From 56108eca836932f0d15dfd95135ff539e469c855 Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Wed, 24 Jun 2026 12:07:49 +0500 Subject: [PATCH 01/18] ci(renovate): pin base images and GitHub Actions to digests Enable Renovate's dockerfile and github-actions managers with pinDigests so OpenSSF Scorecard Pinned-Dependencies (currently 1/10) can pass and supply-chain refs stay reproducible. PR #2849 SHA-pinned actions in 13 workflows, but the check also scores container base images -- 58 unpinned FROM lines across 27 distinct images -- and left build-main.yaml / release-e2e.yaml unpinned. Nothing kept the new action SHAs updated either, so they would silently stop receiving security patches. Enabling the managers lets Renovate open the initial pin PR (and pin the two missed workflows) and keep digests fresh thereafter. Digest-only refreshes and the initial pin are batched into a single weekly PR to avoid a trickle of rebuild-triggering PRs on the shared CI runner; real tag bumps stay individual for review. Also pin s3manager's floating tags (golang:1, alpine:latest) to concrete versions first, otherwise digest tracking churns endlessly. Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- .github/renovate.json | 14 +++++++++++++- packages/system/bucket/images/s3manager/Dockerfile | 4 ++-- 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/.github/renovate.json b/.github/renovate.json index 9475acf1b..6c2010250 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -4,7 +4,7 @@ "config:recommended", ":semanticCommits" ], - "enabledManagers": ["gomod"], + "enabledManagers": ["gomod", "dockerfile", "github-actions"], "postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"], "labels": ["automated", "do-not-merge/hold"], "automerge": false, @@ -22,6 +22,18 @@ "matchManagers": ["gomod"], "matchDepTypes": ["golang"], "enabled": false + }, + { + "description": "Pin Dockerfile base images and GitHub Actions to immutable digests so OpenSSF Scorecard Pinned-Dependencies passes and supply-chain refs stay reproducible. The tag is kept in front of the digest so it stays human-readable and trackable.", + "matchManagers": ["dockerfile", "github-actions"], + "pinDigests": true + }, + { + "description": "Batch the initial pin and all digest-only refreshes (same tag, rebuilt upstream) into a single weekly PR. Without this, frequently-rebuilt bases (alpine, debian, golang, distroless) would trickle in one rebuild-triggering PR each, loading the shared CI runner. Real tag bumps (major/minor/patch) are intentionally left out of this group so they get individual review.", + "matchManagers": ["dockerfile", "github-actions"], + "matchUpdateTypes": ["digest", "pinDigest"], + "groupName": "container image & action digests", + "schedule": ["before 6am on monday"] } ] } diff --git a/packages/system/bucket/images/s3manager/Dockerfile b/packages/system/bucket/images/s3manager/Dockerfile index e97adf07b..e9eb55f07 100644 --- a/packages/system/bucket/images/s3manager/Dockerfile +++ b/packages/system/bucket/images/s3manager/Dockerfile @@ -1,6 +1,6 @@ # Source: https://github.com/cloudlena/s3manager/blob/main/Dockerfile -FROM docker.io/library/golang:1 AS builder +FROM docker.io/library/golang:1.26 AS builder ARG TARGETOS ARG TARGETARCH @@ -12,7 +12,7 @@ RUN git apply /cozystack.patch RUN go mod tidy RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -ldflags="-s -w" -a -installsuffix cgo -o bin/s3manager -FROM docker.io/library/alpine:latest +FROM docker.io/library/alpine:3.24 WORKDIR /usr/src/app RUN addgroup -S s3manager && adduser -S s3manager -G s3manager RUN apk add --no-cache \ From 50344f1ab9bc197b082676ef4321050a3f1d6d79 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Mon, 22 Jun 2026 17:11:09 +0300 Subject: [PATCH 02/18] refactor(platform): add shared cozystack-version stamp helper Extract the labeled cozystack-version ConfigMap stamp into a sourced shell helper so migrations cannot drift back to a label-less apply that strips the platform.cozystack.io/no-delete label. render_cozystack_version_manifest emits the manifest on stdout (pure, unit-testable); stamp_cozystack_version renders and applies it. The namespace defaults to cozy-system and honors $NAMESPACE. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- hack/cozystack-version-stamp.bats | 95 +++++++++++++++++++ .../migrations/lib/cozystack-version.sh | 43 +++++++++ 2 files changed, 138 insertions(+) create mode 100644 hack/cozystack-version-stamp.bats create mode 100644 packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh diff --git a/hack/cozystack-version-stamp.bats b/hack/cozystack-version-stamp.bats new file mode 100644 index 000000000..038642c85 --- /dev/null +++ b/hack/cozystack-version-stamp.bats @@ -0,0 +1,95 @@ +#!/usr/bin/env bats +# ----------------------------------------------------------------------------- +# Unit tests for +# packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh +# +# render_cozystack_version_manifest emits the cozystack-version +# ConfigMap manifest on stdout, always carrying the +# platform.cozystack.io/no-delete=true label that the +# cozystack-no-delete-guardrail ValidatingAdmissionPolicy keys on. Migrations +# apply it under the default kubectl field manager; a label-less apply by that +# same manager would strip the label, so the manifest is centralized here and +# every migration sources it instead of copy-pasting a heredoc. +# +# cozytest.sh's awk parser recognizes only @test blocks and a bare `}` on its +# own line; there is no bats `run` or `$status`. Assertions are expressed as +# direct shell tests that exit non-zero on failure. Each test runs in its own +# subshell, so NAMESPACE set/unset in one test does not leak into another. +# +# Run with: hack/cozytest.sh