Managed by Terraform

Update dependency rok8s to v16 (#1221 )
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: jdesouza <james@fairwinds.com>
2026-08-29 22:17:16 +00:00 · 2026-08-06 16:10:01 +00:00 · 2026-08-06 09:26:30 -03:00 · 2026-08-06 09:14:18 -03:00 · 2026-08-06 08:58:02 -03:00 · 2026-08-05 14:12:49 +00:00
19 changed files with 407 additions and 226 deletions
@@ -1,7 +1,7 @@
 version: 2.1

 orbs:
-  rok8s: fairwinds/rok8s-scripts@14
+  rok8s: fairwinds/rok8s-scripts@16.0.0
  oss-docs: fairwinds/oss-docs@0

 executors:
@@ -13,10 +13,10 @@ commands:
  install_goreleaser_dependencies:
    description: Installs dependencies for CI scripts
    steps:
-    - run: apk update
-    # Register other docker platforms, to build arm64.
-    # This shouldn't be needed, why TBD.
-    - run: docker run --privileged --rm tonistiigi/binfmt --install all
+      - run: apk update
+      # Register other docker platforms, to build arm64.
+      # This shouldn't be needed, why TBD.
+      - run: docker run --privileged --rm tonistiigi/binfmt --install all

 references:
  set_environment_variables: &set_environment_variables
@@ -105,6 +105,26 @@ references:
        sha256sum vault_1.13.2_linux_amd64.zip | grep f7930279de8381de7c532164b4a4408895d9606c0d24e2e9d2f9acb5dfe99b3c
        unzip vault_1.13.2_linux_amd64.zip
        mv vault /usr/bin/vault
+  setup_qemu_binfmt: &setup_qemu_binfmt
+    run:
+      name: Setup QEMU for multi-arch Docker builds
+      command: |
+        sudo apt-get update -y
+        sudo apt-get install -y qemu-user-static binfmt-support
+        docker buildx create --use || true
+        docker buildx inspect --bootstrap
+  load_polaris_image_into_kind: &load_polaris_image_into_kind
+    run:
+      name: Load Polaris snapshot image into Kind
+      command: |
+        TAR="/tmp/workspace/docker_save/polaris_${CIRCLE_SHA1}.tar"
+        if [ -f "$TAR" ]; then
+          echo "Loading snapshot image from $TAR"
+          docker load -i "$TAR"
+          kind load docker-image "us-docker.pkg.dev/fairwinds-ops/oss/polaris:${CIRCLE_SHA1}"
+        else
+          echo "No snapshot tar (tag workflow); tests will pull the image from the registry."
+        fi
 jobs:
  test_k8s:
    working_directory: ~/polaris
@@ -113,12 +133,15 @@ jobs:
    steps:
      - checkout
      - *set_environment_variables
+      - attach_workspace:
+          at: /tmp/workspace
      - *install_k8s
+      - *load_polaris_image_into_kind
      - *test_k8s

  test:
    docker:
-      - image: cimg/go:1.26.2
+      - image: cimg/go:1.26.5
    steps:
      - checkout
      - *set_environment_variables
@@ -126,7 +149,7 @@ jobs:
      - run: go test ./... -coverprofile=coverage.txt -covermode=count
      - *test_binary_dashboard

-  build_and_push:
+  release:
    working_directory: /go/src/github.com/fairwindsops/polaris/
    resource_class: large
    shell: /bin/bash
@@ -134,7 +157,7 @@ jobs:
      # The goreleaser image tag determins the version of Go.
      # Manually check goreleaser images for their version of Go.
      # Ref: https://hub.docker.com/r/goreleaser/goreleaser/tags
-      - image: goreleaser/goreleaser:v2.15.4
+      - image: goreleaser/goreleaser:v2.17.1
    steps:
      - checkout
      - setup_remote_docker
@@ -144,35 +167,112 @@ jobs:
      - rok8s/get_vault_env:
          vault_path: repo/polaris/env
      - *set_environment_variables
-      - run: docker login quay.io -u="${FAIRWINDS_QUAY_USER}" -p="${FAIRWINDS_QUAY_TOKEN}"
+      - run:
+          name: docker login Google Artifact Registry
+          command: |
+            docker login -u _json_key -p "$(echo $GCP_ARTIFACTREADWRITE_JSON_KEY | base64 -d)" us-docker.pkg.dev
      - install_goreleaser_dependencies
-      - run: scripts/goreleaser.sh
+      - run: echo 'export GORELEASER_CURRENT_TAG="${CIRCLE_TAG}"' >> $BASH_ENV
+      - run: goreleaser release --clean
+      - run: mkdir -p /tmp/workspace/docker_save && touch /tmp/workspace/docker_save/.release-workspace-marker
+      - persist_to_workspace:
+          root: /tmp/workspace
+          paths:
+            - docker_save
+
+  snapshot:
+    working_directory: /home/circleci/project
+    machine:
+      image: ubuntu-2204:current
+    resource_class: large
+    shell: /bin/bash
+    steps:
+      - checkout
+      - *setup_qemu_binfmt
+      - run:
+          name: goreleaser release (snapshot, local only)
+          environment:
+            GORELEASER_SKIP_RELEASE: "true"
+          command: |
+            set -euo pipefail
+            REPO_ROOT="${HOME}/project"
+            docker run --rm \
+              -v /var/run/docker.sock:/var/run/docker.sock \
+              -v "${REPO_ROOT}:/workspace" -w /workspace \
+              -e GORELEASER_SKIP_RELEASE=true \
+              -e CIRCLE_SHA1 \
+              -e CIRCLE_BRANCH \
