deps: modernize all dependencies (python, terraform, helm, images, CI)

.github/dependabot.yml

@@ -0,0 +1,24 @@
+version: 2
+updates:
+  # Python CLI (Poetry)
+  - package-ecosystem: "pip"
+    directory: "/tools"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+
+  # GitHub Actions used by the release workflows
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+
+  # Terraform providers and modules
+  - package-ecosystem: "terraform"
+    directories:
+      - "/platform/terraform/*"
+      - "/platform/terraform/modules/*"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10

.github/workflows/pre_release.yml

@@ -5,11 +5,11 @@ on:
       PYTHON_VERSION:
         description: "Python Version"
         required: false
-        default: "3.12.2"  
+        default: "3.12"  
       POETRY_VERSION:
         description: "The version of Poetry to use"
         required: false
-        default: "1.8.2"  # Ensure this matches the latest stable version
+        default: "2.4.1"  # Ensure this matches the latest stable version
       RELEASE_TAG:
         description: "The new version should be a valid PEP 440 string"
         required: true
@@ -21,12 +21,12 @@ jobs:
   test_pypi_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
       - name: Install Poetry
         run: pip install poetry==${{ inputs.POETRY_VERSION }}
         shell: bash
       - name: Set up Python ${{ inputs.PYTHON_VERSION }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ inputs.PYTHON_VERSION }}
       - name: Configure Poetry with specified Python version

.github/workflows/release.yml

@@ -5,11 +5,11 @@ on:
       PYTHON_VERSION:
         description: "Python Version"
         required: false
-        default: "3.12.2"
+        default: "3.12"
       POETRY_VERSION:
         description: "The version of Poetry to use"
         required: false
-        default: "1.8.2"
+        default: "2.4.1"
       RELEASE_TAG:
         description: "The new version should be a valid PEP 440 string"
         required: true
@@ -22,12 +22,12 @@ jobs:
     name: Builds Using Poetry and Publishes to PyPI
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
       - name: Install Poetry
         run: pip install poetry==${{ inputs.POETRY_VERSION }}
         shell: bash
       - name: Set up Python ${{ inputs.PYTHON_VERSION }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ inputs.PYTHON_VERSION }}
       - run: poetry version ${{ inputs.RELEASE_TAG }}

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/argo-workflows/application.yaml

@@ -10,15 +10,15 @@ spec:
   project: core
   source:
     repoURL: https://argoproj.github.io/argo-helm
-    targetRevision: 0.45.15
+    targetRevision: 1.0.17
     helm:
       valuesObject:
         commonLabels:
           cg-devx.cost-allocation.cost-center: platform
           cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
           cg-devx.metadata.service: continuous-integration.argo-workflow
-          cg-devx.metadata.chart-version: 0.45.15
-          cg-devx.metadata.version: 3.6.7
+          cg-devx.metadata.chart-version: 1.0.17
+          cg-devx.metadata.version: v4.0.6
         singleNamespace: false
         nameOverride: argo
         controller:

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/argocd/label-transformer.yaml

@@ -7,7 +7,7 @@ labels:
   cg-devx.cost-allocation.cost-center: "platform"
   cg-devx.metadata.owner: "<GITOPS_REPOSITORY_NAME>-admin"
   cg-devx.metadata.service: "continuous-delivery.argocd"
-  cg-devx.metadata.version: "2.14.12"
+  cg-devx.metadata.version: "3.4.4"
 fieldSpecs:
 - path: metadata/labels
   create: true

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/atlantis/application.yaml

@@ -10,15 +10,15 @@ spec:
   source:
     repoURL: https://runatlantis.github.io/helm-charts
     chart: atlantis
-    targetRevision: 5.17.2
+    targetRevision: 6.6.0
     helm:
       values: |-
         commonLabels:
           cg-devx.cost-allocation.cost-center: platform
           cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
           cg-devx.metadata.service: atlantis
-          cg-devx.metadata.chart-version: 5.17.2
-          cg-devx.metadata.version: 0.34.0
+          cg-devx.metadata.chart-version: 6.6.0
+          cg-devx.metadata.version: v0.44.0
         statefulSet:
           annotations:
             secret.reloader.stakater.com/reload: "atlantis-envs-secrets"
@@ -36,7 +36,7 @@ spec:
             cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
             cg-devx.metadata.service: atlantis
             cg-devx.metadata.chart-version: 5.4.2
-            cg-devx.metadata.version: 0.28.5
+            cg-devx.metadata.version: v0.44.0
             # <ADDITIONAL_LABELS>
         resources:
           limits:

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/backstage/application.yaml

@@ -10,14 +10,14 @@ spec:
   source:
     repoURL: https://backstage.github.io/charts
     chart: backstage
-    targetRevision: 1.6.0
+    targetRevision: 2.8.2
     helm:
       values: |-
         commonLabels:
           cg-devx.cost-allocation.cost-center: platform
           cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
           cg-devx.metadata.service: developer-portal.backstage
-          cg-devx.metadata.chart-version: 1.6.0
+          cg-devx.metadata.chart-version: 2.8.2
           cg-devx.metadata.version: 1.17.0-next.2
         global:
           imageRegistry: ""
@@ -57,7 +57,6 @@ spec:
             tag: 1.17.0-next.2
             pullPolicy: Always
             pullSecrets: []
-            debug: false
           containerPorts:
             backend: 7007
           command: ["node", "packages/backend"]

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/devsecops/kyverno/kyverno-policies.yaml

@@ -13,16 +13,16 @@ spec:
   source:
     chart: kyverno-policies
     repoURL: https://kyverno.github.io/kyverno
-    targetRevision: v3.4.1
+    targetRevision: v3.8.0
     helm:
       releaseName: kyverno-policies
       values: |
         customLabels:
           cg-devx.cost-allocation.cost-center: platform
           cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
           cg-devx.metadata.service: policy-engine.kyverno-policies
-          cg-devx.metadata.chart-version: 3.4.1
-          cg-devx.metadata.version: 1.14.1
+          cg-devx.metadata.chart-version: 3.8.0
+          cg-devx.metadata.version: v1.18.0
   syncPolicy:
     automated:
       prune: true

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/devsecops/kyverno/kyverno.yaml

@@ -13,16 +13,16 @@ spec:
   source:
     chart: kyverno
     repoURL: https://kyverno.github.io/kyverno
-    targetRevision: v3.4.1
+    targetRevision: v3.8.1
     helm:
       releaseName: kyverno
       values: |
         commonLabels:
           cg-devx.cost-allocation.cost-center: platform
           cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
           cg-devx.metadata.service: policy-engine.kyverno
-          cg-devx.metadata.chart-version: 3.4.1
-          cg-devx.metadata.version: 1.14.1
+          cg-devx.metadata.chart-version: 3.8.1
+          cg-devx.metadata.version: v1.18.1
         global:
           imagePullSecrets:
            - name: docker-config

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/devsecops/kyverno/policy-reporter.yaml

@@ -13,7 +13,7 @@ spec:
   source:
     chart: policy-reporter
     repoURL: https://kyverno.github.io/policy-reporter
-    targetRevision: v3.1.4
+    targetRevision: v3.7.4
     helm:
       releaseName: policy-reporter
       values: |
@@ -22,8 +22,8 @@ spec:
             cg-devx.cost-allocation.cost-center: platform
             cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
             cg-devx.metadata.service: policy-engine.kyverno-policy-reporter
-            cg-devx.metadata.chart-version: 3.1.4
-            cg-devx.metadata.version: 3.1.1          
+            cg-devx.metadata.chart-version: 3.7.4
+            cg-devx.metadata.version: 3.7.4          
         ui:
           enabled: true
         kyvernoPlugin:

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/devsecops/tracee/tracee.yaml

@@ -15,7 +15,7 @@ spec:
   source:
     chart: tracee
     repoURL: https://aquasecurity.github.io/helm-charts/
-    targetRevision: 0.23.1
+    targetRevision: 0.24.1
     helm:
       releaseName: tracee
       values: |
@@ -25,8 +25,8 @@ spec:
           cg-devx.cost-allocation.cost-center: platform
           cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
           cg-devx.metadata.service: runtime-security.tracee
-          cg-devx.metadata.chart-version: 0.23.1
-          cg-devx.metadata.version: 0.23.1
+          cg-devx.metadata.chart-version: 0.24.1
+          cg-devx.metadata.version: 0.24.1
   syncPolicy:
     automated:
       prune: true

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/devsecops/trivy/trivy-operator.yaml

@@ -15,7 +15,7 @@ spec:
   source:
     chart: trivy-operator
     repoURL: https://aquasecurity.github.io/helm-charts/
-    targetRevision: 0.28.1
+    targetRevision: 0.33.2
     helm:
       releaseName: trivy-operator
       values: |
@@ -28,25 +28,25 @@ spec:
             cg-devx.cost-allocation.cost-center: platform
             cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
             cg-devx.metadata.service: runtime-vulnerability-analysis
-            cg-devx.metadata.chart-version: 0.28.1
-            cg-devx.metadata.version: 0.28.1
+            cg-devx.metadata.chart-version: 0.33.2
+            cg-devx.metadata.version: 0.31.2
         serviceMonitor:
           # enabled determines whether a serviceMonitor should be deployed
           enabled: true
           labels:
             cg-devx.cost-allocation.cost-center: platform
             cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
             cg-devx.metadata.service: runtime-vulnerability-analysis
-            cg-devx.metadata.chart-version: 0.28.1
-            cg-devx.metadata.version: 0.28.1
+            cg-devx.metadata.chart-version: 0.33.2
+            cg-devx.metadata.version: 0.31.2
         operator:
           metricsVulnIdEnabled: true
           labels:
             cg-devx.cost-allocation.cost-center: platform
             cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
             cg-devx.metadata.service: runtime-vulnerability-analysis
-            cg-devx.metadata.chart-version: 0.28.1
-            cg-devx.metadata.version: 0.28.1
+            cg-devx.metadata.chart-version: 0.33.2
+            cg-devx.metadata.version: 0.31.2
   syncPolicy:
     automated:
       prune: true

