Merge pull request #135 from Lerentis/bugfix/tt/133

bugfixes and updates

Author: Lerentis

Dockerfile

@@ -1,15 +1,15 @@
-FROM alpine:3.23.3
+FROM alpine:3.24.2 
 
 LABEL org.opencontainers.image.source=https://github.com/Lerentis/bitwarden-crd-operator
 LABEL org.opencontainers.image.description="Kubernetes Operator to create k8s secrets from bitwarden"
 LABEL org.opencontainers.image.licenses=MIT
 
-ARG PYTHON_VERSION=3.12.12-r0
-ARG PIP_VERSION=25.1.1-r1
+ARG PYTHON_VERSION=3.14.7-r1
+ARG PIP_VERSION=26.1.2-r0
 ARG GCOMPAT_VERSION=1.1.0-r4
-ARG LIBCRYPTO_VERSION=3.5.5-r0
+ARG LIBCRYPTO_VERSION=3.5.8-r0
 ARG BW_VERSION=2025.5.0
-ARG NODE_VERSION=24.14.1-r0
+ARG NODE_VERSION=24.18.1-r0
 
 COPY requirements.txt /requirements.txt
 

charts/bitwarden-crd-operator/Chart.yaml

@@ -4,9 +4,9 @@ description: Deploy the Bitwarden CRD Operator
 
 type: application
 
-version: "v0.18.0"
+version: "v0.18.1"
 
-appVersion: "0.17.0"
+appVersion: "0.18.0"
 
 keywords:
   - operator
@@ -112,8 +112,24 @@ annotations:
   artifacthub.io/operator: "true"
   artifacthub.io/containsSecurityUpdates: "false"
   artifacthub.io/changes: |
-    - kind: added
-      description: "Added self heal mechanism on vault unlock issues"
+    - kind: changed
+      description: "updated alpine to 3.24.2"
+    - kind: changed
+      description: "updated python to 3.14.7"
+    - kind: changed
+      description: "updated pip to 26.1.2"
+    - kind: changed
+      description: "updated libcrypto3 to 3.5.8"
+    - kind: changed
+      description: "updated nodejs to 24.18.1"
+    - kind: fixed
+      description: "fixed auth recovery to reconfigure the bitwarden host instead of falling back to a default"
+    - kind: changed
+      description: "updated kopf to 1.44.6"
+    - kind: changed
+      description: "updated kubernetes to 36.0.3"
+    - kind: fixed
+      description: "fixed termination of operator process after failed authentication recovery"
   artifacthub.io/images: |
     - name: bitwarden-crd-operator
-      image: ghcr.io/lerentis/bitwarden-crd-operator:0.17.0
+      image: ghcr.io/lerentis/bitwarden-crd-operator:0.18.0

requirements.txt

@@ -1,4 +1,4 @@
-kopf==1.44.4
-kubernetes==35.0.0
+kopf==1.44.6
+kubernetes==36.0.3
 Jinja2==3.1.6
 schedule==1.2.2

src/bitwardenCrdOperator.py

@@ -92,6 +92,15 @@ def recover_auth_state(logger):
     command_wrapper(logger, "logout", use_success=False)
 
     home_dir = os.path.expanduser("~")
+
+    bw_host_file = os.path.join(home_dir, ".bw_host")
+    if os.path.isfile(bw_host_file):
+        try:
+            os.remove(bw_host_file)
+            logger.warn("Removed Bitwarden CLI host marker to recover auth state")
+        except OSError as exc:
+            logger.warn(f"Could not remove Bitwarden CLI host marker: {exc}")
+
     cli_data_file = os.path.join(home_dir, ".config", "Bitwarden CLI", "data.json")
     if os.path.isfile(cli_data_file):
         try:
@@ -126,6 +135,7 @@ def bitwarden_signin(logger, **kwargs):
         "Authentication failure threshold reached, recovering Bitwarden auth state"
     )
     recover_auth_state(logger)
+    _configure_bw_host(logger)
 
     recovery_ok, recovery_error = _login_and_unlock(logger)
     if recovery_ok:
@@ -135,7 +145,7 @@ def bitwarden_signin(logger, **kwargs):
 
     logger.error(f"Authentication recovery failed: {recovery_error}")
     logger.error("Stopping operator process after failed authentication recovery")
-    sys.exit(1)
+    os._exit(1)
 
 
 def run_continuously(interval=30):

src/utils/utils.py

@@ -1,10 +1,18 @@
 import os
 import json
 import subprocess
-import distutils
 import kubernetes
 import kopf
 