+              -e CIRCLE_TAG \
+              --entrypoint sh \
+              goreleaser/goreleaser:v2.15.4 \
+              -c 'git config --global --add safe.directory /workspace && cd /workspace && goreleaser release --snapshot --clean --skip=sign,homebrew'
+      - run: mkdir -p /tmp/workspace/docker_save/
+      - run:
+          name: Tag and save amd64 image for Kind
+          command: |
+            set -euo pipefail
+            docker tag "us-docker.pkg.dev/fairwinds-ops/oss/polaris:${CIRCLE_SHA1}-amd64" "us-docker.pkg.dev/fairwinds-ops/oss/polaris:${CIRCLE_SHA1}"
+            docker save "us-docker.pkg.dev/fairwinds-ops/oss/polaris:${CIRCLE_SHA1}" -o "/tmp/workspace/docker_save/polaris_${CIRCLE_SHA1}.tar"
+      - persist_to_workspace:
+          root: /tmp/workspace
+          paths:
+            - docker_save
+      - store_artifacts:
+          path: dist
+          destination: snapshot

 workflows:
  version: 2

-  release:
+  branch:
+    jobs:
+      - test:
+          filters:
+            tags:
+              ignore: /.*/
+      - snapshot:
+          filters:
+            branches:
+              ignore: /pull\/[0-9]+/
+            tags:
+              ignore: /.*/
+      - test_k8s:
+          requires:
+            - snapshot
+          filters:
+            branches:
+              ignore: /pull\/[0-9]+/
+            tags:
+              ignore: /.*/
+
+  tag_release:
    jobs:
      - test:
          filters:
            tags:
              only: /.*/
-      - build_and_push:
+            branches:
+              ignore: /.*/
+      - release:
+          requires:
+            - test
          context: org-global
          filters:
            branches:
-              ignore: /pull\/[0-9]+/
+              ignore: /.*/
            tags:
              ignore: /^testing-.*/
      - test_k8s:
          requires:
-            - build_and_push
+            - release
          filters:
            branches:
-              ignore: /pull\/[0-9]+/
+              ignore: /.*/
            tags:
              ignore: /^testing-.*/
      - oss-docs/publish-docs:
+          requires:
+            - test_k8s
          repository: polaris
          filters:
            branches:
@@ -1,6 +1,6 @@
 # The action uses an own Dockerfile on purpose because the root Dockerfile takes way too long to build for an action

-FROM alpine:3.23
+FROM alpine:3.24

 RUN	apk add --no-cache \
  bash \
@@ -1,20 +0,0 @@
-## DO NOT EDIT - Managed by Terraform
-version: 2
-updates:
-  - package-ecosystem: "docker"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "npm"
-    directory: "/docs"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 0
-    ignore:
-      - dependency-name: "*"
-
-  - package-ecosystem: "gomod"
-    directory: "/"
-    schedule:
-      interval: "weekly"
@@ -1,14 +1,8 @@
+## DO NOT EDIT - Managed by Terraform
+# yaml-language-server: $$schema=https://goreleaser.com/static/schema.json
+
 version: 2
-checksum:
-  name_template: 'checksums.txt'
-changelog:
-  sort: asc
-  filters:
-    exclude:
-    - '^docs:'
-    - '^test:'
-env:
-  - GOBIN={{ .Env.TMPDIR }}/go-bin
+project_name: polaris
 before:
  hooks:
    - go mod download
@@ -30,31 +24,13 @@ builds:
    goarm:
      - "6"
      - "7"
-     # Go does not support windows/arm (32-bit); only windows/arm64 is supported.
    ignore:
      - goos: windows
        goarch: arm
-archives:
-  - id: polaris
-    builds: ["polaris"]
-    name_template: "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}{{ if .Mips }}_{{ .Mips }}{{ end }}"
-signs:
- cmd: cosign
-  args: ["sign-blob", "--key=hashivault://cosign", "-output-signature=${signature}", "${artifact}"]
-  artifacts: checksum
-release:
-  # Branch/PR builds set GORELEASER_SKIP_RELEASE=true; tag builds set false.
-  disable: '{{ eq .Env.GORELEASER_SKIP_RELEASE "true" }}'
-  prerelease: auto
-  footer: |
-    You can verify the signature of the checksums.txt file using [cosign](https://github.com/sigstore/cosign).
-
-    ```
-    cosign verify-blob checksums.txt --signature=checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign.pub
-    ```
+      - goos: windows
+        goarch: arm64
 brews:
  - name: polaris
-    skip_upload: '{{ eq .Env.GORELEASER_SKIP_RELEASE "true" }}'
    repository:
      owner: FairwindsOps
      name: homebrew-tap
@@ -63,51 +39,78 @@ brews:
    url_template: "https://github.com/FairwindsOps/polaris/releases/download/{{ .Tag }}/{{ .ArtifactName }}"
    test: |
      system "#{bin}/polaris version"
+release:
+  disable: '{{ eq (envOrDefault "GORELEASER_SKIP_RELEASE" "false") "true" }}'
+  prerelease: auto
+  github:
+    owner: FairwindsOps
+    name: polaris
+  footer: |
+    You can verify the signatures of both the checksums.txt file and the published docker images using [cosign](https://github.com/sigstore/cosign).
