From e4758db5caec751ebd93218b0e0618692646ea68 Mon Sep 17 00:00:00 2001 From: Marcos Yacob Date: Wed, 1 Jul 2026 11:09:31 -0300 Subject: [PATCH 1/7] Update DCO (#706) Signed-off-by: Marcos Yacob --- .github/workflows/dco.yaml | 38 ++++++++++++++++++++++++++------------ 1 file changed, 26 insertions(+), 12 deletions(-) diff --git a/.github/workflows/dco.yaml b/.github/workflows/dco.yaml index 9a5124d8..5084aec0 100644 --- a/.github/workflows/dco.yaml +++ b/.github/workflows/dco.yaml @@ -1,20 +1,34 @@ name: DCO on: - pull_request: + pull_request: {} + workflow_dispatch: {} merge_group: - push: - branches: - - main + types: + - checks_requested + +permissions: + contents: read + jobs: - check_dco: - runs-on: ubuntu-22.04 - permissions: - contents: read - name: Check DCO + check-dco: + runs-on: ubuntu-latest steps: - - name: Run dco-check - uses: christophebedard/dco-check@ec8bfc43106afe98b323ace9133650df10497e12 # 0.5.1 + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - name: Skip DCO check in merge queue + if: github.event_name == 'merge_group' + run: | + echo "Skipping DCO check for merge queue - DCO is validated on PR commits before entering the queue" + exit 0 + - name: Set up Python 3.x + if: github.event_name != 'merge_group' + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: - args: --exclude-pattern 'dependabot\[bot\]@users\.noreply\.github\.com' + python-version: '3.x' + - name: Check DCO + if: github.event_name != 'merge_group' env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + pip3 install -U dco-check + dco-check --exclude-pattern 'dependabot\[bot\]@users\.noreply\.github\.com' From fc4afb5e0152b6482befc92575e2a9626f03e378 Mon Sep 17 00:00:00 2001 From: Sayak Date: Wed, 1 Jul 2026 19:56:28 +0530 Subject: [PATCH 2/7] Fix gcInterval zero-value causing 100% CPU (#699) When consumers embed ControllerManagerConfig without explicitly setting GCInterval, Go's zero value (0) is serialized into the config YAML. LoadOptionsFromFile then overwrites the default 10s with 0, causing the GC loop to run continuously with no pause. This fix: - Adds omitempty to the gcInterval JSON tag so zero values are omitted - Adds a defensive check to fall back to defaultGCInterval when gcInterval is <= 0 Fixes #698 Signed-off-by: Sayak Das Co-authored-by: Cursor Co-authored-by: Marcos Yacob --- api/v1alpha1/controllermanagerconfig_types.go | 2 +- cmd/main.go | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/api/v1alpha1/controllermanagerconfig_types.go b/api/v1alpha1/controllermanagerconfig_types.go index 5902a730..f786cdb2 100644 --- a/api/v1alpha1/controllermanagerconfig_types.go +++ b/api/v1alpha1/controllermanagerconfig_types.go @@ -53,7 +53,7 @@ type ControllerManagerConfig struct { // is otherwise idle. This impacts how quickly SPIRE state will converge // after CRDs are removed or SPIRE state is mutated out from underneath // the controller. - GCInterval time.Duration `json:"gcInterval"` + GCInterval time.Duration `json:"gcInterval,omitempty"` // SPIREServerSocketPath is the path to the SPIRE Server API socket SPIREServerSocketPath string `json:"spireServerSocketPath"` diff --git a/cmd/main.go b/cmd/main.go index fa74948d..3a28bc5c 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -148,6 +148,9 @@ func parseConfig() (Config, error) { if err := spirev1alpha1.LoadOptionsFromFile(configFileFlag, scheme, &retval.options, &retval.ctrlConfig, expandEnvFlag); err != nil { return retval, fmt.Errorf("unable to load the config file: %w", err) } + if retval.ctrlConfig.GCInterval <= 0 { + retval.ctrlConfig.GCInterval = defaultGCInterval + } for _, ignoredNamespace := range retval.ctrlConfig.IgnoreNamespaces { regex, err := regexp.Compile(ignoredNamespace) if err != nil { From