Add support for linux/s390x and linux/arm64 (Red Hat) by benashz · Pull Request #1152 · hashicorp/vault-secrets-operator

benashz · 2025-11-17T16:30:28Z

Build and publish container images for:

linux/s390x
linux/arm64
Adapt integrations tests to be compatible with the above platforms. Adds a new mini Helm chart for deploying Postgres.
Make dependabot run every day to reduce the lag between secvulns - which seem to be on the rise.
Drop the obsolete ubi-redhat build step

Helm:

Add the ability set the securityContext for the CSI driver.

PCI review checklist

I have documented a clear reason for, and description of, the change I am making.
If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
If applicable, I've documented the impact of any changes to security controls.

Adds support running VSO on linux/390x.

tvoran · 2025-11-20T18:03:39Z

Should we add the OLM bundle labels for the architectures here or is that going to be done later?

I think we just need to add a labels block under metadata in the ClusterServiceVersion:

  labels:
    operatorframework.io/os.zos: supported
    operatorframework.io/os.linux: supported
    operatorframework.io/arch.s390x: supported
    operatorframework.io/arch.amd64: supported
    operatorframework.io/arch.arm64: supported

(There are no labels there now since it defaults to just linux/amd64.)

prb112 · 2025-11-21T00:48:11Z

    operatorframework.io/os.zos: supported

You don't need to do the above. you are only compiling for linux? right

benashz · 2025-11-21T15:50:55Z

You don't need to do the above. you are only compiling for linux? right

@prb112 yes, so basically drop that line?

prb112 · 2025-11-21T15:51:48Z

You don't need to do the above. you are only compiling for linux? right

@prb112 yes, so basically drop that line?

Right

benashz · 2025-11-21T16:11:22Z

You don't need to do the above. you are only compiling for linux? right

@prb112 yes, so basically drop that line?

Right

Ah, yeah that makes sense; zOS is an entirely different beast altogether.

benashz · 2025-11-21T16:11:54Z

Should we add the OLM bundle labels for the architectures here or is that going to be done later?

I think we just need to add a labels block under metadata in the ClusterServiceVersion:
  labels:
    operatorframework.io/os.zos: supported
    operatorframework.io/os.linux: supported
    operatorframework.io/arch.s390x: supported
    operatorframework.io/arch.amd64: supported
    operatorframework.io/arch.arm64: supported
(There are no labels there now since it defaults to just linux/amd64.)

Thanks @tvoran

Added (minus the zOS bit) in 42aa835 and a4e1256

Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>

tvoran · 2025-11-21T18:07:52Z

Do we need to add a license header to everything in this postgresql chart?

Yeah, I suppose so - it is our code. I will put up another PR.

copywrite is weird.

Looks like were missing a check for that: #1158 fixes both issues.