+
+    ```bash
+    cosign verify-blob checksums.txt --bundle=checksums.txt.sigstore.json --key https://artifacts.fairwinds.com/cosign-p256.pub
+    ```
+
+    ```bash
+    cosign verify us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .Tag }} --key https://artifacts.fairwinds.com/cosign-p256.pub
+    ```
+checksum:
+  name_template: "checksums.txt"
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - '^docs:'
+      - '^test:'
+signs:
+  - cmd: cosign
+    signature: "${artifact}.sigstore.json"
+    args:
+      - "sign-blob"
+      - "--key=hashivault://cosign-p256"
+      - "--bundle=${signature}"
+      - "${artifact}"
+      - "--yes"
+    artifacts: all
+docker_signs:
+  - artifacts: all
+    args: ["sign", "--key=hashivault://cosign-p256", "us-docker.pkg.dev/fairwinds-ops/oss/polaris@${digest}", "-r", "--yes"]
 dockers:
-  # There are multiple images to match the `--platform` docker build flag with
-  # combinations of `GOOS`, `GOARCH`, and `GOARM`
- image_templates:
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
-  use: buildx
-  build_flag_templates:
-  - "--platform=linux/amd64"
- image_templates:
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
-  use: buildx
-  goarch: arm64
-  goos: linux
-  build_flag_templates:
-  - "--platform=linux/arm64"
+   - image_templates:
+        - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .FullCommit }}-amd64"
+        - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .Tag }}-amd64"
+     use: buildx
+     dockerfile: Dockerfile
+     build_flag_templates:
+        - "--platform=linux/amd64"
+   - image_templates:
+        - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .FullCommit }}-arm64v8"
+        - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .Tag }}-arm64v8"
+     use: buildx
+     goarch: arm64
+     goos: linux
+     dockerfile: Dockerfile
+     build_flag_templates:
+        - "--platform=linux/arm64/v8"
+   - image_templates:
+        - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .FullCommit }}-armv7"
+        - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .Tag }}-armv7"
+     use: buildx
+     goarch: arm
+     goarm: 7
+     goos: linux
+     dockerfile: Dockerfile
+     build_flag_templates:
+        - "--platform=linux/arm/v7"
 docker_manifests:
-# Create Docker manifests that make multiple architectures available within a tag,
-# and provide partial-version tags like 2, and 2.2.
- name_template: quay.io/fairwinds/polaris:{{ .FullCommit }}
-  image_templates:
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
- name_template: 'quay.io/fairwinds/polaris:{{ envOrDefault "FEATURE_DOCKER_TAG" "none" }}'
-  # Tag builds set GORELEASER_SKIP_FEATURE_DOCKER_TAGS=true; feature branches set false.
-  skip_push: '{{ eq .Env.GORELEASER_SKIP_FEATURE_DOCKER_TAGS "true" }}'
-  image_templates:
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
- name_template: quay.io/fairwinds/polaris:latest
-  skip_push: '{{ eq .Env.GORELEASER_SKIP_RELEASE "true" }}'
-  image_templates:
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
- name_template: quay.io/fairwinds/polaris:{{ .Tag }}
-  skip_push: '{{ eq .Env.GORELEASER_SKIP_RELEASE "true" }}'
-  image_templates:
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
- name_template: quay.io/fairwinds/polaris:{{ .Major }}
-  skip_push: '{{ eq .Env.GORELEASER_SKIP_RELEASE "true" }}'
-  image_templates:
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
- name_template: quay.io/fairwinds/polaris:{{ .Major }}.{{ .Minor }}
-  skip_push: '{{ eq .Env.GORELEASER_SKIP_RELEASE "true" }}'
-  image_templates:
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
+  - name_template: us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .Tag }}
+    image_templates:
+      - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .Tag }}-amd64"
+      - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .Tag }}-arm64v8"
+      - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .Tag }}-armv7"
+  - name_template: us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .FullCommit }}
+    image_templates:
+      - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .FullCommit }}-amd64"
+      - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .FullCommit }}-arm64v8"
+      - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .FullCommit }}-armv7"
@@ -1,4 +1,4 @@
-FROM alpine:3.23.4
+FROM alpine:3.24.1

 LABEL org.opencontainers.image.authors="FairwindsOps, Inc." \
      org.opencontainers.image.vendor="FairwindsOps, Inc." \
@@ -29,6 +29,44 @@ Polaris can be run in three different modes:
 ## Documentation
 Check out the [documentation at docs.fairwinds.com](https://polaris.docs.fairwinds.com)

+## Notice: Registry Migration and Immutable Images (v10.1.8 → v10.2.0)
+
+Starting with **v10.2.0**:
+
+- Images moved to `us-docker.pkg.dev/fairwinds-ops/oss/polaris`
