | `"xyz"` |  |
-| broker.server | string | `"example.k8s.apiserver"` |  |
+ | broker.server | string | `"example.k8s.apiserver"` |  |
-| broker.token | string | `"test"` |  |
+ | broker.token | string | `"test"` |  |
-| ipsec.debug | bool | `false` |  |
+ | ipsec.debug | bool | `false` |  |
-| ipsec.forceUDPEncaps | bool | `false` |  |
+ | ipsec.forceUDPEncaps | bool | `false` |  |
-| ipsec.ikePort | int | `500` |  |
+ | ipsec.ikePort | int | `500` |  |
-| ipsec.natPort | int | `4500` |  |
+ | ipsec.natPort | int | `4500` |  |
-| ipsec.psk | string | `""` |  |
+ | ipsec.pskSecret | string | `""` | Name of the Kubernetes Secret containing the IPsec PSK as field psk |
-| leadership.leaseDuration | int | `10` |  |
+ | ipsec.psk | string | `""` |  |
-| leadership.renewDeadline | int | `5` |  |
+ | leadership.leaseDuration | int | `10` |  |
-| leadership.retryPeriod | int | `2` |  |
+ | leadership.renewDeadline | int | `5` |  |
-| operator.affinity | object | `{}` |  |
+ | leadership.retryPeriod | int | `2` |  |
-| operator.image.pullPolicy | string | `"IfNotPresent"` |  |
+ | operator.affinity | object | `{}` |  |
-| operator.image.repository | string | `"quay.io/submariner/submariner-operator"` |  |
+ | operator.image.pullPolicy | string | `"IfNotPresent"` |  |
-| operator.image.tag | string | `"0.14.0"` |  |
+ | operator.image.repository | string | `"quay.io/submariner/submariner-operator"` |  |
-| operator.resources | object | `{}` |  |
+ | operator.image.tag | string | `"0.14.0"` |  |
-| operator.tolerations | list | `[]` |  |
+ | operator.resources | object | `{}` |  |
-| submariner.cableDriver | string | `"libreswan"` |  |
+ | operator.tolerations | list | `[]` |  |
-| submariner.clusterCidr | string | `""` |  |
+ | submariner.cableDriver | string | `"libreswan"` |  |
-| submariner.clusterId | string | `""` |  |
+ | submariner.clusterCidr | string | `""` |  |
-| submariner.colorCodes | string | `"blue"` |  |
+ | submariner.clusterId | string | `""` |  |
-| submariner.coreDNSCustomConfig | object | `{}` |  |
+ | submariner.colorCodes | string | `"blue"` |  |
-| submariner.debug | bool | `false` |  |
+ | submariner.coreDNSCustomConfig | object | `{}` |  |
-| submariner.globalCidr | string | `""` |  |
+ | submariner.debug | bool | `false` |  |
-| submariner.clustersetIpCidr | string | `""` |  |
+ | submariner.globalCidr | string | `""` |  |
-| submariner.clustersetIpEnabled | bool | `false` |  |
+ | submariner.clustersetIpCidr | string | `""` |  |
-| submariner.healthcheckEnabled | bool | `true` |  |
+ | submariner.clustersetIpEnabled | bool | `false` |  |
-| submariner.images.repository | string | `"quay.io/submariner"` |  |
+ | submariner.healthcheckEnabled | bool | `true` |  |
-| submariner.images.tag | string | `"0.14.0"` |  |
+ | submariner.images.repository | string | `"quay.io/submariner"` |  |
-| submariner.natEnabled | bool | `false` |  |
+ | submariner.images.tag | string | `"0.14.0"` |  |
-| submariner.serviceCidr | string | `""` |  |
+ | submariner.natEnabled | bool | `false` |  |
-| submariner.serviceDiscovery | bool | `true` |  |
+ | submariner.serviceCidr | string | `""` |  |
-| submariner.token | string | `""` |  |
+ | submariner.brokerK8sSecret | string | `""` |  Name of the Kubernetes Secret containing broker credentials (ca.crt, token). |
+ | submariner.serviceDiscovery | bool | `true` |  |
+ | submariner.token | string | `""` |  |

submariner-operator/templates/submariner.yaml

@@ -6,15 +6,23 @@ metadata:
 spec:
   broker: k8s
   brokerK8sApiServer: {{ .Values.broker.server }}
+  {{- if .Values.submariner.brokerK8sSecret }}
+  brokerK8sSecret: {{ .Values.submariner.brokerK8sSecret }}
+  {{- else }}
   brokerK8sApiServerToken: {{ .Values.broker.token }}
   brokerK8sCA: {{ .Values.broker.ca }}
+  {{- end }}
   brokerK8sRemoteNamespace: {{ .Values.broker.namespace }}
   brokerK8sInsecure: {{ .Values.broker.insecure }}
   ceIPSecDebug: {{ .Values.ipsec.debug }}
   ceIPSecForceUDPEncaps: {{ .Values.ipsec.forceUDPEncaps }}
   ceIPSecIKEPort: {{ .Values.ipsec.ikePort }}
   ceIPSecNATTPort: {{ .Values.ipsec.natPort }}
+  {{- if .Values.ipsec.pskSecret }}
+  ceIPSecPSKSecret: {{ .Values.ipsec.pskSecret }}
+  {{- else }}
   ceIPSecPSK: {{ .Values.ipsec.psk }}
+  {{- end }}
   clusterCIDR: "{{ .Values.submariner.clusterCidr }}"
   clusterID: {{ .Values.submariner.clusterId }}
   colorCodes: {{ .Values.submariner.colorCodes }}

submariner-operator/values.yaml

@@ -7,6 +7,7 @@ submariner:
   globalCidr: ""
   clustersetIpCidr: ""
   clustersetIpEnabled: false
+  brokerK8sSecret: ""
   loadBalancerEnabled: false
   natEnabled: false
   colorCodes: blue
@@ -28,6 +29,7 @@ broker:
 images: {}
 ipsec:
   psk: ""
+  pskSecret: ""
   debug: false
   forceUDPEncaps: false
   ikePort: 500