Repository: kubernetes-sigs/security-profiles-operator
Pull request #1709 (2023-05-26 06:57:01)

Update external dependencies

#### What type of PR is this?

/kind cleanup


#### What this PR does / why we need it:

#### Which issue(s) this PR fixes:

None

#### Does this PR have test?

None
#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
- Updated kube-rbac-proxy to v0.14.1.
- Updated cert-manager to v1.12.1.
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1709#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1709#pullrequestreview-1445334422" title="Approved">JAORMX</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1709#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [JAORMX,saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5b6f0e3ab..9ab97b143 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -8,7 +8,7 @@ on:
   pull_request:
 env:
   GO_VERSION: '1.20'
-  NIX_VERSION: '2.13.3'
+  NIX_VERSION: '2.15.1'
   BOM_VERSION: v0.5.1
 
 permissions: {}
diff --git a/Dockerfile.build-image b/Dockerfile.build-image
index 3d959362e..c6d5b7b55 100644
--- a/Dockerfile.build-image
+++ b/Dockerfile.build-image
@@ -20,7 +20,7 @@ RUN apt-get update && apt-get install -y wget xz-utils libapparmor-dev
 
 ENV USER=root
 
-ARG NIX_VERSION=2.13.3
+ARG NIX_VERSION=2.15.1
 RUN wget https://nixos.org/releases/nix/nix-${NIX_VERSION}/nix-${NIX_VERSION}-x86_64-linux.tar.xz && \
     tar xf nix-${NIX_VERSION}-x86_64-linux.tar.xz && \
     groupadd -r -g 30000 nixbld && \
diff --git a/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml b/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml
index 52ca3208b..8ae089aba 100644
--- a/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml
+++ b/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml
@@ -853,7 +853,7 @@ spec:
                 - manager
                 env:
                 - name: RELATED_IMAGE_RBAC_PROXY
-                  value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+                  value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
                 - name: RELATED_IMAGE_SELINUXD
                   value: quay.io/security-profiles-operator/selinuxd
                 - name: RELATED_IMAGE_SELINUXD_EL8
@@ -977,7 +977,7 @@ spec:
     name: Kubernetes SIGs
     url: https://github.com/kubernetes-sigs
   relatedImages:
-  - image: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+  - image: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
     name: rbac-proxy
   - image: quay.io/security-profiles-operator/selinuxd
     name: selinuxd
diff --git a/cloudbuild.yaml b/cloudbuild.yaml
index 6428b0302..f218a65ba 100644
--- a/cloudbuild.yaml
+++ b/cloudbuild.yaml
@@ -5,7 +5,7 @@ options:
   substitution_option: ALLOW_LOOSE
   machineType: E2_HIGHCPU_8
 steps:
-  - name: gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20220617-174ad91c3a
+  - name: gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20230522-312425ae46
     entrypoint: bash
     env:
       - TAG=$_GIT_TAG
diff --git a/dependencies.yaml b/dependencies.yaml
index 7668904e8..699241c0a 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -50,7 +50,7 @@ dependencies:
       match: OLM_VERSION
 
   - name: cert-manager
-    version: 1.12.0
+    version: 1.12.1
     refPaths:
     - path: test/e2e_test.go
       match: cert-manager/cert-manager
@@ -68,7 +68,7 @@ dependencies:
       match: kindVersion
 
   - name: kind-image
-    version: 1.27.1
+    version: 1.27.2
     refPaths:
     - path: test/suite_test.go
       match: kindImage
@@ -128,7 +128,7 @@ dependencies:
       match: registry.access.redhat.com/ubi8/go-toolset
 
   - name: nix
-    version: 2.13.3
+    version: 2.15.1
     refPaths:
     - path: Dockerfile.build-image
       match: NIX_VERSION
@@ -136,7 +136,7 @@ dependencies:
       match: NIX_VERSION
 
   - name: kube-rbac-proxy
-    version: 0.14.0
+    version: 0.14.1
     refPaths:
     - path: internal/pkg/manager/spod/bindata/spod.go
       match: gcr.io/kubebuilder/kube-rbac-proxy
@@ -158,7 +158,7 @@ dependencies:
       match: gcr.io/kubebuilder/kube-rbac-proxy
 
   - name: gcb-docker-gcloud
-    version: v20220617-174ad91c3a
+    version: v20230522-312425ae46
     refPaths:
     - path: cloudbuild.yaml
       match: gcr.io/k8s-staging-test-infra/gcb-docker-gcloud
@@ -200,7 +200,7 @@ dependencies:
       match: baseProfileName
 
