From dac8f7ca6ab9e3aed282f64c41beb48693da371b Mon Sep 17 00:00:00 2001 From: Jan Schoone <6106846+jschoone@users.noreply.github.com> Date: Wed, 4 Nov 2026 17:27:13 +0100 Subject: [PATCH 1/2] build: update the builder image to Go 1.26 and make it buildable again The builder image could not be built from the Dockerfile anymore: Wolfi only keeps current package versions, so clusterctl (removed), controller-gen, kind and trivy failed with "unable to select packages" because of their pinned versions. - Go 1.26.10 on bookworm (there is no bullseye image for Go 1.26). pip needs --break-system-packages there (PEP 668). - golangci-lint v2.10.1. It has to be built with Go >= 1.26 to work with the Go 1.26 standard library; v2.4.0 (built with Go 1.25) panics with "file requires newer Go version go1.26". v2.15.0 is not used: its tarball did not match the checksum of the release in install.sh. - controller-gen v0.23.0, kind v0.33.0 and trivy v0.70.0, the versions Wolfi has now. The CRDs in the repository are generated with the controller-gen of the Makefile (v0.16.2), not with this one. - clusterctl v1.14.3, downloaded from the GitHub release in its own stage as it is not in Wolfi anymore. It is only copied to hack/tools/bin for local use (BINARIES in the Makefile, the quickstart uses clusterctl init); no target and no test calls it. The CSO moves to Cluster API 1.13 and 1.14. Installing Cluster API 1.11 or 1.12 with it is not checked. Built locally with podman and checked: go 1.26.10, golangci-lint 2.10.1, clusterctl 1.14.3, controller-gen 0.23.0, helm 3.19.0, kind 0.33.0, kubectl 1.34.13, kustomize 5.7.1, trivy 0.70.0, lychee, hadolint, yamllint, yamlfixer. Not part of this commit: the new image has to be built and pushed with hack/upgrade-builder-image.sh (make builder-image-push). Only then .builder-image-version.txt and the image tags in the workflows can be updated. golangci-lint v2.10.1 reports 15 new findings in the existing code (gosec G602/G703/G704, noctx, prealloc, revive enforce-switch-style and var-naming). They have to be fixed or excluded before the image is used by the CI, otherwise the lint job fails. Signed-off-by: Jan Schoone <6106846+jschoone@users.noreply.github.com> --- images/builder/Dockerfile | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/images/builder/Dockerfile b/images/builder/Dockerfile index 2839e1309..ee9d5aeec 100644 --- a/images/builder/Dockerfile +++ b/images/builder/Dockerfile @@ -29,27 +29,33 @@ RUN apk add --no-cache curl && \ mv /tmp/lychee /usr/bin/lychee && \ rm -rf /tmp/linux-amd64 /tmp/lychee-${LYCHEE_VERSION}.tgz +# Install clusterctl (not available in Wolfi anymore) +FROM docker.io/library/alpine:3.22.1 AS clusterctl +# update: datasource=github-tags depName=kubernetes-sigs/cluster-api +ENV CLUSTERCTL_VERSION="v1.14.3" +# hadolint ignore=DL3018 +RUN apk add --no-cache curl && \ + curl -sfL -o /usr/bin/clusterctl https://github.com/kubernetes-sigs/cluster-api/releases/download/${CLUSTERCTL_VERSION}/clusterctl-linux-amd64 && \ + chmod +x /usr/bin/clusterctl + FROM cgr.dev/chainguard/wolfi-base:latest AS wolfi -# update: datasource=github-tags depName=kubernetes-sigs/cluster-api -ARG CLUSTERCTL_VERSION="v1.10.4" # update: datasource=github-tags depName=helm/helm ENV HELM_VERSION="v3.19.0" # update: datasource=github-tags depName=kubernetes-sigs/kind -ARG KIND_VERSION="v0.30.0" +ARG KIND_VERSION="v0.33.0" # update: datasource=github-tags depName=kubernetes/kubernetes ARG KUBECTL_VERSION="v1.34.0" # update: datasource=github-tags depName=kubernetes-sigs/kustomize extractVersion=^kustomize\/v(?.