v0.44.0

[github.com/gardener/oidc-webhook-authenticator:v0.44.0]

🏃 Others

• [OPERATOR] Component binaries are now built with Go 1.26.3 by @dependabot[bot] [#236]
• [OPERATOR] Component binaries are now built with Go 1.26.4 by @dependabot[bot] [#243]
• [DEPENDENCY] The following third party dependencies have been updated:
  • github.com/coreos/go-oidc/v3 v3.15.0 -> v3.18.0
  • github.com/go-jose/go-jose/v4 v4.1.3 -> v4.1.4
  • golang.org/x/oauth2 v0.34.0 -> v0.36.0 by @dependabot[bot] [#242]
• [DEPENDENCY] The following third party dependencies have been updated:
  • k8s.io/api v0.36.0 -> v0.36.2
  • k8s.io/apimachinery v0.36.0 -> v0.36.2
  • k8s.io/apiserver v0.36.0 -> v0.36.2
  • k8s.io/client-go v0.36.0 -> v0.36.2
  • k8s.io/component-base v0.36.0 -> v0.36.2
  • k8s.io/apiextensions-apiserver v0.36.0 -> v0.36.2
  • k8s.io/streaming v0.36.0 -> v0.36.2
  • github.com/fsnotify/fsnotify v1.9.0 -> v1.10.1
  • go.opentelemetry.io/otel v1.41.0 -> v1.44.0
  • go.opentelemetry.io/otel/sdk v1.40.0 -> v1.44.0
  • go.yaml.in/yaml/v2 v2.4.3 -> v2.4.4
  • golang.org/x/time v0.14.0 -> v0.15.0
  • golang.org/x/crypto v0.47.0 -> v0.53.0
  • golang.org/x/mod v0.32.0 -> v0.37.0
  • golang.org/x/net v0.49.0 -> v0.56.0
  • golang.org/x/sync v0.19.0 -> v0.21.0
  • golang.org/x/sys v0.40.0 -> v0.46.0
  • golang.org/x/term v0.39.0 -> v0.44.0
  • golang.org/x/text v0.33.0 -> v0.38.0
  • golang.org/x/tools v0.41.0 -> v0.46.0
  • sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 -> v0.36.0
  • sigs.k8s.io/structured-merge-diff/v6 v6.3.2 -> v6.4.0 by @vpnachev [#247]
• [DEPENDENCY] The following third party dependencies have been updated:
  • sigs.k8s.io/controller-runtime v0.24.0 -> v0.24.1 by @dependabot[bot] [#239]

application/spdx+json

• oidc-webhook-authenticator-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/oidc-webhook-authenticator@sha256:3379ab6a56dbaacb6c99d231e16501dba0db21951c7774fc04e8df77129b1b5e
• oidc-webhook-authenticator-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/oidc-webhook-authenticator@sha256:50eedb8f5c3addecd458c9f417a77ae17da2a69189c8b6b85bcc2ac669bc8b7e

application/vnd.cyclonedx+json

• oidc-webhook-authenticator-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/oidc-webhook-authenticator@sha256:08f7ad36bd4cb9050e3e703bce1a3aecaf30c2469d516b20ed671a036e716bb3
• oidc-webhook-authenticator-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/oidc-webhook-authenticator@sha256:4f133678dd0b901d4783c5673088142e60c519eb494d6e7c4b521b03e7bce294

Helm Charts

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/oidc-webhook-authenticator:v0.44.0

Container (OCI) Images

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/gardener/oidc-webhook-authenticator:v0.44.0

v0.43.0

[github.com/gardener/oidc-webhook-authenticator:v0.43.0]

