diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index bba9a45a0..255dc6b48 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -16,7 +16,7 @@ jobs: runs-on: actuated-8cpu-12gb steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 1 # - name: Set up Docker Buildx diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index d03e29446..bbb4a3a73 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -19,7 +19,7 @@ jobs: runs-on: actuated-8cpu-12gb steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 1 diff --git a/Dockerfile b/Dockerfile index 5fc4908a7..a1f5015af 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ -FROM --platform=${BUILDPLATFORM:-linux/amd64} ghcr.io/openfaas/license-check:0.4.1 as license-check -FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.26 as builder +FROM --platform=${BUILDPLATFORM:-linux/amd64} ghcr.io/openfaas/license-check:0.4.1 AS license-check +FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.27 AS builder ARG TARGETPLATFORM ARG BUILDPLATFORM diff --git a/go.mod b/go.mod index a697e8188..369db1941 100644 --- a/go.mod +++ b/go.mod @@ -1,117 +1,118 @@ module github.com/inlets/inlets-operator -go 1.25.0 +go 1.27.0 require ( github.com/google/go-cmp v0.7.0 github.com/inlets/cloud-provision v0.7.2 - github.com/sethvargo/go-password v0.3.1 - k8s.io/api v0.35.3 - k8s.io/apimachinery v0.35.3 - k8s.io/client-go v0.35.3 - k8s.io/code-generator v0.35.3 + github.com/sethvargo/go-password v0.4.0 + k8s.io/api v0.37.1 + k8s.io/apimachinery v0.37.1 + k8s.io/client-go v0.37.1 + k8s.io/code-generator v0.37.1 k8s.io/klog v1.0.0 ) require ( - cloud.google.com/go/auth v0.20.0 // indirect - cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect - cloud.google.com/go/compute/metadata v0.9.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 // indirect - github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect + cloud.google.com/go/auth v0.24.1 // indirect + cloud.google.com/go/auth/oauth2adapt v0.3.0 // indirect + cloud.google.com/go/compute/metadata v0.10.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.15.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/internal v1.13.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute v1.0.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork v1.1.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0 // indirect - github.com/AzureAD/microsoft-authentication-library-for-go v1.7.1 // indirect + github.com/AzureAD/microsoft-authentication-library-for-go v1.10.1 // indirect github.com/aws/aws-sdk-go v1.55.8 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect - github.com/digitalocean/godo v1.184.0 // indirect - github.com/dimchansky/utfbom v1.1.1 // indirect + github.com/digitalocean/godo v1.231.0 // indirect + github.com/dimchansky/utfbom v1.2.0 // indirect github.com/dirien/ovh-go-sdk v0.2.0 // indirect github.com/emicklei/go-restful/v3 v3.13.0 // indirect - github.com/felixge/httpsnoop v1.0.4 // indirect - github.com/fxamacker/cbor/v2 v2.9.1 // indirect - github.com/go-logr/logr v1.4.3 // indirect + github.com/felixge/httpsnoop v1.1.0 // indirect + github.com/fxamacker/cbor/v2 v2.9.6 // indirect + github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect - github.com/go-openapi/jsonpointer v0.22.5 // indirect - github.com/go-openapi/jsonreference v0.21.5 // indirect - github.com/go-openapi/swag v0.25.5 // indirect - github.com/go-openapi/swag/cmdutils v0.25.5 // indirect - github.com/go-openapi/swag/conv v0.25.5 // indirect - github.com/go-openapi/swag/fileutils v0.25.5 // indirect - github.com/go-openapi/swag/jsonname v0.25.5 // indirect - github.com/go-openapi/swag/jsonutils v0.25.5 // indirect - github.com/go-openapi/swag/loading v0.25.5 // indirect - github.com/go-openapi/swag/mangling v0.25.5 // indirect - github.com/go-openapi/swag/netutils v0.25.5 // indirect - github.com/go-openapi/swag/stringutils v0.25.5 // indirect - github.com/go-openapi/swag/typeutils v0.25.5 // indirect - github.com/go-openapi/swag/yamlutils v0.25.5 // indirect + github.com/go-openapi/jsonpointer v1.0.2 // indirect + github.com/go-openapi/jsonreference v1.0.3 // indirect + github.com/go-openapi/swag v0.27.1 // indirect + github.com/go-openapi/swag/cmdutils v0.27.1 // indirect + github.com/go-openapi/swag/conv v0.29.2 // indirect + github.com/go-openapi/swag/fileutils v0.27.1 // indirect + github.com/go-openapi/swag/jsonutils v0.29.2 // indirect + github.com/go-openapi/swag/loading v0.27.1 // indirect + github.com/go-openapi/swag/mangling v0.27.1 // indirect + github.com/go-openapi/swag/netutils v0.27.1 // indirect + github.com/go-openapi/swag/pools v0.29.2 // indirect + github.com/go-openapi/swag/stringutils v0.27.1 // indirect + github.com/go-openapi/swag/typeutils v0.29.2 // indirect + github.com/go-openapi/swag/yamlutils v0.27.1 // indirect github.com/go-resty/resty/v2 v2.17.2 // indirect github.com/golang-jwt/jwt/v5 v5.3.1 // indirect github.com/golang/mock v1.6.0 // indirect github.com/google/gnostic-models v0.7.1 // indirect github.com/google/go-querystring v1.2.0 // indirect - github.com/google/s2a-go v0.1.9 // indirect + github.com/google/s2a-go v0.1.11 // indirect github.com/google/uuid v1.6.0 // indirect - github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect - github.com/googleapis/gax-go/v2 v2.21.0 // indirect + github.com/googleapis/enterprise-certificate-proxy v0.3.24 // indirect + github.com/googleapis/gax-go/v2 v2.27.0 // indirect github.com/hashicorp/go-cleanhttp v0.5.2 // indirect github.com/hashicorp/go-retryablehttp v0.7.8 // indirect github.com/hetznercloud/hcloud-go v1.59.2 // indirect github.com/jmespath/go-jmespath v0.4.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/kylelemons/godebug v1.1.0 // indirect - github.com/linode/linodego v1.67.0 // indirect + github.com/linode/linodego v1.69.1 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/ovh/go-ovh v1.9.0 // indirect github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect github.com/pkg/errors v0.9.1 // indirect - github.com/pmezard/go-difflib v1.0.0 // indirect - github.com/prometheus/client_golang v1.23.2 // indirect - github.com/prometheus/client_model v0.6.2 // indirect - github.com/prometheus/common v0.67.5 // indirect - github.com/prometheus/procfs v0.20.1 // indirect - github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36 // indirect + github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect + github.com/prometheus/client_golang v1.25.0 // indirect + github.com/prometheus/client_model v0.6.3 // indirect + github.com/prometheus/common v0.72.1 // indirect + github.com/prometheus/procfs v0.22.0 // indirect + github.com/scaleway/scaleway-sdk-go v1.39.0 // indirect github.com/spf13/pflag v1.0.10 // indirect github.com/vultr/govultr/v2 v2.17.2 // indirect github.com/x448/float16 v0.8.4 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect - go.opentelemetry.io/otel v1.43.0 // indirect - go.opentelemetry.io/otel/metric v1.43.0 // indirect - go.opentelemetry.io/otel/trace v1.43.0 // indirect + go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.72.0 // indirect + go.opentelemetry.io/otel v1.47.0 // indirect + go.opentelemetry.io/otel/log v1.47.0 // indirect + go.opentelemetry.io/otel/metric v1.47.0 // indirect + go.opentelemetry.io/otel/trace v1.47.0 // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect - go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/crypto v0.49.0 // indirect - golang.org/x/mod v0.34.0 // indirect - golang.org/x/net v0.52.0 // indirect - golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/sync v0.20.0 // indirect - golang.org/x/sys v0.43.0 // indirect - golang.org/x/term v0.41.0 // indirect - golang.org/x/text v0.35.0 // indirect - golang.org/x/time v0.15.0 // indirect - golang.org/x/tools v0.43.0 // indirect - google.golang.org/api v0.275.0 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect - google.golang.org/grpc v1.80.0 // indirect - google.golang.org/protobuf v1.36.11 // indirect + go.yaml.in/yaml/v3 v3.0.5 // indirect + golang.org/x/crypto v0.58.0 // indirect + golang.org/x/mod v0.42.0 // indirect + golang.org/x/net v0.61.0 // indirect + golang.org/x/oauth2 v0.37.0 // indirect + golang.org/x/sync v0.24.0 // indirect + golang.org/x/sys v0.49.0 // indirect + golang.org/x/term v0.47.0 // indirect + golang.org/x/text v0.43.0 // indirect + golang.org/x/time v0.16.0 // indirect + golang.org/x/tools v0.52.0 // indirect + google.golang.org/api v0.307.0 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b // indirect + google.golang.org/grpc v1.84.0 // indirect + google.golang.org/protobuf v1.36.12 // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect - gopkg.in/ini.v1 v1.67.1 // indirect + gopkg.in/ini.v1 v1.67.3 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect - k8s.io/gengo/v2 v2.0.0-20251215205346-5ee0d033ba5b // indirect + k8s.io/gengo/v2 v2.0.0-20260408192533-25e2208e0dc3 // indirect k8s.io/klog/v2 v2.140.0 // indirect - k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31 // indirect - k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 // indirect - sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect + k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect + k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 // indirect + sigs.k8s.io/json v0.0.0-20260909141634-11ed52e25bc5 // indirect sigs.k8s.io/randfill v1.0.0 // indirect - sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect + sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect sigs.k8s.io/yaml v1.6.0 // indirect ) diff --git a/go.sum b/go.sum index 3f973a243..d420b34bf 100644 --- a/go.sum +++ b/go.sum @@ -1,17 +1,17 @@ -cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA= -cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q= -cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc= -cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c= -cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs= -cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0/go.mod h1:t76Ruy8AHvUAC8GfMWJMa0ElSbuIcO03NLpynfbgsPA= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0= -github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY= -github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8= -github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4= -github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0/go.mod h1:7dCRMLwisfRH3dBupKeNCioWYUZ4SS09Z14H+7i8ZoY= +cloud.google.com/go/auth v0.24.1 h1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs= +cloud.google.com/go/auth v0.24.1/go.mod h1:1dmBXa9xfBvBr39ZnDUDkaaA91ccq9CcqENDgJA4d7c= +cloud.google.com/go/auth/oauth2adapt v0.3.0 h1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88= +cloud.google.com/go/auth/oauth2adapt v0.3.0/go.mod h1:7+2uCm7++XFO+/lN06c2HXpDXb/NMNn2/UwyBPbTnkk= +cloud.google.com/go/compute/metadata v0.10.0 h1:pyKMUQSwchgkIBBJGdILqQbs/BNJXqwSA7Ej6LAvvtY= +cloud.google.com/go/compute/metadata v0.10.0/go.mod h1:rGFHRrIif570kSibjFTMbt6/4/tzgJWFGI/HVol4GIk= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3 h1:qgnWTiWs1G7AqcKZegFvkJD1bmXJcaDU3uC0ELSgZ5U= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3/go.mod h1:XtxD48QPInqoj+GMlcRlXHEYsoOxFnP6w2JgIZ9rDS4= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.15.0 h1:w3gDUJlJ0BfBsHH02DCBDwbkmMSXJqBj6nBOCo9iocY= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.15.0/go.mod h1:7scl8mG/IFLVjJ9ef/ltdND2T1z0CkgVSaQoUxLvmeU= +github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0 h1:xFaZZ+IubdftrDHnGGwZ6QvQ3KHTtWl2MCK+GMt2vxs= +github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0/go.mod h1:mCBhUhlMjLLJKr5aqw2TNS/VqJOie8MzWq3DAMJeKso= +github.com/Azure/azure-sdk-for-go/sdk/internal v1.13.0 h1:Terj1CMW4+NY5CpWjSRkqLoxh2DkYDdv/FH2z0897Uc= +github.com/Azure/azure-sdk-for-go/sdk/internal v1.13.0/go.mod h1:7Ut2Qw9vcwpLW5Q4MBy43uSxXS7tK2yjs94OJ6j5thE= github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute v1.0.0 h1:/Di3vB4sNeQ+7A8efjUVENvyB945Wruvstucqp7ZArg= github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute v1.0.0/go.mod h1:gM3K25LQlsET3QR+4V74zxCsFAy0r6xMNN9n80SZn+4= github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal v1.0.0 h1:lMW1lD/17LUA5z1XTURo7LcVG2ICBPlyMHjIUrcFZNQ= @@ -26,8 +26,8 @@ github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1. github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0/go.mod h1:5kakwfW5CjC9KK+Q4wjXAg+ShuIm2mBMua0ZFj2C8PE= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE= -github.com/AzureAD/microsoft-authentication-library-for-go v1.7.1 h1:edShSHV3DV90+kt+CMaEXEzR9QF7wFrPJxVGz2blMIU= -github.com/AzureAD/microsoft-authentication-library-for-go v1.7.1/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= +github.com/AzureAD/microsoft-authentication-library-for-go v1.10.1 h1:0O6j18nQDoIff6/mtosT5LNU2WehEwp+LqfX6699oqY= +github.com/AzureAD/microsoft-authentication-library-for-go v1.10.1/go.mod h1:xdYAf5bjkOpsd3auA8riiJW4vneBubt9caavL7626jQ= github.com/aws/aws-sdk-go v1.55.8 h1:JRmEUbU52aJQZ2AjX4q4Wu7t4uZjOu71uyNmaWlUkJQ= github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= @@ -38,60 +38,60 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/digitalocean/godo v1.184.0 h1:2B2CQhxftlf3xa24Nrzn5CBQlaQjyaWqi3XbbnJlG3w= -github.com/digitalocean/godo v1.184.0/go.mod h1:xQsWpVCCbkDrWisHA72hPzPlnC+4W5w/McZY5ij9uvU= -github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi/U= -github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE= +github.com/digitalocean/godo v1.231.0 h1:fnwYt5a5IiBLHIc1xL6jHmGNaPpJ9sK5uw+HYZxpHC4= +github.com/digitalocean/godo v1.231.0/go.mod h1:xQsWpVCCbkDrWisHA72hPzPlnC+4W5w/McZY5ij9uvU= +github.com/dimchansky/utfbom v1.2.0 h1:ikiGYT9Wa8zleQ0xrlAWC9Ar9LNInSWRodJ5MkHB3d4= +github.com/dimchansky/utfbom v1.2.0/go.mod h1:kJPs9PFVyF/LnFVVGz+XXvouv0KxympBxr0pSwv0KQU= github.com/dirien/ovh-go-sdk v0.2.0 h1:hIL39yxXnUNEUw1gn3g2cA9QKj2cHdbbowAyq8tHug4= github.com/dirien/ovh-go-sdk v0.2.0/go.mod h1:kz6dmFoAym8NbdVTdGRzQuTGfRNoMrSuevxvxxBPVjA= github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes= github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= -github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= -github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= -github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ= -github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= +github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc= +github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE= +github.com/fxamacker/cbor/v2 v2.9.6 h1:NHZPxuUjJXQjX9itA785y/5NKSlI4HQ+S7noZsmI7hs= +github.com/fxamacker/cbor/v2 v2.9.6/go.mod h1:4EaZp6ClVunETjQ4GHmGNzysDK91Lr+r6Yz6tJqzVCw= github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= -github.com/go-openapi/jsonpointer v0.22.5 h1:8on/0Yp4uTb9f4XvTrM2+1CPrV05QPZXu+rvu2o9jcA= -github.com/go-openapi/jsonpointer v0.22.5/go.mod h1:gyUR3sCvGSWchA2sUBJGluYMbe1zazrYWIkWPjjMUY0= -github.com/go-openapi/jsonreference v0.21.5 h1:6uCGVXU/aNF13AQNggxfysJ+5ZcU4nEAe+pJyVWRdiE= -github.com/go-openapi/jsonreference v0.21.5/go.mod h1:u25Bw85sX4E2jzFodh1FOKMTZLcfifd1Q+iKKOUxExw= -github.com/go-openapi/swag v0.25.5 h1:pNkwbUEeGwMtcgxDr+2GBPAk4kT+kJ+AaB+TMKAg+TU= -github.com/go-openapi/swag v0.25.5/go.mod h1:B3RT6l8q7X803JRxa2e59tHOiZlX1t8viplOcs9CwTA= -github.com/go-openapi/swag/cmdutils v0.25.5 h1:yh5hHrpgsw4NwM9KAEtaDTXILYzdXh/I8Whhx9hKj7c= -github.com/go-openapi/swag/cmdutils v0.25.5/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0= -github.com/go-openapi/swag/conv v0.25.5 h1:wAXBYEXJjoKwE5+vc9YHhpQOFj2JYBMF2DUi+tGu97g= -github.com/go-openapi/swag/conv v0.25.5/go.mod h1:CuJ1eWvh1c4ORKx7unQnFGyvBbNlRKbnRyAvDvzWA4k= -github.com/go-openapi/swag/fileutils v0.25.5 h1:B6JTdOcs2c0dBIs9HnkyTW+5gC+8NIhVBUwERkFhMWk= -github.com/go-openapi/swag/fileutils v0.25.5/go.mod h1:V3cT9UdMQIaH4WiTrUc9EPtVA4txS0TOmRURmhGF4kc= -github.com/go-openapi/swag/jsonname v0.25.5 h1:8p150i44rv/Drip4vWI3kGi9+4W9TdI3US3uUYSFhSo= -github.com/go-openapi/swag/jsonname v0.25.5/go.mod h1:jNqqikyiAK56uS7n8sLkdaNY/uq6+D2m2LANat09pKU= -github.com/go-openapi/swag/jsonutils v0.25.5 h1:XUZF8awQr75MXeC+/iaw5usY/iM7nXPDwdG3Jbl9vYo= -github.com/go-openapi/swag/jsonutils v0.25.5/go.mod h1:48FXUaz8YsDAA9s5AnaUvAmry1UcLcNVWUjY42XkrN4= -github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.5 h1:SX6sE4FrGb4sEnnxbFL/25yZBb5Hcg1inLeErd86Y1U= -github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.5/go.mod h1:/2KvOTrKWjVA5Xli3DZWdMCZDzz3uV/T7bXwrKWPquo= -github.com/go-openapi/swag/loading v0.25.5 h1:odQ/umlIZ1ZVRteI6ckSrvP6e2w9UTF5qgNdemJHjuU= -github.com/go-openapi/swag/loading v0.25.5/go.mod h1:I8A8RaaQ4DApxhPSWLNYWh9NvmX2YKMoB9nwvv6oW6g= -github.com/go-openapi/swag/mangling v0.25.5 h1:hyrnvbQRS7vKePQPHHDso+k6CGn5ZBs5232UqWZmJZw= -github.com/go-openapi/swag/mangling v0.25.5/go.mod h1:6hadXM/o312N/h98RwByLg088U61TPGiltQn71Iw0NY= -github.com/go-openapi/swag/netutils v0.25.5 h1:LZq2Xc2QI8+7838elRAaPCeqJnHODfSyOa7ZGfxDKlU= -github.com/go-openapi/swag/netutils v0.25.5/go.mod h1:lHbtmj4m57APG/8H7ZcMMSWzNqIQcu0RFiXrPUara14= -github.com/go-openapi/swag/stringutils v0.25.5 h1:NVkoDOA8YBgtAR/zvCx5rhJKtZF3IzXcDdwOsYzrB6M= -github.com/go-openapi/swag/stringutils v0.25.5/go.mod h1:PKK8EZdu4QJq8iezt17HM8RXnLAzY7gW0O1KKarrZII= -github.com/go-openapi/swag/typeutils v0.25.5 h1:EFJ+PCga2HfHGdo8s8VJXEVbeXRCYwzzr9u4rJk7L7E= -github.com/go-openapi/swag/typeutils v0.25.5/go.mod h1:itmFmScAYE1bSD8C4rS0W+0InZUBrB2xSPbWt6DLGuc= -github.com/go-openapi/swag/yamlutils v0.25.5 h1:kASCIS+oIeoc55j28T4o8KwlV2S4ZLPT6G0iq2SSbVQ= -github.com/go-openapi/swag/yamlutils v0.25.5/go.mod h1:Gek1/SjjfbYvM+Iq4QGwa/2lEXde9n2j4a3wI3pNuOQ= -github.com/go-openapi/testify/enable/yaml/v2 v2.4.0 h1:7SgOMTvJkM8yWrQlU8Jm18VeDPuAvB/xWrdxFJkoFag= -github.com/go-openapi/testify/enable/yaml/v2 v2.4.0/go.mod h1:14iV8jyyQlinc9StD7w1xVPW3CO3q1Gj04Jy//Kw4VM= -github.com/go-openapi/testify/v2 v2.4.0 h1:8nsPrHVCWkQ4p8h1EsRVymA2XABB4OT40gcvAu+voFM= -github.com/go-openapi/testify/v2 v2.4.0/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54= +github.com/go-openapi/jsonpointer v1.0.2 h1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8= +github.com/go-openapi/jsonpointer v1.0.2/go.mod h1:N0rI4MbNKD7xAFTiHtB+5Nhrg2j/wwYg7m7Fmb4/jk8= +github.com/go-openapi/jsonreference v1.0.3 h1:5rDbq+JsjCv6/nUDDJt83nLZoADI4w03uvHXer+4aYQ= +github.com/go-openapi/jsonreference v1.0.3/go.mod h1:OJSlMXHysgH272D9z2tiy2MGe5A9vQLHaCPb6KbYdE4= +github.com/go-openapi/swag v0.27.1 h1:VotvOLWW8q/EAxB0YdsBBGC8XYyeL1YwBj2ungAGPNg= +github.com/go-openapi/swag v0.27.1/go.mod h1:GTkJPwHfhJp6MWr4/rCh64HVI3Ofu+tcsbfjfHmTxpE= +github.com/go-openapi/swag/cmdutils v0.27.1 h1:I7sYqaWVl5mq0NEmNQkAmFDyNin9ufvMX/p2zwtQaOE= +github.com/go-openapi/swag/cmdutils v0.27.