+)$ ARG KUSTOMIZE_VERSION="v5.7.1" # update: datasource=github-tags depName=aquasecurity/trivy -ARG TRIVY_VERSION="v0.66.0" +ARG TRIVY_VERSION="v0.70.0" # update: datasource=github-tags depName=kubernetes-sigs/controller-tools -ARG CONTROLLER_GEN_VERSION="v0.19.0" +ARG CONTROLLER_GEN_VERSION="v0.23.0" # hadolint ignore=DL3018 RUN apk add -U --no-cache \ curl \ - clusterctl=~${CLUSTERCTL_VERSION#v} \ controller-gen=~${CONTROLLER_GEN_VERSION#v} \ helm=~${HELM_VERSION#v} \ kind=~${KIND_VERSION#v} \ @@ -60,7 +66,7 @@ RUN apk add -U --no-cache \ # Install Golang CI Lint FROM docker.io/library/alpine:3.22.1 AS golangci # update: datasource=github-tags depName=golangci/golangci-lint versioning=semver -ENV GOLANGCI_VERSION="v2.4.0" +ENV GOLANGCI_VERSION="v2.10.1" WORKDIR / # hadolint ignore=DL3018,DL4006 RUN apk add --no-cache curl && \ @@ -75,7 +81,7 @@ FROM docker.io/aquasec/trivy:0.66.0 AS trivy ############################ # CSO Build Image Base # ############################ -FROM docker.io/library/golang:1.24.6-bullseye +FROM docker.io/library/golang:1.26.10-bookworm # update: datasource=github-tags depName=adrienverge/yamllint versioning=semver ENV YAMLLINT_VERSION="v1.37.1" @@ -89,11 +95,11 @@ RUN apt-get update && \ file zip unzip jq gettext \ libsystemd-dev jq && \ rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* && \ - pip install --no-cache-dir \ + pip install --no-cache-dir --break-system-packages \ yamllint==${YAMLLINT_VERSION} \ yamlfixer-opt-nc==${YAMLFIXER_VERSION} -COPY --from=wolfi /usr/bin/clusterctl /usr/bin/clusterctl +COPY --from=clusterctl /usr/bin/clusterctl /usr/bin/clusterctl COPY --from=wolfi /usr/bin/controller-gen /usr/bin/controller-gen COPY --from=wolfi /usr/bin/helm /usr/bin/helm COPY --from=wolfi /usr/bin/kubectl /usr/bin/kubectl From fea20f0785d61b0c71ab9809f9ed5ae903d4e63f Mon Sep 17 00:00:00 2001 From: Jan Schoone <6106846+jschoone@users.noreply.github.com> Date: Fri, 6 Nov 2026 13:14:40 +0100 Subject: [PATCH 2/2] fix: use setup-envtest of controller-runtime release-0.21 make test-unit fails in the CI: the setup-envtest pinned in the Makefile (June 2023) downloads the test binaries from the Google Cloud Storage bucket kubebuilder-tools, which answers with 401/403 now: unable to fetch checksum for requested version: unable fetch metadata for kubebuilder-tools-1.29.3-linux-amd64.tar.gz -- got status "401 Unauthorized" from GCS KUBEBUILDER_ASSETS stays empty and the controller suite fails with exec: "etcd": executable file not found in $PATH. Use setup-envtest@release-0.21, as the migration branch already does. It downloads from the new location and still provides Kubernetes 1.29.3. Checked: with the old pin every version fails with 401, with release-0.21 setup-envtest use 1.29.3 and 1.33.0 work. Signed-off-by: Jan Schoone <6106846+jschoone@users.noreply.github.com> --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 66b953b33..50df84a43 100644 --- a/Makefile +++ b/Makefile @@ -113,7 +113,7 @@ $(ENVSUBST): # Build envsubst from tools folder. SETUP_ENVTEST := $(abspath $(TOOLS_BIN_DIR)/setup-envtest) setup-envtest: $(SETUP_ENVTEST) ## Build a local copy of setup-envtest $(SETUP_ENVTEST): # Build setup-envtest from tools folder. - go install sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.0.0-20230620070423-a784ee78d04b + go install sigs.k8s.io/controller-runtime/tools/setup-envtest@release-0.21 CTLPTL := $(abspath $(TOOLS_BIN_DIR)/ctlptl) ctlptl: $(CTLPTL) ## Build a local copy of ctlptl