🏃 Others

• [OPERATOR] OWA is now built with Go 1.26.2 by @dependabot[bot] [#231]
• [DEPENDENCY] The following third party dependencies have been updated:
  • github.com/go-jose/go-jose/v4 v4.1.2 -> v4.1.3
  • github.com/onsi/ginkgo/v2 v2.27.2 -> v2.27.4
  • github.com/onsi/gomega v1.38.2 -> v1.39.0
  • github.com/spf13/cobra v1.10.1 -> v1.10.2
  • golang.org/x/time v0.13.0 -> v0.14.0
  • k8s.io/api v0.35.0 -> v0.36.0
  • k8s.io/apimachinery v0.35.0 -> v0.36.0
  • k8s.io/apiserver v0.35.0 -> v0.36.0
  • k8s.io/client-go v0.35.0 -> v0.36.0
  • k8s.io/component-base v0.35.0 -> v0.36.0
  • sigs.k8s.io/controller-runtime v0.23.3 -> v0.24.0 by @dimityrmirchev [#234]

application/spdx+json

• oidc-webhook-authenticator-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/oidc-webhook-authenticator@sha256:72b64bd9788ef665bde13505ecf20cebdf29e73c812e5b9f4dff02d1aa75ceda
• oidc-webhook-authenticator-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/oidc-webhook-authenticator@sha256:e8e7ff7b7dcbdf38b05bec8f115fbd3268c8966e05cce035a497b4ae5f83ffa7

Helm Charts

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/oidc-webhook-authenticator:v0.43.0

Container (OCI) Images

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/gardener/oidc-webhook-authenticator:v0.43.0

v0.42.0

[github.com/gardener/oidc-webhook-authenticator:v0.42.0]

🏃 Others

• [OPERATOR] OWA is now built with Go 1.26.0 by @dependabot[bot] [#220]

Helm Charts

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/oidc-webhook-authenticator:v0.42.0

Container (OCI) Images

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/gardener/oidc-webhook-authenticator:v0.42.0

v0.41.0

[github.com/gardener/oidc-webhook-authenticator:v0.41.0]

🏃 Others

• [OPERATOR] OWA is now built using go version 1.25.6. by @dependabot[bot] [#215]

Helm Charts

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/oidc-webhook-authenticator:v0.41.0

Container (OCI) Images

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/gardener/oidc-webhook-authenticator:v0.41.0

v0.40.0

[github.com/gardener/oidc-webhook-authenticator:v0.40.0]

🏃 Others

• [OPERATOR] OWA is now built with Go 1.25.5 by @dependabot[bot] [#209]
• [OPERATOR] The container image base layer has been updated to Debian 13 (trixie). by @dimityrmirchev [#212]
• [DEPENDENCY] The following third party dependencies have been updated:
  • sigs.k8s.io/controller-runtime from v0.22.1 -> v0.22.4 by @dependabot[bot] [#210]
• [DEPENDENCY] The following third party dependencies have been updated:
  • golang.org/x/crypto v0.42.0 -> v0.45.0
  • golang.org/x/net v0.44.0 -> v0.47.0
  • golang.org/x/sync v0.17.0 -> v0.18.0
  • golang.org/x/sys v0.36.0 -> v0.38.0
  • golang.org/x/term v0.35.0 -> v0.37.0
  • golang.org/x/text v0.29.0 -> v0.31.0
  • golang.org/x/tools v0.37.0 -> v0.38.0 by @dependabot[bot] [#205]

Helm Charts

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/oidc-webhook-authenticator:v0.40.0

Container (OCI) Images

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/gardener/oidc-webhook-authenticator:v0.40.0

v0.39.0

[github.com/gardener/oidc-webhook-authenticator:v0.39.0]

⚠️ Breaking Changes

• [USER] The clientID field in the OpenIDConnect CRD is now deprecated and replaced by the new audiences field, which accepts a list of acceptable audience values for the ID token. by @theoddora [#200]

🏃 Others

• [OPERATOR] OWA is now built using go version 1.25.4. by @dimityrmirchev [#203]
• [OPERATOR] Migrate the test framework from (deprecated) Ginkgo v1 to Ginkgo v2. by @theoddora [#198]

Helm Charts

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/oidc-webhook-authenticator:v0.39.0

Container (OCI) Images

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/gardener/oidc-webhook-authenticator:v0.39.0

v0.38.0

[github.com/gardener/oidc-webhook-authenticator:v0.38.0]

✨ New Features

• [OPERATOR] Helm charts of OWA are now published as OCI artifacts. by @dimityrmirchev [#188]

