ESO-564: Upgrade Kubernetes 1.36.3 dependencies and release operator v1.3.0

.ci-operator.yaml

@@ -1,4 +1,4 @@
 build_root_image:
   name: builder
   namespace: ocp
-  tag: rhel-9-golang-1.26-openshift-4.23
+  tag: rhel-9-golang-1.26-openshift-5.0

Dockerfile

@@ -15,7 +15,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o ex
 
 # Use distroless as minimal base image to package the external-secrets-operator binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM registry.access.redhat.com/ubi9-minimal:9.4
+FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
 WORKDIR /
 COPY --from=builder /workspace/external-secrets-operator /bin/external-secrets-operator
 USER 65534:65534

Makefile

@@ -16,9 +16,9 @@ export XDG_CONFIG_HOME ?= $(PROJECT_ROOT)/_output/.config
 
 # IMG_VERSION defines the images version for the operator, bundle and catalog (must be valid semver: Major.Minor.Patch).
 # To re-generate any image for another specific version without changing the standard setup, you can:
-# - use the IMG_VERSION as arg of the specific image build and push targets (e.g make IMG_VERSION=1.2.0 bundle-build bundle-push)
-# - use environment variables to overwrite this value (e.g export IMG_VERSION=1.2.0)
-IMG_VERSION ?= 1.2.0
+# - use the IMG_VERSION as arg of the specific image build and push targets (e.g make IMG_VERSION=1.3.0 bundle-build bundle-push)
+# - use environment variables to overwrite this value (e.g export IMG_VERSION=1.3.0)
+IMG_VERSION ?= 1.3.0
 
 # Validate IMG_VERSION is valid semver (Major.Minor.Patch), fallback to default if not.
 ifneq ($(shell echo '$(IMG_VERSION)' | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$$' && echo valid),valid)
@@ -33,21 +33,21 @@ EXTERNAL_SECRETS_VERSION ?= v2.5.0
 # To re-generate a bundle for other specific channels without changing the standard setup, you can:
 # - use the CHANNELS as arg of the bundle target (e.g make bundle CHANNELS=candidate,fast,stable)
 # - use environment variables to overwrite this value (e.g export CHANNELS="candidate,fast,stable")
-BUNDLE_CHANNELS ?=
+CHANNELS ?= stable-v1,stable-v1.3
 ifneq ($(origin CHANNELS), undefined)
-BUNDLE_CHANNELS := --channels=$(CHANNELS)
+BUNDLE_CHANNELS := $(CHANNELS)
 endif
 
 # DEFAULT_CHANNEL defines the default channel used in the bundle.
 # Add a new line here if you would like to change its default config. (E.g DEFAULT_CHANNEL = "stable")
 # To re-generate a bundle for any other default channel without changing the default setup, you can:
 # - use the DEFAULT_CHANNEL as arg of the bundle target (e.g make bundle DEFAULT_CHANNEL=stable)
 # - use environment variables to overwrite this value (e.g export DEFAULT_CHANNEL="stable")
-BUNDLE_DEFAULT_CHANNEL ?=
+DEFAULT_CHANNEL ?= stable-v1
 ifneq ($(origin DEFAULT_CHANNEL), undefined)
-BUNDLE_DEFAULT_CHANNEL := --default-channel=$(DEFAULT_CHANNEL)
+BUNDLE_DEFAULT_CHANNEL := $(DEFAULT_CHANNEL)
 endif
-BUNDLE_METADATA_OPTS ?= $(BUNDLE_CHANNELS) $(BUNDLE_DEFAULT_CHANNEL)
+BUNDLE_METADATA_OPTS ?= --channels=$(BUNDLE_CHANNELS) --default-channel=$(BUNDLE_DEFAULT_CHANNEL)
 
 # IMAGE_TAG_BASE defines the docker.io namespace and part of the image name for remote images.
 # This variable is used to construct full image tags for bundle and catalog images.
@@ -61,7 +61,7 @@ IMAGE_TAG_BASE ?= operator.openshift.io/external-secrets-operator
 BUNDLE_IMG ?= $(IMAGE_TAG_BASE)-bundle:v$(IMG_VERSION)
 
 # BUNDLE_GEN_FLAGS are the flags passed to the operator-sdk generate bundle command
-BUNDLE_GEN_FLAGS ?= -q --overwrite --version $(IMG_VERSION) $(BUNDLE_METADATA_OPTS)
+BUNDLE_GEN_FLAGS ?= -q --overwrite=false --version $(IMG_VERSION) $(BUNDLE_METADATA_OPTS)
 
