chore(deps): update module golang.org/x/net to v0.33.0 [security] (#816)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/init-branch-release.yaml

@@ -57,7 +57,7 @@ jobs:
           git diff
 
       - name: Create pull request
-        uses: peter-evans/create-pull-request@v7.0.5
+        uses: peter-evans/create-pull-request@v7.0.6
         with:
           commit-message: "Bump version to ${{ inputs.TARGET_VERSION }}"
           title: "Bump version to ${{ inputs.TARGET_VERSION }} on ${{ inputs.TARGET_BRANCH }} branch"

.github/workflows/pull_request-helm.yaml

@@ -16,7 +16,7 @@ env:
 
 jobs:
 
-  helm-validation:
+  helm-chart-validation:
     permissions:
       contents: read
 
@@ -42,6 +42,24 @@ jobs:
       with:
         charts: deployments/kubernetes/chart/reloader
 
+  helm-version-validation:
+    needs: helm-chart-validation
+
+    permissions:
+      contents: read
+
+    runs-on: ubuntu-latest
+    name: Helm Version Validation
+    if: ${{ contains(github.event.pull_request.labels.*.name, 'release/helm-chart') }}
+
+    steps:
+
+    - name: Check out code
+      uses: actions/checkout@v4
+      with:
+        ref: ${{github.event.pull_request.head.sha}}
+        fetch-depth: 0
+
     - name: Add Stakater Helm Repo
       run: |
         helm repo add stakater https://stakater.github.io/stakater-charts

.github/workflows/pull_request.yaml

@@ -25,7 +25,7 @@ env:
 
 jobs:
   qa:
-    uses: stakater/.github/.github/workflows/pull_request_doc_qa.yaml@v0.0.106
+    uses: stakater/.github/.github/workflows/pull_request_doc_qa.yaml@v0.0.114
     with:
       MD_CONFIG: .github/md_config.json
       DOC_SRC: README.md

.github/workflows/pull_request_docs.yaml

@@ -15,7 +15,7 @@ on:
 
 jobs:
   qa:
-    uses: stakater/.github/.github/workflows/pull_request_doc_qa.yaml@v0.0.106
+    uses: stakater/.github/.github/workflows/pull_request_doc_qa.yaml@v0.0.114
     with:
       MD_CONFIG: .github/md_config.json
       DOC_SRC: docs

.github/workflows/push-helm-chart.yaml

@@ -15,14 +15,14 @@ env:
   REGISTRY: ghcr.io
 
 jobs:
-  build:
+  verify-and-push-helm-chart:
 
     permissions:
       contents: read
       packages: write # to push artifacts to `ghcr.io`
 
-    name: Build
-    if: github.event.pull_request.merged == true
+    name: Verify and Push Helm Chart
+    if: ${{ (github.event.pull_request.merged == true) && (contains(github.event.pull_request.labels.*.name, 'release/helm-chart')) }}
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/push-pr-image.yaml

@@ -5,6 +5,15 @@ on:
     branches:
       - master
     types: [ labeled ]
+    paths:
+      - '!.markdownlint.yaml'
+      - '!.vale.ini'
+      - '!Dockerfile-docs'
+      - '!docs-nginx.conf'
+      - '!docs/**'
+      - '!theme_common'
+      - '!theme_override'
+      - '!deployments/kubernetes/chart/reloader/**'
 
 env:
   DOCKER_FILE_PATH: Dockerfile

.vale.ini

@@ -1,7 +1,7 @@
 StylesPath = styles
 MinAlertLevel = warning
 
-Packages = https://github.com/stakater/vale-package/releases/download/v0.0.44/Stakater.zip
+Packages = https://github.com/stakater/vale-package/releases/download/v0.0.47/Stakater.zip
 Vocab = Stakater
 
 # Only check MarkDown files

README.md

@@ -95,7 +95,7 @@ We can also specify a specific configmap or secret which would trigger rolling u
 To do this either set the auto annotation to `"false"` (`reloader.stakater.com/auto: "false"`) or remove it altogether, and use annotations for [Configmap](.#Configmap) or [Secret](.#Secret).
 
 It's also possible to enable auto reloading for all resources, by setting the `--auto-reload-all` flag.
-In this case, all resources that do not have the auto annotation (or its typed version) set to `"false"`, will be reloaded automatically when their ConfigMaps or Secrets are updated.
+In this case, all resources that do not have the auto annotation (or its typed version) set to `"false"`, will be reloaded automatically when their Configmaps or Secrets are updated.
 Notice that setting the auto annotation to an undefined value counts as false as-well.
 
 ### Configmap
@@ -173,6 +173,7 @@ spec:
 - you may want to prevent watching certain resources with the `--resources-to-ignore` flag
 - you can configure logging in JSON format with the `--log-format=json` option
 - you can configure the "reload strategy" with the `--reload-strategy=<strategy-name>` option (details below)
+- you can configure rollout reload strategy with `reloader.stakater.com/rollout-strategy` annotation, `restart` or `rollout` values are available (defaults to `rollout`)
 
 ## Reload Strategies
 
@@ -209,8 +210,8 @@ Reloader can be configured to ignore the resources `secrets` and `configmaps` by
 
 | Argument                         | Description          |
 |----------------------------------|----------------------|
-| --resources-to-ignore=configMaps | To ignore configMaps |
-| --resources-to-ignore=secrets    | To ignore secrets    |
+| `--resources-to-ignore=configMaps` | To ignore configmaps |
+| `--resources-to-ignore=secrets`    | To ignore secrets    |
 
 **Note:** At one time only one of these resource can be ignored, trying to do it will cause error in Reloader. Workaround for ignoring both resources is by scaling down the Reloader pods to `0`.
 