+- `quay.io/fairwinds/polaris` is deprecated
+
+### Required action
+
+```diff
+- quay.io/fairwinds/polaris:<tag>
+ us-docker.pkg.dev/fairwinds-ops/oss/polaris:<tag>
+```
+
+---
+
+## Immutable and signed images
+
+* Images are now **signed**
+* Tags are **immutable**
+* No more floating tags:
+
+  * `v10`
+  * `v10.1`
+  * `latest`
+
+Use full version tags:
+
+```
+us-docker.pkg.dev/fairwinds-ops/oss/polaris:v<major>.<minor>.<patch>
+```
+
+Or pin by digest:
+
+```
+us-docker.pkg.dev/fairwinds-ops/oss/polaris@sha256:<digest>
+```
+
 <!-- Begin boilerplate -->
 ## Join the Fairwinds Open Source Community

@@ -46,11 +46,11 @@ go test ./pkg/... -v -coverprofile cover.out
 ### Webhook tests
 ```bash
 kind create cluster --wait=90s --image kindest/node:v1.15.11 --name polaris-test
-docker build -t quay.io/fairwinds/polaris:debug . # or use your own registry
-docker push quay.io/fairwinds/polaris:debug
+docker build -t us-docker.pkg.dev/fairwinds-ops/oss/polaris:debug . # or use your own registry
+docker push us-docker.pkg.dev/fairwinds-ops/oss/polaris:debug
 helm repo add jetstack https://charts.jetstack.io
 helm install cert-manager jetstack/cert-manager --namespace cert-manager --version v1.12.1 --set "installCRDs=true" --wait
-POLARIS_IMAGE=quay.io/fairwinds/polaris:debug ./test/webhook_test.sh
+POLARIS_IMAGE=us-docker.pkg.dev/fairwinds-ops/oss/polaris:debug ./test/webhook_test.sh
 ```
 to avoid the final cleanup for debugging purposes, you can run
 ```bash
@@ -42,7 +42,7 @@ polaris dashboard --port 8080 --audit-path=./deploy/
 ### Local Docker container

 ```
-docker run -d -p8080:8080 -v ~/.kube/config:/opt/app/config:ro  quay.io/fairwinds/polaris:1.2 polaris dashboard --kubeconfig /opt/app/config
+docker run -d -p8080:8080 -v ~/.kube/config:/opt/app/config:ro  us-docker.pkg.dev/fairwinds-ops/oss/polaris:1.2 polaris dashboard --kubeconfig /opt/app/config
 ```

 ##  Using the Dashboard
@@ -4,4 +4,4 @@ options:

 images:
  docker:
-  - quay.io/fairwinds/polaris:$CI_SHA1
+  - us-docker.pkg.dev/fairwinds-ops/oss/polaris:$CI_SHA1
@@ -15,10 +15,10 @@ require (
 	github.com/thoas/go-funk v0.9.3
 	gomodules.xyz/jsonpatch/v2 v2.5.0
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.35.4
-	k8s.io/apimachinery v0.35.4
-	k8s.io/client-go v0.35.4
-	sigs.k8s.io/controller-runtime v0.23.3
+	k8s.io/api v0.36.3
+	k8s.io/apimachinery v0.36.3
+	k8s.io/client-go v0.36.3
+	sigs.k8s.io/controller-runtime v0.24.1
 	sigs.k8s.io/yaml v1.6.0
 )

@@ -48,7 +48,6 @@ require (
 	github.com/go-openapi/swag/typeutils v0.25.5 // indirect
 	github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
 	github.com/google/gnostic-models v0.7.1 // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
@@ -68,20 +67,20 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/net v0.51.0 // indirect
+	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sys v0.42.0 // indirect
-	golang.org/x/term v0.40.0 // indirect
-	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/term v0.43.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/apiextensions-apiserver v0.35.4 // indirect
+	k8s.io/apiextensions-apiserver v0.36.0 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20260304202019-5b3e3fdb0acf // indirect
+	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
 	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.3 // indirect
 )
@@ -67,8 +67,6 @@ github.com/go-openapi/testify/v2 v2.4.0 h1:8nsPrHVCWkQ4p8h1EsRVymA2XABB4OT40gcvA
 github.com/go-openapi/testify/v2 v2.4.0/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
-github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
-github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c=
 github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
@@ -106,10 +104,10 @@ github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFd
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/onsi/ginkgo/v2 v2.27.2 h1:LzwLj0b89qtIy6SSASkzlNvX6WktqurSHwkk2ipF/Ns=
-github.com/onsi/ginkgo/v2 v2.27.2/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
-github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
-github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
+github.com/onsi/ginkgo/v2 v2.27.4 h1:fcEcQW/A++6aZAZQNUmNjvA9PSOzefMJBerHJ4t8v8Y=
+github.com/onsi/ginkgo/v2 v2.27.4/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
+github.com/onsi/gomega v1.39.0 h1:y2ROC3hKFmQZJNFeGAMeHZKkjBL65mIZcvrLQBF9k6Q=
+github.com/onsi/gomega v1.39.0/go.mod h1:ZCU1pkQcXDO5Sl9/VVEGlDyp+zm0m1cmeG5TOzLgdh4=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -156,35 +154,35 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
-go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
+go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
-golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
-golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
-golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
+golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
-golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
-golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
-golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
-golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
 gomodules.xyz/jsonpatch/v2 v2.5.0 h1:JELs8RLM12qJGXU4u/TO3V25KW8GreMKl9pdkk14RM0=
 gomodules.xyz/jsonpatch/v2 v2.5.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -195,27 +193,27 @@ gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.35.4 h1:P7nFYKl5vo9AGUp1Z+Pmd3p2tA7bX2wbFWCvDeRv988=
-k8s.io/api v0.35.4/go.mod h1:yl4lqySWOgYJJf9RERXKUwE9g2y+CkuwG+xmcOK8wXU=
-k8s.io/apiextensions-apiserver v0.35.4 h1:HeP+Upp7ItdvnyGmub0yoix+2z5+ev4M5cE5TCgtOUU=
-k8s.io/apiextensions-apiserver v0.35.4/go.mod h1:ogQlk+stIE8mnoRthSYCwlOS12fVqgWFiErMwPaXA7c=
-k8s.io/apimachinery v0.35.4 h1:xtdom9RG7e+yDp71uoXoJDWEE2eOiHgeO4GdBzwWpds=
-k8s.io/apimachinery v0.35.4/go.mod h1:NNi1taPOpep0jOj+oRha3mBJPqvi0hGdaV8TCqGQ+cc=
-k8s.io/client-go v0.35.4 h1:DN6fyaGuzK64UvnKO5fOA6ymSjvfGAnCAHAR0C66kD8=
-k8s.io/client-go v0.35.4/go.mod h1:2Pg9WpsS4NeOpoYTfHHfMxBG8zFMSAUi4O/qoiJC3nY=
+k8s.io/api v0.36.3 h1:NxB+05W2UGqXWFXcLO0RB5cnqnUPP5v5sVlaOH0Iz4w=
+k8s.io/api v0.36.3/go.mod h1:JzLQKqRHC5+I8RVj/lS3lCg0mg6nWI9Fo/Sk3ElxHzg=
+k8s.io/apiextensions-apiserver v0.36.0 h1:Wt7E8J+VBCbj4FjiBfDTK/neXDDjyJVJc7xfuOHImZ0=
+k8s.io/apiextensions-apiserver v0.36.0/go.mod h1:kGDjH0msuiIB3tgsYRV0kS9GqpMYMUsQ3GHv7TApyug=
+k8s.io/apimachinery v0.36.3 h1:PkzMRBRG8joFD8EhCuQAtNPvJlxb82FwplP26HIzvAM=
+k8s.io/apimachinery v0.36.3/go.mod h1:cTSjBWgPe/6CQyBKzY/hDIRWCQQQeK0mfLbml0UYFHE=
+k8s.io/client-go v0.36.3 h1:M4JdVzXxYcZk4fGpfDdYnxSwhLKWCFoQsHW6t+z8Hfg=
+k8s.io/client-go v0.36.3/go.mod h1:gcPwr0c87vjjG6HB6pWEqOeuYVoXSsREjzux2j6GF30=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
-k8s.io/kube-openapi v0.0.0-20260304202019-5b3e3fdb0acf h1:btPscg4cMql0XdYK2jLsJcNEKmACJz8l+U7geC06FiM=
-k8s.io/kube-openapi v0.0.0-20260304202019-5b3e3fdb0acf/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
+k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a h1:xCeOEAOoGYl2jnJoHkC3hkbPJgdATINPMAxaynU2Ovg=
+k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
 k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
 k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
-sigs.k8s.io/controller-runtime v0.23.3 h1:VjB/vhoPoA9l1kEKZHBMnQF33tdCLQKJtydy4iqwZ80=
-sigs.k8s.io/controller-runtime v0.23.3/go.mod h1:B6COOxKptp+YaUT5q4l6LqUJTRpizbgf9KSRNdQGns0=
+sigs.k8s.io/controller-runtime v0.24.1 h1:miPEwrmirImAvgME1L9qebGHrOnGJoVmVdtOU9fRfo4=
+sigs.k8s.io/controller-runtime v0.24.1/go.mod h1:vFkfY5fGt5xAC/sKb8IBFKgWPNKG9OUG29dR8Y2wImw=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.3 h1:u08YRbVUi59ri4YD6cg0UqNM4Dimn0sIl+wldcx5PYw=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.3/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
@@ -52,6 +52,7 @@ type ResourceProvider struct {
 	SourceType    string
 	Nodes         []corev1.Node
 	Namespaces    []corev1.Namespace
+	Pods          []corev1.Pod
 	Resources     resourceKindMap
 }

@@ -127,6 +128,7 @@ func newResourceProvider(version, sourceType, sourceName string) ResourceProvide
 		CreationTime:  time.Now(),
 		Nodes:         make([]corev1.Node, 0),
 		Namespaces:    make([]corev1.Namespace, 0),
+		Pods:          make([]corev1.Pod, 0),
 		Resources:     make(map[string][]GenericResource),
 	}
 }
@@ -304,6 +306,14 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 		}
 		namespaces = nsList
 	}
+
+	logrus.Info("Loading pods")
+	pods, err := kube.CoreV1().Pods(c.Namespace).List(ctx, listOpts)
+	if err != nil {
+		logrus.Errorf("Error fetching Pods: %v", err)
+		return nil, err
+	}
+
 	logrus.Info("Setting up restmapper")
 	resources, err := restmapper.GetAPIGroupResources(kube.Discovery())
 	if err != nil {
@@ -383,6 +393,7 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac

 	provider.Nodes = nodes.Items
 	provider.Namespaces = namespaces.Items
+	provider.Pods = pods.Items
 	provider.Resources.addResources(kubernetesResources)
 	logrus.Info("Done loading Kubernetes resources")
 	return &provider, nil
@@ -442,6 +453,7 @@ func (resources *ResourceProvider) addResourceFromString(contents string) error
 			return err
 		}
 		workload.OriginalObjectYAML = contentBytes
+		resources.Pods = append(resources.Pods, pod)
 		resources.Resources.addResource(workload)
 	} else {
 		newResource, err := NewGenericResourceFromBytes(contentBytes)
@@ -157,6 +157,7 @@ func TestGetResourceFromAPI(t *testing.T) {
 					assert.Equal(t, tt.want.SourceName, resources.SourceName)
 					assert.IsType(t, tt.want.CreationTime, resources.CreationTime)
 					assert.Equal(t, 0, len(resources.Nodes), "Should not have any nodes")
+					assert.Equal(t, 5, len(resources.Pods), "Should have 5 pods")
 					for k, v := range resources.Resources {