 # USE_IMAGE_DIGESTS defines if images are resolved via tags or digests
 # You can enable this value if you would like to use SHA Based Digests
@@ -73,11 +73,11 @@ endif
 
 # IMG is the image URL used for building/pushing image targets.
 # Default tag is 'latest' to avoid unnecessary changes in checked-in manifests.
-# Override with a specific version when building release images (e.g., IMG=openshift.io/external-secrets-operator:v1.2.0).
+# Override with a specific version when building release images (e.g., IMG=openshift.io/external-secrets-operator:v1.3.0).
 IMG ?= openshift.io/external-secrets-operator:latest
 
 # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
-ENVTEST_K8S_VERSION = 1.32.0
+ENVTEST_K8S_VERSION = 1.36.0
 
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))
@@ -107,7 +107,7 @@ GO_PACKAGE ?= github.com/openshift/external-secrets-operator
 SOURCE_GIT_COMMIT ?= $(shell git rev-parse HEAD 2>/dev/null)
 BUILD_DATE ?= $(shell date -u +'%Y-%m-%dT%H:%M:%SZ')
 
-# Extract major/minor from IMG_VERSION (e.g., 1.2.0 -> major=1, minor=1)
+# Extract major/minor from IMG_VERSION (e.g., 1.3.0 -> major=1, minor=3)
 IMG_VERSION_MAJOR = $(word 1,$(subst ., ,$(IMG_VERSION)))
 IMG_VERSION_MINOR = $(word 2,$(subst ., ,$(IMG_VERSION)))
 
@@ -143,9 +143,9 @@ KUBE_API_LINT = $(LOCALBIN)/kube-api-linter.so
 # Tool Versions
 # Set the Operator SDK version to use. By default, what is installed on the system is used.
 # This is useful for CI or a project to utilize a specific version of the operator-sdk toolkit.
-OPERATOR_SDK_VERSION ?= v1.39.0
-YQ_VERSION = v4.50.1
-HELM_VERSION ?= v3.17.3
+OPERATOR_SDK_VERSION ?= v1.42.3
+YQ_VERSION = v4.53.3
+HELM_VERSION ?= v4.2.4
 
 # Image tag produced by markdownlint-image; base image for that Dockerfile.
 MARKDOWNLINT_IMAGE ?= external-secrets-operator-markdownlint:latest

bindata/external-secrets/networkpolicy_allow-api-server-and-webhook-traffic.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.2.0"
+    app.kubernetes.io/version: "v1.3.0"
     app.kubernetes.io/managed-by: external-secrets-operator
     external-secrets.io/component: webhook
 spec:

bindata/external-secrets/networkpolicy_allow-api-server-egress-for-bitwarden-sever.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     app.kubernetes.io/name: bitwarden-sdk-server
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.2.0"
+    app.kubernetes.io/version: "v1.3.0"
     app.kubernetes.io/managed-by: external-secrets-operator
 spec:
   podSelector:

bindata/external-secrets/networkpolicy_allow-api-server-egress-for-cert-controller-traffic.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.2.0"
+    app.kubernetes.io/version: "v1.3.0"
     app.kubernetes.io/managed-by: external-secrets-operator
 spec:
   podSelector:

bindata/external-secrets/networkpolicy_allow-api-server-egress-for-main-controller-traffic.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.2.0"
+    app.kubernetes.io/version: "v1.3.0"
     app.kubernetes.io/managed-by: external-secrets-operator
 spec:
   podSelector:

bindata/external-secrets/networkpolicy_allow-dns.yaml

@@ -4,7 +4,7 @@ metadata:
   labels:
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.2.0"
+    app.kubernetes.io/version: "v1.3.0"
     app.kubernetes.io/managed-by: external-secrets-operator
   name: eso-sys-allow-to-dns
 spec:

bindata/external-secrets/networkpolicy_deny-all.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: external-secrets
-    app.kubernetes.io/version: "v1.2.0"
+    app.kubernetes.io/version: "v1.3.0"
     app.kubernetes.io/managed-by: external-secrets-operator
 spec:
   podSelector: {}

bundle.Dockerfile

@@ -1,12 +1,13 @@
-FROM scratch
+FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
 