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM= +github.com/go-openapi/swag/conv v0.29.2 h1:8c9shoB8l0QRSR6ymq1llHdBWDqpIgJfjTGHx3Vuhm0= +github.com/go-openapi/swag/conv v0.29.2/go.mod h1:AZS0YigTNf8qNtD6WqJz/N4RUNmpr76SyjFGkq4+p6Q= +github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzrb0QkmLKf9oM= +github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8= +github.com/go-openapi/swag/jsonutils v0.29.2 h1:uZNSD2/rJDYAfvsLYkykTzXuyxM3QpDKV9jhRHrMu6k= +github.com/go-openapi/swag/jsonutils v0.29.2/go.mod h1:ONTdNvj3Y+IXRzfa17E+Rgt2ns/qiSOYjIo2K7v2yDs= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.2 h1:w+Fd6EBOMGlC74GYGHqCLGyb3Bpams8TtNrgM/SG4jo= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.2/go.mod h1:HC2egPORFzbj/gf05Zrfgz8Mgplx3oW7hgGi7pjZVhM= +github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY= +github.com/go-openapi/swag/loading v0.27.1/go.mod h1:jvGh3iA2+zyUUycB5fgJWzeHnhrpvGnJJM0RVE9ZShE= +github.com/go-openapi/swag/mangling v0.27.1 h1:yC9D0HyUE8gbP+BfmGx9+AA89ikwZTMjESK3OnnoaqA= +github.com/go-openapi/swag/mangling v0.27.1/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w= +github.com/go-openapi/swag/netutils v0.27.1 h1:mICMFoS82F5TZ4Zy3cqmcQk+BFeCp3Uyq3Np7GI0/qU= +github.com/go-openapi/swag/netutils v0.27.1/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ= +github.com/go-openapi/swag/pools v0.29.2 h1:PlGoDRF8WtSyXkedZZkpW3f9wDhFf3u8KtaBcmgmh8c= +github.com/go-openapi/swag/pools v0.29.2/go.mod h1:V3lhxVT4qDYRqc2MRSSbLsTYIYV/2HlHafhyEkmzLIc= +github.com/go-openapi/swag/stringutils v0.27.1 h1:ZXePZ0r2p1qSjo8tD3Un4vFj8+FqlCkczxDrJIhYUp8= +github.com/go-openapi/swag/stringutils v0.27.1/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM= +github.com/go-openapi/swag/typeutils v0.29.2 h1:O7aVvkTs3pXwikgtrPLenigEMdQFgONKRooQA9pgf2I= +github.com/go-openapi/swag/typeutils v0.29.2/go.mod h1:7+GDG+uz9Ke+eVt4rClZg7wklSDp8hT/mKNh/pC26TE= +github.com/go-openapi/swag/yamlutils v0.27.1 h1:ftxv6xvXb1E3zohUc+okZ9nSqNb9StQX/FXnKZ98sQA= +github.com/go-openapi/swag/yamlutils v0.27.1/go.mod h1:bnxFIB1qewGRiZHypXGZ3fNgf13/0HfRgnS/iZBDrOo= +github.com/go-openapi/testify/enable/yaml/v2 v2.7.0 h1:wPW6YRgx3+SID1yUy/Xwa17L8kFEaEKod2VRbJDZNUs= +github.com/go-openapi/testify/enable/yaml/v2 v2.7.0/go.mod h1:mI1M88etYbc3PhgHsWQK2kwvNwW5aGFqMPbmib+SGIs= +github.com/go-openapi/testify/v2 v2.8.0 h1:19QDx5b57p8KjO2E4sgs/woL4Akp+FGLRlVm2xn0Rho= +github.com/go-openapi/testify/v2 v2.8.0/go.mod h1:4gUN8jC+RqOE2qjW/vDmfyTvl5BCht4qL7oca0odrak= github.com/go-resty/resty/v2 v2.17.2 h1:FQW5oHYcIlkCNrMD2lloGScxcHJ0gkjshV3qcQAyHQk= github.com/go-resty/resty/v2 v2.17.2/go.mod h1:kCKZ3wWmwJaNc7S29BRtUhJwy7iqmn+2mLtQrOyQlVA= github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY= @@ -108,14 +108,14 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0= github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= -github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= -github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= +github.com/google/s2a-go v0.1.11 h1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM= +github.com/google/s2a-go v0.1.11/go.mod h1:pz4tyvwXvJLLbyrkh6FW1eS2zPUXMaTmyNhYtyP2tNw= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8= -github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg= -github.com/googleapis/gax-go/v2 v2.21.0 h1:h45NjjzEO3faG9Lg/cFrBh2PgegVVgzqKzuZl/wMbiI= -github.com/googleapis/gax-go/v2 v2.21.0/go.mod h1:But/NJU6TnZsrLai/xBAQLLz+Hc7fHZJt/hsCz3Fih4= +github.com/googleapis/enterprise-certificate-proxy v0.3.24 h1:G9iCJIY+AYVmUskKdjX8FVy7sG+nbzjOQ41cvlmhcvg= +github.com/googleapis/enterprise-certificate-proxy v0.3.24/go.mod h1:hEjCmnoakQzv5ImLUp6alkY7XgLlNoAxwTXmhHHNIsI= +github.com/googleapis/gax-go/v2 v2.27.0 h1:qe2iQOUzxb3fd6x6ewpIEixPQhJ+0Ihc/RRZhKA/2g0= +github.com/googleapis/gax-go/v2 v2.27.0/go.mod h1:RofiqDw3ehcG4L0H1zO3D2Itpwd3/uS/7wdmbNDF1DE= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48= github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k= @@ -136,16 +136,16 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU= github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ= +github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc= github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= -github.com/linode/linodego v1.67.0 h1:pomhFuuCCJI4N6emtB9027h1yXHY2/MIT0hwHEFwvq4= -github.com/linode/linodego v1.67.0/go.mod h1:+9mbdu0P3WMRCl0QbVfiFavR+Iel7TCRDJk3nInyx14= +github.com/linode/linodego v1.69.1 h1:f45N2MHR/oece2/ktTTCYmrlfse4//k3NgwcF5zbGZ0= +github.com/linode/linodego v1.69.1/go.mod h1:Fha0NYsQSx5VZK1HQNJY/z/dIxxkFp+vb5veawbmAUw= github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= @@ -166,35 +166,38 @@ github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmd github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= -github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= -github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= -github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= -github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE= -github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4= -github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw= -github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc= -github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/prometheus/client_golang v1.25.0 h1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0= +github.com/prometheus/client_golang v1.25.0/go.mod h1:j2X/4/kaQHLPnmyEU8zjmkndo1T317VpCIQEml8LTKk= +github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo= +github.com/prometheus/client_model v0.6.3/go.mod h1:gpN5P9S7Rr6Yr92PiQ+Ixvhf6JZEkF1dnxsYL2aPBEM= +github.com/prometheus/common v0.72.1 h1:ZAiQed/nk8IIcsdzb2TlJu23NEUDyDLQ9TXTN2WRK6Y= +github.com/prometheus/common v0.72.1/go.mod h1:1IoBY4IRaJnhs2ESjNzjilP1cJ/P8pimGoomq7zRXrA= +github.com/prometheus/procfs v0.22.0 h1:6q9+/JL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics= +github.com/prometheus/procfs v0.22.0/go.mod h1:CvmFr/GVhIjIvWJZW3tgkODBQMRIf0EyWMQLHCHab58= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= -github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36 h1:ObX9hZmK+VmijreZO/8x9pQ8/P/ToHD/bdSb4Eg4tUo= -github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36/go.mod h1:LEsDu4BubxK7/cWhtlQWfuxwL4rf/2UEpxXz1o1EMtM= -github.com/sethvargo/go-password v0.3.1 h1:WqrLTjo7X6AcVYfC6R7GtSyuUQR9hGyAj/f1PYQZCJU= -github.com/sethvargo/go-password v0.3.1/go.mod h1:rXofC1zT54N7R8K/h1WDUdkf9BOx5OptoxrMBcrXzvs= +github.com/scaleway/scaleway-sdk-go v1.39.0 h1:HCoThqjNYqx+tFcI+JadoqdRN5UBHmC4Ee9lgqEqglw= +github.com/scaleway/scaleway-sdk-go v1.39.0/go.mod h1:ly2TNjJyW0SouDBZcQb2aNgqJYqI5t3BZF/UzBKFZ8o= +github.com/sethvargo/go-password v0.4.0 h1:eSidVKQw5C7CmTDAtH3RipBTSjdU1ZRxQaynD2GWLVU= +github.com/sethvargo/go-password v0.4.0/go.mod h1:PO3nYHwUpcHPR0F9woy7a4abZPvzRuqJr0GaeIYTm3k= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= -github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/vultr/govultr/v2 v2.17.2 h1:gej/rwr91Puc/tgh+j33p/BLR16UrIPnSr+AIwYWZQs= github.com/vultr/govultr/v2 v2.17.2/go.mod h1:ZFOKGWmgjytfyjeyAdhQlSWwTjh2ig+X49cAp50dzXI= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= @@ -202,123 +205,124 @@ github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcY github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo= -go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= -go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= -go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= -go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY= -go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= -go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg= -go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw= -go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A= -go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A= -go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.72.0 h1:LxwW/9ctSCv+QkE/cLR7M91ZIkXNMqJtEMi1vCw9U8s= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.72.0/go.mod h1:tOsftB4SslBwwErVEPaenU2RpThXWPIU8DoJHEC4dyw= +go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM= +go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU= +go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI= +go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw= +go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY= +go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU= +go.opentelemetry.io/otel/sdk v1.47.0 h1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I= +go.opentelemetry.io/otel/sdk v1.47.0/go.mod h1:VUc24kiOeoGsxG8G9ULx3fWKvB7jMhnGE8Oi607lgR0= +go.opentelemetry.io/otel/sdk/metric v1.47.0 h1:lfISg2j93VT6yqdk9OfUaZmw/GfcZqCCV3jdXtsPnKw= +go.opentelemetry.io/otel/sdk/metric v1.47.0/go.mod h1:ypLp+mW1Nt2x+Szt3b5/i1syodyts49lMOwxpDI3VGw= +go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM= +go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= -go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -go.yaml.in/yaml/v4 v4.0.0-rc.3 h1:3h1fjsh1CTAPjW7q/EMe+C8shx5d8ctzZTrLcs/j8Go= -go.yaml.in/yaml/v4 v4.0.0-rc.3/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= +go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4= +go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4= -golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA= +golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54= +golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w= golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI= -golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY= +golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg= +golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= -golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0= -golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw= -golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= -golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= +golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw= +golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= +golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98= +golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= -golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA= +golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= -golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU= -golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A= +golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM= +golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8= -golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA= -golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= -golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= +golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= +golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= +golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE= +golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= -golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s= -golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0= +golang.org/x/tools v0.52.0 h1:ryxg4U63oaUYk7uOLTF37n43f4qgtGvqV4Ioit1BaEs= +golang.org/x/tools v0.52.0/go.mod h1:ItcP5UNaVGG+Yc4eIYmaFLNJ4soEopkx5Y2d4lcEurs= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/api v0.275.0 h1:vfY5d9vFVJeWEZT65QDd9hbndr7FyZ2+6mIzGAh71NI= -google.golang.org/api v0.275.0/go.mod h1:Fnag/EWUPIcJXuIkP1pjoTgS5vdxlk3eeemL7Do6bvw= -google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0= -google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I= -google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 h1:41r6JMbpzBMen0R/4TZeeAmGXSJC7DftGINUodzTkPI= -google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d h1:wT2n40TBqFY6wiwazVK9/iTWbsQrgk5ZfCSVFLO9LQA= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM= -google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4= -google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= -google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= +google.golang.org/api v0.307.0 h1:KJJv1V/cOeCUrgKFippAhSg98QlR2IZFqubQKf7gQdg= +google.golang.org/api v0.307.0/go.mod h1:4XMH+b/ZEfuTbK7FnrFRY9c4xfFHVflGTKuy/i5wUmE= +google.golang.org/genproto v0.0.0-20261012220534-4341edf3f941 h1:CXq2XEi5aEyLjjPZIwqrmQH8ZY4ctUwK7uyAx3mjX/U= +google.golang.org/genproto v0.0.0-20261012220534-4341edf3f941/go.mod h1:3gK0ehnhP0V7/x3ypGoLyT3d0n6TSi/EcsphIjHrcz4= +google.golang.org/genproto/googleapis/api v0.0.0-20261012220534-4341edf3f941 h1:DS/w3N8rsfrwxwgGSj6WhMsPo7aNQGmDx74J81zd0NQ= +google.golang.org/genproto/googleapis/api v0.0.0-20261012220534-4341edf3f941/go.mod h1:AuGAdi9KnXss7xbLxIKhCvk+Ro/SxpET/iS45DNYN+M= +google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b h1:6WNWHZk91dp4gZ25642OALkuG1UVNZbwENJD19DnB8k= +google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= +google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0= +google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0= +google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= +google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= -gopkg.in/dnaeon/go-vcr.v4 v4.0.6 h1:PiJkrakkmzc5s7EfBnZOnyiLwi7o7A9fwPzN0X2uwe0= -gopkg.in/dnaeon/go-vcr.v4 v4.0.6/go.mod h1:sbq5oMEcM4PXngbcNbHhzfCP9OdZodLhrbRYoyg09HY= +gopkg.in/dnaeon/go-vcr.v4 v4.0.7 h1:Mq/RF+mq3QwtEunJSsoTbYPt3elSAmdJhAxrEaqr88I= +gopkg.in/dnaeon/go-vcr.v4 v4.0.7/go.mod h1:cRwV/njsN/D8qNJu4NAXWswz6b4OUh3rMIu4SObbLBg= gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo= gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M= gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc= gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= -gopkg.in/ini.v1 v1.67.1 h1:tVBILHy0R6e4wkYOn3XmiITt/hEVH4TFMYvAX2Ytz6k= -gopkg.in/ini.v1 v1.67.1/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss= +gopkg.in/ini.v1 v1.67.3 h1:iM9Lhz5MRSGhHVGGwCuzG9KO8PoirCXj/m/qTmOJJQw= +gopkg.in/ini.v1 v1.67.3/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss= gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -k8s.io/api v0.35.3 h1:pA2fiBc6+N9PDf7SAiluKGEBuScsTzd2uYBkA5RzNWQ= -k8s.io/api v0.35.3/go.mod h1:9Y9tkBcFwKNq2sxwZTQh1Njh9qHl81D0As56tu42GA4= -k8s.io/apimachinery v0.35.3 h1:MeaUwQCV3tjKP4bcwWGgZ/cp/vpsRnQzqO6J6tJyoF8= -k8s.io/apimachinery v0.35.3/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns= -k8s.io/client-go v0.35.3 h1:s1lZbpN4uI6IxeTM2cpdtrwHcSOBML1ODNTCCfsP1pg= -k8s.io/client-go v0.35.3/go.mod h1:RzoXkc0mzpWIDvBrRnD+VlfXP+lRzqQjCmKtiwZ8Q9c= -k8s.io/code-generator v0.35.3 h1:NDGCLkEm6Ho65wTdSe2EgErmmtsrezOPwwOchlNc6FQ= -k8s.io/code-generator v0.35.3/go.mod h1:LAVriRGXQusHQ0Ns64SE1ublSswm1KrK7cXn0GuQETg= -k8s.io/gengo/v2 v2.0.0-20251215205346-5ee0d033ba5b h1:0YkdvW3rX2vaBWsqCGZAekxPRwaI5NuYNprOsMNVLns= -k8s.io/gengo/v2 v2.0.0-20251215205346-5ee0d033ba5b/go.mod h1:yvyl3l9E+UxlqOMUULdKTAYB0rEhsmjr7+2Vb/1pCSo= +k8s.io/api v0.37.1 h1:l6N77U7tjwB5L056bgrBTJIEdevac/naBZ3iSvDNfpM= +k8s.io/api v0.37.1/go.mod h1:zSlbB1YpJ1YQlFVQy20UYll81UJSJJUMLhkhvg6Z78M= +k8s.io/apimachinery v0.37.1 h1:hGCYyvKHCwtwMitj2vU4vYx0Z16N9GyZk9BBnz0wDAE= +k8s.io/apimachinery v0.37.1/go.mod h1:jF84AyUi/IRIXRot5f+lm6MpxoWI+F1XgjaMmwCdTFw= +k8s.io/client-go v0.37.1 h1:QTv/5ha4jAHtW9qxxVBkQVFBRDb4jHfFopQqqMdc+wM= +k8s.io/client-go v0.37.1/go.mod h1:dnAPtTnCNY38Ho04D2KdY1F4IKausa9UbqaAZKl60SY= +k8s.io/code-generator v0.37.1 h1:tvxxAiGc2kMxoGx8HtUacs4cBdl0X5R+auBD2He974U= +k8s.io/code-generator v0.37.1/go.mod h1:RJepz1uW2WnHEwPDoCGzI3p4V23C7WuUdtqjueDl1uU= +k8s.io/gengo/v2 v2.0.0-20260408192533-25e2208e0dc3 h1:3L6PNkMLXkU/pz3jWzaaIUz0Rs2V9h+5O51AeRC7poc= +k8s.io/gengo/v2 v2.0.0-20260408192533-25e2208e0dc3/go.mod h1:yvyl3l9E+UxlqOMUULdKTAYB0rEhsmjr7+2Vb/1pCSo= k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8= k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I= k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc= k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0= -k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31 h1:V+sn9a/1fEYDGwnllCmqXBk8x7obZ+hl869Q3Abumkg= -k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0= -k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 h1:kBawHLSnx/mYHmRnNUf9d4CpjREbeZuxoSGOX/J+aYM= -k8s.io/utils v0.0.0-20260319190234-28399d86e0b5/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= -sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg= -sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg= +k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A= +k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I= +k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 h1:jVkFFVfXdXP74B/zbO3hM3hpSFD0xvhQ5U686DPurkE= +k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3/go.mod h1:M2s5JB1lIYP3jzZdorPLHXIPJzt9vv2muW5a6L9DtNM= +sigs.k8s.io/json v0.0.0-20260909141634-11ed52e25bc5 h1:k9jo7ED/fsfOcz3L1P20P5tjTNtsdQNwMOG2aKzHrl8= +sigs.k8s.io/json v0.0.0-20260909141634-11ed52e25bc5/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg= sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU= sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY= -sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8= -sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE= +sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q= +sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE= sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs= sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4= diff --git a/vendor/cloud.google.com/go/auth/CHANGES.md b/vendor/cloud.google.com/go/auth/CHANGES.md index 2c1f6ff8f..df93da326 100644 --- a/vendor/cloud.google.com/go/auth/CHANGES.md +++ b/vendor/cloud.google.com/go/auth/CHANGES.md @@ -1,5 +1,73 @@ # Changes +## [0.24.1](https://github.com/googleapis/google-cloud-go/compare/auth/v0.24.0...auth/v0.24.1) (2026-10-08) + + +### Bug Fixes + +* **auth:** Return empty tls.Certificate on secureconnect helper failure ([#20632](https://github.com/googleapis/google-cloud-go/issues/20632)) ([1cdb61a](https://github.com/googleapis/google-cloud-go/commit/1cdb61a25ffb7ac5d0c859191d485621c4f7aed7)), refs [#20593](https://github.com/googleapis/google-cloud-go/issues/20593) + +## [0.24.0](https://github.com/googleapis/google-cloud-go/compare/auth/v0.23.3...auth/v0.24.0) (2026-09-23) + + +### Features + +* **all:** Update supported go versions ([#20520](https://github.com/googleapis/google-cloud-go/issues/20520)) ([90413d3](https://github.com/googleapis/google-cloud-go/commit/90413d3e9d381ef4b92e3c496d98b023c5b2d8cc)) + + +### Bug Fixes + +* **auth:** Honor DisableAsyncRefresh and EarlyTokenRefresh consistently ([#20564](https://github.com/googleapis/google-cloud-go/issues/20564)) ([39f0ea5](https://github.com/googleapis/google-cloud-go/commit/39f0ea51dcbcae2bef1e8c900bdf2e675a19199c)), refs [#20563](https://github.com/googleapis/google-cloud-go/issues/20563) + +## [0.23.3](https://github.com/googleapis/google-cloud-go/compare/auth/v0.23.2...auth/v0.23.3) (2026-09-17) + + +### Bug Fixes + +* Handle secureconnect helper failures gracefully ([c2794c6](https://github.com/googleapis/google-cloud-go/commit/c2794c6bdf267278489af42591f3c3549ae8fcba)) +* Handle secureconnect helper failures gracefully ([#20443](https://github.com/googleapis/google-cloud-go/issues/20443)) ([c2794c6](https://github.com/googleapis/google-cloud-go/commit/c2794c6bdf267278489af42591f3c3549ae8fcba)) + +## [0.23.2](https://github.com/googleapis/google-cloud-go/compare/auth/v0.23.1...auth/v0.23.2) (2026-08-20) + + +### Bug Fixes + +* **auth:** Eliminate timing race conditions in grpctransport otel tests ([#20175](https://github.com/googleapis/google-cloud-go/issues/20175)) ([#20382](https://github.com/googleapis/google-cloud-go/issues/20382)) ([637505e](https://github.com/googleapis/google-cloud-go/commit/637505e5d5f090eec020604c3702b6ace11dcd38)) + +## [0.23.1](https://github.com/googleapis/google-cloud-go/compare/auth/v0.23.0...auth/v0.23.1) (2026-08-13) + + +### Bug Fixes + +* **auth:** Fix OpenTelemetry test flake in grpctransport ([#20191](https://github.com/googleapis/google-cloud-go/issues/20191)) ([e43ce28](https://github.com/googleapis/google-cloud-go/commit/e43ce28d01ea80970e6373e1c4540cb470cdc4a6)) + +## [0.23.0](https://github.com/googleapis/google-cloud-go/compare/auth/v0.22.0...auth/v0.23.0) (2026-08-07) + + +### Features + +* X509 workload identity ecp support ([#20138](https://github.com/googleapis/google-cloud-go/issues/20138)) ([5fa474a](https://github.com/googleapis/google-cloud-go/commit/5fa474a10a3863a1bb34ecb27540e8a574d7a736)) + +## [0.22.0](https://github.com/googleapis/google-cloud-go/compare/auth/v0.21.0...auth/v0.22.0) (2026-07-13) + + +### Features + +* **auth:** Populate http.response.status_code in http transport ([#20053](https://github.com/googleapis/google-cloud-go/issues/20053)) ([bff5d7c](https://github.com/googleapis/google-cloud-go/commit/bff5d7c9bc7f8ea8c0059f7d8e2d4294ba92c5bc)) + +## [0.21.0](https://github.com/googleapis/google-cloud-go/compare/auth/v0.20.0...auth/v0.21.0) (2026-07-07) + + +### Features + +* **auth:** Implement updated design for regional access boundary ([#13417](https://github.com/googleapis/google-cloud-go/issues/13417)) ([fadb6c7](https://github.com/googleapis/google-cloud-go/commit/fadb6c764dbe869fca736d9f0446b5010f21d2f2)) + + +### Bug Fixes + +* **auth:** Avoid double impersonation in idtoken and clarify docs ([#14474](https://github.com/googleapis/google-cloud-go/issues/14474)) ([995bfc3](https://github.com/googleapis/google-cloud-go/commit/995bfc36199ba6ae1c88803c71f39a0b19fc8c0f)), closes [#11105](https://github.com/googleapis/google-cloud-go/issues/11105) +* **auth:** Correct go min version ([#20094](https://github.com/googleapis/google-cloud-go/issues/20094)) ([6bb4358](https://github.com/googleapis/google-cloud-go/commit/6bb4358dca69b803e52eb2af882fa5afc24d54e2)) + ## [0.20.0](https://github.com/googleapis/google-cloud-go/releases/tag/auth%2Fv0.20.0) (2026-04-06) ## [0.19.0](https://github.com/googleapis/google-cloud-go/releases/tag/auth%2Fv0.19.0) (2026-03-23) diff --git a/vendor/cloud.google.com/go/auth/auth.go b/vendor/cloud.google.com/go/auth/auth.go index c6d801583..fd6a11ddf 100644 --- a/vendor/cloud.google.com/go/auth/auth.go +++ b/vendor/cloud.google.com/go/auth/auth.go @@ -386,7 +386,7 @@ func (c *cachedTokenProvider) tokenBlocking(ctx context.Context) (*Token, error) c.mu.Lock() defer c.mu.Unlock() c.isRefreshErr = false - if c.cachedToken.IsValid() || (!c.autoRefresh && !c.cachedToken.isEmpty()) { + if c.cachedToken.isValidWithEarlyExpiry(c.expireEarly) || (!c.autoRefresh && !c.cachedToken.isEmpty()) { return c.cachedToken, nil } t, err := c.tp.Token(ctx) diff --git a/vendor/cloud.google.com/go/auth/credentials/detect.go b/vendor/cloud.google.com/go/auth/credentials/detect.go index c9d7600e0..f79cca4dc 100644 --- a/vendor/cloud.google.com/go/auth/credentials/detect.go +++ b/vendor/cloud.google.com/go/auth/credentials/detect.go @@ -27,7 +27,7 @@ import ( "cloud.google.com/go/auth" "cloud.google.com/go/auth/internal" "cloud.google.com/go/auth/internal/credsfile" - "cloud.google.com/go/auth/internal/trustboundary" + "cloud.google.com/go/auth/internal/regionalaccessboundary" "cloud.google.com/go/compute/metadata" "github.com/googleapis/gax-go/v2/internallog" ) @@ -138,11 +138,15 @@ func OnGCE() bool { // Google APIs can compromise the security of your systems and data. For // more information, refer to [Validate credential configurations from // external sources](https://cloud.google.com/docs/authentication/external/externally-sourced-credentials). +// +// Note: If the detected credential configuration file contains a +// `service_account_impersonation_url` field, the returned credentials will +// yield tokens that are already impersonated to that target service account. func DetectDefault(opts *DetectOptions) (*auth.Credentials, error) { if err := opts.validate(); err != nil { return nil, err } - trustBoundaryEnabled, err := trustboundary.IsEnabled() + regionalAccessBoundaryEnabled, err := regionalaccessboundary.IsEnabled() if err != nil { return nil, err } @@ -175,12 +179,12 @@ func DetectDefault(opts *DetectOptions) (*auth.Credentials, error) { } tp := computeTokenProvider(opts, metadataClient) - if trustBoundaryEnabled { - gceConfigProvider := trustboundary.NewGCEConfigProvider(gceUniverseDomainProvider) + if regionalAccessBoundaryEnabled { + gceConfigProvider := regionalaccessboundary.NewGCEConfigProvider(gceUniverseDomainProvider) var err error - tp, err = trustboundary.NewProvider(opts.client(), gceConfigProvider, opts.logger(), tp) + tp, err = regionalaccessboundary.NewProvider(opts.client(), gceConfigProvider, opts.logger(), tp) if err != nil { - return nil, fmt.Errorf("credentials: failed to initialize GCE trust boundary provider: %w", err) + return nil, fmt.Errorf("credentials: failed to initialize GCE Regional Access Boundary provider: %w", err) } } @@ -454,16 +458,17 @@ func clientCredConfigFromJSON(b []byte, opts *DetectOptions) *auth.Options3LO { } } return &auth.Options3LO{ - ClientID: c.ClientID, - ClientSecret: c.ClientSecret, - RedirectURL: c.RedirectURIs[0], - Scopes: opts.scopes(), - AuthURL: c.AuthURI, - TokenURL: c.TokenURI, - Client: opts.client(), - Logger: opts.logger(), - EarlyTokenExpiry: opts.EarlyTokenRefresh, - AuthHandlerOpts: handleOpts, + ClientID: c.ClientID, + ClientSecret: c.ClientSecret, + RedirectURL: c.RedirectURIs[0], + Scopes: opts.scopes(), + AuthURL: c.AuthURI, + TokenURL: c.TokenURI, + Client: opts.client(), + Logger: opts.logger(), + EarlyTokenExpiry: opts.EarlyTokenRefresh, + DisableAsyncRefresh: opts.DisableAsyncRefresh, + AuthHandlerOpts: handleOpts, // TODO(codyoss): refactor this out. We need to add in auto-detection // for this use case. AuthStyle: auth.StyleInParams, diff --git a/vendor/cloud.google.com/go/auth/credentials/filetypes.go b/vendor/cloud.google.com/go/auth/credentials/filetypes.go index f3737a5e8..59932fc6d 100644 --- a/vendor/cloud.google.com/go/auth/credentials/filetypes.go +++ b/vendor/cloud.google.com/go/auth/credentials/filetypes.go @@ -25,7 +25,7 @@ import ( "cloud.google.com/go/auth/credentials/internal/impersonate" internalauth "cloud.google.com/go/auth/internal" "cloud.google.com/go/auth/internal/credsfile" - "cloud.google.com/go/auth/internal/trustboundary" + "cloud.google.com/go/auth/internal/regionalaccessboundary" ) const cloudPlatformScope = "https://www.googleapis.com/auth/cloud-platform" @@ -109,7 +109,8 @@ func fileCredentials(b []byte, opts *DetectOptions) (*auth.Credentials, error) { } return auth.NewCredentials(&auth.CredentialsOptions{ TokenProvider: auth.NewCachedTokenProvider(tp, &auth.CachedTokenProviderOptions{ - ExpireEarly: opts.EarlyTokenRefresh, + ExpireEarly: opts.EarlyTokenRefresh, + DisableAsyncRefresh: opts.DisableAsyncRefresh, }), JSON: b, ProjectIDProvider: internalauth.StaticCredentialsProperty(projectID), @@ -159,29 +160,30 @@ func handleServiceAccount(f *credsfile.ServiceAccountFile, opts *DetectOptions) return nil, err } - trustBoundaryEnabled, err := trustboundary.IsEnabled() + regionalAccessBoundaryEnabled, err := regionalaccessboundary.IsEnabled() if err != nil { return nil, err } - if !trustBoundaryEnabled { + if !regionalAccessBoundaryEnabled { return tp, nil } - saConfig := trustboundary.NewServiceAccountConfigProvider(opts2LO.Email, opts2LO.UniverseDomain) - return trustboundary.NewProvider(opts.client(), saConfig, opts.logger(), tp) + saConfig := regionalaccessboundary.NewServiceAccountConfigProvider(opts2LO.Email, opts2LO.UniverseDomain) + return regionalaccessboundary.NewProvider(opts.client(), saConfig, opts.logger(), tp) } func handleUserCredential(f *credsfile.UserCredentialsFile, opts *DetectOptions) (auth.TokenProvider, error) { opts3LO := &auth.Options3LO{ - ClientID: f.ClientID, - ClientSecret: f.ClientSecret, - Scopes: opts.scopes(), - AuthURL: googleAuthURL, - TokenURL: opts.tokenURL(), - AuthStyle: auth.StyleInParams, - EarlyTokenExpiry: opts.EarlyTokenRefresh, - RefreshToken: f.RefreshToken, - Client: opts.client(), - Logger: opts.logger(), + ClientID: f.ClientID, + ClientSecret: f.ClientSecret, + Scopes: opts.scopes(), + AuthURL: googleAuthURL, + TokenURL: opts.tokenURL(), + AuthStyle: auth.StyleInParams, + EarlyTokenExpiry: opts.EarlyTokenRefresh, + DisableAsyncRefresh: opts.DisableAsyncRefresh, + RefreshToken: f.RefreshToken, + Client: opts.client(), + Logger: opts.logger(), } return auth.New3LOTokenProvider(opts3LO) } @@ -199,6 +201,8 @@ func handleExternalAccount(f *credsfile.ExternalAccountFile, opts *DetectOptions QuotaProjectID: f.QuotaProjectID, Scopes: opts.scopes(), WorkforcePoolUserProject: f.WorkforcePoolUserProject, + EarlyTokenRefresh: opts.EarlyTokenRefresh, + DisableAsyncRefresh: opts.DisableAsyncRefresh, Client: opts.client(), Logger: opts.logger(), IsDefaultClient: opts.Client == nil, @@ -210,67 +214,69 @@ func handleExternalAccount(f *credsfile.ExternalAccountFile, opts *DetectOptions if err != nil { return nil, err } - trustBoundaryEnabled, err := trustboundary.IsEnabled() + regionalAccessBoundaryEnabled, err := regionalaccessboundary.IsEnabled() if err != nil { return nil, err } - if !trustBoundaryEnabled { + if !regionalAccessBoundaryEnabled { return tp, nil } ud := resolveUniverseDomain(opts.UniverseDomain, f.UniverseDomain) - var configProvider trustboundary.ConfigProvider + var configProvider regionalaccessboundary.ConfigProvider if f.ServiceAccountImpersonationURL == "" { // No impersonation, this is a direct external account credential. - // The trust boundary is based on the workload/workforce pool. + // The Regional Access Boundary is based on the workload/workforce pool. var err error - configProvider, err = trustboundary.NewExternalAccountConfigProvider(f.Audience, ud) + configProvider, err = regionalaccessboundary.NewExternalAccountConfigProvider(f.Audience, ud) if err != nil { return nil, err } } else { - // Impersonation is used. The trust boundary is based on the target service account. + // Impersonation is used. The Regional Access Boundary is based on the target service account. targetSAEmail, err := impersonate.ExtractServiceAccountEmail(f.ServiceAccountImpersonationURL) if err != nil { - return nil, fmt.Errorf("credentials: could not extract target service account email for trust boundary: %w", err) + return nil, fmt.Errorf("credentials: could not extract target service account email for Regional Access Boundary: %w", err) } - configProvider = trustboundary.NewServiceAccountConfigProvider(targetSAEmail, ud) + configProvider = regionalaccessboundary.NewServiceAccountConfigProvider(targetSAEmail, ud) } - return trustboundary.NewProvider(opts.client(), configProvider, opts.logger(), tp) + return regionalaccessboundary.NewProvider(opts.client(), configProvider, opts.logger(), tp) } func handleExternalAccountAuthorizedUser(f *credsfile.ExternalAccountAuthorizedUserFile, opts *DetectOptions) (auth.TokenProvider, error) { externalOpts := &externalaccountuser.Options{ - Audience: f.Audience, - RefreshToken: f.RefreshToken, - TokenURL: f.TokenURL, - TokenInfoURL: f.TokenInfoURL, - ClientID: f.ClientID, - ClientSecret: f.ClientSecret, - Scopes: opts.scopes(), - Client: opts.client(), - Logger: opts.logger(), + Audience: f.Audience, + RefreshToken: f.RefreshToken, + TokenURL: f.TokenURL, + TokenInfoURL: f.TokenInfoURL, + ClientID: f.ClientID, + ClientSecret: f.ClientSecret, + Scopes: opts.scopes(), + EarlyTokenRefresh: opts.EarlyTokenRefresh, + DisableAsyncRefresh: opts.DisableAsyncRefresh, + Client: opts.client(), + Logger: opts.logger(), } tp, err := externalaccountuser.NewTokenProvider(externalOpts) if err != nil { return nil, err } - trustBoundaryEnabled, err := trustboundary.IsEnabled() + regionalAccessBoundaryEnabled, err := regionalaccessboundary.IsEnabled() if err != nil { return nil, err } - if !trustBoundaryEnabled { + if !regionalAccessBoundaryEnabled { return tp, nil } ud := resolveUniverseDomain(opts.UniverseDomain, f.UniverseDomain) - configProvider, err := trustboundary.NewExternalAccountConfigProvider(f.Audience, ud) + configProvider, err := regionalaccessboundary.NewExternalAccountConfigProvider(f.Audience, ud) if err != nil { return nil, err } - return trustboundary.NewProvider(opts.client(), configProvider, opts.logger(), tp) + return regionalaccessboundary.NewProvider(opts.client(), configProvider, opts.logger(), tp) } func handleImpersonatedServiceAccount(f *credsfile.ImpersonatedServiceAccountFile, opts *DetectOptions) (auth.TokenProvider, error) { @@ -306,19 +312,19 @@ func handleImpersonatedServiceAccount(f *credsfile.ImpersonatedServiceAccountFil if err != nil { return nil, err } - trustBoundaryEnabled, err := trustboundary.IsEnabled() + regionalAccessBoundaryEnabled, err := regionalaccessboundary.IsEnabled() if err != nil { return nil, err } - if !trustBoundaryEnabled { + if !regionalAccessBoundaryEnabled { return tp, nil } targetSAEmail, err := impersonate.ExtractServiceAccountEmail(f.ServiceAccountImpersonationURL) if err != nil { - return nil, fmt.Errorf("credentials: could not extract target service account email for trust boundary: %w", err) + return nil, fmt.Errorf("credentials: could not extract target service account email for Regional Access Boundary: %w", err) } - targetSAConfig := trustboundary.NewServiceAccountConfigProvider(targetSAEmail, ud) - return trustboundary.NewProvider(opts.client(), targetSAConfig, opts.logger(), tp) + targetSAConfig := regionalaccessboundary.NewServiceAccountConfigProvider(targetSAEmail, ud) + return regionalaccessboundary.NewProvider(opts.client(), targetSAConfig, opts.logger(), tp) } func handleGDCHServiceAccount(f *credsfile.GDCHServiceAccountFile, opts *DetectOptions) (auth.TokenProvider, error) { return gdch.NewTokenProvider(f, &gdch.Options{ diff --git a/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/externalaccount.go b/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/externalaccount.go index f4f49f175..ae38487fa 100644 --- a/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/externalaccount.go +++ b/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/externalaccount.go @@ -100,6 +100,13 @@ type Options struct { // for AWS credentials. One of SubjectTokenProvider, // AWSSecurityCredentialProvider or CredentialSource must be provided. Optional. AwsSecurityCredentialsProvider AwsSecurityCredentialsProvider + // EarlyTokenRefresh configures how early before a token expires that it + // should be refreshed. If unset, the default value is 3 minutes and 45 + // seconds. Optional. + EarlyTokenRefresh time.Duration + // DisableAsyncRefresh configures a synchronous workflow that refreshes + // stale tokens while blocking. The default is false. Optional. + DisableAsyncRefresh bool // Client for token request. Client *http.Client // IsDefaultClient marks whether the client passed in is a default client that can be overriden. @@ -249,8 +256,12 @@ func NewTokenProvider(opts *Options) (auth.TokenProvider, error) { logger: logger, } + cacheOpts := &auth.CachedTokenProviderOptions{ + ExpireEarly: opts.EarlyTokenRefresh, + DisableAsyncRefresh: opts.DisableAsyncRefresh, + } if opts.ServiceAccountImpersonationURL == "" { - return auth.NewCachedTokenProvider(tp, nil), nil + return auth.NewCachedTokenProvider(tp, cacheOpts), nil } scopes := make([]string, len(opts.Scopes)) @@ -261,14 +272,14 @@ func NewTokenProvider(opts *Options) (auth.TokenProvider, error) { Client: client, URL: opts.ServiceAccountImpersonationURL, Scopes: scopes, - Tp: auth.NewCachedTokenProvider(tp, nil), + Tp: auth.NewCachedTokenProvider(tp, cacheOpts), TokenLifetimeSeconds: opts.ServiceAccountImpersonationLifetimeSeconds, Logger: logger, }) if err != nil { return nil, err } - return auth.NewCachedTokenProvider(imp, nil), nil + return auth.NewCachedTokenProvider(imp, cacheOpts), nil } type subjectTokenProvider interface { diff --git a/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/x509_provider.go b/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/x509_provider.go index d86ca593c..d67f45f47 100644 --- a/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/x509_provider.go +++ b/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/x509_provider.go @@ -30,6 +30,7 @@ import ( "time" "cloud.google.com/go/auth/internal/transport/cert" + "github.com/googleapis/enterprise-certificate-proxy/client" ) // x509Provider implements the subjectTokenProvider type for x509 workload @@ -57,13 +58,13 @@ func (xp *x509Provider) providerType() string { // reads the certificate file, and parses the certificate data. func loadLeafCertificate(configFilePath string) (*x509.Certificate, error) { // Get the path to the certificate file from the configuration file. - path, err := cert.GetCertificatePath(configFilePath) + path, err := cert.GetFileBasedCertificatePath(configFilePath) if err != nil { - return nil, fmt.Errorf("failed to get certificate path from config file: %w", err) + return nil, fmt.Errorf("credentials: failed to get certificate path from config file: %w", err) } leafCertBytes, err := os.ReadFile(path) if err != nil { - return nil, fmt.Errorf("failed to read leaf certificate file: %w", err) + return nil, fmt.Errorf("credentials: failed to read leaf certificate file: %w", err) } // Parse the certificate bytes. return parseCertificate(leafCertBytes) @@ -78,20 +79,20 @@ func encodeCert(cert *x509.Certificate) string { // parseCertificate parses a PEM-encoded certificate from the given byte slice. func parseCertificate(certData []byte) (*x509.Certificate, error) { if len(certData) == 0 { - return nil, errors.New("invalid certificate data: empty input") + return nil, errors.New("credentials: invalid certificate data: empty input") } // Decode the PEM-encoded data. block, _ := pem.Decode(certData) if block == nil { - return nil, errors.New("invalid PEM-encoded certificate data: no PEM block found") + return nil, errors.New("credentials: invalid PEM-encoded certificate data: no PEM block found") } if block.Type != "CERTIFICATE" { - return nil, fmt.Errorf("invalid PEM-encoded certificate data: expected CERTIFICATE block type, got %s", block.Type) + return nil, fmt.Errorf("credentials: invalid PEM-encoded certificate data: expected CERTIFICATE block type, got %s", block.Type) } // Parse the DER-encoded certificate. certificate, err := x509.ParseCertificate(block.Bytes) if err != nil { - return nil, fmt.Errorf("failed to parse certificate: %w", err) + return nil, fmt.Errorf("credentials: failed to parse certificate: %w", err) } return certificate, nil } @@ -110,9 +111,9 @@ func readTrustChain(trustChainPath string) ([]*x509.Certificate, error) { trustChainData, err := os.ReadFile(trustChainPath) if err != nil { if errors.Is(err, fs.ErrNotExist) { - return nil, fmt.Errorf("trust chain file not found: %w", err) + return nil, fmt.Errorf("credentials: trust chain file not found: %w", err) } - return nil, fmt.Errorf("failed to read trust chain file: %w", err) + return nil, fmt.Errorf("credentials: failed to read trust chain file: %w", err) } // Split the file content into PEM certificate