@@ -328,7 +329,7 @@ helm uninstall {{RELEASE_NAME}} -n {{NAMESPACE}}
 | `reloader.isArgoRollouts`         | Enable Argo `Rollouts`. Valid value are either `true` or `false`                                                                                    | boolean     | `false`   |
 | `reloader.isOpenshift`            | Enable OpenShift DeploymentConfigs. Valid value are either `true` or `false`                                                                        | boolean     | `false`   |
 | `reloader.ignoreSecrets`          | To ignore secrets. Valid value are either `true` or `false`. Either `ignoreSecrets` or `ignoreConfigMaps` can be ignored, not both at the same time | boolean     | `false`   |
-| `reloader.ignoreConfigMaps`       | To ignore configMaps. Valid value are either `true` or `false`                                                                                      | boolean     | `false`   |
+| `reloader.ignoreConfigMaps`       | To ignore configmaps. Valid value are either `true` or `false`                                                                                      | boolean     | `false`   |
 | `reloader.reloadOnCreate`         | Enable reload on create events. Valid value are either `true` or `false`                                                                            | boolean     | `false`   |
 | `reloader.reloadOnDelete`         | Enable reload on delete events. Valid value are either `true` or `false`                                                                            | boolean     | `false`   |
 | `reloader.syncAfterRestart`       | Enable sync after Reloader restarts for **Add** events, works only when reloadOnCreate is `true`. Valid value are either `true` or `false`          | boolean     | `false`   |
@@ -346,25 +347,25 @@ helm uninstall {{RELEASE_NAME}} -n {{NAMESPACE}}
 
 #### Deployment Reloader Parameters
 
-| Parameter                                       | Description                                                                             | Type   | Default           |
-|-------------------------------------------------|-----------------------------------------------------------------------------------------|--------|-------------------|
-| `reloader.deployment.replicas`                  | Number of replicas, if you wish to run multiple replicas set `reloader.enableHA = true` | int    | 1                 |
-| `reloader.deployment.revisionHistoryLimit`      | Limit the number of revisions retained in the revision history                          | int    | 2                 |
-| `reloader.deployment.nodeSelector`              | Scheduling pod to a specific node based on set labels                                   | map    | `{}`              |
-| `reloader.deployment.affinity`                  | Set affinity rules on pod                                                               | map    | `{}`              |
-| `reloader.deployment.securityContext`           | Set pod security context                                                                | map    | `{}`              |
-| `reloader.deployment.containerSecurityContext`  | Set container security context                                                          | map    | `{}`              |
-| `reloader.deployment.tolerations`               | A list of `tolerations` to be applied to the deployment                                 | array  | `[]`              |
-| `reloader.deployment.topologySpreadConstraints` | Topology spread constraints for pod assignment                                          | array  | `[]`              |
-| `reloader.deployment.annotations`               | Set deployment annotations                                                              | map    | `{}`              |
-| `reloader.deployment.labels`                    | Set deployment labels, default to stakater settings                                     | array  | `see values.yaml` |
-| `reloader.deployment.image`                     | Set container image name, tag and policy                                                | array  | `see values.yaml` |
-| `reloader.deployment.env`                       | Support for extra environment variables                                                 | array  | `[]`              |
-| `reloader.deployment.livenessProbe`             | Set liveness probe timeout values                                                       | map    | `{}`              |
-| `reloader.deployment.readinessProbe`            | Set readiness probe timeout values                                                      | map    | `{}`              |
-| `reloader.deployment.resources`                 | Set container requests and limits (e.g. CPU or memory)                                  | map    | `{}`              |
-| `reloader.deployment.pod.annotations`           | Set annotations for pod                                                                 | map    | `{}`              |
-| `reloader.deployment.priorityClassName`         | Set priority class for pod in cluster                                                   | string | `""`              |
+| Parameter                                       | Description                                                                                                                                                 | Type   | Default           |
+|-------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|--------|-------------------|
+| `reloader.deployment.replicas`                  | Number of replicas, if you wish to run multiple replicas set `reloader.enableHA = true`. The replicas will be limited to 1 when `reloader.enableHA = false` | int    | 1                 |
+| `reloader.deployment.revisionHistoryLimit`      | Limit the number of revisions retained in the revision history                                                                                              | int    | 2                 |
+| `reloader.deployment.nodeSelector`              | Scheduling pod to a specific node based on set labels                                                                                                       | map    | `{}`              |
+| `reloader.deployment.affinity`                  | Set affinity rules on pod                                                                                                                                   | map    | `{}`              |
+| `reloader.deployment.securityContext`           | Set pod security context                                                                                                                                    | map    | `{}`              |
+| `reloader.deployment.containerSecurityContext`  | Set container security context                                                                                                                              | map    | `{}`              |
+| `reloader.deployment.tolerations`               | A list of `tolerations` to be applied to the deployment                                                                                                     | array  | `[]`              |
+| `reloader.deployment.topologySpreadConstraints` | Topology spread constraints for pod assignment                                                                                                              | array  | `[]`              |
+| `reloader.deployment.annotations`               | Set deployment annotations                                                                                                                                  | map    | `{}`              |
+| `reloader.deployment.labels`                    | Set deployment labels, default to stakater settings                                                                                                         | array  | `see values.yaml` |
+| `reloader.deployment.image`                     | Set container image name, tag and policy                                                                                                                    | array  | `see values.yaml` |
+| `reloader.deployment.env`                       | Support for extra environment variables                                                                                                                     | array  | `[]`              |
+| `reloader.deployment.livenessProbe`             | Set liveness probe timeout values                                                                                                                           | map    | `{}`              |
+| `reloader.deployment.readinessProbe`            | Set readiness probe timeout values                                                                                                                          | map    | `{}`              |
+| `reloader.deployment.resources`                 | Set container requests and limits (e.g. CPU or memory)                                                                                                      | map    | `{}`              |
+| `reloader.deployment.pod.annotations`           | Set annotations for pod                                                                                                                                     | map    | `{}`              |
+| `reloader.deployment.priorityClassName`         | Set priority class for pod in cluster                                                                                                                       | string | `""`              |
 