 						fmt.Println("cont", k, v)
 					}
@@ -50,6 +50,7 @@ func RunAudit(ctx context.Context, config conf.Configuration, kubeResources *kub
 		ClusterInfo: ClusterInfo{
 			Version:     kubeResources.ServerVersion,
 			Nodes:       len(kubeResources.Nodes),
+			Pods:        len(kubeResources.Pods),
 			Namespaces:  len(kubeResources.Namespaces),
 			Controllers: kubeResources.Resources.GetNumberOfControllers(),
 		},
@@ -51,6 +51,9 @@ func TestGetTemplateData(t *testing.T) {
 	assert.EqualValues(t, sum, actualAudit.GetSummary())
 	assert.Equal(t, actualAudit.SourceType, "Cluster", "should be from a cluster")
 	assert.Equal(t, actualAudit.SourceName, "test", "should be from a cluster")
+	assert.Equal(t, 5, actualAudit.ClusterInfo.Pods, "should report pod count from the cluster")
+	assert.Equal(t, 5, actualAudit.ClusterInfo.Controllers, "should report controller count from the cluster")
+	assert.Equal(t, 1, actualAudit.ClusterInfo.Namespaces, "should report namespace count from the cluster")

 	expectedResults := []struct {
 		kind    string
@@ -0,0 +1,97 @@
+// DO NOT EDIT - Managed by Terraform
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":dependencyDashboard"
+  ],
+  "labels": ["dependencies"],
+  "prConcurrentLimit": 10,
+  "branchConcurrentLimit": 10,
+  "minimumReleaseAge": "7 days",
+  "enabledManagers": [
+    "gomod",
+    "dockerfile",
+    "circleci",
+    "custom.regex"
+  ],
+  "postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"],
+  "customManagers": [
+    {
+      "description": "HashiCorp Vault download URL in CircleCI",
+      "customType": "regex",
+      "managerFilePatterns": ["/(^|/)\\.circleci/config\\.yml$/"],
+      "matchStrings": [
+        "https://releases\\.hashicorp\\.com/vault/(?<currentValue>[\\d.]+)/vault_[\\d.]+_linux_amd64\\.zip"
+      ],
+      "depNameTemplate": "hashicorp/vault",
+      "datasourceTemplate": "hashicorp-releases",
+      "autoReplaceStringTemplate": "https://releases.hashicorp.com/vault/{{{newValue}}}/vault_{{{newValue}}}_linux_amd64.zip"
+    },
+    {
+      "description": "HashiCorp Vault archive name in CircleCI (sha256 line must be updated manually)",
+      "customType": "regex",
+      "managerFilePatterns": ["/(^|/)\\.circleci/config\\.yml$/"],
+      "matchStrings": [
+        "vault_(?<currentValue>[\\d.]+)_linux_amd64\\.zip"
+      ],
+      "depNameTemplate": "hashicorp/vault",
+      "datasourceTemplate": "hashicorp-releases",
+      "autoReplaceStringTemplate": "vault_{{{newValue}}}_linux_amd64.zip"
+    },
+    {
+      "description": "golangci-lint install.sh pin in CircleCI",
+      "customType": "regex",
+      "managerFilePatterns": ["/(^|/)\\.circleci/config\\.yml$/"],
+      "matchStrings": [
+        "golangci/golangci-lint/HEAD/install.sh \\| sh -s -- -b /usr/local/bin v(?<currentValue>[0-9.]+)"
+      ],
+      "depNameTemplate": "golangci/golangci-lint",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v?(?<version>.*)$",
+      "autoReplaceStringTemplate": "golangci/golangci-lint/HEAD/install.sh | sh -s -- -b /usr/local/bin v{{{newValue}}}"
+    },
+    {
+      "description": "Kind node image for rok8s-scripts kubernetes_e2e_tests",
+      "customType": "regex",
+      "managerFilePatterns": ["/(^|/)\\.circleci/config\\.yml$/"],
+      "matchStrings": [
+        "kind_node_image:\\s*\"kindest/node:(?<currentValue>v[^\"\\s]+)\""
+      ],
+      "depNameTemplate": "kindest/node",
+      "datasourceTemplate": "docker",
+      "autoReplaceStringTemplate": "kind_node_image: \"kindest/node:{{{newValue}}}\""
+    }
+  ],
+  "packageRules": [
+    {
+      "description": "Group all non-major (minor + patch) updates into a single PR",
+      "matchUpdateTypes": ["minor", "patch", "digest", "lockFileMaintenance"],
+      "groupName": "all non-major dependencies",
+      "groupSlug": "all-non-major",
+      "minimumReleaseAge": "7 days"
+    },
+    {
+      "description": "Keep major updates separate and also enforce minimum age",
+      "matchUpdateTypes": ["major"],
+      "minimumReleaseAge": "7 days"
+    },
+    {
+      "description": "Disable replace updates",
+      "matchManagers": ["gomod"],
+      "matchDepTypes": ["replace"],
+      "enabled": false
+    },
+    {
+      "description": "Every upgrade: upstream release must be at least 7 days old",
+      "matchManagers": ["gomod", "dockerfile", "circleci", "custom.regex"],
+      "minimumReleaseAge": "7 days"
+    },
+    {
+      "description": "Group HashiCorp Vault version bumps (sha256 checksum still needs manual update)",
+      "groupName": "HashiCorp Vault",
+      "matchManagers": ["custom.regex"],
+      "matchDepNames": ["hashicorp/vault"]
+    }
+  ]
+}
@@ -1,55 +0,0 @@
-#!/usr/bin/env sh
-# Wrap goreleaser with branch/tag-specific env (see .goreleaser.yml templates)
-# and, on non-tag CI runs, a temporary git tag.
-
-cleanup() {
-  if [ "${CIRCLE_TAG}" == "" ] ; then
-    echo "${this_script} deleting git tag ${temporary_git_tag} for goreleaser"
-    unset GORELEASER_CURRENT_TAG
-    git tag -d ${temporary_git_tag}
-  fi
-}
-
-set -eE # errexit and errtrace
-trap 'cleanup' ERR
-this_script="$(basename $0)"
-hash goreleaser
-if [ "${TMPDIR}" == "" ] ; then
-  export TMPDIR="/tmp"
-  echo "${this_script} temporarily set the TMPDIR environment variable to ${TMPDIR}, used for a temporary GOBIN environment variable"
-fi
-
-export GORELEASER_SKIP_FEATURE_DOCKER_TAGS=false
-export GORELEASER_SKIP_RELEASE=true
-if [ "${CIRCLE_TAG}" == "" ] ; then
-  # Create a temporary tag for goreleaser, incrementing the last tag.
-  last_git_tag="$(git describe --tags --abbrev=0 2>/dev/null)"
-  if [ "${last_git_tag}" == "" ] ; then
-    echo "${this_script} is unable to determine the last git tag so a temporary tag can be created, using: git describe --tags --abbrev=0"
-    exit 1
-  fi
-  if [ "$(git config user.email)" == "" ] ; then
-    # git will use this env var as its user.email.
-    # git tag -m is used in case tags are manually pushed by accident,
-    # however git tag -m requires an email.
-    export EMAIL='goreleaser_ci@fairwinds.com'
-    echo "${this_script} using ${EMAIL} temporarily as the git user.email"
-  fi
-  temporary_git_tag=$(echo "${last_git_tag}" | awk -F. '{$NF = $NF + 1;} 1' | sed 's/ /./g')-rc
-  echo "${this_script} creating temporary git tag ${temporary_git_tag} for goreleaser, the last real tag is ${last_git_tag}"
-  # The -f is included to overwrite existing tags, perhaps from previous CI jobs.
-  git tag -f -m "temporary local tag for goreleaser" ${temporary_git_tag}
-  export GORELEASER_CURRENT_TAG=${temporary_git_tag}
-  # Use an adjusted git feature branch name as a docker tag; export so goreleaser receives .Env.FEATURE_DOCKER_TAG.
