Update Submariner dependencies to v0.23.2

Signed-off-by: Automated Release <release@submariner.io>

.github/workflows/branch.yml

@@ -11,6 +11,6 @@ jobs:
     name: PR targets branch
     runs-on: ubuntu-latest
     steps:
-      - name: Check that the PR targets devel
-        if: ${{ github.base_ref != 'devel' }}
+      - name: Check that the PR targets release-0.23
+        if: ${{ github.base_ref != 'release-0.23' }}
         run: exit 1

.github/workflows/coderabbit-review.yml

@@ -1,16 +0,0 @@
----
-name: Trigger CodeRabbit for Bot PRs
-on:
-  pull_request_target:
-    types: [opened]
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  trigger-review:
-    uses: submariner-io/submariner-bot/.github/workflows/coderabbit-trigger.yml@devel
-    with:
-      pr_number: ${{ github.event.pull_request.number }}
-    secrets: inherit

.github/workflows/e2e-full.yml

@@ -26,14 +26,14 @@ jobs:
           - k8s_version: 'k8s-oldest-supported'
     steps:
       - name: Check out the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Run E2E deployment and tests
-        uses: submariner-io/shipyard/gh-actions/e2e@devel
+        uses: submariner-io/shipyard/gh-actions/e2e@release-0.23
         with:
           k8s_version: ${{ matrix.k8s_version }}
           using: ${{ matrix.cable_driver }} ${{ matrix.globalnet }} ${{ matrix.lighthouse }}
 
       - name: Post mortem
         if: failure()
-        uses: submariner-io/shipyard/gh-actions/post-mortem@devel
+        uses: submariner-io/shipyard/gh-actions/post-mortem@release-0.23

.github/workflows/e2e.yml

@@ -13,11 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Run E2E deployment and tests
-        uses: submariner-io/shipyard/gh-actions/e2e@devel
+        uses: submariner-io/shipyard/gh-actions/e2e@release-0.23
 
       - name: Post mortem
         if: failure()
-        uses: submariner-io/shipyard/gh-actions/post-mortem@devel
+        uses: submariner-io/shipyard/gh-actions/post-mortem@release-0.23

.github/workflows/flake_finder.yml

@@ -21,13 +21,13 @@ jobs:
         lighthouse: ['', 'lighthouse']
     steps:
       - name: Check out the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Run E2E deployment and tests
-        uses: submariner-io/shipyard/gh-actions/e2e@devel
+        uses: submariner-io/shipyard/gh-actions/e2e@release-0.23
         with:
           using: ${{ matrix.cable_driver }} ${{ matrix.globalnet }} ${{ matrix.lighthouse }}
 
       - name: Post mortem
         if: failure()
-        uses: submariner-io/shipyard/gh-actions/post-mortem@devel
+        uses: submariner-io/shipyard/gh-actions/post-mortem@release-0.23

.github/workflows/linting.yml

@@ -38,15 +38,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310
         with:
           version: v3.6.0
 
       - name: Set up Python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.13.x'
 
@@ -64,7 +64,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
       - name: Run gitlint
@@ -75,7 +75,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Run helm-docs and verify docs are up-to-date
         run: make helm-docs
@@ -85,7 +85,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Run markdown-link-check
         uses: gaurav-nelson/github-action-markdown-link-check@3c3b66f1f7d0900e37b71eca45b63ea9eedfce31
@@ -99,7 +99,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: Run markdownlint
         run: make markdownlint
 
@@ -108,6 +108,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: Run yamllint
         run: make yamllint

.github/workflows/periodic.yml

@@ -16,7 +16,7 @@ jobs:
       issues: write
     steps:
       - name: Check out the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Run markdown-link-check
         uses: gaurav-nelson/github-action-markdown-link-check@3c3b66f1f7d0900e37b71eca45b63ea9eedfce31

.github/workflows/release.yml

@@ -4,7 +4,7 @@ name: Release Charts
 on:
   push:
     branches:
-      - devel
+      - release-0.23
 
 permissions:
   contents: write
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 