 #### Other Reloader Parameters
 
@@ -384,7 +385,7 @@ helm uninstall {{RELEASE_NAME}} -n {{NAMESPACE}}
 
 #### Additional Remarks
 
-- Both `namespaceSelector` & `resourceLabelSelector` can be used together. If they are then both conditions must be met for the configmap or secret to be eligible to trigger reload events. (e.g. If a configMap matches `resourceLabelSelector` but `namespaceSelector` does not match the namespace the configmap is in, it will be ignored).
+- Both `namespaceSelector` & `resourceLabelSelector` can be used together. If they are then both conditions must be met for the configmap or secret to be eligible to trigger reload events. (e.g. If a configmap matches `resourceLabelSelector` but `namespaceSelector` does not match the namespace the configmap is in, it will be ignored).
 - At one time only one of the resources `ignoreConfigMaps` or `ignoreSecrets` can be ignored, trying to do both will cause error in helm template compilation
 - Reloading of OpenShift (DeploymentConfig) and/or Argo `Rollouts` has to be enabled explicitly because it might not be always possible to use it on a cluster with restricted permissions
 - `isOpenShift` Recent versions of OpenShift (tested on 4.13.3) require the specified user to be in an `uid` range which is dynamically assigned by the namespace. The solution is to unset the runAsUser variable via ``deployment.securityContext.runAsUser=null`` and let OpenShift assign it at install
@@ -406,7 +407,7 @@ helm uninstall {{RELEASE_NAME}} -n {{NAMESPACE}}
 
 ### Documentation
 
-You can find more documentation [here](docs)
+The Reloader documentation can be viewed from [the doc site](https://docs.stakater.com/reloader/). The doc source is in the [docs](./docs/) folder.
 
 ### Have a question?
 
@@ -414,7 +415,7 @@ File a GitHub [issue](https://github.com/stakater/Reloader/issues).
 
 ### Talk to us on Slack
 
-Join and talk to us on Slack for discussing Reloader
+Join and talk to us on Slack for discussing Reloader:
 
 [![Join Slack](https://stakater.github.io/README/stakater-join-slack-btn.png)](https://slack.stakater.com/)
 [![Chat](https://stakater.github.io/README/stakater-chat-btn.png)](https://stakater-community.slack.com/messages/CC5S05S12)
@@ -427,12 +428,12 @@ Please use the [issue tracker](https://github.com/stakater/Reloader/issues) to r
 
 ### Developing
 
-1. Deploy Reloader.
-1. Run `okteto up` to activate your development container.
+1. Deploy Reloader
+1. Run `okteto up` to activate your development container
 1. `make build`
 1. `./Reloader`
 
-PRs are welcome. In general, we follow the "fork-and-pull" Git workflow.
+PRs are welcome. In general, we follow the "fork-and-pull" Git workflow:
 
 1. **Fork** the repo on GitHub
 1. **Clone** the project to your own machine
@@ -444,15 +445,29 @@ PRs are welcome. In general, we follow the "fork-and-pull" Git workflow.
 
 ## Release Processes
 
-_Repository GitHub releases_: As requested by the community in [issue 685](https://github.com/stakater/Reloader/issues/685), Reloader is now based on a manual release process. Releases are no longer done on every merged PR to the main branch, but manually on request. When a GitHub release is made, the corresponding image is built and pushed to the registry.
+_Repository GitHub releases_: As requested by the community in [issue 685](https://github.com/stakater/Reloader/issues/685), Reloader is now based on a manual release process. Releases are no longer done on every merged PR to the main branch, but manually on request.
 
-_Repository git tagging_: The Reloader repository is tagged on every push to main. The creation of a tag does not trigger anything else, it just acts as a pointer to a commit on main.
+To make a GitHub release:
 
-_Helm chart versioning_: The Reloader Helm chart release process is still [work in progress](https://github.com/stakater/Reloader/issues/684). This page will be updated when the process is settled. As a heads-up, to address the issues that are inherent in the current process the chart will most probably be relocated to the [Stakater charts repository](https://github.com/stakater/charts/). This setup is common in open-source repositories. When a GitHub release has been manually created in this repository, an image will be built, and Renovate in the charts repository will update the Helm chart to use it.
+1. Code owners create a release branch `release-vX.Y.Z`
+1. Code owners run a dispatch mode workflow to automatically generate version and manifests on the release branch
+1. A PR is created to bump the image version on the release branch, example: [PR-798](https://github.com/stakater/Reloader/pull/798)
+1. Code owners create a GitHub release with tag `vX.Y.Z` and target branch `release-vX.Y.Z`, which triggers creation of images
+
+_Repository git tagging_: Push to the main branch will create a merge-image and merge-tag named `merge-${{ github.event.number }}`, for example `merge-800` when pull request number 800 is merged.
+
+_Helm chart versioning_: The Reloader Helm chart is maintained in [this repository](./deployments/kubernetes/chart/reloader). The Helm chart has its own semantic versioning. Helm charts and code releases are separate artifacts and separately versioned. Manifest making strategy relies on Kustomize. The Reloader Helm chart manages the two artifacts with these two fields:
+
+- [`appVersion`](./deployments/kubernetes/chart/reloader/Chart.yaml) points to released Reloader application image version listed on the [releases page](https://github.com/stakater/Reloader/releases)
+- [`version`](./deployments/kubernetes/chart/reloader/Chart.yaml) sets the Reloader Helm chart version
+
+Helm chart will be released to the chart registry whenever files in `deployments/kubernetes/chart/reloader/**` change on the main branch.
+
+Helm Chart will be released by the maintainers, on labelling a PR with `release/helm-chart` and pre-maturely updating the `version` field in `Chart.yaml` file.
 
