sync to upstream:d59d534

.github/workflows/build_main.yaml

@@ -21,7 +21,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@aa33708b10e362ff993539393ff100fa93ed6a27 # v3.5.0
+      uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
       with:
         version: latest
     - name: Log in to GHCR

.github/workflows/build_tag.yaml

@@ -31,7 +31,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@aa33708b10e362ff993539393ff100fa93ed6a27 # v3.5.0
+      uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
       with:
         version: latest
     - name: Log in to GHCR
@@ -84,7 +84,7 @@ jobs:
         export CONTOUR_E2E_IMAGE="ghcr.io/projectcontour/contour:$(git describe --tags)"
         make setup-kind-cluster run-gateway-conformance cleanup-kind
     - name: Upload gateway conformance report
-      uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+      uses: actions/upload-artifact@89ef406dd8d7e03cfd12d9e0a4a378f454709029 # v4.3.5
       with:
         name: gateway-conformance-report
         path: gateway-conformance-report/projectcontour-contour-*.yaml

.github/workflows/openssf-scorecard.yaml

@@ -32,7 +32,7 @@ jobs:
         results_format: sarif
         publish_results: true
     - name: "Upload artifact"
-      uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+      uses: actions/upload-artifact@89ef406dd8d7e03cfd12d9e0a4a378f454709029 # v4.3.5
       with:
         name: SARIF file
         path: results.sarif

.github/workflows/prbuild.yaml

@@ -27,7 +27,7 @@ jobs:
       with:
         persist-credentials: false
     - name: golangci-lint
-      uses: golangci/golangci-lint-action@a4f60bb28d35aeee14e6880718e0c85ff1882e64 # v6.0.1
+      uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86 # v6.1.0
       with:
         version: v1.56.2
         args: --build-tags=e2e,conformance,tools,gcp,oidc,none --out-format=colored-line-number
@@ -103,7 +103,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@aa33708b10e362ff993539393ff100fa93ed6a27 # v3.5.0
+      uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
       with:
         version: latest
     - name: Build image
@@ -112,7 +112,7 @@ jobs:
       run: |
         make multiarch-build
     - name: Upload image
-      uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+      uses: actions/upload-artifact@89ef406dd8d7e03cfd12d9e0a4a378f454709029 # v4.3.5
       with:
         name: image
         path: image/contour-*.tar

Makefile

@@ -3,10 +3,6 @@ PROJECT = contour
 MODULE = github.com/$(ORG)/$(PROJECT)
 REGISTRY ?= ghcr.io/projectcontour
 IMAGE := $(REGISTRY)/$(PROJECT)
-SRCDIRS := ./cmd ./internal ./apis
-LOCAL_BOOTSTRAP_CONFIG = localenvoyconfig.yaml
-SECURE_LOCAL_BOOTSTRAP_CONFIG = securelocalenvoyconfig.yaml
-ENVOY_IMAGE = docker.io/envoyproxy/envoy:v1.30.4
 GATEWAY_API_VERSION ?= $(shell grep "sigs.k8s.io/gateway-api" go.mod | awk '{print $$2}')
 
 # Used to supply a local Envoy docker container an IP to connect to that is running

apis/projectcontour/v1alpha1/contourdeployment.go

@@ -140,6 +140,13 @@ type ContourSettings struct {
 	// +kubebuilder:validation:MinItems=1
 	// +kubebuilder:validation:MaxItems=42
 	DisabledFeatures []contour_v1.Feature `json:"disabledFeatures,omitempty"`
+
+	// CertLifetime is the number of days for which certificates will be valid.
+	// defaults to 365.
+	//
+	// +kubebuilder:validation:Minimum=0
+	// +optional
+	CertLifetime uint32 `json:"certLifetime,omitempty" yaml:"certLifetime,omitempty"`
 }
 
 // DeploymentSettings contains settings for Deployment resources.

changelogs/unreleased/6604-izturn-minor.md

@@ -0,0 +1,4 @@
+
+## Customize the certificate's lifetime
+
+customize the number of days for which certificates will be valid. defaults to 365.

examples/contour/01-crds.yaml

@@ -1416,6 +1416,13 @@ spec:
                   and associated resources, including things like replica count
                   for the Deployment, and node placement constraints for the pods.
                 properties:
+                  certLifetime:
+                    description: |-
+                      CertLifetime is the number of days for which certificates will be valid.
+                      defaults to 365.
+                    format: int32
+                    minimum: 0
+                    type: integer
                   deployment:
                     description: Deployment describes the settings for running contour
                       as a `Deployment`.