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/harbor/harbor.yaml

@@ -15,7 +15,7 @@ spec:
   source:
     chart: harbor
     repoURL: https://helm.goharbor.io
-    targetRevision: v1.16.3
+    targetRevision: v1.19.1
     helm:
       releaseName: harbor
       values: |
@@ -42,8 +42,8 @@ spec:
               cg-devx.cost-allocation.cost-center: platform
               cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
               cg-devx.metadata.service: oci-registry.harbor
-              cg-devx.metadata.chart-version: 1.16.3
-              cg-devx.metadata.version: 2.12.3
+              cg-devx.metadata.chart-version: 1.19.1
+              cg-devx.metadata.version: 2.15.1
         database:
           type: internal
           internal:
@@ -55,8 +55,8 @@ spec:
             cg-devx.cost-allocation.cost-center: platform
             cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
             cg-devx.metadata.service: oci-registry.harbor
-            cg-devx.metadata.chart-version: 1.16.3
-            cg-devx.metadata.version: 2.12.3
+            cg-devx.metadata.chart-version: 1.19.1
+            cg-devx.metadata.version: 2.15.1
         registry:
           # set the service account to be used, default if left empty
           serviceAccountName: ""
@@ -75,8 +75,8 @@ spec:
             cg-devx.cost-allocation.cost-center: platform
             cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
             cg-devx.metadata.service: oci-registry.harbor
-            cg-devx.metadata.chart-version: 1.16.3
-            cg-devx.metadata.version: 2.12.3
+            cg-devx.metadata.chart-version: 1.19.1
+            cg-devx.metadata.version: 2.15.1
         portal:
           resources:
             requests:
@@ -86,8 +86,8 @@ spec:
             cg-devx.cost-allocation.cost-center: platform
             cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
             cg-devx.metadata.service: oci-registry.harbor
-            cg-devx.metadata.chart-version: 1.16.3
-            cg-devx.metadata.version: 2.12.3
+            cg-devx.metadata.chart-version: 1.19.1
+            cg-devx.metadata.version: 2.15.1
         persistence:
           enabled: true
           imageChartStorage:
@@ -106,8 +106,8 @@ spec:
             cg-devx.cost-allocation.cost-center: platform
             cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
             cg-devx.metadata.service: oci-registry.harbor
-            cg-devx.metadata.chart-version: 1.16.3
-            cg-devx.metadata.version: 2.12.3
+            cg-devx.metadata.chart-version: 1.19.1
+            cg-devx.metadata.version: 2.15.1
         jobservice:
           resources:
             requests:
@@ -117,8 +117,8 @@ spec:
             cg-devx.cost-allocation.cost-center: platform
             cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
             cg-devx.metadata.service: oci-registry.harbor
-            cg-devx.metadata.chart-version: 1.16.3
-            cg-devx.metadata.version: 2.12.3
+            cg-devx.metadata.chart-version: 1.19.1
+            cg-devx.metadata.version: 2.15.1
         redis:
           type: internal
           internal:
@@ -130,25 +130,25 @@ spec:
             cg-devx.cost-allocation.cost-center: platform
             cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
             cg-devx.metadata.service: oci-registry.harbor
-            cg-devx.metadata.chart-version: 1.16.3
-            cg-devx.metadata.version: 2.12.3
+            cg-devx.metadata.chart-version: 1.19.1
+            cg-devx.metadata.version: 2.15.1
         notary:
           enabled: false
           podLabels:
             cg-devx.cost-allocation.cost-center: platform
             cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
             cg-devx.metadata.service: oci-registry.harbor
-            cg-devx.metadata.chart-version: 1.16.3
-            cg-devx.metadata.version: 2.12.3
+            cg-devx.metadata.chart-version: 1.19.1
+            cg-devx.metadata.version: 2.15.1
         trivy:
           # enabled the flag to enable Trivy scanner
           enabled: true
           podLabels:
             cg-devx.cost-allocation.cost-center: platform
             cg-devx.metadata.owner: <GITOPS_REPOSITORY_NAME>-admin
             cg-devx.metadata.service: oci-registry.harbor
-            cg-devx.metadata.chart-version: 1.16.3
-            cg-devx.metadata.version: 2.12.3
+            cg-devx.metadata.chart-version: 1.19.1
+            cg-devx.metadata.version: 2.15.1
         updateStrategy:
           type: Recreate
         existingSecretAdminPassword: harbor-admin