mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Aleksei Sviridkin
f8a648abdc
## What this PR does Re-vendors the openbao-helm chart from 0.25.3 to 0.25.7 (appVersion v2.5.0 → v2.5.1), the latest in the `^0.25` line the Makefile pins. The vendored tree is byte-identical to a fresh upstream pull; cozystack overrides (`injector.enabled: false`, `csi.enabled: false`) are untouched and still render nothing, so the changed runtime surface is the openbao server StatefulSet image. **Security scope (honest accounting):** v2.5.1 fixes two OpenBao CVEs — including the critical **CVE-2025-68121** (Go stdlib TLS, CVSS 10.0, via a Go 1.25.7 rebuild) and **CVE-2026-24051** (otel/sdk). The issue also lists `github.com/jackc/pgx/v5` — that is **not** addressed: pgx is unchanged in v2.5.1 upstream, so it can't be closed by an in-`^0.25` bump. `libcap2`/`libexpat` are base-image packages picked up incidentally by the rebuild (not verified here). Widening past 0.25.x to 0.28.x (app v2.5.5) would need a CHART_VERSION constraint change plus a 0.26/0.27/0.28 changelog review and is intentionally left out. Adds helm-unittest coverage (the package shipped none): pins the server image and the injector/CSI-disabled invariants. `helm unittest` 3/3 pass. Closes #2895 ### Release note ```release-note chore(openbao): bump openbao chart to 0.25.7 (app v2.5.1, fixes critical CVE-2025-68121) ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for configuring headless service annotations (including HA standby headless service). * Enhanced the Grafana dashboard with consistent dynamic job filtering across Prometheus queries. * **Updates** * Upgraded Helm chart to **0.25.7** (OpenBao app **v2.5.1**). * Updated snapshot agent image tag to **0.3.0**. * **Tests** * Added Helm unit test coverage via a `helm unittest` Makefile target and new chart rendering invariants. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
How to test packages local
cd packages/core/installer
make image-cozystack REGISTRY=YOUR_CUSTOM_REGISTRY
make apply
kubectl delete po -l app=source-controller -n cozy-fluxcd