tvoran

Just a question about license headers, but 👍

…ate (#1167) * Bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#1154) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.43.0 to 0.45.0. - [Commits](golang/crypto@v0.43.0...v0.45.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.45.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Add support for linux/s390x and linux/arm64 (Red Hat) (#1152) * Bump ubi10 to 10.1 * Update the build * Run dependabot daily for all types * Fix integration test make target * Add bats test for CSI driver securityContext * Rejig the build add arm64 support * Drop vestigial build-docker-ubi-redhat step * Add operator framework labels. Helm: - Add the ability set the securityContext for the CSI driver. Co-authored-by: Theron Voran <tvoran@users.noreply.github.com> --------- Co-authored-by: Theron Voran <tvoran@users.noreply.github.com> * Include s390x build in release default (#1160) * Bump the gomod-backward-compatible group with 7 updates (#1157) Bumps the gomod-backward-compatible group with 7 updates: | Package | From | To | | --- | --- | --- | | [github.com/go-openapi/runtime](https://github.com/go-openapi/runtime) | `0.29.1` | `0.29.2` | | [github.com/gruntwork-io/terratest](https://github.com/gruntwork-io/terratest) | `0.52.0` | `0.53.0` | | [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.255.0` | `0.256.0` | | [k8s.io/api](https://github.com/kubernetes/api) | `0.34.1` | `0.34.2` | | [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) | `0.34.1` | `0.34.2` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.34.1` | `0.34.2` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.34.1` | `0.34.2` | Updates `github.com/go-openapi/runtime` from 0.29.1 to 0.29.2 - [Release notes](https://github.com/go-openapi/runtime/releases) - [Commits](go-openapi/runtime@v0.29.1...v0.29.2) Updates `github.com/gruntwork-io/terratest` from 0.52.0 to 0.53.0 - [Release notes](https://github.com/gruntwork-io/terratest/releases) - [Commits](gruntwork-io/terratest@v0.52.0...v0.53.0) Updates `google.golang.org/api` from 0.255.0 to 0.256.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.255.0...v0.256.0) Updates `k8s.io/api` from 0.34.1 to 0.34.2 - [Commits](kubernetes/api@v0.34.1...v0.34.2) Updates `k8s.io/apiextensions-apiserver` from 0.34.1 to 0.34.2 - [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases) - [Commits](kubernetes/apiextensions-apiserver@v0.34.1...v0.34.2) Updates `k8s.io/apimachinery` from 0.34.1 to 0.34.2 - [Commits](kubernetes/apimachinery@v0.34.1...v0.34.2) Updates `k8s.io/client-go` from 0.34.1 to 0.34.2 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.34.1...v0.34.2) --- updated-dependencies: - dependency-name: github.com/go-openapi/runtime dependency-version: 0.29.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod-backward-compatible - dependency-name: github.com/gruntwork-io/terratest dependency-version: 0.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-backward-compatible - dependency-name: google.golang.org/api dependency-version: 0.256.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-backward-compatible - dependency-name: k8s.io/api dependency-version: 0.34.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod-backward-compatible - dependency-name: k8s.io/apiextensions-apiserver dependency-version: 0.34.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod-backward-compatible - dependency-name: k8s.io/apimachinery dependency-version: 0.34.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod-backward-compatible - dependency-name: k8s.io/client-go dependency-version: 0.34.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod-backward-compatible ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Add Transit Options to Encrypt/Decrypt Helpers (#1156) * add opts to transit, in order to add request params * comments * add test * update transit signatures * update test * update test * Bump github.com/gruntwork-io/terratest from 0.53.0 to 0.54.0 in the gomod-backward-compatible group (#1162) Bump github.com/gruntwork-io/terratest Bumps the gomod-backward-compatible group with 1 update: [github.com/gruntwork-io/terratest](https://github.com/gruntwork-io/terratest). Updates `github.com/gruntwork-io/terratest` from 0.53.0 to 0.54.0 - [Release notes](https://github.com/gruntwork-io/terratest/releases) - [Commits](gruntwork-io/terratest@v0.53.0...v0.54.0) --- updated-dependencies: - dependency-name: github.com/gruntwork-io/terratest dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-backward-compatible ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * CSI: ensure securityContext.privileged is true on the DaemonSet. (#1163) Fixes a regression where the securityContext was moved to an enpty value. The CSI driver requires that mountPropagation perms * CSI: ensure securityContext.privileged is true on the driver container. (#1164) Fixes a regression where the securityContext was moved to an enpty value. The CSI driver requires that mountPropagation perms Partially fixed in #1163 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ben Ash <32777270+benashz@users.noreply.github.com> Co-authored-by: Theron Voran <tvoran@users.noreply.github.com> Co-authored-by: Michael Blaum <96261585+hashiblaum@users.noreply.github.com>

benashz added 2 commits November 14, 2025 09:44

WIP: Add support for linux/s390x

b7d4f64

Bump ubi10 to 10.1

efeaa0c

benashz requested a review from a team as a code owner November 17, 2025 16:30

Remove debug skip

bf3dc56

benashz changed the title ~~Vault 34419,vault 40777/build for z~~ Add support for linux/s390x Nov 17, 2025

benashz mentioned this pull request Nov 17, 2025

WIP: Add support for linux/s390x #1145

Closed

3 tasks

benashz and others added 2 commits November 17, 2025 11:37

Merge branch 'main' into VAULT-34419,VAULT-40777/build-for-Z

ae42b49

Update the build

3186371

benashz force-pushed the VAULT-34419,VAULT-40777/build-for-Z branch 2 times, most recently from b1f8dac to 3a1549e Compare November 18, 2025 21:58