   - name: audit2rbac
-    version: v0.9.0
+    version: v0.10.0
     refPaths:
     - path: hack/ci/install-audit2rbac.sh
       match: VERSION
diff --git a/deploy/helm/templates/deployment.yaml b/deploy/helm/templates/deployment.yaml
index 925df0f03..77d3d04dc 100644
--- a/deploy/helm/templates/deployment.yaml
+++ b/deploy/helm/templates/deployment.yaml
@@ -25,7 +25,7 @@ spec:
         - manager
         env:
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: RELATED_IMAGE_SELINUXD_EL8
diff --git a/deploy/kustomize-deployment/manager_deployment.yaml b/deploy/kustomize-deployment/manager_deployment.yaml
index 62a7d3387..0945c3719 100644
--- a/deploy/kustomize-deployment/manager_deployment.yaml
+++ b/deploy/kustomize-deployment/manager_deployment.yaml
@@ -36,7 +36,7 @@ spec:
               cpu: 500m
           env:
             - name: RELATED_IMAGE_RBAC_PROXY
-              value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+              value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
             - name: RELATED_IMAGE_SELINUXD
               value: quay.io/security-profiles-operator/selinuxd
             - name: RELATED_IMAGE_SELINUXD_EL8
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index 207d4510b..e901c6ac7 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -3155,7 +3155,7 @@ spec:
         - name: RESTRICT_TO_NAMESPACE
           value: NS_REPLACE
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: RELATED_IMAGE_SELINUXD_EL8
diff --git a/deploy/openshift-dev.yaml b/deploy/openshift-dev.yaml
index 3d2485cca..ac9297ef6 100644
--- a/deploy/openshift-dev.yaml
+++ b/deploy/openshift-dev.yaml
@@ -3146,7 +3146,7 @@ spec:
         - manager
         env:
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: RELATED_IMAGE_SELINUXD_EL8
diff --git a/deploy/openshift-downstream.yaml b/deploy/openshift-downstream.yaml
index ede0050ce..d5bbec491 100644
--- a/deploy/openshift-downstream.yaml
+++ b/deploy/openshift-downstream.yaml
@@ -3166,7 +3166,7 @@ spec:
         - manager
         env:
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: RELATED_IMAGE_SELINUXD_EL8
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index 2f59563a2..dd26788ae 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -3153,7 +3153,7 @@ spec:
         - manager
         env:
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: RELATED_IMAGE_SELINUXD_EL8
diff --git a/deploy/webhook-operator.yaml b/deploy/webhook-operator.yaml
index 8a860a82c..8a7808ec1 100644
--- a/deploy/webhook-operator.yaml
+++ b/deploy/webhook-operator.yaml
@@ -3153,7 +3153,7 @@ spec:
         - --webhook=false
         env:
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0
+          value: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: RELATED_IMAGE_SELINUXD_EL8
diff --git a/hack/ci/baseprofiles.sh b/hack/ci/baseprofiles.sh
index 004278de1..0a82e3027 100755
--- a/hack/ci/baseprofiles.sh
+++ b/hack/ci/baseprofiles.sh
@@ -69,7 +69,7 @@ wait_for() {
 }
 
 install_operator() {
-    kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml
+    kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.1/cert-manager.yaml
     k_wait -n cert-manager pod -l app.kubernetes.io/instance=cert-manager
 
     git apply hack/deploy-localhost.patch
diff --git a/hack/ci/install-audit2rbac.sh b/hack/ci/install-audit2rbac.sh
index ad03d3271..81e5e29f3 100755
--- a/hack/ci/install-audit2rbac.sh
+++ b/hack/ci/install-audit2rbac.sh
@@ -15,7 +15,7 @@
 
 set -euo pipefail
 
-VERSION=v0.9.0
+VERSION=v0.10.0
 curl -sSfL --retry 5 --retry-delay 3 \
     "https://github.com/liggitt/audit2rbac/releases/download/$VERSION/audit2rbac-linux-amd64.tar.gz" -o- |
     tar xfz -
diff --git a/installation-usage.md b/installation-usage.md
index 94dfba67a..6440043ef 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -101,7 +101,7 @@ cert-manager via `kubectl`, if you're **not** running on
 [OpenShift](https://www.redhat.com/en/technologies/cloud-computing/openshift):
 
 ```sh
-$ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml
+$ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.1/cert-manager.yaml
 $ kubectl --namespace cert-manager wait --for condition=ready pod -l app.kubernetes.io/instance=cert-manager
 ```
 