e5e3db739e3a6f1e34633c4657e106c0ca93caf9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 1 Jul 2026 15:19:43 +0000 Subject: [PATCH 3/7] Bump github.com/spiffe/go-spiffe/v2 from 2.8.0 to 2.8.1 in /demo/greeter (#697) Bumps [github.com/spiffe/go-spiffe/v2](https://github.com/spiffe/go-spiffe) from 2.8.0 to 2.8.1. - [Release notes](https://github.com/spiffe/go-spiffe/releases) - [Changelog](https://github.com/spiffe/go-spiffe/blob/main/CHANGELOG.md) - [Commits](https://github.com/spiffe/go-spiffe/compare/v2.8.0...v2.8.1) --- updated-dependencies: - dependency-name: github.com/spiffe/go-spiffe/v2 dependency-version: 2.8.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- demo/greeter/go.mod | 2 +- demo/greeter/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/demo/greeter/go.mod b/demo/greeter/go.mod index e47ef970..dcbb3a30 100644 --- a/demo/greeter/go.mod +++ b/demo/greeter/go.mod @@ -3,7 +3,7 @@ module greeter go 1.26.4 require ( - github.com/spiffe/go-spiffe/v2 v2.8.0 + github.com/spiffe/go-spiffe/v2 v2.8.1 google.golang.org/grpc v1.81.1 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6 ) diff --git a/demo/greeter/go.sum b/demo/greeter/go.sum index 6b332e58..38009cf0 100644 --- a/demo/greeter/go.sum +++ b/demo/greeter/go.sum @@ -18,8 +18,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/spiffe/go-spiffe/v2 v2.8.0 h1:vHCTEZYhpXZ9y6JkIouIdHLJobWGUFn2467/WsXHHjA= -github.com/spiffe/go-spiffe/v2 v2.8.0/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U= +github.com/spiffe/go-spiffe/v2 v2.8.1 h1:eXZMLsu+3MLEPJyGJkolqtVrteZfQdUpOWj6LTiDl/E= +github.com/spiffe/go-spiffe/v2 v2.8.1/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= From e56bdaae7797a3f59946bfa37e47db0fdbb885f7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 1 Jul 2026 15:21:24 +0000 Subject: [PATCH 4/7] Bump google.golang.org/grpc from 1.81.1 to 1.82.0 (#702) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 3f0c0169..74f185a1 100644 --- a/go.mod +++ b/go.mod @@ -15,7 +15,7 @@ require ( github.com/spiffe/spire-api-sdk v1.15.1 github.com/stretchr/testify v1.11.1 go.uber.org/zap v1.28.0 - google.golang.org/grpc v1.81.1 + google.golang.org/grpc v1.82.0 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af k8s.io/api v0.36.2 k8s.io/apimachinery v0.36.2 @@ -77,7 +77,7 @@ require ( golang.org/x/time v0.14.0 // indirect golang.org/x/tools v0.45.0 // indirect gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/go.sum b/go.sum index 696ac1a3..545b626f 100644 --- a/go.sum +++ b/go.sum @@ -192,10 +192,10 @@ gomodules.xyz/jsonpatch/v2 v2.5.0 h1:JELs8RLM12qJGXU4u/TO3V25KW8GreMKl9pdkk14RM0 gomodules.xyz/jsonpatch/v2 v2.5.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ= -google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU= +google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From e2d13785ab5fad4ae61ae5535e915cb449771cf0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 1 Jul 2026 12:45:16 -0300 Subject: [PATCH 5/7] Bump google.golang.org/grpc from 1.81.1 to 1.82.0 in /demo/greeter (#703) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- demo/greeter/go.mod | 4 ++-- demo/greeter/go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/demo/greeter/go.mod b/demo/greeter/go.mod index dcbb3a30..318e3049 100644 --- a/demo/greeter/go.mod +++ b/demo/greeter/go.mod @@ -4,7 +4,7 @@ go 1.26.4 require ( github.com/spiffe/go-spiffe/v2 v2.8.1 - google.golang.org/grpc v1.81.1 + google.golang.org/grpc v1.82.0 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6 ) @@ -14,6 +14,6 @@ require ( golang.org/x/net v0.55.0 // indirect golang.org/x/sys v0.45.0 // indirect golang.org/x/text v0.37.0 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect google.golang.org/protobuf v1.36.11 // indirect ) diff --git a/demo/greeter/go.sum b/demo/greeter/go.sum