🏃 Others

• [DEVELOPER] GHA build workflow now also runs the tests. by @vpnachev [#193]
• [OPERATOR] OWA is now built using go version 1.25.1. by @dimityrmirchev [#190]
• [DEPENDENCY] The following 3rd party dependencies have been updated:
  • github.com/coreos/go-oidc/v3 v3.14.1 -> v3.15.0
  • github.com/go-jose/go-jose/v4 v4.1.1 -> v4.1.2
  • golang.org/x/time v0.12.0 -> v0.13.0
  • k8s.io/api v0.33.2 -> v0.34.1
  • k8s.io/apimachinery v0.33.2 -> v0.34.1
  • k8s.io/apiserver v0.33.2 -> v0.34.1
  • k8s.io/client-go v0.33.2 -> v0.34.1
  • k8s.io/component-base v0.33.2 -> v0.34.1
  • sigs.k8s.io/controller-runtime v0.21.0 -> v0.22.1
  • golang.org/x/crypto v0.39.0 -> v0.42.0
  • golang.org/x/net v0.41.0 -> v0.44.0
  • golang.org/x/oauth2 v0.30.0 -> v0.31.0
  • golang.org/x/sync v0.15.0 -> v0.17.0
  • golang.org/x/sys v0.33.0 -> v0.36.0
  • golang.org/x/term v0.32.0 -> v0.35.0
  • golang.org/x/text v0.26.0 -> v0.29.0 by @vpnachev [#194]
• [DEVELOPER] migrate CICD-Pipelines to GitHub-Actions by @ccwienk [#184]
• [OPERATOR] Test results are now exported as inlined ocm-resource. by @Franziska-Schallhorn [#186]

Helm Charts

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/oidc-webhook-authenticator:v0.38.0

Container (OCI) Images

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/gardener/oidc-webhook-authenticator:v0.38.0

v0.37.0

[gardener/oidc-webhook-authenticator]

🏃 Others

• [OPERATOR] oidc-webhook-authenticator is now built with go 1.24.5. by @vpnachev [#185]
• [DEPENDENCY] The following 3rd party dependencies have been updated:
  • k8s.io/api v0.31.1 -> v0.33.2
  • k8s.io/apiextensions-apiserver v0.31.0 -> v0.33.2
  • k8s.io/apimachinery v0.31.1 -> v0.33.2
  • k8s.io/apiserver v0.31.0 -> v0.33.2
  • k8s.io/client-go v0.31.1 -> v0.33.2
  • k8s.io/component-base v0.31.1 -> v0.33.2
  • sigs.k8s.io/controller-runtime v0.19.0 -> v0.21.0
  • golang.org/x/crypto v0.36.0 -> v0.39.0
  • golang.org/x/net v0.38.0 -> v0.41.0
  • golang.org/x/oauth2 v0.21.0 -> v0.30.0
  • golang.org/x/sync v0.12.0 -> v0.15.0
  • golang.org/x/sys v0.31.0 -> v0.33.0
  • golang.org/x/term v0.30.0 -> v0.32.0
  • golang.org/x/text v0.23.0 -> v0.26.0
  • golang.org/x/time v0.6.0 -> v0.12.0 by @vpnachev [#182]

Container (OCI) Images

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/gardener/oidc-webhook-authenticator:v0.37.0

v0.36.0

[gardener/oidc-webhook-authenticator]

✨ New Features

• [USER] Containers, which do not require privilege escalations, now forbid privilege escalations explicitly. by @georgibaltiev [#179]

🏃 Others

• [OPERATOR] OWA is now built using go version 1.24.4. by @dimityrmirchev [#180]

Container (OCI) Images

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/gardener/oidc-webhook-authenticator:v0.36.0

v0.35.0

[gardener/oidc-webhook-authenticator]

⚠️ Breaking Changes

• [OPERATOR] The default CPU and memory limits on the oidc-webhook-authenticator container have been removed, please set your own limits via the helm chart value .runtime.resources if needed. by @vpnachev [#173]

🏃 Others

• [OPERATOR] OWA is now built using go version 1.24.2. by @dimityrmirchev [#177]

Docker Images

• oidc-webhook-authenticator: europe-docker.pkg.dev/gardener-project/releases/gardener/oidc-webhook-authenticator:v0.35.0