examples/render/contour-deployment.yaml

@@ -1636,6 +1636,13 @@ spec:
                   and associated resources, including things like replica count
                   for the Deployment, and node placement constraints for the pods.
                 properties:
+                  certLifetime:
+                    description: |-
+                      CertLifetime is the number of days for which certificates will be valid.
+                      defaults to 365.
+                    format: int32
+                    minimum: 0
+                    type: integer
                   deployment:
                     description: Deployment describes the settings for running contour
                       as a `Deployment`.

examples/render/contour-gateway-provisioner.yaml

@@ -1427,6 +1427,13 @@ spec:
                   and associated resources, including things like replica count
                   for the Deployment, and node placement constraints for the pods.
                 properties:
+                  certLifetime:
+                    description: |-
+                      CertLifetime is the number of days for which certificates will be valid.
+                      defaults to 365.
+                    format: int32
+                    minimum: 0
+                    type: integer
                   deployment:
                     description: Deployment describes the settings for running contour
                       as a `Deployment`.

examples/render/contour-gateway.yaml

@@ -1452,6 +1452,13 @@ spec:
                   and associated resources, including things like replica count
                   for the Deployment, and node placement constraints for the pods.
                 properties:
+                  certLifetime:
+                    description: |-
+                      CertLifetime is the number of days for which certificates will be valid.
+                      defaults to 365.
+                    format: int32
+                    minimum: 0
+                    type: integer
                   deployment:
                     description: Deployment describes the settings for running contour
                       as a `Deployment`.

examples/render/contour.yaml

@@ -1636,6 +1636,13 @@ spec:
                   and associated resources, including things like replica count
                   for the Deployment, and node placement constraints for the pods.
                 properties:
+                  certLifetime:
+                    description: |-
+                      CertLifetime is the number of days for which certificates will be valid.
+                      defaults to 365.
+                    format: int32
+                    minimum: 0
+                    type: integer
                   deployment:
                     description: Deployment describes the settings for running contour
                       as a `Deployment`.

go.mod

@@ -8,7 +8,7 @@ require (
 	github.com/ahmetb/gen-crd-api-reference-docs v0.3.0
 	github.com/alecthomas/kingpin/v2 v2.4.0
 	github.com/bombsimon/logrusr/v4 v4.1.0
-	github.com/cert-manager/cert-manager v1.15.1
+	github.com/cert-manager/cert-manager v1.15.2
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 	github.com/distribution/reference v0.6.0
 	github.com/envoyproxy/go-control-plane v0.12.1-0.20240111020705-5401a878d8bb
@@ -19,17 +19,17 @@ require (
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
 	github.com/onsi/ginkgo/v2 v2.19.1
-	github.com/onsi/gomega v1.34.0
+	github.com/onsi/gomega v1.34.1
 	github.com/projectcontour/yages v0.1.0
 	github.com/prometheus/client_golang v1.19.1
 	github.com/prometheus/client_model v0.6.1
 	github.com/prometheus/common v0.55.0
 	github.com/sirupsen/logrus v1.9.3
 	github.com/stretchr/testify v1.9.0
 	github.com/tsaarni/certyaml v0.9.3
-	github.com/vektra/mockery/v2 v2.43.2
+	github.com/vektra/mockery/v2 v2.44.1
 	go.uber.org/automaxprocs v1.5.3
-	golang.org/x/oauth2 v0.21.0
+	golang.org/x/oauth2 v0.22.0
 	gonum.org/v1/plot v0.14.0
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240528184218-531527333157
 	google.golang.org/grpc v1.65.0
@@ -120,17 +120,17 @@ require (
 	github.com/subosito/gotenv v1.4.2 // indirect
 	github.com/tsaarni/x500dn v1.0.0 // indirect
 	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
-	golang.org/x/crypto v0.24.0 // indirect
-	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 // indirect
+	golang.org/x/crypto v0.25.0 // indirect
+	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
 	golang.org/x/image v0.18.0 // indirect
-	golang.org/x/mod v0.17.0 // indirect
-	golang.org/x/net v0.26.0 // indirect
+	golang.org/x/mod v0.19.0 // indirect
+	golang.org/x/net v0.27.0 // indirect
 	golang.org/x/sync v0.7.0 // indirect
-	golang.org/x/sys v0.21.0 // indirect
-	golang.org/x/term v0.21.0 // indirect
+	golang.org/x/sys v0.22.0 // indirect
+	golang.org/x/term v0.22.0 // indirect
 	golang.org/x/text v0.16.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
+	golang.org/x/tools v0.23.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect