Repository: kubernetes-sigs/security-profiles-operator
Pull request #1030 (2022-07-13 23:32:44)

build(deps): bump github/codeql-action from 2.1.15 to 2.1.16
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.15 to 2.1.16.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>2.1.16 - 13 Jul 2022</h2>
<ul>
<li>You can now quickly debug a job that uses the CodeQL Action by re-running the job from the GitHub UI and selecting the &quot;Enable debug logging&quot; option. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1132">#1132</a></li>
<li>You can now see diagnostic messages produced by the analysis in the logs of the <code>analyze</code> Action by enabling debug mode. To enable debug mode, pass <code>debug: true</code> to the <code>init</code> Action, or <a href="https://docs.github.com/en/actions/monitoring-and-troubleshooting-workflows/enabling-debug-logging#enabling-step-debug-logging">enable step debug logging</a>. This feature is available for CodeQL CLI version 2.10.0 and later. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1133">#1133</a></li>
</ul>
<h2>2.1.15 - 28 Jun 2022</h2>
<ul>
<li>CodeQL query packs listed in the <code>packs</code> configuration field will be skipped if their target language is not being analyzed in the current Actions job. Previously, this would throw an error. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1116">#1116</a></li>
<li>The combination of python2 and poetry is no longer supported. See <a href="https://github-redirect.dependabot.com/actions/setup-python/issues/374">actions/setup-python#374</a> for more details. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1124">#1124</a></li>
<li>Update default CodeQL bundle version to 2.10.0. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1123">#1123</a></li>
</ul>
<h2>2.1.14 - 22 Jun 2022</h2>
<p>No user facing changes.</p>
<h2>2.1.13 - 21 Jun 2022</h2>
<ul>
<li>Update default CodeQL bundle version to 2.9.4. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1100">#1100</a></li>
</ul>
<h2>2.1.12 - 01 Jun 2022</h2>
<ul>
<li>Update default CodeQL bundle version to 2.9.3. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1084">#1084</a></li>
</ul>
<h2>2.1.11 - 17 May 2022</h2>
<ul>
<li>Update default CodeQL bundle version to 2.9.2. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1074">#1074</a></li>
</ul>
<h2>2.1.10 - 10 May 2022</h2>
<ul>
<li>Update default CodeQL bundle version to 2.9.1. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1056">#1056</a></li>
<li>When <code>wait-for-processing</code> is enabled, the workflow will now fail if there were any errors that occurred during processing of the analysis results.</li>
</ul>
<h2>2.1.9 - 27 Apr 2022</h2>
<ul>
<li>Add <code>working-directory</code> input to the <code>autobuild</code> action. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1024">#1024</a></li>
<li>The <code>analyze</code> and <code>upload-sarif</code> actions will now wait up to 2 minutes for processing to complete after they have uploaded the results so they can report any processing errors that occurred. This behavior can be disabled by setting the <code>wait-for-processing</code> action input to <code>&quot;false&quot;</code>. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1007">#1007</a></li>
<li>Update default CodeQL bundle version to 2.9.0.</li>
<li>Fix a bug where <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1041">status reporting fails on Windows</a>. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1042">#1042</a></li>
</ul>
<h2>2.1.8 - 08 Apr 2022</h2>
<ul>
<li>Update default CodeQL bundle version to 2.8.5. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1014">#1014</a></li>
<li>Fix error where the init action would fail due to a GitHub API request that was taking too long to complete <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1025">#1025</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/github/codeql-action/commit/3e7e3b32d0fb8283594bb0a76cc60a00918b0969"><code>3e7e3b3</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1140">#1140</a> from github/update-v2.1.16-548f07e3</li>
<li><a href="https://github.com/github/codeql-action/commit/330d552535525b24181fe3c2f200e29b0c5f8f0d"><code>330d552</code></a> Update changelog for v2.1.16</li>
<li><a href="https://github.com/github/codeql-action/commit/548f07e30706c49fbfe5f195ce65d95bbea1f5dd"><code>548f07e</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1139">#1139</a> from github/aeisenberg/concat-not-push</li>
<li><a href="https://github.com/github/codeql-action/commit/a844fefc86f4f7c2caaee0b229c92cf6eaaa63ed"><code>a844fef</code></a> Merge branch 'main' into aeisenberg/concat-not-push</li>
<li><a href="https://github.com/github/codeql-action/commit/7ce9ef91378a67bb65e7c5784eca6e4212810876"><code>7ce9ef9</code></a> Use concat instead of push around <code>listFolders</code></li>
<li><a href="https://github.com/github/codeql-action/commit/d750c6d79db8d52f7f0a682fdcf86c95079c8802"><code>d750c6d</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1138">#1138</a> from github/henrymercer/drop-token-check</li>
<li><a href="https://github.com/github/codeql-action/commit/4cb248b0ec5609a765e5cad161ca212554e0c196"><code>4cb248b</code></a> Merge branch 'main' into henrymercer/drop-token-check</li>
<li><a href="https://github.com/github/codeql-action/commit/1e7f7708647807004060a90e238228eb7026fbf8"><code>1e7f770</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1132">#1132</a> from github/henrymercer/one-click-debug</li>
<li><a href="https://github.com/github/codeql-action/commit/816b3e91bca9dcdd4438770f882f5cda2a003e4d"><code>816b3e9</code></a> Update failure message</li>
<li><a href="https://github.com/github/codeql-action/commit/fbbd1dcd5294ba1ab279dc35e4a61b21ed805290"><code>fbbd1dc</code></a> Fix extra double quote</li>
<li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/3f62b754e23e0dd60f91b744033e1dc1654c0ec6...3e7e3b32d0fb8283594bb0a76cc60a00918b0969">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=2.1.15&new-version=2.1.16)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

k8s-ci-robot: @dependabot[bot]: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our [release note process](https://git.k8s.io/community/contributors/guide/release-notes.md) to remove it.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
k8s-ci-robot: Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a [kubernetes-sigs](https://github.com/orgs/kubernetes-sigs/people) member to verify that this patch is reasonable to test. If it is, they should reply with `/ok-to-test` on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should [join the org](https://git.k8s.io/community/community-membership.md#member) to skip this step.

Once the patch is verified, the new status will be reflected by the `ok-to-test` label.

I understand the commands that are listed [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>

k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1030#" title="Author self-approved">dependabot[bot]</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **jaormx** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @jaormx` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["jaormx"]} -->
k8s-ci-robot: @dependabot[bot]: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 19240da05624467dbba4394e6d9e17faeb4e9161 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1030/pull-security-profiles-operator-test-e2e/1547363435782606848) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1030). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Adependabot[bot]). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1030#" title="Author self-approved">dependabot[bot]</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1030#pullrequestreview-1038410662" title="Approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/go.mod b/go.mod
index 72ee4cd14..4f50a68af 100644
--- a/go.mod
+++ b/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/aquasecurity/libbpfgo v0.3.0-libbpf-0.8.0
 	github.com/cert-manager/cert-manager v1.8.2
 	github.com/containers/common v0.48.1-0.20220510094751-400832f41771
-	github.com/crossplane/crossplane-runtime v0.16.0
+	github.com/crossplane/crossplane-runtime v0.17.0
 	github.com/go-logr/logr v1.2.3
 	github.com/maxbrunsfeld/counterfeiter/v6 v6.5.0
 	github.com/mogensen/kubernetes-split-yaml v0.3.0
@@ -26,9 +26,9 @@ require (
 	google.golang.org/grpc v1.47.0
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0
 	google.golang.org/protobuf v1.28.0
-	k8s.io/api v0.24.2
-	k8s.io/apimachinery v0.24.2
-	k8s.io/client-go v0.24.2
+	k8s.io/api v0.24.3
+	k8s.io/apimachinery v0.24.3
+	k8s.io/client-go v0.24.3
 	k8s.io/klog/v2 v2.70.1
 	sigs.k8s.io/controller-runtime v0.12.3
 	sigs.k8s.io/controller-tools v0.9.2
diff --git a/go.sum b/go.sum
index af978743a..f056b9f08 100644
--- a/go.sum
+++ b/go.sum
@@ -334,8 +334,8 @@ github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46t
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/crossplane/crossplane-runtime v0.16.0 h1:NstJdHeK3C+u3By0vQjOG1Y6+v53JYOy00IgCL9GHAw=
-github.com/crossplane/crossplane-runtime v0.16.0/go.mod h1:IPT3HTsovwmbw3i+SdsOyaC3r3b7TW+otBMmZsHLnSU=
+github.com/crossplane/crossplane-runtime v0.17.0 h1:gt2JcOYcVBw/luQToq2hUkoersL12ICuV0YzKI5lyCs=
+github.com/crossplane/crossplane-runtime v0.17.0/go.mod h1:IPT3HTsovwmbw3i+SdsOyaC3r3b7TW+otBMmZsHLnSU=
 github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
 github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/d2g/dhcp4 v0.0.0-20170904100407-a1d1b6c41b1c/go.mod h1:Ct2BUK8SB0YC1SMSibvLzxjeJLnrYEVLULFNiHY9YfQ=
@@ -1723,8 +1723,9 @@ k8s.io/api v0.21.3/go.mod h1:hUgeYHUbBp23Ue4qdX9tR8/ANi/g3ehylAqDn9NWVOg=
 k8s.io/api v0.22.1/go.mod h1:bh13rkTp3F1XEaLGykbyRD2QaTTzPm0e/BMd8ptFONY=
 k8s.io/api v0.22.5/go.mod h1:mEhXyLaSD1qTOf40rRiKXkc+2iCem09rWLlFwhCEiAs=
 k8s.io/api v0.23.0/go.mod h1:8wmDdLBHBNxtOIytwLstXt5E9PddnZb0GaMcqsvDBpg=
-k8s.io/api v0.24.2 h1:g518dPU/L7VRLxWfcadQn2OnsiGWVOadTLpdnqgY2OI=
 k8s.io/api v0.24.2/go.mod h1:AHqbSkTm6YrQ0ObxjO3Pmp/ubFF/KuM7jU+3khoBsOg=
+k8s.io/api v0.24.3 h1:tt55QEmKd6L2k5DP6G/ZzdMQKvG5ro4H4teClqm0sTY=
+k8s.io/api v0.24.3/go.mod h1:elGR/XSZrS7z7cSZPzVWaycpJuGIw57j9b95/1PdJNI=
 k8s.io/apiextensions-apiserver v0.21.3/go.mod h1:kl6dap3Gd45+21Jnh6utCx8Z2xxLm8LGDkprcd+KbsE=
 k8s.io/apiextensions-apiserver v0.24.2 h1:/4NEQHKlEz1MlaK/wHT5KMKC9UKYz6NZz6JE6ov4G6k=
 k8s.io/apiextensions-apiserver v0.24.2/go.mod h1:e5t2GMFVngUEHUd0wuCJzw8YDwZoqZfJiGOW6mm2hLQ=
@@ -1735,8 +1736,9 @@ k8s.io/apimachinery v0.21.3/go.mod h1:H/IM+5vH9kZRNJ4l3x/fXP/5bOPJaVP/guptnZPeCF
 k8s.io/apimachinery v0.22.1/go.mod h1:O3oNtNadZdeOMxHFVxOreoznohCpy0z6mocxbZr7oJ0=
 k8s.io/apimachinery v0.22.5/go.mod h1:xziclGKwuuJ2RM5/rSFQSYAj0zdbci3DH8kj+WvyN0U=
 k8s.io/apimachinery v0.23.0/go.mod h1:fFCTTBKvKcwTPFzjlcxp91uPFZr+JA0FubU4fLzzFYc=
-k8s.io/apimachinery v0.24.2 h1:5QlH9SL2C8KMcrNJPor+LbXVTaZRReml7svPEh4OKDM=
 k8s.io/apimachinery v0.24.2/go.mod h1:82Bi4sCzVBdpYjyI4jY6aHX+YCUchUIrZrXKedjd2UM=
+k8s.io/apimachinery v0.24.3 h1:hrFiNSA2cBZqllakVYyH/VyEh4B581bQRmqATJSeQTg=
+k8s.io/apimachinery v0.24.3/go.mod h1:82Bi4sCzVBdpYjyI4jY6aHX+YCUchUIrZrXKedjd2UM=
 k8s.io/apiserver v0.20.1/go.mod h1:ro5QHeQkgMS7ZGpvf4tSMx6bBOgPfE+f52KwvXfScaU=
 k8s.io/apiserver v0.20.4/go.mod h1:Mc80thBKOyy7tbvFtB4kJv1kbdD0eIH8k8vianJcbFM=
 k8s.io/apiserver v0.20.6/go.mod h1:QIJXNt6i6JB+0YQRNcS0hdRHJlMhflFmsBDeSgT1r8Q=
@@ -1749,8 +1751,9 @@ k8s.io/client-go v0.20.6/go.mod h1:nNQMnOvEUEsOzRRFIIkdmYOjAZrC8bgq0ExboWSU1I0=
 k8s.io/client-go v0.21.3/go.mod h1:+VPhCgTsaFmGILxR/7E1N0S+ryO010QBeNCv5JwRGYU=
 k8s.io/client-go v0.22.1/go.mod h1:BquC5A4UOo4qVDUtoc04/+Nxp1MeHcVc1HJm1KmG8kk=
 k8s.io/client-go v0.22.5/go.mod h1:cs6yf/61q2T1SdQL5Rdcjg9J1ElXSwbjSrW2vFImM4Y=
-k8s.io/client-go v0.24.2 h1:CoXFSf8if+bLEbinDqN9ePIDGzcLtqhfd6jpfnwGOFA=
 k8s.io/client-go v0.24.2/go.mod h1:zg4Xaoo+umDsfCWr4fCnmLEtQXyCNXCvJuSsglNcV30=
+k8s.io/client-go v0.24.3 h1:Nl1840+6p4JqkFWEW2LnMKU667BUxw03REfLAVhuKQY=
+k8s.io/client-go v0.24.3/go.mod h1:AAovolf5Z9bY1wIg2FZ8LPQlEdKHjLI7ZD4rw920BJw=
 k8s.io/code-generator v0.19.7/go.mod h1:lwEq3YnLYb/7uVXLorOJfxg+cUu2oihFhHZ0n9NIla0=
 k8s.io/code-generator v0.21.3/go.mod h1:K3y0Bv9Cz2cOW2vXUrNZlFbflhuPvuadW6JdnN6gGKo=
 k8s.io/code-generator v0.22.0/go.mod h1:eV77Y09IopzeXOJzndrDyCI88UBok2h6WxAlBwpxa+o=
diff --git a/vendor/github.com/crossplane/crossplane-runtime/apis/common/v1/policies.go b/vendor/github.com/crossplane/crossplane-runtime/apis/common/v1/policies.go
index 81b74814f..ca0fa7d90 100644
--- a/vendor/github.com/crossplane/crossplane-runtime/apis/common/v1/policies.go
+++ b/vendor/github.com/crossplane/crossplane-runtime/apis/common/v1/policies.go
@@ -45,3 +45,26 @@ const (
 	// update.
 	UpdateManual UpdatePolicy = "Manual"
 )
+
+// ResolvePolicy is a type for resolve policy.
+type ResolvePolicy string
+
+// ResolutionPolicy is a type for resolution policy.
+type ResolutionPolicy string
+
+const (
+	// ResolvePolicyAlways is a resolve option.
+	// When the ResolvePolicy is set to ResolvePolicyAlways the reference will
+	// be tried to resolve for every reconcile loop.
+	ResolvePolicyAlways ResolvePolicy = "Always"
+
+	// ResolutionPolicyRequired is a resolution option.
+	// When the ResolutionPolicy is set to ResolutionPolicyRequired the execution
+	// could not continue even if the reference cannot be resolved.
+	ResolutionPolicyRequired ResolutionPolicy = "Required"
+
+	// ResolutionPolicyOptional is a resolution option.
+	// When the ReferenceResolutionPolicy is set to ReferencePolicyOptional the
+	// execution could continue even if the reference cannot be resolved.
+	ResolutionPolicyOptional ResolutionPolicy = "Optional"
+)
diff --git a/vendor/github.com/crossplane/crossplane-runtime/apis/common/v1/resource.go b/vendor/github.com/crossplane/crossplane-runtime/apis/common/v1/resource.go
index bbefdbdec..872d9a098 100644
--- a/vendor/github.com/crossplane/crossplane-runtime/apis/common/v1/resource.go
+++ b/vendor/github.com/crossplane/crossplane-runtime/apis/common/v1/resource.go
@@ -77,10 +77,50 @@ type SecretKeySelector struct {
 	Key string `json:"key"`
 }
 