 # Core bundle labels.
 LABEL operators.operatorframework.io.bundle.mediatype.v1=registry+v1
 LABEL operators.operatorframework.io.bundle.manifests.v1=manifests/
 LABEL operators.operatorframework.io.bundle.metadata.v1=metadata/
 LABEL operators.operatorframework.io.bundle.package.v1=openshift-external-secrets-operator
-LABEL operators.operatorframework.io.bundle.channels.v1=alpha
-LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.39.0
+LABEL operators.operatorframework.io.bundle.channels.v1=stable-v1,stable-v1.3
+LABEL operators.operatorframework.io.bundle.channel.default.v1=stable-v1
+LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.42.0
 LABEL operators.operatorframework.io.metrics.mediatype.v1=metrics+v1
 LABEL operators.operatorframework.io.metrics.project_layout=go.kubebuilder.io/v4
 

bundle/manifests/openshift-external-secrets-operator.clusterserviceversion.yaml

@@ -220,7 +220,7 @@ metadata:
     categories: Security
     console.openshift.io/disable-operand-delete: "true"
     containerImage: openshift.io/external-secrets-operator:latest
-    createdAt: "2026-06-19T12:17:03Z"
+    createdAt: "2026-08-19T15:21:11Z"
     features.operators.openshift.io/cnf: "false"
     features.operators.openshift.io/cni: "false"
     features.operators.openshift.io/csi: "false"
@@ -231,7 +231,7 @@ metadata:
     features.operators.openshift.io/token-auth-aws: "false"
     features.operators.openshift.io/token-auth-azure: "false"
     features.operators.openshift.io/token-auth-gcp: "false"
-    olm.skipRange: '>=1.1.0 <1.2.0'
+    olm.skipRange: '>=1.2.0 <1.3.0'
     operator.openshift.io/uninstall-message: The External Secrets Operator for Red
       Hat OpenShift will be removed from external-secrets-operator namespace. If your
       Operator configured any off-cluster resources, these will continue to run and
@@ -242,7 +242,7 @@ metadata:
     operatorframework.io/suggested-namespace: external-secrets-operator
     operators.openshift.io/valid-subscription: '["OpenShift Kubernetes Engine", "OpenShift
       Container Platform", "OpenShift Platform Plus"]'
-    operators.operatorframework.io/builder: operator-sdk-v1.39.0
+    operators.operatorframework.io/builder: operator-sdk-v1.42.3
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
     repository: https://github.com/openshift/external-secrets-operator
     support: Red Hat, Inc.
@@ -252,7 +252,7 @@ metadata:
     operatorframework.io/arch.ppc64le: supported
     operatorframework.io/arch.s390x: supported
     operatorframework.io/os.linux: supported
-  name: openshift-external-secrets-operator.v1.2.0
+  name: openshift-external-secrets-operator.v1.3.0
   namespace: placeholder
 spec:
   apiservicedefinitions: {}
@@ -743,7 +743,7 @@ spec:
                 - name: OPERATOR_NAME
                   value: external-secrets-operator
                 - name: OPERATOR_IMAGE_VERSION
-                  value: 1.2.0
+                  value: 1.3.0
                 - name: RELATED_IMAGE_EXTERNAL_SECRETS
                   value: ghcr.io/external-secrets/external-secrets:v2.5.0
                 - name: OPERAND_EXTERNAL_SECRETS_IMAGE_VERSION
@@ -844,5 +844,5 @@ spec:
     name: external-secrets
   - image: ghcr.io/external-secrets/bitwarden-sdk-server:v0.6.0
     name: bitwarden-sdk-server
-  replaces: external-secrets-operator.v1.1.0
-  version: 1.2.0
+  replaces: external-secrets-operator.v1.2.0
+  version: 1.3.0

bundle/manifests/operator.openshift.io_externalsecretsconfigs.yaml

@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.21.0
   creationTimestamp: null
   labels:
     app.kubernetes.io/name: externalsecretsconfig

bundle/manifests/operator.openshift.io_externalsecretsmanagers.yaml

@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.21.0
   creationTimestamp: null
   labels:
     app.kubernetes.io/name: externalsecretsmanager

bundle/metadata/annotations.yaml

@@ -4,8 +4,9 @@ annotations:
   operators.operatorframework.io.bundle.manifests.v1: manifests/
   operators.operatorframework.io.bundle.metadata.v1: metadata/
   operators.operatorframework.io.bundle.package.v1: openshift-external-secrets-operator
-  operators.operatorframework.io.bundle.channels.v1: alpha
-  operators.operatorframework.io.metrics.builder: operator-sdk-v1.39.0
+  operators.operatorframework.io.bundle.channels.v1: stable-v1,stable-v1.3
+  operators.operatorframework.io.bundle.channel.default.v1: stable-v1
+  operators.operatorframework.io.metrics.builder: operator-sdk-v1.42.0
   operators.operatorframework.io.metrics.mediatype.v1: metrics+v1
   operators.operatorframework.io.metrics.project_layout: go.kubebuilder.io/v4