-  export FEATURE_DOCKER_TAG=$(echo "${CIRCLE_BRANCH:0:26}" | sed 's/[^a-zA-Z0-9]/-/g' | sed 's/-\+$//')
-  echo "${this_script} also using docker tag ${FEATURE_DOCKER_TAG} since ${CIRCLE_BRANCH} is a feature branch"
-else
-  export GORELEASER_CURRENT_TAG=${CIRCLE_TAG}
-  echo "${this_script} setting GORELEASER_SKIP_RELEASE to false, and GORELEASER_SKIP_FEATURE_DOCKER_TAGS to true, because CIRCLE_TAG is set"
-  export GORELEASER_SKIP_FEATURE_DOCKER_TAGS=true
-  export GORELEASER_SKIP_RELEASE=false
-fi
-
-echo "${this_script} using git tag ${GORELEASER_CURRENT_TAG}"
-goreleaser --skip=sign "$@"
-cleanup
@@ -22,7 +22,9 @@ function check_timeout() {

 helm repo add fairwinds-stable https://charts.fairwinds.com/stable
 helm install polaris fairwinds-stable/polaris --namespace polaris --create-namespace \
-  --set image.tag=$CI_SHA1
+  --set image.repository=us-docker.pkg.dev/fairwinds-ops/oss/polaris \
+  --set image.tag=$CI_SHA1 \
+  --set image.pullPolicy=IfNotPresent

 check_dashboard_is_ready

@@ -88,7 +88,9 @@ helm install polaris fairwinds-stable/polaris --namespace polaris --create-names
  --set dashboard.enable=false \
  --set webhook.enable=true \
  --set webhook.mutate=true \
-  --set image.tag=$CI_SHA1
+  --set image.repository=us-docker.pkg.dev/fairwinds-ops/oss/polaris \
+  --set image.tag=$CI_SHA1 \
+  --set image.pullPolicy=IfNotPresent

 echo "Waiting for the webhook to come online"
 check_webhook_is_ready
Author	SHA1	Message	Date
Terraform User	dafa0b74fc	Managed by Terraform	2026-08-06 16:10:01 +00:00
renovate[bot]lnx01 jdesouza	f0a370c757	Update dependency rok8s to v16 (#1221 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: jdesouza <james@fairwinds.com>	2026-08-06 09:26:30 -03:00
renovate[bot]lnx01 jdesouza	cb741e3eb1	Update all non-major dependencies (#1219 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: jdesouza <james@fairwinds.com>	2026-08-06 09:14:18 -03:00
renovate[bot]andlnx01	b65142e8be	Pin dependency rok8s to 14.4.0 (#1218 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-08-06 08:58:02 -03:00
Terraform User	31bc0fdb84	Managed by Terraform	2026-08-05 14:12:49 +00:00
dependabot[bot]lnx01 Vitor Vezani	292a1c257c	Bump k8s.io/client-go from 0.35.4 to 0.36.3 (#1217 ) * Bump k8s.io/client-go from 0.35.4 to 0.36.3 Bumps [k8s.io/client-go](https://github.com/kubernetes/client-go) from 0.35.4 to 0.36.3. - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](https://github.com/kubernetes/client-go/compare/v0.35.4...v0.36.3) --- updated-dependencies: - dependency-name: k8s.io/client-go dependency-version: 0.36.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Bump sigs.k8s.io/controller-runtime to v0.24.1 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Vitor Vezani <vitor.vezani@fairwinds.com>	2026-08-03 11:03:11 -03:00
dependabot[bot]andlnx01	06ef2d3f70	Bump k8s.io/apimachinery from 0.36.2 to 0.36.3 (#1216 ) Bumps [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) from 0.36.2 to 0.36.3. - [Commits](https://github.com/kubernetes/apimachinery/compare/v0.36.2...v0.36.3) --- updated-dependencies: - dependency-name: k8s.io/apimachinery dependency-version: 0.36.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-03 10:44:28 -03:00
Vitor Rodrigo Vezani	4bdf5315b6	Add pod support to ResourceProvider and update related tests (#1214 )	2026-07-21 13:19:25 -03:00
dependabot[bot]andlnx01	278cb9008c	Bump golang.org/x/net from 0.51.0 to 0.55.0 (#1208 ) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.51.0 to 0.55.0. - [Commits](https://github.com/golang/net/compare/v0.51.0...v0.55.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.55.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-06 18:09:58 -03:00
dependabot[bot]lnx01 Vitor Rodrigo Vezani	d6858e0fe4	Bump alpine from 3.23.4 to 3.24.1 (#1209 ) Bumps alpine from 3.23.4 to 3.24.1. --- updated-dependencies: - dependency-name: alpine dependency-version: 3.24.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Vitor Rodrigo Vezani <vitor.vezani@fairwinds.com>	2026-07-06 17:36:37 -03:00
dependabot[bot]andlnx01	78fe4cb11c	Bump k8s.io/apimachinery from 0.36.1 to 0.36.2 (#1210 ) Bumps [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) from 0.36.1 to 0.36.2. - [Commits](https://github.com/kubernetes/apimachinery/compare/v0.36.1...v0.36.2) --- updated-dependencies: - dependency-name: k8s.io/apimachinery dependency-version: 0.36.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-06 17:33:43 -03:00
dependabot[bot]andlnx01	387e787a40	Bump k8s.io/apimachinery from 0.35.4 to 0.36.1 (#1197 ) Bumps [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) from 0.35.4 to 0.36.1. - [Commits](https://github.com/kubernetes/apimachinery/compare/v0.35.4...v0.36.1) --- updated-dependencies: - dependency-name: k8s.io/apimachinery dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-01 08:46:46 -03:00
Terraform User	1fdfec73a1	Managed by Terraform	2026-04-27 18:39:00 +00:00
Vitor Rodrigo Vezani	aee298e2e0	add notice to include registry change and immutable images notice (#1191 ) * add notice to include registry change and immutable images notice * try to fix tests * Refactor goreleaser script to conditionally skip Docker tags based on release status * remove if	2026-04-27 12:42:05 -03:00
Vitor Rodrigo Vezani	0444cf92bc	unify release process along with others OSS projects (#1192 ) * unify release process along with others OSS projects * remove docker loging * override polaris image repository for tests * fix polaris * adding snapshot back * store snapshot version into circleci workspace and load with kind on k8s cluster * add test back * add test back * fix polaris config	2026-04-27 12:24:11 -03:00
Terraform User	50e4c63079	Managed by Terraform	2026-04-24 20:23:41 +00:00
Terraform User	7d053a6cbd	Managed by Terraform	2026-04-23 15:34:04 +00:00
Terraform User	d50336387b	Managed by Terraform	2026-04-23 14:42:23 +00:00
Vitor Rodrigo Vezani	1554c90ece	Add GCR support (#1189 )	2026-04-22 10:45:37 -03:00