chore(deps): update dependency crossplane-contrib/provider-upjet-aws to v2.7.0 - #327
Open
github-actions[bot] wants to merge 1 commit into
Open
chore(deps): update dependency crossplane-contrib/provider-upjet-aws to v2.7.0#327github-actions[bot] wants to merge 1 commit into
github-actions[bot] wants to merge 1 commit into
Conversation
github-actions
Bot
added
the
dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.6.0→v2.7.0Release Notes
crossplane-contrib/provider-upjet-aws (crossplane-contrib/provider-upjet-aws)
v2.7.0Compare Source
Summary
6.55.0account,bedrock,bedrockagentcore,cloudwatchlogs,lambdaandopensearchserverlessAPI groupsupjetv2.4.1-0.20260728103920-4f6e6e10dff2crossplane-runtimev2.3.3KeyPair.lightsail—status.atProvider.privateKeyremoved (#2136)The upstream Terraform provider changed
private_keyonaws_lightsail_key_pairfrom aregular attribute to a
Sensitiveattribute. Consequently:status.atProvider.privateKeyis removed from the CRDinstead.
Go module consumers: crossplane-runtime v2.3 changes (#2171)
All generated API types moved their common Crossplane types from
github.com/crossplane/crossplane-runtime/v2/apis/common/v1togithub.com/crossplane/crossplane/apis/v2/core/v2. Every*Ref,*Selector,*SecretRefandSecretKeySelectorfield changed its Go type(
v1.Reference→v2.Reference,v1.Selector→v2.Selector,v1.SecretKeySelector→xpv2.SecretKeySelector, …).This is not a CRD/YAML-level change — the schema is identical, so
existing manifests and stored objects are unaffected.
It is a notification for anyone importing this provider's
apis/...packages in Go(e.g. function or composition authors, custom controllers). Please update imports accordingly if needed.
Following fields still work but will be removed in the next major version as underlying TF
versions deprecated them. Use the new replacements on external consumers where possible.
S3Endpointdmsspec.forProvider.kmsKeyArnspec.forProvider.serverSideEncryptionKmsKeyIdSecretVersionsecretsmanagerstatus.atProvider.arnstatus.atProvider.secretArnCluster.elasticache—valkeyremoved fromspec.forProvider.engine(#2136)valkeywas never a valid engine for theClusterresource; it was accepted by the CRDenum but rejected by AWS. Aligned with the AWS SDK to avoid confusion
(see hashicorp/terraform-provider-aws#41181).
Valkey engines continue to be created via
ReplicationGroup.elasticacheorServerlessCache.elasticache.🆕 New managed resources
PrimaryContactaccountaws_account_primary_contactGuardrailbedrockaws_bedrock_guardrailEvaluatorbedrockagentcoreaws_bedrockagentcore_evaluatorHarnessbedrockagentcoreaws_bedrockagentcore_harnessOnlineEvaluationConfigbedrockagentcoreaws_bedrockagentcore_online_evaluation_configPolicybedrockagentcoreaws_bedrockagentcore_policyPolicyEnginebedrockagentcoreaws_bedrockagentcore_policy_engineResourcePolicybedrockagentcoreaws_bedrockagentcore_resource_policyAccountPolicycloudwatchlogsaws_cloudwatch_log_account_policyRuntimeManagementConfiglambdaaws_lambda_runtime_management_configCollectionGroupopensearchserverlessaws_opensearchserverless_collection_group🔼 Terraform AWS provider version bump
6.34.0→6.53.0. The single largest change in this release; theKeyPair.lightsail,Cluster.elasticache, required→optional and deprecation items aboveall originate here. Also backports new fields into cluster-scoped
v1beta1APIs,configures singleton-list conversions for newly added nested blocks, and fixes example
manifests the new provider version rejected (
Broker.mq,Cluster.elasticache,kafka).6.53.0→6.55.0. Additive at the API level (no removed CRD properties, nonew required-field rules, no new deprecations). Carries three fixes not implied by the
title:
Table.dynamodb— in-place GSI/attribute updates no longer fail validation.Broker.mq— a spurious emptyshared_resourcesdiff is dropped, preventing a no-opupdate.
SecurityConfig.opensearchserverless—samlOptionsnow uses a regular singleton-listconversion after TF 6.x switched it to a list-nested block. No CRD API change.
VaultLockConfiguration.backupnow supports updates. The retention argumentsare no longer
ForceNew, so changing retention on an unlocked vault applies in placeinstead of looping on upjet's
assertNoForceNewrefusal (EXT-338). Addsstatus.atProvider.locked/lockDateand the first example manifests for this kind.InstanceState.rdsstopped→availabletransitions (fixes #2100).spec.forProvider.statecan now bring a stopped RDS instance back up. Also adds themissing password secrets to the
instancestate.yamlexamples; Go bumped to1.26.5.🐞 Bug fixes
When streaming is enabled via
spec.forProvider.streamEnabled: trueinTable.dynamodbinMRSC mode, the configuration is now properly propagated to all the replica tables.
applyMethoddiffers(fixes #1286, #1444). Affects
ParameterGroup/ClusterParameterGroupin therds,docdbandneptunegroups: AWS silently ignores apply-method-only changes, soapplyMethodnever round-tripped. A shared custom diff now suppresses theparameterdiff when all parameter changes are
ApplyMethod-only; value changes andadditions/removals are untouched.
LBListenerRule.elbv2withaction.forward.target_group_arnwas late-inited into spec but stripped from state on the next Observe,producing a diff on every cycle. Fixed with a forced per-
actionlate-init (which alsobackfills
orderandforward.stickiness) plus a custom diff that suppresses theresulting spurious ARN add/remove. Real user-driven ARN changes still apply.
status.atProvider.tags/tagsAll. A tag key removed fromor renamed in
spec.forProvider.tagskept appearing in status indefinitely. The externalAWS resource was always correct — only observed state was wrong.
aws_vpc_endpoint_subnet_associationandaws_vpc_endpoint_route_table_associationflipped the
crossplane.io/external-nameannotation between the Terraform ID and theimport ID on every reconciliation, causing perpetual updates, delete/recreate cycles and
AWS
429throttling. Both forms are now derived deterministically from the named fields.was gated behind leader election, so followers could not serve conversion requests. It now
happens eagerly on all pods, with reconciler setup still deferred to the leader.
performanceInsightsKmsKeyIdreference on RDSInstance/Cluster(fixes #2155). Adds the cross-resource reference to
aws_kms_key(all versions, bothscopes) with the generated
Ref/Selectorfields, plus KMS example manifests.🔧 Upjet & crossplane-runtime bumps and their transitive effects
Directly consumed by changes in this release
decoupled from leader election. Consumed by #2122.
terraformedtemplates, plus the newTerraform.ResourceSchematemplate variable(replacing
Terraform.SchemaVersion). Consumed by #2137 (tags fix) and #2140(forced late-init).
fixes "Unexpected Identity Change" errors during
Observefor Framework resources withTerraform resource identity, and makes external-name resolution error out when
FrameworkResourceWithComputedIdentifierreturns the placeholder stub instead of a realidentifier. Relevant to the
bedrockagentcoreandopensearchserverlessresources addedhere. Consumed by #2151.
crossplane/apis/v2for runtime 2.3.x. Consumed by #2171; this is the source of theGo-level
v1.Reference→v2.Referencechange described under Breaking changes.Observable schema/behavior effects in the shipped CRDs
emitted on observation (
status.atProvider) fields. Visible in this release asLBListener.elbv2status.atProvider.defaultActionlosingx-kubernetes-list-type: map/
x-kubernetes-list-map-keys: [index]and the injectedindexdefault. Removing thosemarkers from a status field is schema-compatible; it stops server-side-apply from treating
observed lists as associative maps.
status.lastHandledReconcileAtto every MR CRD in theprovider ("holds the value of the most recent reconcile-requested-at annotation token that
the controller has processed"). This accounts for the bulk of the 2038 modified CRD files.