blocks. @@ -130,7 +131,7 @@ func readTrustChain(trustChainPath string) ([]*x509.Certificate, error) { // Parse the certificate data. cert, err := parseCertificate([]byte(certData)) if err != nil { - return nil, fmt.Errorf("error parsing certificate from trust chain file: %w", err) + return nil, fmt.Errorf("credentials: error parsing certificate from trust chain file: %w", err) } // Append the certificate to the trust chain. @@ -141,6 +142,35 @@ func readTrustChain(trustChainPath string) ([]*x509.Certificate, error) { return certificateTrustChain, nil } +func (xp *x509Provider) ecpSubjectToken(configFilePath string) (string, error) { + key, err := client.Cred(configFilePath) + if err != nil { + return "", fmt.Errorf("credentials: failed to initialize ECP client: %w", err) + } + defer key.Close() + + rawChain := key.CertificateChain() + if len(rawChain) == 0 { + return "", errors.New("credentials: ECP returned an empty certificate chain") + } + + certChain := make([]string, 0, len(rawChain)) + for _, derBytes := range rawChain { + cert, err := x509.ParseCertificate(derBytes) + if err != nil { + return "", fmt.Errorf("credentials: failed to parse certificate from ECP chain: %w", err) + } + certChain = append(certChain, encodeCert(cert)) + } + + jsonChain, err := json.Marshal(certChain) + if err != nil { + return "", fmt.Errorf("credentials: failed to format certificate data: %w", err) + } + + return string(jsonChain), nil +} + // subjectToken retrieves the X.509 subject token. It loads the leaf // certificate and, if a trust chain path is configured, the trust chain // certificates. It then constructs a JSON array containing the base64-encoded @@ -148,16 +178,24 @@ func readTrustChain(trustChainPath string) ([]*x509.Certificate, error) { // The leaf certificate must be at the top of the trust chain file. This JSON // array is used as the subject token for mTLS authentication. func (xp *x509Provider) subjectToken(context.Context) (string, error) { + configFilePath := cert.GetConfigFilePath(xp.ConfigFilePath) + + // First check if it's ECP based cert config + if cert.IsECPConfig(configFilePath) { + return xp.ecpSubjectToken(configFilePath) + } + + // It's not ECP, do the normal file based cert config way. // Load the leaf certificate. - leafCert, err := loadLeafCertificate(xp.ConfigFilePath) + leafCert, err := loadLeafCertificate(configFilePath) if err != nil { - return "", fmt.Errorf("failed to load leaf certificate: %w", err) + return "", fmt.Errorf("credentials: failed to load leaf certificate: %w", err) } // Read the trust chain. trustChain, err := readTrustChain(xp.TrustChainPath) if err != nil { - return "", fmt.Errorf("failed to read trust chain: %w", err) + return "", fmt.Errorf("credentials: failed to read trust chain: %w", err) } // Initialize the certificate chain with the leaf certificate. @@ -178,7 +216,7 @@ func (xp *x509Provider) subjectToken(context.Context) (string, error) { // Return an error if the current certificate is the same as the leaf certificate. if encoded == certChain[0] { - return "", errors.New("the leaf certificate must be at the top of the trust chain file") + return "", errors.New("credentials: the leaf certificate must be at the top of the trust chain file") } // Add the current certificate to the chain. @@ -189,7 +227,7 @@ func (xp *x509Provider) subjectToken(context.Context) (string, error) { // Convert the certificate chain to a JSON array of base64-encoded strings. jsonChain, err := json.Marshal(certChain) if err != nil { - return "", fmt.Errorf("failed to format certificate data: %w", err) + return "", fmt.Errorf("credentials: failed to format certificate data: %w", err) } // Return the JSON-formatted certificate chain. diff --git a/vendor/cloud.google.com/go/auth/credentials/internal/externalaccountuser/externalaccountuser.go b/vendor/cloud.google.com/go/auth/credentials/internal/externalaccountuser/externalaccountuser.go index ae39206e5..e4a34b1e5 100644 --- a/vendor/cloud.google.com/go/auth/credentials/internal/externalaccountuser/externalaccountuser.go +++ b/vendor/cloud.google.com/go/auth/credentials/internal/externalaccountuser/externalaccountuser.go @@ -51,6 +51,14 @@ type Options struct { // Scopes contains the desired scopes for the returned access token. Scopes []string + // EarlyTokenRefresh configures how early before a token expires that it + // should be refreshed. If unset, the default value is 3 minutes and 45 + // seconds. Optional. + EarlyTokenRefresh time.Duration + // DisableAsyncRefresh configures a synchronous workflow that refreshes + // stale tokens while blocking. The default is false. Optional. + DisableAsyncRefresh bool + // Client for token request. Client *http.Client // Logger for logging. @@ -71,7 +79,10 @@ func NewTokenProvider(opts *Options) (auth.TokenProvider, error) { tp := &tokenProvider{ o: opts, } - return auth.NewCachedTokenProvider(tp, nil), nil + return auth.NewCachedTokenProvider(tp, &auth.CachedTokenProviderOptions{ + ExpireEarly: opts.EarlyTokenRefresh, + DisableAsyncRefresh: opts.DisableAsyncRefresh, + }), nil } type tokenProvider struct { diff --git a/vendor/cloud.google.com/go/auth/httptransport/transport.go b/vendor/cloud.google.com/go/auth/httptransport/transport.go index 87b3fef21..be1945a98 100644 --- a/vendor/cloud.google.com/go/auth/httptransport/transport.go +++ b/vendor/cloud.google.com/go/auth/httptransport/transport.go @@ -284,6 +284,11 @@ func (t *otelAttributeTransport) RoundTrip(req *http.Request) (*http.Response, e } resp, err := t.base.RoundTrip(req) + if gax.IsFeatureEnabled("METRICS") { + if data != nil && resp != nil { + data.SetHTTPStatusCode(resp.StatusCode) + } + } var logger *slog.Logger if gax.IsFeatureEnabled("LOGGING") { diff --git a/vendor/cloud.google.com/go/auth/internal/internal.go b/vendor/cloud.google.com/go/auth/internal/internal.go index 48e9bd9ec..d79e0ffbe 100644 --- a/vendor/cloud.google.com/go/auth/internal/internal.go +++ b/vendor/cloud.google.com/go/auth/internal/internal.go @@ -48,11 +48,8 @@ const ( // Universe domain is the default service domain for a given Cloud universe. DefaultUniverseDomain = "googleapis.com" - // TrustBoundaryNoOp is a constant indicating no trust boundary is enforced. - TrustBoundaryNoOp = "0x0" - - // TrustBoundaryDataKey is the key used to store trust boundary data in a token's metadata. - TrustBoundaryDataKey = "google.auth.trust_boundary_data" + // RegionalAccessBoundaryDataKey is the key used to store regional access boundary data in a token's metadata. + RegionalAccessBoundaryDataKey = "google.auth.regional_access_boundary_data" ) type clonableTransport interface { @@ -231,55 +228,35 @@ func FormatIAMServiceAccountResource(name string) string { return fmt.Sprintf("projects/-/serviceAccounts/%s", name) } -// TrustBoundaryData represents the trust boundary data associated with a token. +// RegionalAccessBoundaryData represents the regional access boundary data associated with a token. // It contains information about the regions or environments where the token is valid. -type TrustBoundaryData struct { +type RegionalAccessBoundaryData struct { // Locations is the list of locations that the token is allowed to be used in. Locations []string // EncodedLocations represents the locations in an encoded format. EncodedLocations string } -// NewTrustBoundaryData returns a new TrustBoundaryData with the specified locations and encoded locations. -func NewTrustBoundaryData(locations []string, encodedLocations string) *TrustBoundaryData { +// NewRegionalAccessBoundaryData returns a new RegionalAccessBoundaryData with the specified locations and encoded locations. +func NewRegionalAccessBoundaryData(locations []string, encodedLocations string) *RegionalAccessBoundaryData { // Ensure consistency by treating a nil slice as an empty slice. if locations == nil { locations = []string{} } locationsCopy := make([]string, len(locations)) copy(locationsCopy, locations) - return &TrustBoundaryData{ + return &RegionalAccessBoundaryData{ Locations: locationsCopy, EncodedLocations: encodedLocations, } } -// NewNoOpTrustBoundaryData returns a new TrustBoundaryData with no restrictions. -func NewNoOpTrustBoundaryData() *TrustBoundaryData { - return &TrustBoundaryData{ - Locations: []string{}, - EncodedLocations: TrustBoundaryNoOp, - } -} - -// TrustBoundaryHeader returns the value for the x-allowed-locations header and a bool -// indicating if the header should be set. The return values are structured to -// handle three distinct states required by the backend: -// 1. Header not set: (value="", present=false) -> data is empty. -// 2. Header set to an empty string: (value="", present=true) -> data is a no-op. -// 3. Header set to a value: (value="...", present=true) -> data has locations. -func (t TrustBoundaryData) TrustBoundaryHeader() (value string, present bool) { +// RegionalAccessBoundaryHeader returns the value for the x-allowed-locations header and a bool +// indicating if the header should be set. If EncodedLocations is empty, the header +// should not be present. Otherwise, it should be present with the value of EncodedLocations. +func (t RegionalAccessBoundaryData) RegionalAccessBoundaryHeader() (value string, present bool) { if t.EncodedLocations == "" { - // If the data is empty, the header should not be present. return "", false } - - // If data is not empty, the header should always be present. - present = true - value = "" - if t.EncodedLocations != TrustBoundaryNoOp { - value = t.EncodedLocations - } - // For a no-op, the backend requires an empty string. - return value, present + return t.EncodedLocations, true } diff --git a/vendor/cloud.google.com/go/auth/internal/trustboundary/external_accounts_config_providers.go b/vendor/cloud.google.com/go/auth/internal/regionalaccessboundary/external_accounts_config_providers.go similarity index 60% rename from vendor/cloud.google.com/go/auth/internal/trustboundary/external_accounts_config_providers.go rename to vendor/cloud.google.com/go/auth/internal/regionalaccessboundary/external_accounts_config_providers.go index 8fa5600bd..2c1189017 100644 --- a/vendor/cloud.google.com/go/auth/internal/trustboundary/external_accounts_config_providers.go +++ b/vendor/cloud.google.com/go/auth/internal/regionalaccessboundary/external_accounts_config_providers.go @@ -12,7 +12,7 @@ // See the License for the specific language governing permissions and // limitations under the License. -package trustboundary +package regionalaccessboundary import ( "context" @@ -21,13 +21,13 @@ import ( ) const ( - workloadAllowedLocationsEndpoint = "https://iamcredentials.%s/v1/projects/%s/locations/global/workloadIdentityPools/%s/allowedLocations" - workforceAllowedLocationsEndpoint = "https://iamcredentials.%s/v1/locations/global/workforcePools/%s/allowedLocations" + workloadAllowedLocationsEndpoint = "https://iamcredentials.googleapis.com/v1/projects/%s/locations/global/workloadIdentityPools/%s/allowedLocations" + workforceAllowedLocationsEndpoint = "https://iamcredentials.googleapis.com/v1/locations/global/workforcePools/%s/allowedLocations" ) var ( - workforceAudiencePattern = regexp.MustCompile(`//iam\.([^/]+)/locations/global/workforcePools/([^/]+)`) - workloadAudiencePattern = regexp.MustCompile(`//iam\.([^/]+)/projects/([^/]+)/locations/global/workloadIdentityPools/([^/]+)`) + workforceAudiencePattern = regexp.MustCompile(`^//iam\.([^/]+)/locations/([^/]+)/workforcePools/([^/]+)/providers/[^/]+$`) + workloadAudiencePattern = regexp.MustCompile(`^//iam\.([^/]+)/projects/([^/]+)/locations/([^/]+)/workloadIdentityPools/([^/]+)/providers/[^/]+$`) ) // NewExternalAccountConfigProvider creates a new ConfigProvider for external accounts. @@ -36,19 +36,19 @@ func NewExternalAccountConfigProvider(audience, inputUniverseDomain string) (Con var isWorkload bool matches := workloadAudiencePattern.FindStringSubmatch(audience) - if len(matches) == 4 { // Expecting full match, domain, projectNumber, poolID + if len(matches) == 5 { // Expecting full match, domain, projectNumber, location, poolID audienceDomain = matches[1] projectNumber = matches[2] - poolID = matches[3] + poolID = matches[4] isWorkload = true } else { matches = workforceAudiencePattern.FindStringSubmatch(audience) - if len(matches) == 3 { // Expecting full match, domain, poolID + if len(matches) == 4 { // Expecting full match, domain, location, poolID audienceDomain = matches[1] - poolID = matches[2] + poolID = matches[3] isWorkload = false } else { - return nil, fmt.Errorf("trustboundary: unknown audience format: %q", audience) + return nil, fmt.Errorf("regionalaccessboundary: unknown audience format: %q", audience) } } @@ -56,7 +56,7 @@ func NewExternalAccountConfigProvider(audience, inputUniverseDomain string) (Con if effectiveUniverseDomain == "" { effectiveUniverseDomain = audienceDomain } else if audienceDomain != "" && effectiveUniverseDomain != audienceDomain { - return nil, fmt.Errorf("trustboundary: provided universe domain (%q) does not match domain in audience (%q)", inputUniverseDomain, audienceDomain) + return nil, fmt.Errorf("regionalaccessboundary: provided universe domain (%q) does not match domain in audience (%q)", inputUniverseDomain, audienceDomain) } if isWorkload { @@ -77,8 +77,8 @@ type workforcePoolConfigProvider struct { universeDomain string } -func (p *workforcePoolConfigProvider) GetTrustBoundaryEndpoint(ctx context.Context) (string, error) { - return fmt.Sprintf(workforceAllowedLocationsEndpoint, p.universeDomain, p.poolID), nil +func (p *workforcePoolConfigProvider) GetRegionalAccessBoundaryEndpoint(ctx context.Context) (string, error) { + return fmt.Sprintf(workforceAllowedLocationsEndpoint, p.poolID), nil } func (p *workforcePoolConfigProvider) GetUniverseDomain(ctx context.Context) (string, error) { @@ -91,8 +91,8 @@ type workloadIdentityPoolConfigProvider struct { universeDomain string } -func (p *workloadIdentityPoolConfigProvider) GetTrustBoundaryEndpoint(ctx context.Context) (string, error) { - return fmt.Sprintf(workloadAllowedLocationsEndpoint, p.universeDomain, p.projectNumber, p.poolID), nil +func (p *workloadIdentityPoolConfigProvider) GetRegionalAccessBoundaryEndpoint(ctx context.Context) (string, error) { + return fmt.Sprintf(workloadAllowedLocationsEndpoint, p.projectNumber, p.poolID), nil } func (p *workloadIdentityPoolConfigProvider) GetUniverseDomain(ctx context.Context) (string, error) { diff --git a/vendor/cloud.google.com/go/auth/internal/regionalaccessboundary/regional_access_boundary.go b/vendor/cloud.google.com/go/auth/internal/regionalaccessboundary/regional_access_boundary.go new file mode 100644 index 000000000..a94d25ee0 --- /dev/null +++ b/vendor/cloud.google.com/go/auth/internal/regionalaccessboundary/regional_access_boundary.go @@ -0,0 +1,503 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package regionalaccessboundary + +import ( + "context" + "encoding/json" + "errors" + "fmt" + "io" + "log/slog" + "maps" + "math/rand" + "net" + "net/http" + "net/url" + "os" + "strings" + "sync" + "time" + + "cloud.google.com/go/auth" + "cloud.google.com/go/auth/internal" + "cloud.google.com/go/auth/internal/retry" + "github.com/googleapis/gax-go/v2/internallog" +) + +// ProviderKey is the key to fetch the DataProvider from Token Metadata. +const ProviderKey = "regionalaccessboundary.ProviderKey" + +const ( + // serviceAccountAllowedLocationsEndpoint is the URL for fetching allowed locations for a given service account email. + serviceAccountAllowedLocationsEndpoint = "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/%s/allowedLocations" + + // cacheTTL is the duration cached RAB data remains valid before hard expiry. + cacheTTL = 6 * time.Hour + // cacheSoftExpiry is the threshold before hard expiry where a background refresh is triggered. + cacheSoftExpiry = 1 * time.Hour + // baseCooldownDuration is the initial delay after a failed background fetch. + baseCooldownDuration = 15 * time.Minute +) + +var ( + // retryOptions configures the retry behavior for Regional Access Boundary lookups. + retryOptions = &retry.Options{ + Initial: 1 * time.Second, + Max: 60 * time.Second, + Multiplier: 2.0, + MaxAttempts: 6, + } +) + +// isEnabled wraps isRegionalAccessBoundaryEnabled with sync.OnceValues to ensure it's +// called only once. +var isEnabled = sync.OnceValues(isRegionalAccessBoundaryEnabled) + +// IsEnabled returns if the Regional Access Boundary feature is enabled and an error if +// the configuration is invalid. The underlying check is performed only once. +func IsEnabled() (bool, error) { + return isEnabled() +} + +// isRegionalAccessBoundaryEnabled checks if the Regional Access Boundary feature +// is enabled via the GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED environment variable. +// +// If the environment variable is not set or empty, it is considered false. +// +// The environment variable is interpreted as a boolean with the following +// (case-insensitive) rules: +// - "true", "1" are considered true. +// - All other values (including "false", "0", or invalid strings) are considered false. +func isRegionalAccessBoundaryEnabled() (bool, error) { + val := strings.ToLower(os.Getenv("GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED")) + return val == "true" || val == "1", nil +} + +// ConfigProvider provides specific configuration for Regional Access Boundary lookups. +type ConfigProvider interface { + // GetRegionalAccessBoundaryEndpoint returns the endpoint URL for the Regional Access Boundary lookup. + GetRegionalAccessBoundaryEndpoint(ctx context.Context) (url string, err error) + // GetUniverseDomain returns the universe domain associated with the credential. + // It may return an error if the universe domain cannot be determined. + GetUniverseDomain(ctx context.Context) (string, error) +} + +// AllowedLocationsResponse is the structure of the response from the Regional Access Boundary API. +type AllowedLocationsResponse struct { + // Locations is the list of allowed locations. + Locations []string `json:"locations"` + // EncodedLocations is the encoded representation of the allowed locations. + EncodedLocations string `json:"encodedLocations"` +} + +// fetchRegionalAccessBoundaryData fetches the Regional Access Boundary data from the API. +func fetchRegionalAccessBoundaryData(ctx context.Context, client *http.Client, url string, token *auth.Token, logger *slog.Logger) (*internal.RegionalAccessBoundaryData, error) { + if logger == nil { + logger = slog.New(slog.NewTextHandler(io.Discard, nil)) + } + if client == nil { + return nil, errors.New("regionalaccessboundary: HTTP client is required") + } + + if url == "" { + return nil, errors.New("regionalaccessboundary: URL cannot be empty") + } + + req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil) + if err != nil { + return nil, fmt.Errorf("regionalaccessboundary: failed to create Regional Access Boundary request: %w", err) + } + + if token == nil || token.Value == "" { + return nil, errors.New("regionalaccessboundary: access token required for lookup API authentication") + } + typ := token.Type + if typ == "" { + typ = internal.TokenTypeBearer + } + req.Header.Set("Authorization", typ+" "+token.Value) + logger.DebugContext(ctx, "Regional Access Boundary