+// Policy represents the Resolve and Resolution policies of Reference instance.
+type Policy struct {
+	// Resolve specifies when this reference should be resolved. The default
+	// is 'IfNotPresent', which will attempt to resolve the reference only when
+	// the corresponding field is not present. Use 'Always' to resolve the
+	// reference on every reconcile.
+	// +optional
+	// +kubebuilder:validation:Enum=Always;IfNotPresent
+	Resolve *ResolvePolicy `json:"resolve,omitempty"`
+
+	// Resolution specifies whether resolution of this reference is required.
+	// The default is 'Required', which means the reconcile will fail if the
+	// reference cannot be resolved. 'Optional' means this reference will be
+	// a no-op if it cannot be resolved.
+	// +optional
+	// +kubebuilder:default=Required
+	// +kubebuilder:validation:Enum=Required;Optional
+	Resolution *ResolutionPolicy `json:"resolution,omitempty"`
+}
+
+// IsResolutionPolicyOptional checks whether the resolution policy of relevant reference is Optional.
+func (p *Policy) IsResolutionPolicyOptional() bool {
+	if p == nil || p.Resolution == nil {
+		return false
+	}
+	return *p.Resolution == ResolutionPolicyOptional
+}
+
+// IsResolvePolicyAlways checks whether the resolution policy of relevant reference is Always.
+func (p *Policy) IsResolvePolicyAlways() bool {
+	if p == nil || p.Resolve == nil {
+		return false
+	}
+	return *p.Resolve == ResolvePolicyAlways
+}
+
 // A Reference to a named object.
 type Reference struct {
 	// Name of the referenced object.
 	Name string `json:"name"`
+
+	// Policies for referencing.
+	// +optional
+	Policy *Policy `json:"policy,omitempty"`
 }
 