+
+def _strtobool(value):
+    normalized = str(value).strip().lower()
+    if normalized in {"y", "yes", "1", "true", "on"}:
+        return 1
+    if normalized in {"n", "no", "0", "false", "off", ""}:
+        return 0
+    raise ValueError(f"invalid truth value {value!r}")
+
 bw_sync_interval = float(os.environ.get(
     'BW_SYNC_INTERVAL', 900))
 
@@ -30,7 +38,7 @@ def _sync(logger):
             logger.info("Running with regular force sync enabled")
         return
 
-    global_force_sync = bool(distutils.util.strtobool(
+    global_force_sync = bool(_strtobool(
         os.environ.get('BW_FORCE_SYNC', "false")))
 
     if global_force_sync:

tests/test_bitwarden_signin_recovery.py

@@ -86,19 +86,19 @@ def test_recovery_runs_after_threshold_and_resets_counter(
         self.assertEqual(operator.auth_failures, 0)
         self.assertEqual(os.environ.get("BW_SESSION"), "new-session")
 
-    @patch("bitwardenCrdOperator.sys.exit")
+    @patch("bitwardenCrdOperator.os._exit")
     @patch("bitwardenCrdOperator.recover_auth_state")
     @patch("bitwardenCrdOperator.command_wrapper")
     def test_recovery_failure_exits_process(
-        self, command_wrapper_mock, recover_auth_state_mock, sys_exit_mock
+        self, command_wrapper_mock, recover_auth_state_mock, os_exit_mock
     ):
         os.environ["BW_AUTH_FAILURE_THRESHOLD"] = "1"
         command_wrapper_mock.side_effect = [None, None]
 
         operator.bitwarden_signin(self.logger)
 
         recover_auth_state_mock.assert_called_once_with(self.logger)
-        sys_exit_mock.assert_called_once_with(1)
+        os_exit_mock.assert_called_once_with(1)
 
     def test_invalid_threshold_uses_default_without_exception_control_flow(self):
         os.environ["BW_AUTH_FAILURE_THRESHOLD"] = "invalid"
@@ -108,13 +108,16 @@ def test_invalid_threshold_uses_default_without_exception_control_flow(self):
         self.assertEqual(threshold, operator.AUTH_FAILURE_THRESHOLD)
 
     @patch("bitwardenCrdOperator.command_wrapper")
-    def test_recover_auth_state_clears_session_and_cache_file(
+    def test_recover_auth_state_clears_session_cache_and_bw_host_marker(
         self, command_wrapper_mock
     ):
         with tempfile.TemporaryDirectory() as temp_dir:
             data_file = Path(temp_dir) / ".config" / "Bitwarden CLI" / "data.json"
             data_file.parent.mkdir(parents=True, exist_ok=True)
             data_file.write_text("{ invalid", encoding="utf-8")
+
+            bw_host_file = Path(temp_dir) / ".bw_host"
+            bw_host_file.write_text("https://vault.example.com", encoding="utf-8")
             os.environ["BW_SESSION"] = "stale-session"
 
             with patch(
@@ -124,6 +127,7 @@ def test_recover_auth_state_clears_session_and_cache_file(
 
             self.assertNotIn("BW_SESSION", os.environ)
             self.assertFalse(data_file.exists())
+            self.assertFalse(bw_host_file.exists())
             command_wrapper_mock.assert_called_once_with(
                 self.logger, "logout", use_success=False
             )