 ## Changelog
 
-View our closed [Pull Requests](https://github.com/stakater/Reloader/pulls?q=is%3Apr+is%3Aclosed).
+View the [releases page](https://github.com/stakater/Reloader/releases) to see what has changed in each release.
 
 ## License
 

deployments/kubernetes/chart/reloader/Chart.yaml

@@ -3,8 +3,8 @@
 apiVersion: v1
 name: reloader
 description: Reloader chart that runs on kubernetes
-version: 1.2.1
-appVersion: v1.2.0
+version: 1.2.2
+appVersion: v1.2.1
 keywords:
   - Reloader
   - kubernetes

deployments/kubernetes/chart/reloader/templates/deployment.yaml

@@ -18,7 +18,7 @@ metadata:
   namespace: {{ .Values.namespace | default .Release.Namespace }}
 spec:
 {{- if not (.Values.reloader.enableHA) }}
-  replicas: 1
+  replicas: {{ min .Values.reloader.deployment.replicas 1 }}
 {{- else }}
   replicas: {{ .Values.reloader.deployment.replicas }}
 {{- end}}
@@ -75,9 +75,13 @@ spec:
       containers:
       {{- if .Values.global.imageRegistry }}
       - image: "{{ .Values.global.imageRegistry }}/{{ .Values.reloader.deployment.image.base }}:{{ .Values.reloader.deployment.image.tag }}"
-{{- else }}
+      {{- else }}
+      {{- if .Values.reloader.deployment.image.digest }}
+      - image: "{{ .Values.reloader.deployment.image.name }}@{{ .Values.reloader.deployment.image.digest }}"
+      {{- else }}
       - image: "{{ .Values.reloader.deployment.image.name }}:{{ .Values.reloader.deployment.image.tag }}"
-{{- end }}
+      {{- end }}
+      {{- end }}
         imagePullPolicy: {{ .Values.reloader.deployment.image.pullPolicy }}
         name: {{ template "reloader-fullname" . }}
         env:

deployments/kubernetes/chart/reloader/templates/poddisruptionbudget.yaml

@@ -5,7 +5,12 @@ metadata:
   name: {{ template "reloader-fullname" . }}
   namespace: {{ .Values.namespace | default .Release.Namespace }}
 spec:
+{{- if .Values.reloader.podDisruptionBudget.maxUnavailable }}
+  maxUnavailable: {{ .Values.reloader.podDisruptionBudget.maxUnavailable }}
+{{- end }}
+{{- if and .Values.reloader.podDisruptionBudget.minAvailable (not .Values.reloader.podDisruptionBudget.maxUnavailable)}}
   minAvailable: {{ .Values.reloader.podDisruptionBudget.minAvailable }}
+{{- end }}
   selector:
     matchLabels:
       app: {{ template "reloader-fullname" . }}

deployments/kubernetes/chart/reloader/templates/role.yaml

@@ -67,16 +67,6 @@ rules:
       - get
       - update
       - patch
-  - apiGroups:
-      - "extensions"
-    resources:
-      - deployments
-      - daemonsets
-    verbs:
-      - list
-      - get
-      - update
-      - patch
   - apiGroups:
       - "batch"
     resources:

deployments/kubernetes/chart/reloader/values.yaml

@@ -96,11 +96,12 @@ reloader:
     labels:
       provider: stakater
       group: com.stakater.platform
-      version: v1.2.0
+      version: v1.2.1
     image:
       name: ghcr.io/stakater/reloader
       base: stakater/reloader
-      tag: v1.2.0
+      tag: v1.2.1
+      # digest: sha256:1234567
       pullPolicy: IfNotPresent
     # Support for extra environment variables.
     env:
@@ -288,6 +289,9 @@ reloader:
     enabled: false
     # Set the minimum available replicas
     # minAvailable: 1
+    # OR Set the maximum unavailable replicas
+    # maxUnavailable: 1
+    # If both defined only maxUnavailable will be used
 
   netpol:
     enabled: false

docs/How-it-works.md

@@ -1,6 +1,17 @@
 # How Does Reloader Work?
 
-Reloader watches for `ConfigMap` and `Secret` and detects if there are changes in data of these objects. After change detection Reloader performs rolling upgrade on relevant Pods via associated `Deployment`, `Daemonset` and `Statefulset`.
+Reloader watches for `ConfigMap` and `Secret` and detects if there are changes in data of these objects. After change detection Reloader performs rolling upgrade on relevant Pods via associated `Deployment`, `Daemonset` and `Statefulset`:
+
+```mermaid
+flowchart LR
+    subgraph Reloader
+    controller("Controller watches in a loop") -- "Detects a change" --> upgrade_handler("Upgrade handler checks if the change is a valid data change by comparing the change hash")
+    upgrade_handler -- "Update resource" --> update_resource("Updates the resource with computed hash of change")
+    end
+    Reloader -- "Watches" --> secret_configmaps("Secrets/ConfigMaps")
+    Reloader -- "Updates resources with Reloader environment variable" --> resources("Deployments/DaemonSets/StatefulSets resources with Reloader annotation")
+    resources -- "Restart pods based on StrategyType" --> Pods
+```
 
 ## How Does Change Detection Work?
 

go.mod

@@ -53,11 +53,11 @@ require (
 	github.com/smartystreets/goconvey v1.7.2 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	golang.org/x/net v0.26.0 // indirect
+	golang.org/x/net v0.33.0 // indirect
 	golang.org/x/oauth2 v0.21.0 // indirect
-	golang.org/x/sys v0.22.0 // indirect
-	golang.org/x/term v0.21.0 // indirect
-	golang.org/x/text v0.16.0 // indirect
+	golang.org/x/sys v0.28.0 // indirect
+	golang.org/x/term v0.27.0 // indirect
+	golang.org/x/text v0.21.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	google.golang.org/protobuf v1.34.2 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect

go.sum

@@ -255,6 +255,8 @@ golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
 golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
+golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
 golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
@@ -286,10 +288,14 @@ golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
 golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
 golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
+golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -297,6 +303,8 @@ golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
 golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
+golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
 golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

internal/pkg/callbacks/rolling_upgrade.go

@@ -2,10 +2,11 @@ package callbacks
 
 import (
 	"context"
-	"time"
 	"fmt"
+	"time"
 
 	"github.com/sirupsen/logrus"
+	"github.com/stakater/Reloader/internal/pkg/options"
 	"github.com/stakater/Reloader/pkg/kube"
 	appsv1 "k8s.io/api/apps/v1"
 	batchv1 "k8s.io/api/batch/v1"
@@ -329,11 +330,15 @@ func UpdateDeploymentConfig(clients kube.Clients, namespace string, resource run
 
 // UpdateRollout performs rolling upgrade on rollout
 func UpdateRollout(clients kube.Clients, namespace string, resource runtime.Object) error {
+	var err error
 	rollout := resource.(*argorolloutv1alpha1.Rollout)
-	rolloutBefore, _ := clients.ArgoRolloutClient.ArgoprojV1alpha1().Rollouts(namespace).Get(context.TODO(), rollout.Name, meta_v1.GetOptions{})
-	logrus.Warnf("Before: %+v", rolloutBefore.Spec.Template.Spec.Containers[0].Env)
-	logrus.Warnf("After: %+v", rollout.Spec.Template.Spec.Containers[0].Env)
-	_, err := clients.ArgoRolloutClient.ArgoprojV1alpha1().Rollouts(namespace).Patch(context.TODO(), rollout.Name, patchtypes.MergePatchType, []byte(fmt.Sprintf(`{"spec": {"restartAt": "%s"}}`, time.Now().Format(time.RFC3339))), meta_v1.PatchOptions{FieldManager: "Reloader"})
+	strategy := rollout.GetAnnotations()[options.RolloutStrategyAnnotation]
+	switch options.ToArgoRolloutStrategy(strategy) {
+	case options.RestartStrategy:
+		_, err = clients.ArgoRolloutClient.ArgoprojV1alpha1().Rollouts(namespace).Patch(context.TODO(), rollout.Name, patchtypes.MergePatchType, []byte(fmt.Sprintf(`{"spec": {"restartAt": "%s"}}`, time.Now().Format(time.RFC3339))), meta_v1.PatchOptions{FieldManager: "Reloader"})
+	case options.RolloutStrategy:
+		_, err = clients.ArgoRolloutClient.ArgoprojV1alpha1().Rollouts(namespace).Update(context.TODO(), rollout, meta_v1.UpdateOptions{FieldManager: "Reloader"})
+	}
 	return err
 }
 