request", "request", internallog.HTTPRequest(req, nil)) + + retryer := retry.NewWithOptions(retryOptions) + startTime := time.Now() + var response *http.Response + for { + response, err = client.Do(req) + + var statusCode int + if response != nil { + statusCode = response.StatusCode + } + pause, shouldRetry := retryer.Retry(statusCode, err) + + // Enforce a maximum 1 minute retry window for specific server errors. + if shouldRetry && (statusCode == 500 || statusCode == 502 || statusCode == 503 || statusCode == 504) { + if time.Since(startTime)+pause > 1*time.Minute { + shouldRetry = false + } + } + + if !shouldRetry { + break + } + + if response != nil { + // Drain and close the body to reuse the connection + io.Copy(io.Discard, response.Body) + response.Body.Close() + } + + if err := retry.Sleep(ctx, pause); err != nil { + return nil, err + } + } + + if err != nil { + return nil, fmt.Errorf("regionalaccessboundary: failed to fetch Regional Access Boundary: %w", err) + } + defer response.Body.Close() + + body, err := io.ReadAll(response.Body) + if err != nil { + return nil, fmt.Errorf("regionalaccessboundary: failed to read Regional Access Boundary response: %w", err) + } + + logger.DebugContext(ctx, "Regional Access Boundary response", "response", internallog.HTTPResponse(response, body)) + + if response.StatusCode != http.StatusOK { + return nil, fmt.Errorf("regionalaccessboundary: Regional Access Boundary request failed with status: %s, body: %s", response.Status, string(body)) + } + + apiResponse := AllowedLocationsResponse{} + if err := json.Unmarshal(body, &apiResponse); err != nil { + return nil, fmt.Errorf("regionalaccessboundary: failed to unmarshal Regional Access Boundary response: %w", err) + } + + if apiResponse.EncodedLocations == "" { + return nil, errors.New("regionalaccessboundary: invalid API response: encodedLocations is empty") + } + + return internal.NewRegionalAccessBoundaryData(apiResponse.Locations, apiResponse.EncodedLocations), nil +} + +// DataProvider fetches and caches Regional Access Boundary Data. +// It implements the auth.TokenProvider interface and uses a ConfigProvider +// to get type-specific details for the lookup. +type DataProvider struct { + client *http.Client + configProvider ConfigProvider + logger *slog.Logger + base auth.TokenProvider + + mu sync.RWMutex + data *internal.RegionalAccessBoundaryData + dataExpiry time.Time + isFetching bool + cooldownExpiry time.Time + cooldownDuration time.Duration // tracks the current cooldown duration for exponential backoff +} + +// NewProvider wraps the provided base [auth.TokenProvider] and returns a new +// provider that fetches and caches the Regional Access Boundary data. It uses +// the provided HTTP client and configProvider. +func NewProvider(client *http.Client, configProvider ConfigProvider, logger *slog.Logger, base auth.TokenProvider) (*DataProvider, error) { + if client == nil { + return nil, errors.New("regionalaccessboundary: HTTP client cannot be nil for DataProvider") + } + if configProvider == nil { + return nil, errors.New("regionalaccessboundary: ConfigProvider cannot be nil for DataProvider") + } + p := &DataProvider{ + client: client, + configProvider: configProvider, + logger: internallog.New(logger), + base: base, + cooldownDuration: 15 * time.Minute, + } + return p, nil +} + +// Token retrieves a token from the base provider and injects the DataProvider +// instance into its metadata. +func (p *DataProvider) Token(ctx context.Context) (*auth.Token, error) { + token, err := p.base.Token(ctx) + if err != nil { + return nil, err + } + + // Clone the token and its metadata to avoid mutating shared/cached state. + newToken := *token + newToken.Metadata = maps.Clone(token.Metadata) + if newToken.Metadata == nil { + newToken.Metadata = make(map[string]interface{}) + } + newToken.Metadata[ProviderKey] = p + + return &newToken, nil +} + +// GetHeaderValue immediately returns a valid header if it's cached, or kicks off a background fetch +// if it is unpopulated or expired. +func (p *DataProvider) GetHeaderValue(ctx context.Context, reqURL string, accessToken *auth.Token) string { + if !strings.Contains(reqURL, "://") { + reqURL = "https://" + reqURL + } + if u, err := url.Parse(reqURL); err == nil { + host := u.Host + if host == "" && strings.HasPrefix(u.Path, "/") { + host = strings.TrimPrefix(u.Path, "/") + } + if h, _, err := net.SplitHostPort(host); err == nil { + host = h + } + // Skip lookup for regional endpoints. + if host == "rep.googleapis.com" || strings.HasSuffix(host, ".rep.googleapis.com") || + host == "rep.sandbox.googleapis.com" || strings.HasSuffix(host, ".rep.sandbox.googleapis.com") { + return "" + } + // Skip lookup for IAM and STS endpoints as they do not require RAB headers. + if host == "iam.googleapis.com" || host == "iamcredentials.googleapis.com" || + host == "sts.googleapis.com" { + return "" + } + } + + // Skip lookup for non-default universe domains. + uniDomain, err := p.configProvider.GetUniverseDomain(ctx) + if err != nil { + p.logger.WarnContext(ctx, "regionalaccessboundary: error getting universe domain", "error", err) + return "" + } + if uniDomain != "" && uniDomain != internal.DefaultUniverseDomain { + return "" + } + + // Return the cached data if present and not expired. + p.mu.RLock() + data := p.data + dataExpiry := p.dataExpiry + p.mu.RUnlock() + + now := time.Now() + if data != nil && now.Before(dataExpiry) { + val, _ := data.RegionalAccessBoundaryHeader() + + // Soft Expiry: if the cached data is within the soft expiration window, + // initiate a non-blocking background refresh to proactively fetch new data + // while continuing to serve the current valid cache block. + if now.After(dataExpiry.Add(-cacheSoftExpiry)) { + p.mu.Lock() + if !p.isFetching && now.After(p.cooldownExpiry) { + p.isFetching = true + go p.fetchAsync(context.Background(), accessToken) + } + p.mu.Unlock() + } + + return val + } + + p.mu.Lock() + defer p.mu.Unlock() + + // Skip lookup if in cooldown or another process is already fetching. + if p.isFetching || time.Now().Before(p.cooldownExpiry) { + return "" + } + + // Start async RAB lookup and return empty header. + p.isFetching = true + go p.fetchAsync(context.Background(), accessToken) + return "" +} + +// fetchAsync performs the background lookup for Regional Access Boundary data. +// It updates the provider's state based on the result (success or failure). +func (p *DataProvider) fetchAsync(ctx context.Context, accessToken *auth.Token) { + defer func() { + p.mu.Lock() + p.isFetching = false + p.mu.Unlock() + }() + + url, err := p.configProvider.GetRegionalAccessBoundaryEndpoint(ctx) + if err != nil { + p.logger.WarnContext(ctx, "regionalaccessboundary: error getting the lookup endpoint", "error", err) + p.handleFetchFailure(ctx) + return + } + + newData, fetchErr := fetchRegionalAccessBoundaryData(ctx, p.client, url, accessToken, p.logger) + + if fetchErr != nil { + p.logger.WarnContext(ctx, "regionalaccessboundary: async fetch failed", "error", fetchErr) + p.handleFetchFailure(ctx) + return + } + + p.handleFetchSuccess(newData) +} + +// handleFetchSuccess updates the cache with new data and clears any existing cooldown. +func (p *DataProvider) handleFetchSuccess(newData *internal.RegionalAccessBoundaryData) { + p.mu.Lock() + defer p.mu.Unlock() + p.data = newData + p.dataExpiry = time.Now().Add(cacheTTL) + p.cooldownExpiry = time.Time{} + p.cooldownDuration = baseCooldownDuration +} + +// handleFetchFailure triggers the cooldown period using exponential backoff. +func (p *DataProvider) handleFetchFailure(ctx context.Context) { + p.mu.Lock() + defer p.mu.Unlock() + + // Add random bounded jitter (between half of the base and the full base) to prevent thundering herds + jitter := p.cooldownDuration/2 + time.Duration(rand.Int63n(int64(p.cooldownDuration/2))) + p.cooldownExpiry = time.Now().Add(jitter) + + // Exponential backoff for the NEXT attempt, up to cacheTTL max (6 hours) + nextCooldown := p.cooldownDuration * 2 + if nextCooldown > cacheTTL { + nextCooldown = cacheTTL + } + p.cooldownDuration = nextCooldown +} + +// serviceAccountConfig holds configuration for SA Regional Access Boundary lookups. +// It implements the ConfigProvider interface. +type serviceAccountConfig struct { + ServiceAccountEmail string + UniverseDomain string +} + +// NewServiceAccountConfigProvider creates a new config for service accounts. +func NewServiceAccountConfigProvider(saEmail, universeDomain string) ConfigProvider { + return &serviceAccountConfig{ + ServiceAccountEmail: saEmail, + UniverseDomain: universeDomain, + } +} + +// GetRegionalAccessBoundaryEndpoint returns the formatted URL for fetching allowed locations +// for the configured service account. +func (sac *serviceAccountConfig) GetRegionalAccessBoundaryEndpoint(ctx context.Context) (url string, err error) { + if sac.ServiceAccountEmail == "" { + return "", errors.New("regionalaccessboundary: service account email cannot be empty for config") + } + return fmt.Sprintf(serviceAccountAllowedLocationsEndpoint, sac.ServiceAccountEmail), nil +} + +// GetUniverseDomain returns the configured universe domain, defaulting to +// [internal.DefaultUniverseDomain] if not explicitly set. +func (sac *serviceAccountConfig) GetUniverseDomain(ctx context.Context) (string, error) { + if sac.UniverseDomain == "" { + return internal.DefaultUniverseDomain, nil + } + return sac.UniverseDomain, nil +} + +// GCEConfigProvider implements ConfigProvider for GCE environments. +// It lazily fetches and caches the necessary metadata (service account email, universe domain) +type GCEConfigProvider struct { + // universeDomainProvider provides the universe domain and underlying metadata client. + universeDomainProvider *internal.ComputeUniverseDomainProvider + + // Caching for service account email + saMu sync.Mutex + saEmail string + + // Caching for universe domain + udOnce sync.Once + ud string + udErr error +} + +// NewGCEConfigProvider creates a new GCEConfigProvider +// which uses the provided gceUDP to interact with the GCE metadata server. +func NewGCEConfigProvider(gceUDP *internal.ComputeUniverseDomainProvider) *GCEConfigProvider { + // The validity of gceUDP and its internal MetadataClient will be checked + // within the GetRegionalAccessBoundaryEndpoint and GetUniverseDomain methods. + return &GCEConfigProvider{ + universeDomainProvider: gceUDP, + } +} + +func (g *GCEConfigProvider) fetchSA(ctx context.Context) (string, error) { + if g.universeDomainProvider == nil || g.universeDomainProvider.MetadataClient == nil { + return "", errors.New("regionalaccessboundary: GCEConfigProvider not properly initialized (missing ComputeUniverseDomainProvider or MetadataClient)") + } + mdClient := g.universeDomainProvider.MetadataClient + saEmail, err := mdClient.EmailWithContext(ctx, "default") + if err != nil { + return "", fmt.Errorf("regionalaccessboundary: GCE config: failed to get service account email: %w", err) + } + return saEmail, nil +} + +func (g *GCEConfigProvider) fetchUD(ctx context.Context) { + if g.universeDomainProvider == nil || g.universeDomainProvider.MetadataClient == nil { + g.udErr = errors.New("regionalaccessboundary: GCEConfigProvider not properly initialized (missing ComputeUniverseDomainProvider or MetadataClient)") + return + } + ud, err := g.universeDomainProvider.GetProperty(ctx) + if err != nil { + g.udErr = fmt.Errorf("regionalaccessboundary: GCE config: failed to get universe domain: %w", err) + return + } + if ud == "" { + ud = internal.DefaultUniverseDomain + } + g.ud = ud +} + +// GetRegionalAccessBoundaryEndpoint constructs the Regional Access Boundary lookup URL for a GCE environment. +// It uses cached service account email after the first call. +func (g *GCEConfigProvider) GetRegionalAccessBoundaryEndpoint(ctx context.Context) (string, error) { + // Check if we already have a cached service account email. + g.saMu.Lock() + if g.saEmail != "" { + email := g.saEmail + g.saMu.Unlock() + return fmt.Sprintf(serviceAccountAllowedLocationsEndpoint, email), nil + } + g.saMu.Unlock() + + // Fetch the email from the metadata server. We do not hold the lock + // during this I/O operation to avoid blocking other goroutines. + email, err := g.fetchSA(ctx) + if err != nil { + return "", err + } + + // Cache the successful result. + g.saMu.Lock() + g.saEmail = email + g.saMu.Unlock() + + return fmt.Sprintf(serviceAccountAllowedLocationsEndpoint, email), nil +} + +// GetUniverseDomain retrieves the universe domain from the GCE metadata server. +// It uses a cached value after the first call. +func (g *GCEConfigProvider) GetUniverseDomain(ctx context.Context) (string, error) { + g.udOnce.Do(func() { g.fetchUD(ctx) }) + if g.udErr != nil { + return "", g.udErr + } + return g.ud, nil +} diff --git a/vendor/cloud.google.com/go/auth/internal/retry/retry.go b/vendor/cloud.google.com/go/auth/internal/retry/retry.go index 276cc4a3e..7cbd06a76 100644 --- a/vendor/cloud.google.com/go/auth/internal/retry/retry.go +++ b/vendor/cloud.google.com/go/auth/internal/retry/retry.go @@ -22,10 +22,6 @@ import ( "time" ) -const ( - maxRetryAttempts = 5 -) - var ( syscallRetryable = func(error) bool { return false } ) @@ -61,21 +57,69 @@ func Sleep(ctx context.Context, d time.Duration) error { // New returns a new Retryer with the default backoff strategy. func New() *Retryer { - return &Retryer{bo: &defaultBackoff{ - cur: 100 * time.Millisecond, - max: 30 * time.Second, - mul: 2, - }} + return NewWithOptions(&Options{ + Initial: 100 * time.Millisecond, + Max: 30 * time.Second, + Multiplier: 2, + MaxAttempts: 5, + }) +} + +// Options defines the configuration for the Retryer. +type Options struct { + // Initial is the initial backoff duration. + Initial time.Duration + // Max is the maximum backoff duration for a single retry attempt. + // It does not limit the total time of all retries. + Max time.Duration + // Multiplier is the factor by which the backoff duration is multiplied after each attempt. + Multiplier float64 + // MaxAttempts is the maximum number of attempts before giving up. + MaxAttempts int +} + +// NewWithOptions returns a new Retryer with the specified backoff strategy. +// If any option is not set (zero value), it defaults to the values used in New(). +func NewWithOptions(opts *Options) *Retryer { + initial := opts.Initial + if initial <= 0 { + initial = 100 * time.Millisecond + } + + max := opts.Max + if max <= 0 { + max = 30 * time.Second + } + + multiplier := opts.Multiplier + if multiplier < 1.0 { + multiplier = 2.0 + } + + maxAttempts := opts.MaxAttempts + if maxAttempts <= 0 { + maxAttempts = 5 + } + + return &Retryer{ + bo: &defaultBackoff{ + cur: initial, + max: max, + mul: multiplier, + }, + maxAttempts: maxAttempts, + } } type backoff interface { Pause() time.Duration } -// Retryer is a retryer for HTTP requests. +// Retryer handles retry logic for HTTP requests using a configurable backoff strategy. type Retryer struct { - bo backoff - attempts int + bo backoff + attempts int + maxAttempts int } // Retry determines if a request should be retried. @@ -87,7 +131,7 @@ func (r *Retryer) Retry(status int, err error) (time.Duration, bool) { if !retryOk { return 0, false } - if r.attempts == maxRetryAttempts { + if r.attempts == r.maxAttempts { return 0, false } r.attempts++ diff --git a/vendor/cloud.google.com/go/auth/internal/retry/retry_linux.go b/vendor/cloud.google.com/go/auth/internal/retry/retry_linux.go new file mode 100644 index 000000000..8f0a78c57 --- /dev/null +++ b/vendor/cloud.google.com/go/auth/internal/retry/retry_linux.go @@ -0,0 +1,31 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +//go:build linux +// +build linux + +package retry + +import ( + "errors" + "syscall" +) + +func init() { + // Initialize syscallRetryable to return true on transient socket-level + // errors. These errors are specific to Linux. + syscallRetryable = func(err error) bool { + return errors.Is(err, syscall.ECONNRESET) || errors.Is(err, syscall.ECONNREFUSED) + } +} diff --git a/vendor/cloud.google.com/go/auth/internal/transport/cba.go b/vendor/cloud.google.com/go/auth/internal/transport/cba.go index 14bca966e..ebce7db51 100644 --- a/vendor/cloud.google.com/go/auth/internal/transport/cba.go +++ b/vendor/cloud.google.com/go/auth/internal/transport/cba.go @@ -65,15 +65,16 @@ const ( // transport packages in order to avoid cyclic deps. It correlates 1:1 with // fields on httptransport.Options and grpctransport.Options. type Options struct { - Endpoint string - DefaultEndpointTemplate string - DefaultMTLSEndpoint string - ClientCertProvider cert.Provider - Client *http.Client - UniverseDomain string - EnableDirectPath bool - EnableDirectPathXds bool - Logger *slog.Logger + Endpoint string + DefaultEndpointTemplate string + DefaultMTLSEndpoint string + ClientCertProvider cert.Provider + Client *http.Client + UniverseDomain string + EnableDirectPath bool + EnableDirectPathXds bool + EnableDirectPathXdsOverInterconnect bool + Logger *slog.Logger } // getUniverseDomain returns the default service domain for a given Cloud diff --git a/vendor/cloud.google.com/go/auth/internal/transport/cert/secureconnect_cert.go b/vendor/cloud.google.com/go/auth/internal/transport/cert/secureconnect_cert.go index 738cb2161..ecb2448b8 100644 --- a/vendor/cloud.google.com/go/auth/internal/transport/cert/secureconnect_cert.go +++ b/vendor/cloud.google.com/go/auth/internal/transport/cert/secureconnect_cert.go @@ -76,9 +76,17 @@ func NewSecureConnectProvider(configFilePath string) (Provider, error) { if err := validateMetadata(metadata); err != nil { return nil, fmt.Errorf("cert: invalid config in %q: %w", configFilePath, err) } - return (&secureConnectSource{ + source := &secureConnectSource{ metadata: metadata, - }).getClientCertificate, nil + } + _, err = source.getClientCertificate(nil) + if errors.Is(err, errSourceUnavailable) { + return nil, errSourceUnavailable + } + if err != nil { + return nil, err + } + return source.getClientCertificate, nil } func validateMetadata(metadata secureConnectMetadata) error { @@ -101,7 +109,10 @@ func (s *secureConnectSource) getClientCertificate(info *tls.CertificateRequestI command := s.metadata.Cmd data, err := exec.Command(command[0], command[1:]...).Output() if err != nil { - return nil, err + // Return errSourceUnavailable so the probe in NewSecureConnectProvider + // can recognize the source as unavailable, and so crypto/tls aborts + // the handshake with a clear error if it fails at runtime. + return nil, fmt.Errorf("%w: %v", errSourceUnavailable, err) } cert, err := tls.X509KeyPair(data, data) if err != nil { diff --git a/vendor/cloud.google.com/go/auth/internal/transport/cert/workload_cert.go b/vendor/cloud.google.com/go/auth/internal/transport/cert/workload_cert.go index b2a3be23c..ddb0c3809 100644 --- a/vendor/cloud.google.com/go/auth/internal/transport/cert/workload_cert.go +++ b/vendor/cloud.google.com/go/auth/internal/transport/cert/workload_cert.go @@ -37,11 +37,21 @@ type certificateConfig struct { CertConfigs certConfigs `json:"cert_configs"` } -// getconfigFilePath determines the path to the certificate configuration file. +type certConfigInfo struct { + certPath string // path to the certificate file + keyPath string // path to the private key file + useECP bool // whether to use Enterprise Certificate Proxy +} + +// GetConfigFilePath determines the path to the certificate configuration file. // It first checks for the presence of an environment variable that specifies // the file path. If the environment variable is not set, it falls back to -// a default configuration file path. -func getconfigFilePath() string { +// a default configuration file path. If a non-empty configFilePath is provided, +// it is returned. +func GetConfigFilePath(configFilePath string) string { + if configFilePath != "" { + return configFilePath + } envFilePath := util.GetConfigFilePathFromEnv() if envFilePath != "" { return envFilePath @@ -50,21 +60,32 @@ func getconfigFilePath() string { } -// GetCertificatePath retrieves the certificate file path from the provided +// GetFileBasedCertificatePath retrieves the certificate file path from the provided // configuration file. If the configFilePath is empty, it attempts to load // the configuration from a well-known gcloud location. // This function is exposed to allow other packages, such as the // externalaccount package, to retrieve the certificate path without needing // to load the entire certificate configuration. -func GetCertificatePath(configFilePath string) (string, error) { - if configFilePath == "" { - configFilePath = getconfigFilePath() - } - certFile, _, err := getCertAndKeyFiles(configFilePath) +func GetFileBasedCertificatePath(configFilePath string) (string, error) { + configFilePath = GetConfigFilePath(configFilePath) + info, err := parseCertConfig(configFilePath) if err != nil { return "", err } - return certFile, nil + if info.useECP { + return "", errors.New("enterprise certificate proxy is enabled, certificate path is not available") + } + return info.certPath, nil +} + +// IsECPConfig checks if the given configuration is an ECP certificate configuration. +func IsECPConfig(configFilePath string) bool { + configFilePath = GetConfigFilePath(configFilePath) + info, err := parseCertConfig(configFilePath) + if err != nil { + return false + } + return info.useECP } // NewWorkloadX509CertProvider creates a certificate source @@ -76,17 +97,19 @@ func GetCertificatePath(configFilePath string) (string, error) { // If configFilePath is empty, the client will attempt to load the config from // a well-known gcloud location. func NewWorkloadX509CertProvider(configFilePath string) (Provider, error) { - if configFilePath == "" { - configFilePath = getconfigFilePath() - } - certFile, keyFile, err := getCertAndKeyFiles(configFilePath) + configFilePath = GetConfigFilePath(configFilePath) + info, err := parseCertConfig(configFilePath) if err != nil { return nil, err } + if info.useECP { + return NewEnterpriseCertificateProxyProvider(configFilePath) + } + source := &workloadSource{ - CertPath: certFile, - KeyPath: keyFile, + CertPath: info.certPath, + KeyPath: info.keyPath, } return source.getClientCertificate, nil } @@ -101,38 +124,60 @@ func (s *workloadSource) getClientCertificate(info *tls.CertificateRequestInfo) return &cert, nil } -// getCertAndKeyFiles attempts to read the provided config file and return the certificate and private -// key file paths. -func getCertAndKeyFiles(configFilePath string) (string, string, error) { +// parseCertConfig attempts to read the provided config file and return the certificate, private +// key file paths, and a boolean indicating whether to use ECP inside a certConfigInfo struct. +func parseCertConfig(configFilePath string) (certConfigInfo, error) { jsonFile, err := os.Open(configFilePath) if err != nil { - return "", "", errSourceUnavailable + return certConfigInfo{}, errSourceUnavailable } + defer jsonFile.Close() byteValue, err := io.ReadAll(jsonFile) if err != nil { - return "", "", err + return certConfigInfo{}, err } var config certificateConfig if err := json.Unmarshal(byteValue, &config); err != nil { - return "", "", err + return certConfigInfo{}, err } if config.CertConfigs.Workload == nil { - return "", "", errSourceUnavailable + // If 'workload' field is absent, it is an ECP config. + // Validate that the config file is a valid ECP file. + var rawMap map[string]any + if err := json.Unmarshal(byteValue, &rawMap); err != nil { + return certConfigInfo{}, err + } + certConfigs, ok := rawMap["cert_configs"].(map[string]any) + if !ok { + return certConfigInfo{}, errSourceUnavailable + } + hasECPSection := false + for _, section := range []string{"pkcs11", "windows_store", "macos_keychain"} { + if _, exists := certConfigs[section]; exists { + hasECPSection = true + break + } + } + _, hasLibs := rawMap["libs"] + if !hasECPSection || !hasLibs { + return certConfigInfo{}, errSourceUnavailable + } + return certConfigInfo{useECP: true}, nil } certFile := config.CertConfigs.Workload.CertPath keyFile := config.CertConfigs.Workload.KeyPath if certFile == "" { - return "", "", errors.New("certificate configuration is missing the certificate file location") + return certConfigInfo{}, errors.New("certificate configuration is missing the certificate file location") } if keyFile == "" { - return "", "", errors.New("certificate configuration is missing the key file location") + return certConfigInfo{}, errors.New("certificate configuration is missing the key file location") } - return certFile, keyFile, nil + return certConfigInfo{certPath: certFile, keyPath: keyFile}, nil } diff --git a/vendor/cloud.google.com/go/auth/internal/transport/headers/headers.go b/vendor/cloud.google.com/go/auth/internal/transport/headers/headers.go index 5483a763c..01c06e272 100644 --- a/vendor/cloud.google.com/go/auth/internal/transport/headers/headers.go +++ b/vendor/cloud.google.com/go/auth/internal/transport/headers/headers.go @@ -15,14 +15,20 @@ package headers import ( + "context" "net/http" "cloud.google.com/go/auth" "cloud.google.com/go/auth/internal" + "cloud.google.com/go/auth/internal/regionalaccessboundary" ) -// SetAuthHeader uses the provided token to set the Authorization and trust -// boundary headers on a request. If the token.Type is empty, the type is +type regionalAccessBoundaryProvider interface { + GetHeaderValue(ctx context.Context, reqURL string, token *auth.Token) string +} + +// SetAuthHeader uses the provided token to set the Authorization and regional +// access boundary headers on a request. If the token.Type is empty, the type is // assumed to be Bearer. func SetAuthHeader(token *auth.Token, req *http.Request) { typ := token.Type @@ -31,31 +37,26 @@ func SetAuthHeader(token *auth.Token, req *http.Request) { } req.Header.Set("Authorization", typ+" "+token.Value) - if headerVal, setHeader := getTrustBoundaryHeader(token); setHeader { - req.Header.Set("x-allowed-locations", headerVal) + if provider, ok := token.Metadata[regionalaccessboundary.ProviderKey].(regionalAccessBoundaryProvider); ok { + if headerVal := provider.GetHeaderValue(req.Context(), req.URL.String(), token); headerVal != "" { + req.Header.Set("x-allowed-locations", headerVal) + } } } -// SetAuthMetadata uses the provided token to set the Authorization and trust -// boundary metadata. If the token.Type is empty, the type is assumed to be +// SetAuthMetadata uses the provided token to set the Authorization and regional +// access boundary metadata. If the token.Type is empty, the type is assumed to be // Bearer. -func SetAuthMetadata(token *auth.Token, m map[string]string) { +func SetAuthMetadata(ctx context.Context, token *auth.Token, reqURL string, m map[string]string) { typ := token.Type if typ == "" { typ = internal.TokenTypeBearer } m["authorization"] = typ + " " + token.Value - if headerVal, setHeader := getTrustBoundaryHeader(token); setHeader { - m["x-allowed-locations"] = headerVal - } -} - -func getTrustBoundaryHeader(token *auth.Token) (val string, present bool) { - if data, ok := token.Metadata[internal.TrustBoundaryDataKey]; ok { - if tbd, ok := data.(internal.TrustBoundaryData); ok { - return tbd.TrustBoundaryHeader() + if provider, ok := token.Metadata[regionalaccessboundary.ProviderKey].(regionalAccessBoundaryProvider); ok { + if headerVal := provider.GetHeaderValue(ctx, reqURL, token); headerVal != "" { + m["x-allowed-locations"] = headerVal } } - return "", false } diff --git a/vendor/cloud.google.com/go/auth/internal/transport/s2a.go b/vendor/cloud.google.com/go/auth/internal/transport/s2a.go index a63309956..7e74590dd 100644 --- a/vendor/cloud.google.com/go/auth/internal/transport/s2a.go +++ b/vendor/cloud.google.com/go/auth/internal/transport/s2a.go @@ -126,7 +126,7 @@ func shouldUseS2A(clientCertSource cert.Provider, opts *Options) bool { return false } // If directPath is enabled, skip S2A. - return !opts.EnableDirectPath && !opts.EnableDirectPathXds + return !opts.EnableDirectPath && !opts.EnableDirectPathXds && !opts.EnableDirectPathXdsOverInterconnect } func isGoogleS2AEnabled() bool { diff --git a/vendor/cloud.google.com/go/auth/internal/transport/transport.go b/vendor/cloud.google.com/go/auth/internal/transport/transport.go index fb0a8a1e0..c4f4c26b7 100644 --- a/vendor/cloud.google.com/go/auth/internal/transport/transport.go +++ b/vendor/cloud.google.com/go/auth/internal/transport/transport.go @@ -67,15 +67,16 @@ func CloneDetectOptions(oldDo *credentials.DetectOptions) *credentials.DetectOpt } newDo := &credentials.DetectOptions{ // Simple types - TokenBindingType: oldDo.TokenBindingType, - Audience: oldDo.Audience, - Subject: oldDo.Subject, - EarlyTokenRefresh: oldDo.EarlyTokenRefresh, - TokenURL: oldDo.TokenURL, - STSAudience: oldDo.STSAudience, - CredentialsFile: oldDo.CredentialsFile, - UseSelfSignedJWT: oldDo.UseSelfSignedJWT, - UniverseDomain: oldDo.UniverseDomain, + TokenBindingType: oldDo.TokenBindingType, + Audience: oldDo.Audience, + Subject: oldDo.Subject, + EarlyTokenRefresh: oldDo.EarlyTokenRefresh, + DisableAsyncRefresh: oldDo.DisableAsyncRefresh, + TokenURL: oldDo.TokenURL, + STSAudience: oldDo.STSAudience, + CredentialsFile: oldDo.CredentialsFile, + UseSelfSignedJWT: oldDo.UseSelfSignedJWT, + UniverseDomain: oldDo.UniverseDomain, // These fields are pointer types that we just want to use exactly as // the user set, copy the ref diff --git a/vendor/cloud.google.com/go/auth/internal/trustboundary/trust_boundary.go b/vendor/cloud.google.com/go/auth/internal/trustboundary/trust_boundary.go deleted file mode 100644 index bf898fffd..000000000 --- a/vendor/cloud.google.com/go/auth/internal/trustboundary/trust_boundary.go +++ /dev/null @@ -1,392 +0,0 @@ -// Copyright 2025 Google LLC -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -package trustboundary - -import ( - "context" - "encoding/json" - "errors" - "fmt" - "io" - "log/slog" - "net/http" - "os" - "strings" - "sync" - - "cloud.google.com/go/auth" - "cloud.google.com/go/auth/internal" - "cloud.google.com/go/auth/internal/retry" - "cloud.google.com/go/auth/internal/transport/headers" - "github.com/googleapis/gax-go/v2/internallog" -) - -const ( - // serviceAccountAllowedLocationsEndpoint is the URL for fetching allowed locations for a given service account email. - serviceAccountAllowedLocationsEndpoint = "https://iamcredentials.%s/v1/projects/-/serviceAccounts/%s/allowedLocations" -) - -// isEnabled wraps isTrustBoundaryEnabled with sync.OnceValues to ensure it's -// called only once. -var isEnabled = sync.OnceValues(isTrustBoundaryEnabled) - -// IsEnabled returns if the trust boundary feature is enabled and an error if -// the configuration is invalid. The underlying check is performed only once. -func IsEnabled() (bool, error) { - return isEnabled() -} - -// isTrustBoundaryEnabled checks if the trust boundary feature is enabled via -// GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED environment variable. -// -// If the environment variable is not set, it is considered false. -// -// The environment variable is interpreted as a boolean with the following -// (case-insensitive) rules: -// - "true", "1" are considered true. -// - "false", "0" are considered false. -// -// Any other values will return an error. -func isTrustBoundaryEnabled() (bool, error) { - const envVar = "GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED" - val, ok := os.LookupEnv(envVar) - if !ok { - return false, nil - } - val = strings.ToLower(val) - switch val { - case "true", "1": - return true, nil - case "false", "0": - return false, nil - default: - return false, fmt.Errorf(`invalid value for %s: %q. Must be one of "true", "false", "1", or "0"`, envVar, val) - } -} - -// ConfigProvider provides specific configuration for trust boundary lookups. -type ConfigProvider interface { - // GetTrustBoundaryEndpoint returns the endpoint URL for the trust boundary lookup. - GetTrustBoundaryEndpoint(ctx context.Context) (url string, err error) - // GetUniverseDomain returns the universe domain associated with the credential. - // It may return an error if the universe domain cannot be determined. - GetUniverseDomain(ctx context.Context) (string, error) -} - -// AllowedLocationsResponse is the structure of the response from the Trust Boundary API. -type AllowedLocationsResponse struct { - // Locations is the list of allowed locations. - Locations []string `json:"locations"` - // EncodedLocations is the encoded representation of the allowed locations. - EncodedLocations string `json:"encodedLocations"` -} - -// fetchTrustBoundaryData fetches the trust boundary data from the API. -func fetchTrustBoundaryData(ctx context.Context, client *http.Client, url string, token *auth.Token, logger *slog.Logger) (*internal.TrustBoundaryData, error) { - if logger == nil { - logger = slog.New(slog.NewTextHandler(io.Discard, nil)) - } - if client == nil { - return nil, errors.New("trustboundary: HTTP client is required") - } - - if url == "" { - return nil, errors.New("trustboundary: URL cannot be empty") - } - - req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil) - if err != nil { - return nil, fmt.Errorf("trustboundary: failed to create trust boundary request: %w", err) - } - - if token == nil || token.Value == "" { - return nil, errors.New("trustboundary: access token required for lookup API authentication") - } - headers.SetAuthHeader(token, req) - logger.DebugContext(ctx, "trust boundary request", "request", internallog.HTTPRequest(req, nil)) - - retryer := retry.New() - var response *http.Response - for { - response, err = client.Do(req) - - var statusCode int - if response != nil { - statusCode = response.StatusCode - } - pause, shouldRetry := retryer.Retry(statusCode, err) - - if !shouldRetry { - break - } - - if response != nil { - // Drain and close the body to reuse the connection - io.Copy(io.Discard, response.Body) - response.Body.Close() - } - - if err := retry.Sleep(ctx, pause); err != nil { - return nil, err - } - } - - if err != nil { - return nil, fmt.Errorf("trustboundary: failed to fetch trust boundary: %w", err) - } - defer response.Body.Close() - - body, err := io.ReadAll(response.Body) - if err != nil { - return nil, fmt.Errorf("trustboundary: failed to read trust boundary response: %w", err) - } - - logger.DebugContext(ctx, "trust boundary response", "response", internallog.HTTPResponse(response, body)) - - if response.StatusCode != http.StatusOK { - return nil, fmt.Errorf("trustboundary: trust boundary request failed with status: %s, body: %s", response.Status, string(body)) - } - - apiResponse := AllowedLocationsResponse{} - if err := json.Unmarshal(body, &apiResponse); err != nil { - return nil, fmt.Errorf("trustboundary: failed to unmarshal trust boundary response: %w", err) - } - - if apiResponse.EncodedLocations == "" { - return nil, errors.New("trustboundary: invalid API response: encodedLocations is empty") - } - - return internal.NewTrustBoundaryData(apiResponse.Locations, apiResponse.EncodedLocations), nil -} - -// serviceAccountConfig holds configuration for SA trust boundary lookups. -// It implements the ConfigProvider interface. -type serviceAccountConfig struct { - ServiceAccountEmail string - UniverseDomain string -} - -// NewServiceAccountConfigProvider creates a new config for service accounts. -func NewServiceAccountConfigProvider(saEmail, universeDomain string) ConfigProvider { - return &serviceAccountConfig{ - ServiceAccountEmail: saEmail, - UniverseDomain: universeDomain, - } -} - -// GetTrustBoundaryEndpoint returns the formatted URL for fetching allowed locations -// for the configured service account and universe domain. -func (sac *serviceAccountConfig) GetTrustBoundaryEndpoint(ctx context.Context) (url string, err error) { - if sac.ServiceAccountEmail == "" { - return "", errors.New("trustboundary: service account email cannot be empty for config") - } - ud := sac.UniverseDomain - if ud == "" { - ud = internal.DefaultUniverseDomain - } - return fmt.Sprintf(serviceAccountAllowedLocationsEndpoint, ud, sac.ServiceAccountEmail), nil -} - -// GetUniverseDomain returns the configured universe domain, defaulting to -// [internal.DefaultUniverseDomain] if not explicitly set. -func (sac *serviceAccountConfig) GetUniverseDomain(ctx context.Context) (string, error) { - if sac.UniverseDomain == "" { - return internal.DefaultUniverseDomain, nil - } - return sac.UniverseDomain, nil -} - -// DataProvider fetches and caches trust boundary Data. -// It implements the DataProvider interface and uses a ConfigProvider -// to get type-specific details for the lookup. -type DataProvider struct { - client *http.Client - configProvider ConfigProvider - data *internal.TrustBoundaryData - logger *slog.Logger - base auth.TokenProvider -} - -// NewProvider wraps the provided base [auth.TokenProvider] to create a new -// provider that injects tokens with trust boundary data. It uses the provided -// HTTP client and configProvider to fetch the data and attach it to the token's -// metadata. -func NewProvider(client *http.Client, configProvider ConfigProvider, logger *slog.Logger, base auth.TokenProvider) (*DataProvider, error) { - if client == nil { - return nil, errors.New("trustboundary: HTTP client cannot be nil for DataProvider") - } - if configProvider == nil { - return nil, errors.New("trustboundary: ConfigProvider cannot be nil for DataProvider") - } - p := &DataProvider{ - client: client, - configProvider: configProvider, - logger: internallog.New(logger), - base: base, - } - return p, nil -} - -// Token retrieves a token from the base provider and injects it with trust -// boundary data. -func (p *DataProvider) Token(ctx context.Context) (*auth.Token, error) { - // Get the original token. - token, err := p.base.Token(ctx) - if err != nil { - return nil, err - } - - tbData, err := p.GetTrustBoundaryData(ctx, token) - if err != nil { - return nil, fmt.Errorf("trustboundary: error fetching the trust boundary data: %w", err) - } - if tbData != nil { - if token.Metadata == nil { - token.Metadata = make(map[string]interface{}) - } - token.Metadata[internal.TrustBoundaryDataKey] = *tbData - } - return token, nil -} - -// GetTrustBoundaryData retrieves the trust boundary data. -// It first checks the universe domain: if it's non-default, a NoOp is returned. -// Otherwise, it checks a local cache. If the data is not cached as NoOp, -// it fetches new data from the endpoint provided by its ConfigProvider, -// using the given accessToken for authentication. Results are cached. -// If fetching fails, it returns previously cached data if available, otherwise the fetch error. -func (p *DataProvider) GetTrustBoundaryData(ctx context.Context, token *auth.Token) (*internal.TrustBoundaryData, error) { - // Check the universe domain. - uniDomain, err := p.configProvider.GetUniverseDomain(ctx) - if err != nil { - return nil, fmt.Errorf("trustboundary: error getting universe domain: %w", err) - } - if uniDomain != "" && uniDomain != internal.DefaultUniverseDomain { - if p.data == nil || p.data.EncodedLocations != internal.TrustBoundaryNoOp { - p.data = internal.NewNoOpTrustBoundaryData() - } - return p.data, nil - } - - // Check cache for a no-op result from a previous API call. - cachedData := p.data - if cachedData != nil && cachedData.EncodedLocations == internal.TrustBoundaryNoOp { - return cachedData, nil - } - - // Get the endpoint - url, err := p.configProvider.GetTrustBoundaryEndpoint(ctx) - if err != nil { - return nil, fmt.Errorf("trustboundary: error getting the lookup endpoint: %w", err) - } - - // Proceed to fetch new data. - newData, fetchErr := fetchTrustBoundaryData(ctx, p.client, url, token, p.logger) - - if fetchErr != nil { - // Fetch failed. Fallback to cachedData if available. - if cachedData != nil { - return cachedData, nil // Successful fallback - } - // No cache to fallback to. - return nil, fmt.Errorf("trustboundary: failed to fetch trust boundary data for endpoint %s and no cache available: %w", url, fetchErr) - } - - // Fetch successful. Update cache. - p.data = newData - return newData, nil -} - -// GCEConfigProvider implements ConfigProvider for GCE environments. -// It lazily fetches and caches the necessary metadata (service account email, universe domain) -// from the GCE metadata server. -type GCEConfigProvider struct { - // universeDomainProvider provides the universe domain and underlying metadata client. - universeDomainProvider *internal.ComputeUniverseDomainProvider - - // Caching for service account email - saOnce sync.Once - saEmail string - saEmailErr error - - // Caching for universe domain - udOnce sync.Once - ud string - udErr error -} - -// NewGCEConfigProvider creates a new GCEConfigProvider -// which uses the provided gceUDP to interact with the GCE metadata server. -func NewGCEConfigProvider(gceUDP *internal.ComputeUniverseDomainProvider) *GCEConfigProvider { - // The validity of gceUDP and its internal MetadataClient will be checked - // within the GetTrustBoundaryEndpoint and GetUniverseDomain methods. - return &GCEConfigProvider{ - universeDomainProvider: gceUDP, - } -} - -func (g *GCEConfigProvider) fetchSA(ctx context.Context) { - if g.universeDomainProvider == nil || g.universeDomainProvider.MetadataClient == nil { - g.saEmailErr = errors.New("trustboundary: GCEConfigProvider not properly initialized (missing ComputeUniverseDomainProvider or MetadataClient)") - return - } - mdClient := g.universeDomainProvider.MetadataClient - saEmail, err := mdClient.EmailWithContext(ctx, "default") - if err != nil { - g.saEmailErr = fmt.Errorf("trustboundary: GCE config: failed to get service account email: %w", err) - return - } - g.saEmail = saEmail -} - -func (g *GCEConfigProvider) fetchUD(ctx context.Context) { - if g.universeDomainProvider == nil || g.universeDomainProvider.MetadataClient == nil { - g.udErr = errors.New("trustboundary: GCEConfigProvider not properly initialized (missing ComputeUniverseDomainProvider or MetadataClient)") - return - } - ud, err := g.universeDomainProvider.GetProperty(ctx) - if err != nil { - g.udErr = fmt.Errorf("trustboundary: GCE config: failed to get universe domain: %w", err) - return - } - if ud == "" { - ud = internal.DefaultUniverseDomain - } - g.ud = ud -} - -// GetTrustBoundaryEndpoint constructs the trust boundary lookup URL for a GCE environment. -// It uses cached metadata (service account email, universe domain) after the first call. -func (g *GCEConfigProvider) GetTrustBoundaryEndpoint(ctx context.Context) (string, error) { - g.saOnce.Do(func() { g.fetchSA(ctx) }) - if g.saEmailErr != nil { - return "", g.saEmailErr - } - g.udOnce.Do(func() { g.fetchUD(ctx) }) - if g.udErr != nil { - return "", g.udErr - } - return fmt.Sprintf(serviceAccountAllowedLocationsEndpoint, g.ud, g.saEmail), nil -} - -// GetUniverseDomain retrieves the universe domain from the GCE metadata server. -// It uses a cached value after the first call. -func (g *GCEConfigProvider) GetUniverseDomain(ctx context.Context) (string, error) { - g.udOnce.Do(func() { g.fetchUD(ctx) }) - if g.udErr != nil { - return "", g.udErr - } - return g.ud, nil -} diff --git a/vendor/cloud.google.com/go/auth/internal/version.go b/vendor/cloud.google.com/go/auth/internal/version.go index d627069b5..39e24f21c 100644 --- a/vendor/cloud.google.com/go/auth/internal/version.go +++ b/vendor/cloud.google.com/go/auth/internal/version.go @@ -17,4 +17,4 @@ package internal // Version is the current tagged release of the library. -const Version = "0.20.0" +const Version = "0.24.1" diff --git a/vendor/cloud.google.com/go/auth/oauth2adapt/CHANGES.md b/vendor/cloud.google.com/go/auth/oauth2adapt/CHANGES.md index 42716752e..4332fc2a8 100644 --- a/vendor/cloud.google.com/go/auth/oauth2adapt/CHANGES.md +++ b/vendor/cloud.google.com/go/auth/oauth2adapt/CHANGES.md @@ -1,4 +1,11 @@ -# Changelog +# Changes + +## [0.3.0](https://github.com/googleapis/google-cloud-go/compare/auth/oauth2adapt/v0.2.8...auth/oauth2adapt/v0.3.0) (2026-09-23) + + +### Features + +* **all:** Update supported go versions ([#20520](https://github.com/googleapis/google-cloud-go/issues/20520)) ([90413d3](https://github.com/googleapis/google-cloud-go/commit/90413d3e9d381ef4b92e3c496d98b023c5b2d8cc)) ## [0.2.8](https://github.com/googleapis/google-cloud-go/compare/auth/oauth2adapt/v0.2.7...auth/oauth2adapt/v0.2.8) (2025-03-17) diff --git a/vendor/cloud.google.com/go/auth/threelegged.go b/vendor/cloud.google.com/go/auth/threelegged.go index 07804dc16..9a9d02657 100644 --- a/vendor/cloud.google.com/go/auth/threelegged.go +++ b/vendor/cloud.google.com/go/auth/threelegged.go @@ -67,6 +67,9 @@ type Options3LO struct { // refreshed. If not set the default value is 3 minutes and 45 seconds. // Optional. EarlyTokenExpiry time.Duration + // DisableAsyncRefresh configures a synchronous workflow that refreshes + // stale tokens while blocking. The default is false. Optional. + DisableAsyncRefresh bool // AuthHandlerOpts provides a set of options for doing a // 3-legged OAuth2 flow with a custom [AuthorizationHandler]. Optional. @@ -192,7 +195,8 @@ func New3LOTokenProvider(opts *Options3LO) (TokenProvider, error) { return new3LOTokenProviderWithAuthHandler(opts), nil } return NewCachedTokenProvider(&tokenProvider3LO{opts: opts, refreshToken: opts.RefreshToken, client: opts.client()}, &CachedTokenProviderOptions{ - ExpireEarly: opts.EarlyTokenExpiry, + ExpireEarly: opts.EarlyTokenExpiry, + DisableAsyncRefresh: opts.DisableAsyncRefresh, }), nil } @@ -211,7 +215,8 @@ type AuthorizationHandlerOptions struct { func new3LOTokenProviderWithAuthHandler(opts *Options3LO) TokenProvider { return NewCachedTokenProvider(&tokenProviderWithHandler{opts: opts, state: opts.AuthHandlerOpts.State}, &CachedTokenProviderOptions{ - ExpireEarly: opts.EarlyTokenExpiry, + ExpireEarly: opts.EarlyTokenExpiry, + DisableAsyncRefresh: opts.DisableAsyncRefresh, }) } diff --git a/vendor/cloud.google.com/go/compute/metadata/.repo-metadata.json b/vendor/cloud.google.com/go/compute/metadata/.repo-metadata.json new file mode 100644 index 000000000..d64bf6cc1 --- /dev/null +++ b/vendor/cloud.google.com/go/compute/metadata/.repo-metadata.json @@ -0,0 +1,10 @@ +{ + "api_shortname": "compute-metadata", + "client_documentation": "https://cloud.google.com/go/docs/reference/cloud.google.com/go/compute/latest/metadata", + "client_library_type": "manual", + "description": "Service Metadata API", + "distribution_name": "cloud.google.com/go/compute/metadata", + "language": "go", + "library_type": "CORE", + "release_level": "stable" +} \ No newline at end of file diff --git a/vendor/cloud.google.com/go/compute/metadata/CHANGES.md b/vendor/cloud.google.com/go/compute/metadata/CHANGES.md index e384683c5..f03d5cd38 100644 --- a/vendor/cloud.google.com/go/compute/metadata/CHANGES.md +++ b/vendor/cloud.google.com/go/compute/metadata/CHANGES.md @@ -1,5 +1,19 @@ # Changes +## [0.10.0](https://github.com/googleapis/google-cloud-go/compare/compute/metadata/v0.9.1...compute/metadata/v0.10.0) (2026-09-23) + + +### Features + +* **all:** Update supported go versions ([#20520](https://github.com/googleapis/google-cloud-go/issues/20520)) ([90413d3](https://github.com/googleapis/google-cloud-go/commit/90413d3e9d381ef4b92e3c496d98b023c5b2d8cc)) + +## [0.9.1](https://github.com/googleapis/google-cloud-go/compare/compute/metadata/v0.9.0...compute/metadata/v0.9.1) (2026-09-17) + + +### Bug Fixes + +* **compute/metadata:** Timeout initial metadata subscriber GET request ([#20488](https://github.com/googleapis/google-cloud-go/issues/20488)) ([f06f6b3](https://github.com/googleapis/google-cloud-go/commit/f06f6b35e4b7ae8b48a3f9d1715229fe81cb2ebd)), refs [#20487](https://github.com/googleapis/google-cloud-go/issues/20487) + ## [0.9.0](https://github.com/googleapis/google-cloud-go/compare/compute/metadata/v0.8.4...compute/metadata/v0.9.0) (2025-09-24) diff --git a/vendor/cloud.google.com/go/compute/metadata/metadata.go b/vendor/cloud.google.com/go/compute/metadata/metadata.go index 6bd189166..918231e3b 100644 --- a/vendor/cloud.google.com/go/compute/metadata/metadata.go +++ b/vendor/cloud.google.com/go/compute/metadata/metadata.go @@ -889,7 +889,9 @@ func (c *Client) SubscribeWithContext(ctx context.Context, suffix string, fn fun const failedSubscribeSleep = time.Second * 5 // First check to see if the metadata value exists at all. - val, lastETag, err := c.getETagWithSubClient(ctx, suffix, true) + initCtx, cancel := context.WithTimeout(ctx, 5*time.Second) + val, lastETag, err := c.getETagWithSubClient(initCtx, suffix, true) + cancel() if err != nil { return err } diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md index fa477145f..8cda72f56 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md @@ -1,5 +1,61 @@ # Release History +## 1.23.3 (2026-10-06) + +### Bugs Fixed + +* Fixed `arm.ResourceID.Location` being empty when the `locations` segment uses different casing. + +### Other Changes + +* Added `azure-deprecating` to the default set of allowed (non-redacted) response headers for logging. +* Replaced internal default HTTP client with the one from `sdk/internal`. + +## 1.23.2 (2026-09-28) + +### Bugs Fixed + +* Fixed unmarshalling `datetime.RFC7231` to use a fixed `GMT` zone. + +## 1.23.1 (2026-08-27) + +### Other Changes + +* Upgraded dependencies. + +## 1.23.0 (2026-08-11) + +### Features Added + +* Helper method `runtime.NewRequestForNextLink` for creating requests for pageable operations that uses a next link. It handles absolute and relative next links. + +### Bugs Fixed + +* Fixed an issue where `runtime.Pager[T].More` could return `true` indefinitely after `NextPage` failed to retrieve the first page, causing `for pager.More()` loops to spin. After a page fetch returns an error the `Pager` now enters a terminal state: `More` returns `false` and subsequent `NextPage` calls return the same error without invoking the fetcher again. + +## 1.22.0 (2026-06-04) + +### Features Added + +* Added type `datetime.RFC7231` for date/time values in RFC 1123 format with a fixed GMT timezone. + +### Other Changes + +* Upgraded dependencies. + +## 1.21.1 (2026-04-16) + +### Bugs Fixed + +* Fixed an issue in `ResponseError.Error()` where the request URL path was being logged unescaped. +* Redact query parameters when logging errors. +* For `runtime.JoinPaths`, don't add a slash between root and paths when `paths` starts with `?` (query string). + +### Other Changes + +* Upgraded to Go 1.25.0. +* Upgraded dependencies. + ## 1.21.0 (2026-01-12) ### Features Added diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/arm/internal/resource/resource_identifier.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/arm/internal/resource/resource_identifier.go index c602e77d1..4b4aa1fb9 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/arm/internal/resource/resource_identifier.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/arm/internal/resource/resource_identifier.go @@ -141,7 +141,7 @@ func (id *ResourceID) init(parent *ResourceID, resourceType ResourceType, name s id.SubscriptionID = name } - if resourceType.lastType() == locationsKey { + if strings.EqualFold(resourceType.lastType(), locationsKey) { id.Location = name } diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/ci.yml b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/ci.yml index b81b62103..5807f6b69 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/ci.yml +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/ci.yml @@ -3,7 +3,6 @@ trigger: branches: include: - main - - feature/* - hotfix/* - release/* paths: diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/doc.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/doc.go index 4862a9f68..299ed5e36 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/doc.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/doc.go @@ -190,7 +190,10 @@ and determining if there are more pages to fetch. No IO calls are made until th pager := widgetClient.NewListWidgetsPager(nil) for pager.More() { page, err := pager.NextPage(context.TODO()) - // handle err + if err != nil { + // process error + break + } for _, widget := range page.Values { // process widget } diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/request.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/request.go index 4bf722630..2df0c7a97 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/request.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/request.go @@ -11,8 +11,11 @@ import ( "fmt" "io" "net/http" + "net/url" + "path" "reflect" "strconv" + "strings" "github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared" ) @@ -119,6 +122,26 @@ func NewRequest(ctx context.Context, httpMethod string, endpoint string) (*Reque return &Request{req: req, values: opValues{}}, nil } +// NewRequestForNextLink creates a new policy.Request with the specified input. +// This helper is for use in paged operations that use the "next link" pattern. +// - endpoint is the service endpoint (e.g. https://contoso.com) +// - nextLink the absolute or relative URL to the next page of items +// +// When nextLink is an absolute URL, its value is used to create the request to the next page. +// If nextLink is a relative URL, it will be joined with the specified endpoint. +// +// Exported as runtime.NewRequestForNextLink(). +func NewRequestForNextLink(ctx context.Context, httpMethod, endpoint, nextLink string) (*Request, error) { + nextLink, err := EncodeQueryParams(nextLink, true) + if err != nil { + return nil, err + } + if !hasScheme(nextLink) { + nextLink = JoinPaths(endpoint, nextLink) + } + return NewRequest(ctx, httpMethod, nextLink) +} + // Body returns the original body specified when the Request was created. func (req *Request) Body() io.ReadSeekCloser { return req.body @@ -257,3 +280,89 @@ func SetBody(req *Request, body io.ReadSeekCloser, contentType string, clobberCo } return nil } + +// JoinPaths concatenates multiple URL path segments into one path, +// inserting path separation characters as required. JoinPaths will preserve +// query parameters in the root path. +// Exported as runtime.JoinPaths +func JoinPaths(root string, paths ...string) string { + if len(paths) == 0 { + return root + } + + qps := "" + if strings.Contains(root, "?") { + splitPath := strings.Split(root, "?") + root, qps = splitPath[0], splitPath[1] + } + + p := path.Join(paths...) + // path.Join will remove any trailing slashes. + // if one was provided, preserve it. + if strings.HasSuffix(paths[len(paths)-1], "/") && !strings.HasSuffix(p, "/") { + p += "/" + } + + if qps != "" { + if strings.Contains(p, "?") { + p = p + "&" + qps + } else { + p = p + "?" + qps + } + } + + if strings.HasSuffix(root, "/") && strings.HasPrefix(p, "/") { + root = root[:len(root)-1] + } else if !strings.HasSuffix(root, "/") && !strings.HasPrefix(p, "/") && !strings.HasPrefix(p, "?") { + p = "/" + p + } + return root + p +} + +// EncodeQueryParams will parse and encode any query parameters in the specified URL. +// Any semicolons will automatically be escaped. +// When encodeSpaces is true all spaces that were form-encoded to + are replaced with %20. +// Exported as runtime.EncodeQueryParams +func EncodeQueryParams(u string, encodeSpaces bool) (string, error) { + before, after, found := strings.Cut(u, "?") + if !found { + return u, nil + } + // starting in Go 1.17, url.ParseQuery will reject semicolons in query params. + // so, we must escape them first. note that this assumes that semicolons aren't + // being used as query param separators which is per the current RFC. + // for more info: + // https://github.com/golang/go/issues/25192 + // https://github.com/golang/go/issues/50034 + qp, err := url.ParseQuery(strings.ReplaceAll(after, ";", "%3B")) + if err != nil { + return "", err + } + encoded := qp.Encode() + if encodeSpaces { + encoded = strings.ReplaceAll(encoded, "+", "%20") + } + return before + "?" + encoded, nil +} + +// hasScheme reports whether s begins with a URI scheme, i.e. is an absolute URI. +// Per RFC 3986: scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ) ":". +// This avoids the allocations of url.Parse when we only need to know if the URI is absolute. +func hasScheme(s string) bool { + for i := 0; i < len(s); i++ { + c := s[i] + switch { + case c >= 'a' && c <= 'z', c >= 'A' && c <= 'Z': + // always valid + case c == ':': + return i > 0 + case i == 0: + return false + case c >= '0' && c <= '9', c == '+', c == '-', c == '.': + // valid after the first character + default: + return false + } + } + return false +} diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/response_error.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/response_error.go index ef0635bb2..8246b6a5b 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/response_error.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/response_error.go @@ -131,7 +131,7 @@ func (e *ResponseError) Error() string { msg := &bytes.Buffer{} if e.RawResponse != nil { if e.RawResponse.Request != nil { - fmt.Fprintf(msg, "%s %s://%s%s\n", e.RawResponse.Request.Method, e.RawResponse.Request.URL.Scheme, e.RawResponse.Request.URL.Host, e.RawResponse.Request.URL.Path) + fmt.Fprintf(msg, "%s %s://%s%s\n", e.RawResponse.Request.Method, e.RawResponse.Request.URL.Scheme, e.RawResponse.Request.URL.Host, e.RawResponse.Request.URL.EscapedPath()) } else { fmt.Fprintln(msg, "Request information not available") } diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go index 213202e33..bfbea747d 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go @@ -37,5 +37,5 @@ const ( Module = "azcore" // Version is the semantic version (see http://semver.org) of this module. - Version = "v1.21.0" + Version = "v1.23.3" ) diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pager.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pager.go index 743513be4..a05b0c34d 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pager.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pager.go @@ -35,6 +35,9 @@ type Pager[T any] struct { handler PagingHandler[T] tracer tracing.Tracer firstPage bool + // fetchErr is set when Fetcher returns an error, placing the Pager in a + // terminal state so that More returns false. + fetchErr error } // NewPager creates an instance of Pager using the specified PagingHandler. @@ -48,7 +51,16 @@ func NewPager[T any](handler PagingHandler[T]) *Pager[T] { } // More returns true if there are more pages to retrieve. +// +// If a prior call to [Pager.NextPage] returned an error while fetching a page, +// the Pager enters a terminal state and More returns false so that a for loop +// over the pager terminates instead of retrying indefinitely. func (p *Pager[T]) More() bool { + // a failed fetch puts the Pager in a terminal state; there are no more pages + // to retrieve regardless of whether it was the first or a subsequent page. + if p.fetchErr != nil { + return false + } if p.current != nil { return p.handler.More(*p.current) } @@ -56,7 +68,17 @@ func (p *Pager[T]) More() bool { } // NextPage advances the pager to the next page. +// +// If fetching the page returns an error, the Pager enters a terminal state: +// [Pager.More] returns false and every subsequent call to NextPage returns the +// same error without invoking the fetcher again. func (p *Pager[T]) NextPage(ctx context.Context) (T, error) { + if p.fetchErr != nil { + // a prior fetch failed; the Pager is in a terminal state. return the + // stored error rather than re-invoking the fetcher, which may not be + // safe to retry (e.g. stateful handlers that latch into a done state). + return *new(T), p.fetchErr + } if p.current != nil { if p.firstPage { // we get here if it's an LRO-pager, we already have the first page @@ -76,6 +98,7 @@ func (p *Pager[T]) NextPage(ctx context.Context) (T, error) { resp, err := p.handler.Fetcher(ctx, p.current) if err != nil { + p.fetchErr = err return *new(T), err } p.current = &resp diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pipeline.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pipeline.go index 3d95fe30d..b93c9c362 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pipeline.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pipeline.go @@ -6,6 +6,7 @@ package runtime import ( "github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported" "github.com/Azure/azure-sdk-for-go/sdk/azcore/policy" + azt "github.com/Azure/azure-sdk-for-go/sdk/internal/transport" ) // PipelineOptions contains Pipeline options for SDK developers @@ -85,7 +86,7 @@ func NewPipeline(module, version string, plOpts PipelineOptions, options *policy policies = append(policies, exported.PolicyFunc(bodyDownloadPolicy)) transport := cp.Transport if transport == nil { - transport = defaultHTTPClient + transport = azt.DefaultHTTPClient } return exported.NewPipeline(transport, policies...) } diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_bearer_token.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_bearer_token.go index 547e5a327..f204a19c4 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_bearer_token.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_bearer_token.go @@ -182,7 +182,7 @@ func (b *BearerTokenPolicy) handleChallenge(req *policy.Request, res *http.Respo func checkHTTPSForAuth(req *policy.Request, allowHTTP bool) error { if strings.ToLower(req.Raw().URL.Scheme) != "https" && !allowHTTP { - return errorinfo.NonRetriableError(errors.New("authenticated requests are not permitted for non TLS protected (https) endpoints")) + return errorinfo.NonRetriableError(errors.New("authorized requests are not permitted for non-TLS protected (https) endpoints")) } return nil } diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_http_trace.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_http_trace.go index ddf9ede01..7017d5e10 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_http_trace.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_http_trace.go @@ -5,10 +5,8 @@ package runtime import ( "context" - "errors" "fmt" "net/http" - "net/url" "strings" "github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported" @@ -73,14 +71,7 @@ func (h *httpTracePolicy) Do(req *policy.Request) (resp *http.Response, err erro span.SetAttributes(tracing.Attribute{Key: attrAZServiceReqID, Value: reqID}) } } else if err != nil { - var urlErr *url.Error - if errors.As(err, &urlErr) { - // calling *url.Error.Error() will include the unsanitized URL - // which we don't want. in addition, we already have the HTTP verb - // and sanitized URL in the trace so we aren't losing any info - err = urlErr.Err - } - span.SetStatus(tracing.SpanStatusError, err.Error()) + span.SetStatus(tracing.SpanStatusError, getSanitizedURLString(err.Error(), req.Raw().URL, h.allowedQP)) } span.End() }() diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_logging.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_logging.go index dd59fbc99..61ba383aa 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_logging.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_logging.go @@ -34,6 +34,7 @@ func NewLogPolicy(o *policy.LogOptions) policy.Policy { // construct default hash set of allowed headers allowedHeaders := map[string]struct{}{ "accept": {}, + "azure-deprecating": {}, "cache-control": {}, "connection": {}, "content-length": {}, @@ -158,6 +159,27 @@ func getSanitizedURL(u url.URL, allowedQueryParams map[string]struct{}) string { return u.String() } +// getSanitizedURLString returns s with the query params of u redacted. +// if s doesn't contain u, then s is returned unchanged. +func getSanitizedURLString(s string, u *url.URL, allowedQueryParams map[string]struct{}) string { + if u.RawQuery == "" { + // the URL doesn't have any query params, so nothing to redact + return s + } + + urlIndex := strings.Index(strings.ToLower(s), strings.ToLower(u.String())) + if urlIndex < 0 { + // the URL isn't in the string, so nothing to redact + return s + } + + // replace the unsanitized URL in the error message with the sanitized version + sanitizedURL := getSanitizedURL(*u, allowedQueryParams) + s = s[:urlIndex] + sanitizedURL + s[urlIndex+len(u.String()):] + + return s +} + // writeRequestWithResponse appends a formatted HTTP request into a Buffer. If request and/or err are // not nil, then these are also written into the Buffer. func (p *logPolicy) writeRequestWithResponse(b *bytes.Buffer, req *policy.Request, resp *http.Response, err error) { @@ -171,7 +193,7 @@ func (p *logPolicy) writeRequestWithResponse(b *bytes.Buffer, req *policy.Reques } if err != nil { fmt.Fprintln(b, " --------------------------------------------------------------------------------") - fmt.Fprint(b, " ERROR:\n"+err.Error()+"\n") + fmt.Fprint(b, " ERROR:\n"+getSanitizedURLString(err.Error(), req.Raw().URL, p.allowedQP)+"\n") } } diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_retry.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_retry.go index 696e1d9f4..50c867914 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_retry.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_retry.go @@ -115,7 +115,8 @@ func (p *retryPolicy) Do(req *policy.Request) (resp *http.Response, err error) { // do this outside the for loop so defers don't accumulate. rwbody = &retryableRequestBody{body: req.Body()} defer func() { - // TODO: https://github.com/Azure/azure-sdk-for-go/issues/25649 + // Match net/http behavior: after a request has produced either a response + // or a transport error, request body close errors are not surfaced to callers. _ = rwbody.realClose() }() } diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/request.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/request.go index df7826b76..20ec6511c 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/request.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/request.go @@ -14,8 +14,6 @@ import ( "mime/multipart" "net/http" "net/textproto" - "net/url" - "path" "strings" "github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported" @@ -43,6 +41,17 @@ func NewRequest(ctx context.Context, httpMethod string, endpoint string) (*polic return exported.NewRequest(ctx, httpMethod, endpoint) } +// NewRequestForNextLink creates a new policy.Request with the specified input. +// This helper is for use in paged operations that use the "next link" pattern. +// - endpoint is the service endpoint (e.g. https://contoso.com) +// - nextLink the absolute or relative URL to the next page of items +// +// When nextLink is an absolute URL, its value is used to create the request to the next page. +// If nextLink is a relative URL, it will be joined with the specified endpoint. +func NewRequestForNextLink(ctx context.Context, httpMethod, endpoint, nextLink string) (*policy.Request, error) { + return exported.NewRequestForNextLink(ctx, httpMethod, endpoint, nextLink) +} + // NewRequestFromRequest creates a new policy.Request with an existing *http.Request func NewRequestFromRequest(req *http.Request) (*policy.Request, error) { return exported.NewRequestFromRequest(req) @@ -51,54 +60,14 @@ func NewRequestFromRequest(req *http.Request) (*policy.Request, error) { // EncodeQueryParams will parse and encode any query parameters in the specified URL. // Any semicolons will automatically be escaped. func EncodeQueryParams(u string) (string, error) { - before, after, found := strings.Cut(u, "?") - if !found { - return u, nil - } - // starting in Go 1.17, url.ParseQuery will reject semicolons in query params. - // so, we must escape them first. note that this assumes that semicolons aren't - // being used as query param separators which is per the current RFC. - // for more info: - // https://github.com/golang/go/issues/25192 - // https://github.com/golang/go/issues/50034 - qp, err := url.ParseQuery(strings.ReplaceAll(after, ";", "%3B")) - if err != nil { - return "", err - } - return before + "?" + qp.Encode(), nil + return exported.EncodeQueryParams(u, false) } // JoinPaths concatenates multiple URL path segments into one path, // inserting path separation characters as required. JoinPaths will preserve // query parameters in the root path func JoinPaths(root string, paths ...string) string { - if len(paths) == 0 { - return root - } - - qps := "" - if strings.Contains(root, "?") { - splitPath := strings.Split(root, "?") - root, qps = splitPath[0], splitPath[1] - } - - p := path.Join(paths...) - // path.Join will remove any trailing slashes. - // if one was provided, preserve it. - if strings.HasSuffix(paths[len(paths)-1], "/") && !strings.HasSuffix(p, "/") { - p += "/" - } - - if qps != "" { - p = p + "?" + qps - } - - if strings.HasSuffix(root, "/") && strings.HasPrefix(p, "/") { - root = root[:len(root)-1] - } else if !strings.HasSuffix(root, "/") && !strings.HasPrefix(p, "/") { - p = "/" + p - } - return root + p + return exported.JoinPaths(root, paths...) } // EncodeByteArray will base-64 encode the byte slice v. diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/BREAKING_CHANGES.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/BREAKING_CHANGES.md index 567e6975b..a7551e49a 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/BREAKING_CHANGES.md +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/BREAKING_CHANGES.md @@ -1,11 +1,22 @@ # Breaking Changes +## v1.15.0 + +### Service Fabric transport requirements + +`ManagedIdentityCredential` now requires a transport that supports the Service Fabric endpoint's +certificate pinning. Applications with a custom `ClientOptions.Transport` must provide an +`*http.Client` whose Transport is `nil` or a standard `*http.Transport` without custom TLS dialing +or verification callbacks. Unsupported transports cause credential construction to fail. +Leave `ClientOptions.Transport` `nil` to use the default transport. The credential derives the +pinned client without modifying a caller-supplied client and rejects redirects. + ## v1.8.0 ### New errors from `NewManagedIdentityCredential` in some environments `NewManagedIdentityCredential` now returns an error when `ManagedIdentityCredentialOptions.ID` is set in a hosting environment whose managed identity API doesn't support user-assigned identities. `ManagedIdentityCredential.GetToken()` formerly logged a warning in these cases. Returning an error instead prevents the credential authenticating an unexpected identity. The affected hosting environments are: - * Azure Arc + * Azure Arc (user-assigned identities are supported starting in v1.15.0 when the agent supports them) * Azure ML (when a resource or object ID is specified; client IDs are supported) * Cloud Shell * Service Fabric diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md index 4a6349e16..ce7aff7ee 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md @@ -1,11 +1,87 @@ # Release History +## 1.15.0 (2026-10-14) + +### Features Added + +- `ManagedIdentityCredential` and `DefaultAzureCredential` support user-assigned managed identities + on Azure Arc when the agent supports them +- `WorkloadIdentityCredential` supports identity binding mode via `WorkloadIdentityCredentialOptions.EnableAzureProxy` + +### Bugs Fixed + +- `ManagedIdentityCredential` verifies the Service Fabric endpoint's certificate against + `IDENTITY_SERVER_THUMBPRINT` and rejects redirects + +### Other Changes + +- On Service Fabric, a custom `ClientOptions.Transport` must be an `*http.Client` with a `nil` + Transport or a standard `*http.Transport` without custom TLS dialing or verification callbacks. + Unsupported transports now cause credential construction to fail +- Upgraded dependencies + +## 1.14.1 (2026-08-27) + +### Other Changes + +- Upgraded dependencies + +## 1.14.0 (2026-06-15) + +### Breaking Changes + +> These changes affect only code written against a beta version such as v1.14.0-beta.3 +- Removed `WorkloadIdentityCredentialOptions.EnableAzureProxy`. + It will return in v1.15.0-beta.1 + +### Bugs Fixed + +- `AzureDeveloperCLICredential` improved reporting of error messages returned from `azd` + +### Other Changes + +- Returned `azidentity` errors include links to the troubleshooting guide when appropriate +- This module now requires a minimum Go version of 1.25 +- Upgraded dependencies + +## 1.14.0-beta.3 (2026-02-10) + +### Breaking Changes + +> These changes affect only code written against a beta version such as v1.14.0-beta.2 +- Renamed `WorkloadIdentityCredentialOptions.EnableAzureTokenProxy` to `EnableAzureProxy` + +### Other Changes + +- Removed extraneous JSON from `AzureDeveloperCLICredential` errors + +## 1.14.0-beta.2 (2025-11-10) + +### Breaking Changes + +> These changes affect only code written against a beta version such as v1.13.0-beta.1 +- `WorkloadIdentityCredential` identity binding mode is disabled by default. To enable it, set + `WorkloadIdentityCredentialOptions.EnableAzureTokenProxy` to `true` +- Removed identity binding mode support from `DefaultAzureCredential`. To use this feature, use + `WorkloadIdentityCredential` directly instead and set + `WorkloadIdentityCredentialOptions.EnableAzureTokenProxy` to `true` + +### Bugs Fixed + +- `AzureCLICredential` quoted arguments incorrectly on Windows + ## 1.13.1 (2025-11-10) ### Bugs Fixed - `AzureCLICredential` quoted arguments incorrectly on Windows +## 1.14.0-beta.1 (2025-10-07) + +### Features Added + +- Restored the `WorkloadIdentityCredential` identity binding mode support removed in v1.13.0 + ## 1.13.0 (2025-10-07) ### Features Added diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/README.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/README.md index 127c25b72..2abfccfa3 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/README.md +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/README.md @@ -68,6 +68,25 @@ in any hosting environment which supports managed identities, such as (this list * [Azure Service Fabric](https://learn.microsoft.com/azure/service-fabric/concepts-managed-identity) * [Azure Virtual Machines](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/how-to-use-vm-token) +### Azure Arc user-assigned identities + +On Azure Arc, `ManagedIdentityCredential` supports selecting a user-assigned identity by client, +object, or resource ID through `ManagedIdentityCredentialOptions.ID`. `DefaultAzureCredential` +supports selecting one by client ID through the `AZURE_CLIENT_ID` environment variable. +The Azure Arc agent must support user-assigned +identities and confirm the requested identity in its token response. Otherwise, token acquisition +fails rather than authenticating the machine's system-assigned identity. + +### Service Fabric transport requirements + +On Service Fabric, `ManagedIdentityCredential` pins the endpoint certificate to +`IDENTITY_SERVER_THUMBPRINT` and rejects redirects. Leave `ClientOptions.Transport` `nil` to use +the default transport. A custom transport must be an `*http.Client` whose `Transport` is `nil` or +an `*http.Transport` without custom TLS dialing or verification callbacks. The credential derives +the pinned client without modifying the caller's client. Unsupported transports cause credential +construction to fail. See the [troubleshooting guide](https://aka.ms/azsdk/go/identity/troubleshoot#azure-service-fabric-managed-identity) +for configuration errors. + ## Examples - [Authenticate with DefaultAzureCredential](#authenticate-with-defaultazurecredential "Authenticate with DefaultAzureCredential") @@ -244,5 +263,3 @@ additional questions or comments. [ctc_overview]: https://aka.ms/azsdk/go/identity/credential-chains#chainedtokencredential-overview [dac_overview]: https://aka.ms/azsdk/go/identity/credential-chains#defaultazurecredential-overview - - diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/TROUBLESHOOTING.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/TROUBLESHOOTING.md index 517006a42..82c2ba7b9 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/TROUBLESHOOTING.md +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/TROUBLESHOOTING.md @@ -20,6 +20,8 @@ This troubleshooting guide covers failure investigation techniques, common error - [Troubleshoot ManagedIdentityCredential authentication issues](#troubleshoot-managedidentitycredential-authentication-issues) - [Azure App Service and Azure Functions managed identity](#azure-app-service-and-azure-functions-managed-identity) - [Azure Virtual Machine managed identity](#azure-virtual-machine-managed-identity) + - [Azure Arc managed identity](#azure-arc-managed-identity) + - [Azure Service Fabric managed identity](#azure-service-fabric-managed-identity) - [Troubleshoot WorkloadIdentityCredential authentication issues](#troubleshoot-workloadidentitycredential-authentication-issues) - [Get additional help](#get-additional-help) @@ -83,7 +85,7 @@ azlog.SetEvents(azidentity.EventAuthentication) | Error |Description| Mitigation | |---|---|---| -|"DefaultAzureCredential failed to acquire a token"|No credential in the `DefaultAzureCredential` chain provided a token|