XValidationrules are omitted forrequired fields that have references, so a field satisfied purely by a
*Ref/*Selectorno longer trips the "is a required parameter" CEL rule.Descriptionon SSAInjectedKey.🔐 Security / CVE remediations
google.golang.org/grpcv1.79.3v1.82.1golang.org/x/netv0.55.0v0.57.0golang.org/x/cryptov0.52.0v0.54.01.25.111.26.5✨ Non-breaking Resource API changes
Non-breaking API relaxations (#2136)
The following fields were
Required→Optional(the generatedis a required parameterCEL validation rules were dropped). Existing manifests keepworking; validation is simply looser now:
Gatewaybedrockagentcorespec.forProvider.protocolTypeMetricAlarmcloudwatchspec.forProvider.comparisonOperatorMetricAlarmcloudwatchspec.forProvider.evaluationPeriodsBrokermqspec.forProvider.userCloudFormationStackserverlessrepospec.forProvider.capabilitiesNew Cross-resource references
New cross-resource references generated in this release:
Instance,ClusterrdsperformanceInsightsKmsKeyIdaws_kms_key(#2156)GuardrailbedrockkmsKeyArnaws_kms_key(#2152)RuntimeManagementConfiglambdafunctionNameaws_lambda_function(#2164)CollectionopensearchserverlesscollectionGroupNameaws_opensearchserverless_collection_group(#2160)AgentRuntimebedrockagentcorefilesystemConfiguration.efsAccessPoint.accessPointArnaws_efs_access_point(#2151)AgentRuntimebedrockagentcorefilesystemConfiguration.s3FilesAccessPoint.accessPointArnaws_s3_access_point(#2151)Browser,CodeInterpreterbedrockagentcorecertificate.location.secretsManager.secretArnaws_secretsmanager_secret(#2151)New fields
New top-level
spec.forProviderfields from the Terraform provider bumps (non-exhaustive —nested additions are not listed):
RestAPI.apigatewayendpointAccessMode,securityPolicyAgentRuntime.bedrockagentcorefilesystemConfigurationBrowser.bedrockagentcorebrowserSigning,certificate,enterprisePolicyCodeInterpreter.bedrockagentcorecertificateGateway.bedrockagentcorepolicyEngineConfigurationGatewayTarget.bedrockagentcoreprivateEndpointMemory.bedrockagentcoreindexedKey,streamDeliveryResourcesBudget.budgetsmetricsDistribution.cloudfrontcacheTagConfigFunction.cloudfronttagsMetricAlarm.cloudwatchevaluationCriteria,evaluationIntervalResourcePolicy.cloudwatchlogsresourceArnDirectory.dsenableDirectoryDataAccessTable.dynamodbrestoreBackupArnNetworkInterface.ec2enaSrdSpecificationRoute.ec2odbNetworkArnVPCIpamPoolCidrAllocation.ec2tagsAddon.eksnamespaceConfigReplicationGroup.elasticachedurabilityServerlessCache.elasticachenetworkTypeUser.elasticachepasswordsWo,passwordsWoVersionLB.elbv2enablePrefixForIpv6SourceNatApplication.emrserverlessjobLevelCostAllocationConfigurationWindowsFileSystem.fsxselfManagedActiveDirectory.passwordWoCatalogTable.glueviewDefinitionConnection.glueauthenticationConfiguration(with OAuth2/basic-auth secret refs)Replicator.kafkalogDeliveryStream.kinesiswarmThroughputMibPsEventSourceMapping.lambda,Function.lambdauseResourceTimeoutForPropagationBroker.mqresourceShareArnsConfiguration.mqskipDestroyDomain.opensearchdeploymentStrategyOptionsCollection.opensearchserverlesscollectionGroupName,encryptionConfig,vectorOptionsResourceShare.ramresourceShareConfigurationCluster.rdsautoMinorVersionUpgradeBucket.s3bucketNamespaceDBCluster.timestreaminfluxdb,DBInstance.timestreaminfluxdbmaintenanceScheduleServer.transferipAddressTypeResourceGateway.vpclatticeresourceConfigDnsResolutionVaultLockConfiguration.backupstatus.atProvider.locked,status.atProvider.lockDate👥 Project
jonasz-lasutadded as a maintainerFull PR list
InstanceState.rdsstopped → available transitionsVaultLockConfigurationmain.go.tmplto theconfig/templatespackageRuntimeManagementConfig.lambdaresourceaws_opensearchserverless_collection_groupresourceGuardrail.bedrockresourcebedrockagentcoreresourceselbv2.LBListenerRulestatus.atProvider.tags/tagsAllcloudwatchlogs.AccountPolicyresourceConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.