internal/pkg/callbacks/rolling_upgrade_test.go

@@ -0,0 +1,105 @@
+package callbacks_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	argorolloutv1alpha1 "github.com/argoproj/argo-rollouts/pkg/apis/rollouts/v1alpha1"
+	argorollouts "github.com/argoproj/argo-rollouts/pkg/client/clientset/versioned/fake"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+
+	"github.com/stakater/Reloader/internal/pkg/callbacks"
+	"github.com/stakater/Reloader/internal/pkg/options"
+	"github.com/stakater/Reloader/internal/pkg/testutil"
+	"github.com/stakater/Reloader/pkg/kube"
+)
+
+var (
+	clients = kube.Clients{ArgoRolloutClient: argorollouts.NewSimpleClientset()}
+)
+
+// TestUpdateRollout test update rollout strategy annotation
+func TestUpdateRollout(t *testing.T) {
+	namespace := "test-ns"
+
+	cases := map[string]struct {
+		name      string
+		strategy  string
+		isRestart bool
+	}{
+		"test-without-strategy": {
+			name:      "defaults to rollout strategy",
+			strategy:  "",
+			isRestart: false,
+		},
+		"test-with-restart-strategy": {
+			name:      "triggers a restart strategy",
+			strategy:  "restart",
+			isRestart: true,
+		},
+		"test-with-rollout-strategy": {
+			name:      "triggers a rollout strategy",
+			strategy:  "rollout",
+			isRestart: false,
+		},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			rollout, err := testutil.CreateRollout(
+				clients.ArgoRolloutClient, name, namespace,
+				map[string]string{options.RolloutStrategyAnnotation: tc.strategy},
+			)
+			if err != nil {
+				t.Errorf("creating rollout: %v", err)
+			}
+			modifiedChan := watchRollout(rollout.Name, namespace)
+
+			err = callbacks.UpdateRollout(clients, namespace, rollout)
+			if err != nil {
+				t.Errorf("updating rollout: %v", err)
+			}
+			rollout, err = clients.ArgoRolloutClient.ArgoprojV1alpha1().Rollouts(
+				namespace).Get(context.TODO(), rollout.Name, meta_v1.GetOptions{})
+
+			if err != nil {
+				t.Errorf("getting rollout: %v", err)
+			}
+			if isRestartStrategy(rollout) == tc.isRestart {
+				t.Errorf("Should not be a restart strategy")
+			}
+			select {
+			case <-modifiedChan:
+				// object has been modified
+			case <-time.After(1 * time.Second):
+				t.Errorf("Rollout has not been updated")
+			}
+		})
+	}
+}
+
+func isRestartStrategy(rollout *argorolloutv1alpha1.Rollout) bool {
+	return rollout.Spec.RestartAt == nil
+}
+
+func watchRollout(name, namespace string) chan interface{} {
+	timeOut := int64(1)
+	modifiedChan := make(chan interface{})
+	watcher, _ := clients.ArgoRolloutClient.ArgoprojV1alpha1().Rollouts(namespace).Watch(context.Background(), meta_v1.ListOptions{TimeoutSeconds: &timeOut})
+	go watchModified(watcher, name, modifiedChan)
+	return modifiedChan
+}
+
+func watchModified(watcher watch.Interface, name string, modifiedChan chan interface{}) {
+	for event := range watcher.ResultChan() {
+		item := event.Object.(*argorolloutv1alpha1.Rollout)
+		if item.Name == name {
+			switch event.Type {
+			case watch.Modified:
+				modifiedChan <- nil
+			}
+			return
+		}
+	}
+}

internal/pkg/options/flags.go

@@ -2,6 +2,15 @@ package options
 
 import "github.com/stakater/Reloader/internal/pkg/constants"
 
+type ArgoRolloutStrategy int
+
+const (
+	// RestartStrategy is the annotation value for restart strategy for rollouts
+	RestartStrategy ArgoRolloutStrategy = iota
+	// RolloutStrategy is the annotation value for rollout strategy for rollouts
+	RolloutStrategy
+)
+
 var (
 	// Auto reload all resources when their corresponding configmaps/secrets are updated
 	AutoReloadAll = false
@@ -27,6 +36,8 @@ var (
 	// SearchMatchAnnotation is an annotation to tag secrets to be found with
 	// AutoSearchAnnotation
 	SearchMatchAnnotation = "reloader.stakater.com/match"
+	// RolloutStrategyAnnotation is an annotation to define rollout update strategy
+	RolloutStrategyAnnotation = "reloader.stakater.com/rollout-strategy"
 	// LogFormat is the log format to use (json, or empty string for default)
 	LogFormat = ""
 	// LogLevel is the log level to use (trace, debug, info, warning, error, fatal and panic)
@@ -45,3 +56,14 @@ var (
 	// Url to send a request to instead of triggering a reload
 	WebhookUrl = ""
 )
+
+func ToArgoRolloutStrategy(s string) ArgoRolloutStrategy {
+	switch s {
+	case "restart":
+		return RestartStrategy
+	case "rollout":
+		fallthrough
+	default:
+		return RolloutStrategy
+	}
+}

internal/pkg/testutil/kube.go

@@ -10,6 +10,8 @@ import (
 	"strings"
 	"time"
 
+	argorolloutv1alpha1 "github.com/argoproj/argo-rollouts/pkg/apis/rollouts/v1alpha1"
+	argorollout "github.com/argoproj/argo-rollouts/pkg/client/clientset/versioned"
 	openshiftv1 "github.com/openshift/api/apps/v1"
 	appsclient "github.com/openshift/client-go/apps/clientset/versioned"
 	"github.com/sirupsen/logrus"
@@ -69,16 +71,16 @@ func DeleteNamespace(namespace string, client kubernetes.Interface) {
 	}
 }
 
-func getObjectMeta(namespace string, name string, autoReload bool, secretAutoReload bool, configmapAutoReload bool) metav1.ObjectMeta {
+func getObjectMeta(namespace string, name string, autoReload bool, secretAutoReload bool, configmapAutoReload bool, extraAnnotations map[string]string) metav1.ObjectMeta {
 	return metav1.ObjectMeta{
 		Name:        name,
 		Namespace:   namespace,
 		Labels:      map[string]string{"firstLabel": "temp"},
-		Annotations: getAnnotations(name, autoReload, secretAutoReload, configmapAutoReload),
+		Annotations: getAnnotations(name, autoReload, secretAutoReload, configmapAutoReload, extraAnnotations),
 	}
 }
 
-func getAnnotations(name string, autoReload bool, secretAutoReload bool, configmapAutoReload bool) map[string]string {
+func getAnnotations(name string, autoReload bool, secretAutoReload bool, configmapAutoReload bool, extraAnnotations map[string]string) map[string]string {
 	annotations := make(map[string]string)
 	if autoReload {
 		annotations[options.ReloaderAutoAnnotation] = "true"
@@ -90,13 +92,15 @@ func getAnnotations(name string, autoReload bool, secretAutoReload bool, configm
 		annotations[options.ConfigmapReloaderAutoAnnotation] = "true"
 	}
 
-	if len(annotations) > 0 {
-		return annotations
-	} else {
-		return map[string]string{
+	if !(len(annotations) > 0) {
+		annotations = map[string]string{
 			options.ConfigmapUpdateOnChangeAnnotation: name,
 			options.SecretUpdateOnChangeAnnotation:    name}
 	}
+	for k, v := range extraAnnotations {
+		annotations[k] = v
+	}
+	return annotations
 }
 
 func getEnvVarSources(name string) []v1.EnvFromSource {
@@ -342,7 +346,7 @@ func getPodTemplateSpecWithInitContainerAndEnv(name string) v1.PodTemplateSpec {
 func GetDeployment(namespace string, deploymentName string) *appsv1.Deployment {
 	replicaset := int32(1)
 	return &appsv1.Deployment{
-		ObjectMeta: getObjectMeta(namespace, deploymentName, false, false, false),
+		ObjectMeta: getObjectMeta(namespace, deploymentName, false, false, false, map[string]string{}),
 		Spec: appsv1.DeploymentSpec{
 			Selector: &metav1.LabelSelector{
 				MatchLabels: map[string]string{"secondLabel": "temp"},
@@ -361,7 +365,7 @@ func GetDeploymentConfig(namespace string, deploymentConfigName string) *openshi
 	replicaset := int32(1)
 	podTemplateSpecWithVolume := getPodTemplateSpecWithVolumes(deploymentConfigName)
 	return &openshiftv1.DeploymentConfig{
-		ObjectMeta: getObjectMeta(namespace, deploymentConfigName, false, false, false),
+		ObjectMeta: getObjectMeta(namespace, deploymentConfigName, false, false, false, map[string]string{}),
 		Spec: openshiftv1.DeploymentConfigSpec{
 			Replicas: replicaset,
 			Strategy: openshiftv1.DeploymentStrategy{
@@ -376,7 +380,7 @@ func GetDeploymentConfig(namespace string, deploymentConfigName string) *openshi
 func GetDeploymentWithInitContainer(namespace string, deploymentName string) *appsv1.Deployment {
 	replicaset := int32(1)
 	return &appsv1.Deployment{
-		ObjectMeta: getObjectMeta(namespace, deploymentName, false, false, false),
+		ObjectMeta: getObjectMeta(namespace, deploymentName, false, false, false, map[string]string{}),
 		Spec: appsv1.DeploymentSpec{
 			Selector: &metav1.LabelSelector{
 				MatchLabels: map[string]string{"secondLabel": "temp"},
@@ -394,7 +398,7 @@ func GetDeploymentWithInitContainer(namespace string, deploymentName string) *ap
 func GetDeploymentWithInitContainerAndEnv(namespace string, deploymentName string) *appsv1.Deployment {
 	replicaset := int32(1)
 	return &appsv1.Deployment{
-		ObjectMeta: getObjectMeta(namespace, deploymentName, true, false, false),
+		ObjectMeta: getObjectMeta(namespace, deploymentName, true, false, false, map[string]string{}),
 		Spec: appsv1.DeploymentSpec{
 			Selector: &metav1.LabelSelector{
 				MatchLabels: map[string]string{"secondLabel": "temp"},
@@ -411,7 +415,7 @@ func GetDeploymentWithInitContainerAndEnv(namespace string, deploymentName strin
 func GetDeploymentWithEnvVars(namespace string, deploymentName string) *appsv1.Deployment {
 	replicaset := int32(1)
 	return &appsv1.Deployment{
-		ObjectMeta: getObjectMeta(namespace, deploymentName, true, false, false),
+		ObjectMeta: getObjectMeta(namespace, deploymentName, true, false, false, map[string]string{}),
 		Spec: appsv1.DeploymentSpec{
 			Selector: &metav1.LabelSelector{
 				MatchLabels: map[string]string{"secondLabel": "temp"},
@@ -429,7 +433,7 @@ func GetDeploymentConfigWithEnvVars(namespace string, deploymentConfigName strin
 	replicaset := int32(1)
 	podTemplateSpecWithEnvVars := getPodTemplateSpecWithEnvVars(deploymentConfigName)
 	return &openshiftv1.DeploymentConfig{
-		ObjectMeta: getObjectMeta(namespace, deploymentConfigName, false, false, false),
+		ObjectMeta: getObjectMeta(namespace, deploymentConfigName, false, false, false, map[string]string{}),
 		Spec: openshiftv1.DeploymentConfigSpec{
 			Replicas: replicaset,
 			Strategy: openshiftv1.DeploymentStrategy{
@@ -443,7 +447,7 @@ func GetDeploymentConfigWithEnvVars(namespace string, deploymentConfigName strin
 func GetDeploymentWithEnvVarSources(namespace string, deploymentName string) *appsv1.Deployment {
 	replicaset := int32(1)
 	return &appsv1.Deployment{
-		ObjectMeta: getObjectMeta(namespace, deploymentName, true, false, false),
+		ObjectMeta: getObjectMeta(namespace, deploymentName, true, false, false, map[string]string{}),
 		Spec: appsv1.DeploymentSpec{
 			Selector: &metav1.LabelSelector{
 				MatchLabels: map[string]string{"secondLabel": "temp"},
@@ -460,7 +464,7 @@ func GetDeploymentWithEnvVarSources(namespace string, deploymentName string) *ap
 func GetDeploymentWithPodAnnotations(namespace string, deploymentName string, both bool) *appsv1.Deployment {
 	replicaset := int32(1)
 	deployment := &appsv1.Deployment{
-		ObjectMeta: getObjectMeta(namespace, deploymentName, false, false, false),
+		ObjectMeta: getObjectMeta(namespace, deploymentName, false, false, false, map[string]string{}),
 		Spec: appsv1.DeploymentSpec{
 			Selector: &metav1.LabelSelector{
 				MatchLabels: map[string]string{"secondLabel": "temp"},
@@ -475,7 +479,7 @@ func GetDeploymentWithPodAnnotations(namespace string, deploymentName string, bo
 	if !both {
 		deployment.ObjectMeta.Annotations = nil
 	}
-	deployment.Spec.Template.ObjectMeta.Annotations = getAnnotations(deploymentName, true, false, false)
+	deployment.Spec.Template.ObjectMeta.Annotations = getAnnotations(deploymentName, true, false, false, map[string]string{})
 	return deployment
 }
 
@@ -483,9 +487,9 @@ func GetDeploymentWithTypedAutoAnnotation(namespace string, deploymentName strin
 	replicaset := int32(1)
 	var objectMeta metav1.ObjectMeta
 	if resourceType == SecretResourceType {
-		objectMeta = getObjectMeta(namespace, deploymentName, false, true, false)
+		objectMeta = getObjectMeta(namespace, deploymentName, false, true, false, map[string]string{})
 	} else if resourceType == ConfigmapResourceType {
-		objectMeta = getObjectMeta(namespace, deploymentName, false, false, true)
+		objectMeta = getObjectMeta(namespace, deploymentName, false, false, true, map[string]string{})
 	}
 
 	return &appsv1.Deployment{
@@ -537,7 +541,7 @@ func GetDeploymentWithExcludeAnnotation(namespace string, deploymentName string,
 // GetDaemonSet provides daemonset for testing
 func GetDaemonSet(namespace string, daemonsetName string) *appsv1.DaemonSet {
 	return &appsv1.DaemonSet{
-		ObjectMeta: getObjectMeta(namespace, daemonsetName, false, false, false),
+		ObjectMeta: getObjectMeta(namespace, daemonsetName, false, false, false, map[string]string{}),
 		Spec: appsv1.DaemonSetSpec{
 			Selector: &metav1.LabelSelector{
 				MatchLabels: map[string]string{"secondLabel": "temp"},
@@ -552,7 +556,7 @@ func GetDaemonSet(namespace string, daemonsetName string) *appsv1.DaemonSet {
 
 func GetDaemonSetWithEnvVars(namespace string, daemonSetName string) *appsv1.DaemonSet {
 	return &appsv1.DaemonSet{
-		ObjectMeta: getObjectMeta(namespace, daemonSetName, true, false, false),
+		ObjectMeta: getObjectMeta(namespace, daemonSetName, true, false, false, map[string]string{}),
 		Spec: appsv1.DaemonSetSpec{
 			Selector: &metav1.LabelSelector{
 				MatchLabels: map[string]string{"secondLabel": "temp"},
@@ -568,7 +572,7 @@ func GetDaemonSetWithEnvVars(namespace string, daemonSetName string) *appsv1.Dae
 // GetStatefulSet provides statefulset for testing
 func GetStatefulSet(namespace string, statefulsetName string) *appsv1.StatefulSet {
 	return &appsv1.StatefulSet{
-		ObjectMeta: getObjectMeta(namespace, statefulsetName, false, false, false),
+		ObjectMeta: getObjectMeta(namespace, statefulsetName, false, false, false, map[string]string{}),
 		Spec: appsv1.StatefulSetSpec{
 			Selector: &metav1.LabelSelector{
 				MatchLabels: map[string]string{"secondLabel": "temp"},
@@ -584,7 +588,7 @@ func GetStatefulSet(namespace string, statefulsetName string) *appsv1.StatefulSe
 // GetStatefulSet provides statefulset for testing
 func GetStatefulSetWithEnvVar(namespace string, statefulsetName string) *appsv1.StatefulSet {
 	return &appsv1.StatefulSet{
-		ObjectMeta: getObjectMeta(namespace, statefulsetName, true, false, false),
+		ObjectMeta: getObjectMeta(namespace, statefulsetName, true, false, false, map[string]string{}),
 		Spec: appsv1.StatefulSetSpec{
 			Selector: &metav1.LabelSelector{
 				MatchLabels: map[string]string{"secondLabel": "temp"},
@@ -1071,3 +1075,28 @@ func VerifyResourceAnnotationUpdate(clients kube.Clients, config util.Config, up
 func GetSHAfromEmptyData() string {
 	return crypto.GenerateSHA("")
 }
+
+// GetRollout provides rollout for testing
+func GetRollout(namespace string, rolloutName string, annotations map[string]string) *argorolloutv1alpha1.Rollout {
+	replicaset := int32(1)
+	return &argorolloutv1alpha1.Rollout{
+		ObjectMeta: getObjectMeta(namespace, rolloutName, false, false, false, annotations),
+		Spec: argorolloutv1alpha1.RolloutSpec{
+			Selector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{"secondLabel": "temp"},
+			},
+			Replicas: &replicaset,
+			Template: getPodTemplateSpecWithVolumes(rolloutName),
+		},
+	}
+}
+
+// CreateRollout creates a rolout in given namespace and returns the Rollout
+func CreateRollout(client argorollout.Interface, rolloutName string, namespace string, annotations map[string]string) (*argorolloutv1alpha1.Rollout, error) {
+	logrus.Infof("Creating Rollout")
+	rolloutClient := client.ArgoprojV1alpha1().Rollouts(namespace)
+	rolloutObj := GetRollout(namespace, rolloutName, annotations)
+	rollout, err := rolloutClient.Create(context.TODO(), rolloutObj, metav1.CreateOptions{})
+	time.Sleep(3 * time.Second)
+	return rollout, err
+}