index 38009cf0..1fdedd70 100644 --- a/demo/greeter/go.sum +++ b/demo/greeter/go.sum @@ -42,10 +42,10 @@ golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ= -google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU= +google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6 h1:ExN12ndbJ608cboPYflpTny6mXSzPrDLh0iTaVrRrds= google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6/go.mod h1:6ytKWczdvnpnO+m+JiG9NjEDzR1FJfsnmJdG7B8QVZ8= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= From 2bcc89179f62011e2adc78ba67749feeeb18b363 Mon Sep 17 00:00:00 2001 From: jungooji <46273764+zzzz465@users.noreply.github.com> Date: Thu, 2 Jul 2026 11:07:41 +0900 Subject: [PATCH 6/7] ci: add Datadog instrumentation to release builds Port the compile-time Datadog OTel instrumentation setup from pubg/spire@016fae87 (orchestrion pin + -toolexec build) so release and nightly images are built with orchestrion when DATADOG_INSTRUMENTATION=true. Signed-off-by: jungooji <46273764+zzzz465@users.noreply.github.com> --- .github/workflows/nightly_build.yaml | 12 +++++++----- .github/workflows/release_build.yaml | 4 ++++ Dockerfile | 17 ++++++++++++++++- Makefile | 4 ++++ 4 files changed, 31 insertions(+), 6 deletions(-) diff --git a/.github/workflows/nightly_build.yaml b/.github/workflows/nightly_build.yaml index ffab0aa4..a3932357 100644 --- a/.github/workflows/nightly_build.yaml +++ b/.github/workflows/nightly_build.yaml @@ -1,9 +1,11 @@ name: Nightly Build on: - schedule: - # Random minute number to avoid GH scheduler stampede - - cron: '37 21 * * *' - workflow_dispatch: {} + push: + tags: + - 'nightly-*' + +env: + DATADOG_INSTRUMENTATION: "true" jobs: build-and-publish-images: @@ -36,4 +38,4 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Push images - run: ./.github/workflows/scripts/push-images.sh nightly + run: ./.github/workflows/scripts/push-images.sh "${GITHUB_REF#refs/tags/}" diff --git a/.github/workflows/release_build.yaml b/.github/workflows/release_build.yaml index 858196e0..3b0ad9f9 100644 --- a/.github/workflows/release_build.yaml +++ b/.github/workflows/release_build.yaml @@ -3,6 +3,10 @@ on: push: tags: - 'v[0-9].[0-9]+.[0-9]+' + +env: + DATADOG_INSTRUMENTATION: "true" + jobs: build-image: runs-on: ubuntu-22.04 diff --git a/Dockerfile b/Dockerfile index 3be98946..450caaf4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,14 +23,29 @@ FROM --platform=${BUILDPLATFORM} tonistiigi/xx@sha256:904fe94f236d36d65aeb5a2462 # Build FROM --platform=${BUILDPLATFORM} base AS builder +ARG datadog_instrumentation=false +ARG orchestrion_version=v1.11.0 ARG TARGETPLATFORM ARG TARGETARCH ENV CGO_ENABLED=0 COPY --link --from=xx / / + +RUN < Date: Thu, 2 Jul 2026 11:07:41 +0900 Subject: [PATCH 7/7] ci: exclude upstream author with mismatched DCO sign-off name Upstream commit fc4afb5e (merged from spiffe main) carries a Signed-off-by whose name differs from the commit author name, which dco-check rejects when scanning fork-sync PR ranges. Signed-off-by: jungooji <46273764+zzzz465@users.noreply.github.com> --- .github/workflows/dco.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dco.yaml b/.github/workflows/dco.yaml index 5084aec0..ee4d1f7e 100644 --- a/.github/workflows/dco.yaml +++ b/.github/workflows/dco.yaml @@ -31,4 +31,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | pip3 install -U dco-check - dco-check --exclude-pattern 'dependabot\[bot\]@users\.noreply\.github\.com' + # sayadas@redhat.com: upstream commit fc4afb5e has a sign-off whose name + # ("Sayak Das") does not match the author name ("Sayak"), which dco-check + # rejects. The commit is already in spiffe/spire-controller-manager main. + dco-check --exclude-pattern 'dependabot\[bot\]@users\.noreply\.github\.com|sayadas@redhat\.com'