 // A TypedReference refers to an object by Name, Kind, and APIVersion. It is
@@ -109,6 +149,10 @@ type Selector struct {
 	// MatchControllerRef ensures an object with the same controller reference
 	// as the selecting object is selected.
 	MatchControllerRef *bool `json:"matchControllerRef,omitempty"`
+
+	// Policies for selection.
+	// +optional
+	Policy *Policy `json:"policy,omitempty"`
 }
 
 // SetGroupVersionKind sets the Kind and APIVersion of a TypedReference.
diff --git a/vendor/github.com/crossplane/crossplane-runtime/apis/common/v1/zz_generated.deepcopy.go b/vendor/github.com/crossplane/crossplane-runtime/apis/common/v1/zz_generated.deepcopy.go
index d7cae60a7..5f8a7e345 100644
--- a/vendor/github.com/crossplane/crossplane-runtime/apis/common/v1/zz_generated.deepcopy.go
+++ b/vendor/github.com/crossplane/crossplane-runtime/apis/common/v1/zz_generated.deepcopy.go
@@ -229,6 +229,31 @@ func (in *MergeOptions) DeepCopy() *MergeOptions {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Policy) DeepCopyInto(out *Policy) {
+	*out = *in
+	if in.Resolve != nil {
+		in, out := &in.Resolve, &out.Resolve
+		*out = new(ResolvePolicy)
+		**out = **in
+	}
+	if in.Resolution != nil {
+		in, out := &in.Resolution, &out.Resolution
+		*out = new(ResolutionPolicy)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Policy.
+func (in *Policy) DeepCopy() *Policy {
+	if in == nil {
+		return nil
+	}
+	out := new(Policy)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ProviderConfigStatus) DeepCopyInto(out *ProviderConfigStatus) {
 	*out = *in
@@ -248,7 +273,7 @@ func (in *ProviderConfigStatus) DeepCopy() *ProviderConfigStatus {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ProviderConfigUsage) DeepCopyInto(out *ProviderConfigUsage) {
 	*out = *in
-	out.ProviderConfigReference = in.ProviderConfigReference
+	in.ProviderConfigReference.DeepCopyInto(&out.ProviderConfigReference)
 	out.ResourceReference = in.ResourceReference
 }
 