.github/workflows/stale.yml

@@ -16,7 +16,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93
         with:
           days-before-issue-stale: 120
           days-before-pr-stale: 14

Makefile

@@ -1,4 +1,4 @@
-BASE_BRANCH ?= devel
+BASE_BRANCH ?= release-0.23
 export BASE_BRANCH
 export HELM_REPO_LOCATION=./helm_repo
 
@@ -17,7 +17,7 @@ endif
 export DEPLOYTOOL = helm
 GH_URL=https://submariner-io.github.io/submariner-charts/charts
 CHARTS_DIR=charts
-CHARTS_VERSION=0.23.0-m0
+CHARTS_VERSION=0.23.2
 HELM_DOCS_VERSION=0.15.0
 REPO_URL=$(shell git config remote.origin.url)
 

submariner-operator/README.md

@@ -28,6 +28,7 @@ Submariner enables direct networking between Pods and Services in different Kube
 | ipsec.forceUDPEncaps | bool | `false` |  |
 | ipsec.ikePort | int | `500` |  |
 | ipsec.natPort | int | `4500` |  |
+| ipsec.pskSecret | string | `""` | Name of the Kubernetes Secret containing the IPsec PSK as field psk |
 | ipsec.psk | string | `""` |  |
 | leadership.leaseDuration | int | `10` |  |
 | leadership.renewDeadline | int | `5` |  |
@@ -52,5 +53,6 @@ Submariner enables direct networking between Pods and Services in different Kube
 | submariner.images.tag | string | `"0.14.0"` |  |
 | submariner.natEnabled | bool | `false` |  |
 | submariner.serviceCidr | string | `""` |  |
+| submariner.brokerK8sSecret | string | `""` |  Name of the Kubernetes Secret containing broker credentials (ca.crt, token). |
 | submariner.serviceDiscovery | bool | `true` |  |
 | submariner.token | string | `""` |  |

submariner-operator/templates/submariner.yaml

@@ -6,15 +6,23 @@ metadata:
 spec:
   broker: k8s
   brokerK8sApiServer: {{ .Values.broker.server }}
+  {{- if .Values.submariner.brokerK8sSecret }}
+  brokerK8sSecret: {{ .Values.submariner.brokerK8sSecret }}
+  {{- else }}
   brokerK8sApiServerToken: {{ .Values.broker.token }}
   brokerK8sCA: {{ .Values.broker.ca }}
+  {{- end }}
   brokerK8sRemoteNamespace: {{ .Values.broker.namespace }}
   brokerK8sInsecure: {{ .Values.broker.insecure }}
   ceIPSecDebug: {{ .Values.ipsec.debug }}
   ceIPSecForceUDPEncaps: {{ .Values.ipsec.forceUDPEncaps }}
   ceIPSecIKEPort: {{ .Values.ipsec.ikePort }}
   ceIPSecNATTPort: {{ .Values.ipsec.natPort }}
+  {{- if .Values.ipsec.pskSecret }}
+  ceIPSecPSKSecret: {{ .Values.ipsec.pskSecret }}
+  {{- else }}
   ceIPSecPSK: {{ .Values.ipsec.psk }}
+  {{- end }}
   clusterCIDR: "{{ .Values.submariner.clusterCidr }}"
   clusterID: {{ .Values.submariner.clusterId }}
   colorCodes: {{ .Values.submariner.colorCodes }}

submariner-operator/values.yaml

@@ -7,6 +7,7 @@ submariner:
   globalCidr: ""
   clustersetIpCidr: ""
   clustersetIpEnabled: false
+  brokerK8sSecret: ""
   loadBalancerEnabled: false
   natEnabled: false
   colorCodes: blue
@@ -28,6 +29,7 @@ broker:
 images: {}
 ipsec:
   psk: ""
+  pskSecret: ""
   debug: false
   forceUDPEncaps: false
   ikePort: 500