diff --git a/internal/pkg/manager/spod/bindata/spod.go b/internal/pkg/manager/spod/bindata/spod.go
index 81bc00933..917e251bd 100644
--- a/internal/pkg/manager/spod/bindata/spod.go
+++ b/internal/pkg/manager/spod/bindata/spod.go
@@ -55,7 +55,7 @@ const (
 	SelinuxdPrivateDir                         = "/var/run/selinuxd"
 	SelinuxdSocketPath                         = SelinuxdPrivateDir + "/selinuxd.sock"
 	SelinuxdDBPath                             = SelinuxdPrivateDir + "/selinuxd.db"
-	MetricsImage                               = "gcr.io/kubebuilder/kube-rbac-proxy:v0.14.0"
+	MetricsImage                               = "gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1"
 	sysKernelDebugPath                         = "/sys/kernel/debug"
 	InitContainerIDNonRootenabler              = 0
 	InitContainerIDSelinuxSharedPoliciesCopier = 1
diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json
index 6d2c5680a..3300b08f2 100644
--- a/nix/nixpkgs.json
+++ b/nix/nixpkgs.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/nixos/nixpkgs",
-  "rev": "101bc33b43fc36ca5fc831f09b74270a8f0ad63a",
-  "date": "2023-04-06T08:50:54-03:00",
-  "path": "/nix/store/4jd2p4zm620xr42r8wwbxld99lazn534-nixpkgs",
-  "sha256": "1g3s4qkw6jlfq136v2ihdj5z7alnz9hnj12arhqy697hpy9az49n",
+  "rev": "7b5ce85d8fc3c3bfe0b5c472be23b742cb1ad2aa",
+  "date": "2023-05-26T00:51:46-06:00",
+  "path": "/nix/store/xvnw4nzq5r4qghfjwnqj7nvv81pd9qfm-nixpkgs",
+  "sha256": "1ssvnf0573jpvji1ihrnv2hdl4qsdbm3hx699izrsvi0sb6m2dsk",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,


Test patch:
diff --git a/.github/workflows/olm_tests.yaml b/.github/workflows/olm_tests.yaml
index 97e2d4fdb..129300e4e 100644
--- a/.github/workflows/olm_tests.yaml
+++ b/.github/workflows/olm_tests.yaml
@@ -6,7 +6,7 @@ on:
   pull_request:
 env:
   GO_VERSION: '1.20'
-  KIND_IMG_TAG: v1.27.1
+  KIND_IMG_TAG: v1.27.2
 
 permissions: {}
 
diff --git a/hack/ci/e2e-olm.sh b/hack/ci/e2e-olm.sh
index 722958fbd..bffa5bddf 100755
--- a/hack/ci/e2e-olm.sh
+++ b/hack/ci/e2e-olm.sh
@@ -69,7 +69,7 @@ function deploy_deps() {
 
     # cert-manager first. This should be done using dependencies in the
     # future
-    kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml
+    kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.1/cert-manager.yaml
     kubectl -ncert-manager wait --for condition=ready pod -l app.kubernetes.io/instance=cert-manager
 
     # All installation methods run off the same catalog
diff --git a/test/e2e_test.go b/test/e2e_test.go
index 8f133e2b8..8d2c26c09 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -32,7 +32,7 @@ import (
 )
 
 const (
-	certmanager       = "https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml"
+	certmanager       = "https://github.com/cert-manager/cert-manager/releases/download/v1.12.1/cert-manager.yaml"
 	namespaceManifest = "deploy/namespace-operator.yaml"
 	testNamespace     = "test-ns"
 	defaultNamespace  = "default"
diff --git a/test/suite_test.go b/test/suite_test.go
index f4c3df64a..48ea38e57 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -40,7 +40,7 @@ import (
 
 const (
 	kindVersion      = "v0.19.0"
-	kindImage        = "kindest/node:v1.27.1@sha256:b7d12ed662b873bd8510879c1846e87c7e676a79fefc93e17b2a52989d3ff42b"
+	kindImage        = "kindest/node:v1.27.2@sha256:ee77a85d1146ba4f1df9f836c828845a7dbe1f1a094ee670879d7c14f41e31f2"
 	kindDarwinSHA512 = "c24b71f9c3599c38d58110bb2fe938c23b713a139a4f7e3429118b04d2b3bfb6784fba292987cad6d5818527a56affd7264a8e33cc2f958f13ae2ca03764b54c" //nolint:lll // full length SHA
 	kindLinuxSHA512  = "c4242fe35f00ee0dc99eafb512689db26a29cbad0375f343244db3a2805f064bbae607d6db59fec84ae143706231e82d416d82dd26d2848610cb447ff39ded78" //nolint:lll // full length SHA
 )