@@ -273,7 +298,7 @@ func (in *PublishConnectionDetailsTo) DeepCopyInto(out *PublishConnectionDetails
 	if in.SecretStoreConfigRef != nil {
 		in, out := &in.SecretStoreConfigRef, &out.SecretStoreConfigRef
 		*out = new(Reference)
-		**out = **in
+		(*in).DeepCopyInto(*out)
 	}
 }
 
@@ -290,6 +315,11 @@ func (in *PublishConnectionDetailsTo) DeepCopy() *PublishConnectionDetailsTo {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Reference) DeepCopyInto(out *Reference) {
 	*out = *in
+	if in.Policy != nil {
+		in, out := &in.Policy, &out.Policy
+		*out = new(Policy)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Reference.
@@ -318,12 +348,12 @@ func (in *ResourceSpec) DeepCopyInto(out *ResourceSpec) {
 	if in.ProviderConfigReference != nil {
 		in, out := &in.ProviderConfigReference, &out.ProviderConfigReference
 		*out = new(Reference)
-		**out = **in
+		(*in).DeepCopyInto(*out)
 	}
 	if in.ProviderReference != nil {
 		in, out := &in.ProviderReference, &out.ProviderReference
 		*out = new(Reference)
-		**out = **in
+		(*in).DeepCopyInto(*out)
 	}
 }
 
@@ -429,6 +459,11 @@ func (in *Selector) DeepCopyInto(out *Selector) {
 		*out = new(bool)
 		**out = **in
 	}
+	if in.Policy != nil {
+		in, out := &in.Policy, &out.Policy
+		*out = new(Policy)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Selector.
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 24cdd3704..9ff23ab59 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -111,7 +111,7 @@ github.com/containers/common/pkg/seccomp
 # github.com/cpuguy83/go-md2man/v2 v2.0.2
 ## explicit; go 1.11
 github.com/cpuguy83/go-md2man/v2/md2man
-# github.com/crossplane/crossplane-runtime v0.16.0
+# github.com/crossplane/crossplane-runtime v0.17.0
 ## explicit; go 1.17
 github.com/crossplane/crossplane-runtime/apis/common/v1
 github.com/crossplane/crossplane-runtime/pkg/errors
@@ -630,7 +630,7 @@ gopkg.in/yaml.v2
 # gopkg.in/yaml.v3 v3.0.1
 ## explicit
 gopkg.in/yaml.v3
-# k8s.io/api v0.24.2
+# k8s.io/api v0.24.3
 ## explicit; go 1.16
 k8s.io/api/admission/v1
 k8s.io/api/admission/v1beta1
@@ -684,7 +684,7 @@ k8s.io/api/storage/v1beta1
 k8s.io/apiextensions-apiserver/pkg/apis/apiextensions
 k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1
 k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1
-# k8s.io/apimachinery v0.24.2
+# k8s.io/apimachinery v0.24.3
 ## explicit; go 1.16
 k8s.io/apimachinery/pkg/api/equality
 k8s.io/apimachinery/pkg/api/errors
@@ -732,7 +732,7 @@ k8s.io/apimachinery/pkg/version
 k8s.io/apimachinery/pkg/watch
 k8s.io/apimachinery/third_party/forked/golang/json
 k8s.io/apimachinery/third_party/forked/golang/reflect
-# k8s.io/client-go v0.24.2
+# k8s.io/client-go v0.24.3
 ## explicit; go 1.16
 k8s.io/client-go/applyconfigurations/admissionregistration/v1
 k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1


Test patch:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c9866ef0e..3eaf6c8e6 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -29,11 +29,11 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-      - uses: github/codeql-action/init@3f62b754e23e0dd60f91b744033e1dc1654c0ec6
+      - uses: github/codeql-action/init@3e7e3b32d0fb8283594bb0a76cc60a00918b0969
         with:
           languages: go
-      - uses: github/codeql-action/autobuild@3f62b754e23e0dd60f91b744033e1dc1654c0ec6
-      - uses: github/codeql-action/analyze@3f62b754e23e0dd60f91b744033e1dc1654c0ec6
+      - uses: github/codeql-action/autobuild@3e7e3b32d0fb8283594bb0a76cc60a00918b0969
+      - uses: github/codeql-action/analyze@3e7e3b32d0fb8283594bb0a76cc60a00918b0969
 
   coverage:
     runs-on: ubuntu-20.04