Run dependabot daily for all types

c37868c

benashz force-pushed the VAULT-34419,VAULT-40777/build-for-Z branch from 3a1549e to c37868c Compare November 18, 2025 22:08

benashz and others added 6 commits November 19, 2025 09:21

Fix integration test make target

1e30b47

Fix ups

6ca4718

Add bats test for CSI driver securityContext

f748d43

Rejig the build add arm64 support

b737057

Create the namespace for Helm

fb9b4a2

Merge branch 'main' into VAULT-34419,VAULT-40777/build-for-Z

e7d7e18

benashz requested review from digivava and tvoran November 20, 2025 17:24

benashz changed the title ~~Add support for linux/s390x~~ Add support for linux/s390x and linux/arm64 Nov 20, 2025

benashz changed the title ~~Add support for linux/s390x and linux/arm64~~ Add support for linux/s390x and linux/arm64 (Red Hat) Nov 20, 2025

tvoran reviewed Nov 20, 2025

View reviewed changes

Comment thread .github/workflows/build.yaml

benashz added 2 commits November 21, 2025 11:05

Drop vestigial build-docker-ubi-redhat step

4b1ab36

Add operator framework labels.

42aa835

Make manifests

a4e1256

benashz requested a review from tvoran November 21, 2025 16:58

tvoran reviewed Nov 21, 2025

View reviewed changes

Comment thread .release/vault-secrets-operator-artifacts.hcl Outdated

Use the correct UBI tags for Red Hat

7424faf

Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>

tvoran reviewed Nov 21, 2025

View reviewed changes

tvoran approved these changes Nov 21, 2025

View reviewed changes

benashz merged commit acbf601 into main Nov 21, 2025
55 checks passed

benashz deleted the VAULT-34419,VAULT-40777/build-for-Z branch November 21, 2025 18:15

benashz mentioned this pull request Nov 26, 2025

CSI: ensure securityContext.privileged is true on the DaemonSet. #1163

Merged

3 tasks

benashz added this to the v1.1.0 milestone Dec 12, 2025

Navigation Menu

Add support for linux/s390x and linux/arm64 (Red Hat) - #1152

Add support for linux/s390x and linux/arm64 (Red Hat)#1152
benashz merged 16 commits into
mainfrom
VAULT-34419,VAULT-40777/build-for-Z

benashz commented Nov 17, 2025 •

edited

Loading

Uh oh!

tvoran commented Nov 20, 2025

Uh oh!

Uh oh!

prb112 commented Nov 21, 2025

Uh oh!

benashz commented Nov 21, 2025

Uh oh!

prb112 commented Nov 21, 2025

Uh oh!

benashz commented Nov 21, 2025

Uh oh!

benashz commented Nov 21, 2025 •

edited

Loading

Uh oh!

Uh oh!

tvoran Nov 21, 2025

Uh oh!

benashz Nov 21, 2025

Uh oh!

benashz Nov 21, 2025

Uh oh!

tvoran left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

benashz commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PCI review checklist

Uh oh!

tvoran commented Nov 20, 2025

Uh oh!

Uh oh!

prb112 commented Nov 21, 2025

Uh oh!

benashz commented Nov 21, 2025

Uh oh!

prb112 commented Nov 21, 2025

Uh oh!

benashz commented Nov 21, 2025

Uh oh!

benashz commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

tvoran Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

benashz Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

benashz Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

tvoran left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

benashz commented Nov 17, 2025 •

edited

Loading

benashz commented Nov 21, 2025 •

edited

Loading