hack/cozystack-version-stamp.bats +# ----------------------------------------------------------------------------- + +@test "renders parseable YAML for a version" { + . packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh + render_cozystack_version_manifest 45 | yq . >/dev/null +} + +@test "carries the no-delete label set to true" { + . packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh + val=$(render_cozystack_version_manifest 45 \ + | yq -r '.metadata.labels."platform.cozystack.io/no-delete"') + [ "$val" = "true" ] +} + +@test "names the ConfigMap cozystack-version" { + . packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh + name=$(render_cozystack_version_manifest 45 | yq -r '.metadata.name') + [ "$name" = "cozystack-version" ] +} + +@test "stamps the requested version as a quoted string" { + # The version MUST render as a quoted YAML string; an unquoted numeric + # scalar (version: 45) would change the ConfigMap data type the rest of + # the platform reads as a string. + . packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh + out=$(render_cozystack_version_manifest 45) + printf '%s\n' "$out" | grep -qx ' version: "45"' + v=$(printf '%s\n' "$out" | yq -r '.data.version') + [ "$v" = "45" ] +} + +@test "defaults namespace to cozy-system when NAMESPACE is unset" { + unset NAMESPACE + . packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh + ns=$(render_cozystack_version_manifest 45 | yq -r '.metadata.namespace') + [ "$ns" = "cozy-system" ] +} + +@test "honors a NAMESPACE override" { + . packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh + out=$(export NAMESPACE=cozy-other; render_cozystack_version_manifest 45) + ns=$(printf '%s\n' "$out" | yq -r '.metadata.namespace') + [ "$ns" = "cozy-other" ] +} + +@test "requires a version argument" { + . packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh + if ( render_cozystack_version_manifest ) 2>/dev/null; then + echo "expected non-zero exit when version arg is missing" >&2 + exit 1 + fi +} + +@test "render output matches the canonical labeled manifest" { + # Golden test: pins the exact bytes migrations 42/43/44 apply today, so the + # refactor that routes them through this helper is provably manifest-stable. + unset NAMESPACE + . packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh + expected=$(cat <<'EOF' +apiVersion: v1 +kind: ConfigMap +metadata: + name: cozystack-version + namespace: cozy-system + labels: + platform.cozystack.io/no-delete: "true" +data: + version: "45" +EOF +) + actual=$(render_cozystack_version_manifest 45) + if [ "$actual" != "$expected" ]; then + printf 'expected:\n%s\n---\nactual:\n%s\n' "$expected" "$actual" >&2 + exit 1 + fi +} diff --git a/packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh b/packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh new file mode 100644 index 000000000..81b86d622 --- /dev/null +++ b/packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh @@ -0,0 +1,43 @@ +# shellcheck shell=sh +# Shared helper for stamping the cozystack-version ConfigMap during migrations. +# +# The ConfigMap MUST carry the platform.cozystack.io/no-delete=true label so the +# cozystack-no-delete-guardrail ValidatingAdmissionPolicy guards it against +# deletion. Migrations apply it under the default kubectl field manager; a +# label-less apply by that same manager would strip the label (the failure mode +# migration 42 first fixed). templates/cozystack-version.yaml renders the +# labeled ConfigMap only on first install (lookup-if-not), so every upgrade-time +# stamp must re-emit the label by hand. +# +# Centralizing the manifest here means migration 45+ cannot drift back to a +# label-less apply: each migration sources this file and calls the helper +# instead of copy-pasting a heredoc. +# +# Sourced, not executed. Each migrations/ script does: +# . "$(dirname "$0")/lib/cozystack-version.sh" +# and run-migrations.sh sources /migrations/lib/cozystack-version.sh. + +# render_cozystack_version_manifest +# Emit the labeled cozystack-version ConfigMap manifest on stdout. Pure (no +# kubectl), so it is unit-testable in isolation. The namespace defaults to +# cozy-system and is overridable via $NAMESPACE. +render_cozystack_version_manifest() { + : "${1:?render_cozystack_version_manifest: version argument required}" + cat < +# Render and apply the labeled manifest under the default kubectl field manager. +stamp_cozystack_version() { + render_cozystack_version_manifest "$1" | kubectl apply --filename - +} From b199b5e438cb08be872b6a8a4b9a1fe0b9728a2f Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Mon, 22 Jun 2026 17:14:12 +0300 Subject: [PATCH 03/18] refactor(platform): stamp cozystack-version via shared helper in migrations Migrations 42, 43 and 44 each carried a copy-pasted heredoc that applied the labeled cozystack-version ConfigMap. Source the shared helper and call it instead, so the labeled manifest has a single definition and future migrations cannot reintroduce a label-less apply. Behavior-preserving: the rendered manifest is byte-identical to the previous heredocs. Migration 42 keeps its MIGRATION_DRY_RUN path, now building its manifest from the helper's pure renderer. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- .../platform/images/migrations/migrations/42 | 25 ++++++------------- .../platform/images/migrations/migrations/43 | 24 +++++------------- .../platform/images/migrations/migrations/44 | 24 +++++------------- 3 files changed, 20 insertions(+), 53 deletions(-) diff --git a/packages/core/platform/images/migrations/migrations/42 b/packages/core/platform/images/migrations/migrations/42 index adc4f0fea..5844f4acc 100755 --- a/packages/core/platform/images/migrations/migrations/42 +++ b/packages/core/platform/images/migrations/migrations/42 @@ -14,29 +14,20 @@ # the next chart-driven apply sees no diff. # # 3-way-merge note: this apply records the no-delete label in the kubectl -# last-applied-configuration annotation under the default field manager. -# Any future migration that re-stamps cozystack-version via the same field -# manager MUST include the label inline (matching the chart template at -# templates/cozystack-version.yaml) — a label-less apply by the same field -# manager would strip it. +# last-applied-configuration annotation under the default field manager. A +# label-less apply by the same field manager would strip it, so the manifest +# is rendered by the shared helper (lib/cozystack-version.sh) that every +# migration sources rather than a hand-copied heredoc. set -euo pipefail +# shellcheck source=lib/cozystack-version.sh +. "$(dirname "$0")/lib/cozystack-version.sh" + NAMESPACE="${NAMESPACE:-cozy-system}" DRY_RUN="${MIGRATION_DRY_RUN:-0}" -MANIFEST=$(cat </dev/null 2>&1; then # No early-close (head) in the pipe: under pipefail a large name list would # SIGPIPE kubectl and abort the migration. @@ -23,21 +26,6 @@ if kubectl get deployment flux-tenants -n cozy-fluxcd >/dev/null 2>&1; then fi fi -# Stamp version. -# Mirror migration 43's labeled manifest. A label-less apply by the same field -# manager would strip the platform.cozystack.io/no-delete label, dropping -# cozystack-version out of the cozystack-no-delete-guardrail -# ValidatingAdmissionPolicy. templates/cozystack-version.yaml only re-renders -# the labeled ConfigMap on first install, so the label must be carried inline -# here. -kubectl apply --filename - < Date: Mon, 22 Jun 2026 17:14:26 +0300 Subject: [PATCH 04/18] fix(platform): stamp the no-delete label on bootstrap cozystack-version The bootstrap path that creates cozystack-version when the ConfigMap is absent applied it without the platform.cozystack.io/no-delete label, leaving it unguarded by the cozystack-no-delete-guardrail ValidatingAdmissionPolicy. Route it through the shared helper so the bootstrap ConfigMap carries the label like every migration-driven stamp. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- .../core/platform/images/migrations/run-migrations.sh | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/packages/core/platform/images/migrations/run-migrations.sh b/packages/core/platform/images/migrations/run-migrations.sh index 90a72d907..e2143f9b8 100755 --- a/packages/core/platform/images/migrations/run-migrations.sh +++ b/packages/core/platform/images/migrations/run-migrations.sh @@ -1,6 +1,9 @@ #!/bin/sh set -euo pipefail +# shellcheck source=migrations/lib/cozystack-version.sh +. /migrations/lib/cozystack-version.sh + NAMESPACE="${NAMESPACE:-cozy-system}" CURRENT_VERSION="${CURRENT_VERSION:-0}" TARGET_VERSION="${TARGET_VERSION:-0}" @@ -10,9 +13,9 @@ echo "Starting migrations from version $CURRENT_VERSION to $TARGET_VERSION" # Check if ConfigMap exists if ! kubectl get configmap --namespace "$NAMESPACE" cozystack-version >/dev/null 2>&1; then echo "ConfigMap cozystack-version does not exist, creating it with version $TARGET_VERSION" - kubectl create configmap --namespace "$NAMESPACE" cozystack-version \ - --from-literal=version="$TARGET_VERSION" \ - --dry-run=client --output yaml | kubectl apply --filename - + # Stamp via the shared helper so the bootstrap ConfigMap carries the + # platform.cozystack.io/no-delete label like every migration-driven stamp. + stamp_cozystack_version "$TARGET_VERSION" echo "ConfigMap created with version $TARGET_VERSION" exit 0 fi From 985b4b0954853a00169b6edbe5af8337ddb8f8c3 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Mon, 22 Jun 2026 20:20:23 +0300 Subject: [PATCH 05/18] fix(platform): guard stamp_cozystack_version against a missing version Mirror render_cozystack_version_manifest's argument guard in stamp_cozystack_version so a missing version aborts before the kubectl pipe. Without it, a render failure in a shell without pipefail would leave the pipeline exit status to kubectl, which would apply empty input. Add a unittest covering the guard. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- hack/cozystack-version-stamp.bats | 10 ++++++++++ .../migrations/migrations/lib/cozystack-version.sh | 3 +++ 2 files changed, 13 insertions(+) diff --git a/hack/cozystack-version-stamp.bats b/hack/cozystack-version-stamp.bats index 038642c85..f8e84a203 100644 --- a/hack/cozystack-version-stamp.bats +++ b/hack/cozystack-version-stamp.bats @@ -70,6 +70,16 @@ fi } +@test "stamp_cozystack_version requires a version argument" { + # The guard fires before the kubectl pipe, so this needs no cluster: a + # missing version must abort rather than apply empty input to kubectl. + . packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh + if ( stamp_cozystack_version ) 2>/dev/null; then + echo "expected non-zero exit when version arg is missing" >&2 + exit 1 + fi +} + @test "render output matches the canonical labeled manifest" { # Golden test: pins the exact bytes migrations 42/43/44 apply today, so the # refactor that routes them through this helper is provably manifest-stable. diff --git a/packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh b/packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh index 81b86d622..e05f1c170 100644 --- a/packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh +++ b/packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh @@ -39,5 +39,8 @@ EOF # stamp_cozystack_version # Render and apply the labeled manifest under the default kubectl field manager. stamp_cozystack_version() { + # Guard the version here too, not only in render: without pipefail a render + # failure would not abort the pipeline and kubectl would apply empty input. + : "${1:?stamp_cozystack_version: version argument required}" render_cozystack_version_manifest "$1" | kubectl apply --filename - } From de44ecf15aa078fe2120effd1b6929d382f42b90 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Mon, 22 Jun 2026 20:28:16 +0300 Subject: [PATCH 06/18] test(platform): enforce go-forward version stamps route through the helper The helper header and run-migrations.sh claimed every migration-driven stamp routes through the helper, but migrations 1-41 still stamp the cozystack-version ConfigMap label-less and are backfilled by migration 42. Scope the comments to go-forward stamps (migration 42 onward and the bootstrap path), and add a unittest asserting no migration numbered >= 42 nor run-migrations.sh stamps cozystack-version without the helper, so the no-drift invariant is enforced rather than aspirational. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- hack/cozystack-version-stamp.bats | 38 +++++++++++++++++++ .../migrations/lib/cozystack-version.sh | 11 ++++-- .../images/migrations/run-migrations.sh | 4 +- 3 files changed, 49 insertions(+), 4 deletions(-) diff --git a/hack/cozystack-version-stamp.bats b/hack/cozystack-version-stamp.bats index f8e84a203..85db10d8f 100644 --- a/hack/cozystack-version-stamp.bats +++ b/hack/cozystack-version-stamp.bats @@ -103,3 +103,41 @@ EOF exit 1 fi } + +@test "no go-forward stamp bypasses the helper (migrations >= 42 and run-migrations.sh)" { + # The helper exists so go-forward stamps cannot drift back to a label-less + # apply that drops the no-delete label. Migrations 1-41 are frozen and + # backfilled by 42, so they are exempt; migration 42 onward and the + # bootstrap path must each source the helper, call its API, and never stamp + # cozystack-version directly with kubectl. Blocking only the historical + # 'kubectl create configmap' shape is too weak — an inline 'kubectl apply' + # of a hand-rolled label-less manifest would slip past it. + mig_dir=packages/core/platform/images/migrations/migrations + files="" + for f in "$mig_dir"/*; do + n=$(basename "$f") + case "$n" in *[!0-9]*) continue ;; esac # skip lib/ and other non-numeric + [ "$n" -ge 42 ] || continue + files="$files $f" + done + files="$files packages/core/platform/images/migrations/run-migrations.sh" + + for f in $files; do + if ! grep -Eq 'cozystack-version\.sh' "$f"; then + echo "$f does not source the cozystack-version helper" >&2 + exit 1 + fi + if ! grep -Eq '(render_cozystack_version_manifest|stamp_cozystack_version)' "$f"; then + echo "$f does not call the cozystack-version helper API" >&2 + exit 1 + fi + # Strip full-comment lines first: a comment that explains why a stamp + # routes through the helper must not read as a direct stamp itself. A + # real bypass command never starts with '#', so the guard keeps its + # strength against actual direct stamping. + if grep -v '^[[:space:]]*#' "$f" | grep -Eq 'kubectl[[:space:]].*(create[[:space:]]+configmap|apply).*cozystack-version'; then + echo "$f stamps cozystack-version directly instead of via the helper" >&2 + exit 1 + fi + done +} diff --git a/packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh b/packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh index e05f1c170..7b665f5f0 100644 --- a/packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh +++ b/packages/core/platform/images/migrations/migrations/lib/cozystack-version.sh @@ -10,10 +10,15 @@ # stamp must re-emit the label by hand. # # Centralizing the manifest here means migration 45+ cannot drift back to a -# label-less apply: each migration sources this file and calls the helper -# instead of copy-pasting a heredoc. +# label-less apply: every go-forward stamp (migration 42 onward and the +# bootstrap path in run-migrations.sh) sources this file and calls the helper +# instead of copy-pasting a heredoc. Migrations 1-41 predate the no-delete +# label and stamp label-less on purpose; migration 42 backfills the label on +# any upgrade path through them, so they are left frozen. The +# cozystack-version-stamp.bats suite pins this — no migration numbered >= 42 +# (nor run-migrations.sh) may stamp cozystack-version without the helper. # -# Sourced, not executed. Each migrations/ script does: +# Sourced, not executed. Each migrations/ script (42+) does: # . "$(dirname "$0")/lib/cozystack-version.sh" # and run-migrations.sh sources /migrations/lib/cozystack-version.sh. diff --git a/packages/core/platform/images/migrations/run-migrations.sh b/packages/core/platform/images/migrations/run-migrations.sh index e2143f9b8..aeea5ec44 100755 --- a/packages/core/platform/images/migrations/run-migrations.sh +++ b/packages/core/platform/images/migrations/run-migrations.sh @@ -14,7 +14,9 @@ echo "Starting migrations from version $CURRENT_VERSION to $TARGET_VERSION" if ! kubectl get configmap --namespace "$NAMESPACE" cozystack-version >/dev/null 2>&1; then echo "ConfigMap cozystack-version does not exist, creating it with version $TARGET_VERSION" # Stamp via the shared helper so the bootstrap ConfigMap carries the - # platform.cozystack.io/no-delete label like every migration-driven stamp. + # platform.cozystack.io/no-delete label, matching every go-forward stamp + # (migration 42 onward; migrations 1-41 stamp label-less and are backfilled + # by migration 42, so they are intentionally left as-is). stamp_cozystack_version "$TARGET_VERSION" echo "ConfigMap created with version $TARGET_VERSION" exit 0 From 60b6cf3fdccd093004d63fe039a07de07a58eebf Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Wed, 10 Jun 2026 13:53:42 +0300 Subject: [PATCH 07/18] refactor(api): return typed apierrors from TenantNamespace registry helpers The access-check helpers returned plain fmt.Errorf values, which the apiserver coerces to 500 InternalError regardless of the actual failure. A request without user identity now surfaces as 401 Unauthorized, and a RoleBinding list failure as 500 InternalError with a typed Status body. Get also repackages a NotFound from the backing Namespace lookup so the Status body reports the tenantnamespaces resource instead of namespaces. The Watch goroutine already logs access-check failures and skips the event, so no untyped error escapes to the client from that path. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- pkg/registry/core/tenantnamespace/rest.go | 13 +- .../core/tenantnamespace/rest_test.go | 273 +++++++++++++++++- 2 files changed, 278 insertions(+), 8 deletions(-) diff --git a/pkg/registry/core/tenantnamespace/rest.go b/pkg/registry/core/tenantnamespace/rest.go index ee6a938ee..870770157 100644 --- a/pkg/registry/core/tenantnamespace/rest.go +++ b/pkg/registry/core/tenantnamespace/rest.go @@ -139,6 +139,11 @@ func (r *REST) Get( ns := &corev1.Namespace{} err = r.c.Get(ctx, types.NamespacedName{Namespace: "", Name: name}, ns, &client.GetOptions{Raw: opts}) if err != nil { + // Repackage NotFound so the Status reports this resource, not the + // backing Namespace one. + if apierrors.IsNotFound(err) { + return nil, apierrors.NewNotFound(r.gvr.GroupResource(), name) + } return nil, err } @@ -437,7 +442,7 @@ func (r *REST) filterAccessible( ) ([]string, error) { u, ok := request.UserFrom(ctx) if !ok { - return []string{}, fmt.Errorf("user missing in context") + return nil, apierrors.NewUnauthorized("user missing in context") } groups := make(map[string]struct{}) for _, group := range u.GetGroups() { @@ -456,7 +461,7 @@ func (r *REST) filterAccessible( rbs := &rbacv1.RoleBindingList{} err := r.c.List(ctx, rbs) if err != nil { - return []string{}, fmt.Errorf("failed to list rolebindings: %w", err) + return nil, apierrors.NewInternalError(fmt.Errorf("failed to list rolebindings: %w", err)) } allowedNameSet := make(map[string]struct{}) for i := range rbs.Items { @@ -491,7 +496,7 @@ func (r *REST) hasAccessToNamespace( ) (bool, error) { u, ok := request.UserFrom(ctx) if !ok { - return false, fmt.Errorf("user missing in context") + return false, apierrors.NewUnauthorized("user missing in context") } groups := make(map[string]struct{}) for _, group := range u.GetGroups() { @@ -520,7 +525,7 @@ func (r *REST) hasAccessToNamespaceForUser( rbs := &rbacv1.RoleBindingList{} err := r.c.List(ctx, rbs, client.InNamespace(namespace)) if err != nil { - return false, fmt.Errorf("failed to list rolebindings in %s: %w", namespace, err) + return false, apierrors.NewInternalError(fmt.Errorf("failed to list rolebindings in %s: %w", namespace, err)) } // Check if user is in any RoleBinding subjects diff --git a/pkg/registry/core/tenantnamespace/rest_test.go b/pkg/registry/core/tenantnamespace/rest_test.go index b03c96888..199edabf2 100644 --- a/pkg/registry/core/tenantnamespace/rest_test.go +++ b/pkg/registry/core/tenantnamespace/rest_test.go @@ -457,8 +457,9 @@ func TestList_NamespaceListError_Propagates(t *testing.T) { } // TestList_RoleBindingListError_Propagates asserts a failure to list -// RoleBindings during access filtering fails the List instead of returning an -// unfiltered or silently truncated result. +// RoleBindings during access filtering fails the List with a typed +// InternalError instead of returning an unfiltered or silently truncated +// result. func TestList_RoleBindingListError_Propagates(t *testing.T) { wantErr := errors.New("rolebinding list failed") fc := fake.NewClientBuilder(). @@ -482,8 +483,12 @@ func TestList_RoleBindingListError_Propagates(t *testing.T) { u := &user.DefaultInfo{Name: "test-user", Groups: []string{"system:authenticated"}} ctx := request.WithUser(context.Background(), u) - if _, err := r.List(ctx, nil); !errors.Is(err, wantErr) { - t.Fatalf("expected %v, got %v", wantErr, err) + _, err := r.List(ctx, nil) + if err == nil { + t.Fatal("expected error, got nil") + } + if !apierrors.IsInternalError(err) { + t.Fatalf("expected InternalError, got %v", err) } } @@ -798,3 +803,263 @@ func TestGet_NonTenantNamespace(t *testing.T) { t.Errorf("expected NotFound error, got %v", err) } } + +// Typed-error tests: helpers must return apierrors so the apiserver maps +// failures to accurate status codes instead of coercing everything to 500. + +// newRoleBindingListErrorClient returns a fake client whose List fails for +// RoleBindingList only, simulating an RBAC listing outage. +func newRoleBindingListErrorClient(scheme *runtime.Scheme, listErr error, objs ...client.Object) client.Client { + return fake.NewClientBuilder(). + WithScheme(scheme). + WithObjects(objs...). + WithInterceptorFuncs(interceptor.Funcs{ + List: func(ctx context.Context, c client.WithWatch, list client.ObjectList, opts ...client.ListOption) error { + if _, ok := list.(*rbacv1.RoleBindingList); ok { + return listErr + } + return c.List(ctx, list, opts...) + }, + }). + Build() +} + +func TestHasAccessToNamespace_NoUserInContext(t *testing.T) { + scheme := runtime.NewScheme() + _ = corev1.AddToScheme(scheme) + _ = rbacv1.AddToScheme(scheme) + + c := fake.NewClientBuilder().WithScheme(scheme).Build() + + r := &REST{ + c: c, + gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, + } + + _, err := r.hasAccessToNamespace(context.Background(), "tenant-test") + if err == nil { + t.Fatal("expected error, got nil") + } + if !apierrors.IsUnauthorized(err) { + t.Errorf("expected Unauthorized error, got %v", err) + } +} + +func TestHasAccessToNamespace_RoleBindingListError(t *testing.T) { + scheme := runtime.NewScheme() + _ = corev1.AddToScheme(scheme) + _ = rbacv1.AddToScheme(scheme) + + c := newRoleBindingListErrorClient(scheme, errors.New("etcd is on fire")) + + r := &REST{ + c: c, + gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, + } + + u := &user.DefaultInfo{ + Name: "test-user", + Groups: []string{"system:authenticated"}, + } + ctx := request.WithUser(context.Background(), u) + + _, err := r.hasAccessToNamespace(ctx, "tenant-test") + if err == nil { + t.Fatal("expected error, got nil") + } + if !apierrors.IsInternalError(err) { + t.Errorf("expected InternalError, got %v", err) + } + var statusErr *apierrors.StatusError + if !errors.As(err, &statusErr) { + t.Fatalf("expected *apierrors.StatusError, got %T", err) + } + if statusErr.Status().Code != 500 { + t.Errorf("expected status code 500, got %d", statusErr.Status().Code) + } +} + +func TestFilterAccessible_NoUserInContext(t *testing.T) { + scheme := runtime.NewScheme() + _ = corev1.AddToScheme(scheme) + _ = rbacv1.AddToScheme(scheme) + + c := fake.NewClientBuilder().WithScheme(scheme).Build() + + r := &REST{ + c: c, + gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, + } + + _, err := r.filterAccessible(context.Background(), []string{"tenant-test"}) + if err == nil { + t.Fatal("expected error, got nil") + } + if !apierrors.IsUnauthorized(err) { + t.Errorf("expected Unauthorized error, got %v", err) + } +} + +func TestFilterAccessible_RoleBindingListError(t *testing.T) { + scheme := runtime.NewScheme() + _ = corev1.AddToScheme(scheme) + _ = rbacv1.AddToScheme(scheme) + + c := newRoleBindingListErrorClient(scheme, errors.New("etcd is on fire")) + + r := &REST{ + c: c, + gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, + } + + u := &user.DefaultInfo{ + Name: "test-user", + Groups: []string{"system:authenticated"}, + } + ctx := request.WithUser(context.Background(), u) + + _, err := r.filterAccessible(ctx, []string{"tenant-test"}) + if err == nil { + t.Fatal("expected error, got nil") + } + if !apierrors.IsInternalError(err) { + t.Errorf("expected InternalError, got %v", err) + } +} + +func TestGet_NotFoundReportsTenantNamespaceResource(t *testing.T) { + scheme := runtime.NewScheme() + _ = corev1.AddToScheme(scheme) + _ = rbacv1.AddToScheme(scheme) + + c := fake.NewClientBuilder().WithScheme(scheme).Build() + + r := &REST{ + c: c, + gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, + } + + u := &user.DefaultInfo{ + Name: "admin-user", + Groups: []string{"system:masters"}, + } + ctx := request.WithUser(context.Background(), u) + + _, err := r.Get(ctx, "tenant-missing", &metav1.GetOptions{}) + if err == nil { + t.Fatal("expected error, got nil") + } + if !apierrors.IsNotFound(err) { + t.Fatalf("expected NotFound error, got %v", err) + } + var statusErr *apierrors.StatusError + if !errors.As(err, &statusErr) { + t.Fatalf("expected *apierrors.StatusError, got %T", err) + } + details := statusErr.Status().Details + if details == nil { + t.Fatal("expected status details, got nil") + } + if details.Group != "core.cozystack.io" || details.Kind != "tenantnamespaces" { + t.Errorf("expected NotFound for core.cozystack.io/tenantnamespaces, got %s/%s", details.Group, details.Kind) + } +} + +func TestList_RoleBindingListError(t *testing.T) { + scheme := runtime.NewScheme() + _ = corev1.AddToScheme(scheme) + _ = rbacv1.AddToScheme(scheme) + + ns := &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"}, + } + + c := newRoleBindingListErrorClient(scheme, errors.New("etcd is on fire"), ns) + + r := &REST{ + c: c, + gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, + } + + u := &user.DefaultInfo{ + Name: "test-user", + Groups: []string{"system:authenticated"}, + } + ctx := request.WithUser(context.Background(), u) + + obj, err := r.List(ctx, nil) + if err == nil { + t.Fatal("expected error, got nil") + } + if obj != nil { + t.Errorf("expected nil object, got %v", obj) + } + if !apierrors.IsInternalError(err) { + t.Errorf("expected InternalError, got %v", err) + } +} + +func TestGet_NoUserInContext(t *testing.T) { + scheme := runtime.NewScheme() + _ = corev1.AddToScheme(scheme) + _ = rbacv1.AddToScheme(scheme) + + ns := &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"}, + } + + c := fake.NewClientBuilder(). + WithScheme(scheme). + WithObjects(ns). + Build() + + r := &REST{ + c: c, + gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, + } + + obj, err := r.Get(context.Background(), "tenant-test", &metav1.GetOptions{}) + if err == nil { + t.Fatal("expected error, got nil") + } + if obj != nil { + t.Errorf("expected nil object, got %v", obj) + } + if !apierrors.IsUnauthorized(err) { + t.Errorf("expected Unauthorized error, got %v", err) + } +} + +func TestGet_RoleBindingListError(t *testing.T) { + scheme := runtime.NewScheme() + _ = corev1.AddToScheme(scheme) + _ = rbacv1.AddToScheme(scheme) + + ns := &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"}, + } + + c := newRoleBindingListErrorClient(scheme, errors.New("etcd is on fire"), ns) + + r := &REST{ + c: c, + gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"}, + } + + u := &user.DefaultInfo{ + Name: "test-user", + Groups: []string{"system:authenticated"}, + } + ctx := request.WithUser(context.Background(), u) + + obj, err := r.Get(ctx, "tenant-test", &metav1.GetOptions{}) + if err == nil { + t.Fatal("expected error, got nil") + } + if obj != nil { + t.Errorf("expected nil object, got %v", obj) + } + if !apierrors.IsInternalError(err) { + t.Errorf("expected InternalError, got %v", err) + } +} From ed30425b17b1141b46f56718c785115d6618d79e Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Tue, 16 Jun 2026 08:04:14 +0300 Subject: [PATCH 08/18] fix(tenant): grant watch verb to cleanup Role so pre-delete hook can wait The pre-delete cleanup hook deletes the tenant's HelmReleases with `kubectl delete --wait=true`, which opens a watch on helmreleases to block until finalization. The hook Role granted only get/list/delete, so the watch was rejected with 403, the delete call hung, the Job never finished, and tenant deletion stalled on the hook. Add the watch verb, matching the kubernetes app chart's cleanup Role which already includes it for the same --wait deletes. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- .../apps/tenant/templates/cleanup-job.yaml | 2 +- .../tenant/tests/cleanup_role_watch_test.yaml | 29 +++++++++++++++++++ 2 files changed, 30 insertions(+), 1 deletion(-) create mode 100644 packages/apps/tenant/tests/cleanup_role_watch_test.yaml diff --git a/packages/apps/tenant/templates/cleanup-job.yaml b/packages/apps/tenant/templates/cleanup-job.yaml index 0f13daa48..be5729b67 100644 --- a/packages/apps/tenant/templates/cleanup-job.yaml +++ b/packages/apps/tenant/templates/cleanup-job.yaml @@ -21,7 +21,7 @@ metadata: rules: - apiGroups: ["helm.toolkit.fluxcd.io"] resources: ["helmreleases"] - verbs: ["get", "list", "delete"] + verbs: ["get", "list", "watch", "delete"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding diff --git a/packages/apps/tenant/tests/cleanup_role_watch_test.yaml b/packages/apps/tenant/tests/cleanup_role_watch_test.yaml new file mode 100644 index 000000000..2c5d83094 --- /dev/null +++ b/packages/apps/tenant/tests/cleanup_role_watch_test.yaml @@ -0,0 +1,29 @@ +suite: tenant cleanup Role can watch HelmReleases + +# The pre-delete cleanup hook deletes the tenant's HelmReleases with +# `kubectl delete --wait=true`, which sets up a watch on helmreleases to block +# until finalization completes. Without the watch verb that watch is rejected +# with HTTP 403, the delete call hangs, the Job never finishes, and tenant +# deletion stalls on the hook. Pin the verb so it cannot regress. + +# Restrict rendering to the cleanup template so the chart's namespace.yaml +# `lookup` (which errors under helm-unittest) is not evaluated. +templates: + - templates/cleanup-job.yaml + +release: + name: tenant-test + namespace: tenant-test + +tests: + - it: cleanup Role grants watch on helmreleases + asserts: + - template: templates/cleanup-job.yaml + documentIndex: 1 + isKind: + of: Role + - template: templates/cleanup-job.yaml + documentIndex: 1 + contains: + path: rules[0].verbs + content: watch From 5e7936c811a5bca331b84e3220337dcc91298adb Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Tue, 16 Jun 2026 08:24:54 +0300 Subject: [PATCH 09/18] fix(tenant): replace bitnami/kubectl with maintained clastix image in cleanup hook MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pre-delete cleanup Job ran kubectl from `bitnami/kubectl:latest`. The bitnami Docker Hub catalog has moved to a legacy/sunset state, so that pull is at risk of breaking — which would stop the cleanup hook from starting at all — and the `:latest` tag leaves the kubectl version unpinned and non-reproducible. Switch to `docker.io/clastix/kubectl:v1.32`, the version-pinned image already used by every other first-party cleanup/delete hook in the repo (kubernetes, keycloak-configure, dashboard, mariadb). That image is Alpine-based and ships only `/bin/sh`, so the hook script (pure POSIX) now invokes `/bin/sh` instead of `/bin/bash` — matching those sibling hooks. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- .../apps/tenant/templates/cleanup-job.yaml | 4 +-- .../tenant/tests/cleanup_role_watch_test.yaml | 32 ++++++++++++++++++- 2 files changed, 33 insertions(+), 3 deletions(-) diff --git a/packages/apps/tenant/templates/cleanup-job.yaml b/packages/apps/tenant/templates/cleanup-job.yaml index be5729b67..59cb0544f 100644 --- a/packages/apps/tenant/templates/cleanup-job.yaml +++ b/packages/apps/tenant/templates/cleanup-job.yaml @@ -62,9 +62,9 @@ spec: restartPolicy: OnFailure containers: - name: cleanup - image: bitnami/kubectl:latest + image: docker.io/clastix/kubectl:v1.32 command: - - /bin/bash + - /bin/sh - -c - | set -e diff --git a/packages/apps/tenant/tests/cleanup_role_watch_test.yaml b/packages/apps/tenant/tests/cleanup_role_watch_test.yaml index 2c5d83094..53fcb5920 100644 --- a/packages/apps/tenant/tests/cleanup_role_watch_test.yaml +++ b/packages/apps/tenant/tests/cleanup_role_watch_test.yaml @@ -1,10 +1,16 @@ -suite: tenant cleanup Role can watch HelmReleases +suite: tenant cleanup pre-delete hook # The pre-delete cleanup hook deletes the tenant's HelmReleases with # `kubectl delete --wait=true`, which sets up a watch on helmreleases to block # until finalization completes. Without the watch verb that watch is rejected # with HTTP 403, the delete call hangs, the Job never finishes, and tenant # deletion stalls on the hook. Pin the verb so it cannot regress. +# +# The Job runs kubectl from a maintained, version-pinned image. Pin the image +# so it cannot drift back to an unpinned / sunset base (e.g. bitnami:latest), +# and pin the command interpreter to a shell that image actually ships +# (clastix/kubectl is Alpine — /bin/sh only, no /bin/bash) so the container +# can exec at all. # Restrict rendering to the cleanup template so the chart's namespace.yaml # `lookup` (which errors under helm-unittest) is not evaluated. @@ -27,3 +33,27 @@ tests: contains: path: rules[0].verbs content: watch + + - it: cleanup Job uses the maintained clastix kubectl image + asserts: + - template: templates/cleanup-job.yaml + documentIndex: 3 + isKind: + of: Job + - template: templates/cleanup-job.yaml + documentIndex: 3 + equal: + path: spec.template.spec.containers[0].image + value: docker.io/clastix/kubectl:v1.32 + + - it: cleanup Job invokes a shell the image actually ships + asserts: + - template: templates/cleanup-job.yaml + documentIndex: 3 + isKind: + of: Job + - template: templates/cleanup-job.yaml + documentIndex: 3 + equal: + path: spec.template.spec.containers[0].command[0] + value: /bin/sh From e1f6a9c2aa3591fa54058fda6afd08b53650a95a Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Mon, 22 Jun 2026 20:39:05 +0300 Subject: [PATCH 10/18] fix(tenant): run the cleanup hook as non-root under a restrictive securityContext The pre-delete cleanup Job ran kubectl as root with no securityContext. Add a pod-level runAsNonRoot + runAsUser 65534 + seccompProfile RuntimeDefault and a container-level allowPrivilegeEscalation: false plus capabilities drop ALL, mirroring the dashboard adopt hook that runs the same clastix/kubectl image non-root. Pin the securityContext in helm-unittest. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- .../apps/tenant/templates/cleanup-job.yaml | 9 ++++++ .../tenant/tests/cleanup_role_watch_test.yaml | 32 +++++++++++++++++++ 2 files changed, 41 insertions(+) diff --git a/packages/apps/tenant/templates/cleanup-job.yaml b/packages/apps/tenant/templates/cleanup-job.yaml index 59cb0544f..a4996ec5d 100644 --- a/packages/apps/tenant/templates/cleanup-job.yaml +++ b/packages/apps/tenant/templates/cleanup-job.yaml @@ -60,9 +60,18 @@ spec: spec: serviceAccountName: {{ include "tenant.name" . }}-cleanup restartPolicy: OnFailure + securityContext: + runAsNonRoot: true + runAsUser: 65534 + seccompProfile: + type: RuntimeDefault containers: - name: cleanup image: docker.io/clastix/kubectl:v1.32 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] command: - /bin/sh - -c diff --git a/packages/apps/tenant/tests/cleanup_role_watch_test.yaml b/packages/apps/tenant/tests/cleanup_role_watch_test.yaml index 53fcb5920..710cc1f9d 100644 --- a/packages/apps/tenant/tests/cleanup_role_watch_test.yaml +++ b/packages/apps/tenant/tests/cleanup_role_watch_test.yaml @@ -57,3 +57,35 @@ tests: equal: path: spec.template.spec.containers[0].command[0] value: /bin/sh + + - it: cleanup Job runs non-root under a restrictive securityContext + asserts: + - template: templates/cleanup-job.yaml + documentIndex: 3 + isKind: + of: Job + - template: templates/cleanup-job.yaml + documentIndex: 3 + equal: + path: spec.template.spec.securityContext.runAsNonRoot + value: true + - template: templates/cleanup-job.yaml + documentIndex: 3 + equal: + path: spec.template.spec.securityContext.runAsUser + value: 65534 + - template: templates/cleanup-job.yaml + documentIndex: 3 + equal: + path: spec.template.spec.securityContext.seccompProfile.type + value: RuntimeDefault + - template: templates/cleanup-job.yaml + documentIndex: 3 + equal: + path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation + value: false + - template: templates/cleanup-job.yaml + documentIndex: 3 + contains: + path: spec.template.spec.containers[0].securityContext.capabilities.drop + content: ALL From 0f33e3a60d4494d262bf24174cbd49c3cc931b46 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Wed, 17 Jun 2026 13:20:59 +0300 Subject: [PATCH 11/18] chore(deps): bump first-party image Go modules to 1.26.4 The token-proxy, kube-ovn-webhook and kubevirt-csi-driver image modules still pinned go 1.26.2, so their binaries shipped standard-library versions that the 1.26.4 toolchain fixes. Raise the go directive and refresh module dependencies to current releases. token-proxy and kube-ovn-webhook take a full dependency refresh; kube-ovn-webhook also moves k8s.io/* from 0.26.0 to 0.36.2 (only long-stable admission/core API is used, so no code change is needed). kubevirt-csi-driver keeps its existing replace-based k8s.io/* alignment at 0.36.0 and only raises the go directive; a blanket go get -u is avoided there because it pulls transitive bumps that break compilation of the pinned vendored upstream csi-driver source. Also ignore the locally-built binaries under the two image directories so they cannot be committed by accident. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/apps/kubernetes/.gitignore | 1 + .../images/kubevirt-csi-driver/go.mod | 2 +- .../dashboard/images/token-proxy/go.mod | 12 +- .../dashboard/images/token-proxy/go.sum | 20 +- packages/system/kubeovn-webhook/.gitignore | 1 + .../images/kubeovn-webhook/go.mod | 76 +++-- .../images/kubeovn-webhook/go.sum | 284 +++++++----------- 7 files changed, 168 insertions(+), 228 deletions(-) create mode 100644 packages/apps/kubernetes/.gitignore create mode 100644 packages/system/kubeovn-webhook/.gitignore diff --git a/packages/apps/kubernetes/.gitignore b/packages/apps/kubernetes/.gitignore new file mode 100644 index 000000000..59ec0d536 --- /dev/null +++ b/packages/apps/kubernetes/.gitignore @@ -0,0 +1 @@ +images/kubevirt-csi-driver/kubevirt-csi-driver diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod b/packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod index cef60a7f6..dcf5441f8 100644 --- a/packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod +++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod @@ -1,6 +1,6 @@ module cozystack.io/kubevirt-csi-driver -go 1.26.2 +go 1.26.4 require ( github.com/container-storage-interface/spec v1.10.0 diff --git a/packages/system/dashboard/images/token-proxy/go.mod b/packages/system/dashboard/images/token-proxy/go.mod index 2b045361a..b33ce164b 100644 --- a/packages/system/dashboard/images/token-proxy/go.mod +++ b/packages/system/dashboard/images/token-proxy/go.mod @@ -1,23 +1,23 @@ module token-proxy -go 1.26.2 +go 1.26.4 require ( github.com/gorilla/securecookie v1.1.2 - github.com/lestrrat-go/httprc/v3 v3.0.5 - github.com/lestrrat-go/jwx/v3 v3.1.0 + github.com/lestrrat-go/httprc/v3 v3.0.6 + github.com/lestrrat-go/jwx/v3 v3.1.1 ) require ( github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect github.com/goccy/go-json v0.10.6 // indirect github.com/lestrrat-go/blackmagic v1.0.4 // indirect - github.com/lestrrat-go/dsig v1.2.1 // indirect + github.com/lestrrat-go/dsig v1.3.0 // indirect github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect github.com/lestrrat-go/httpcc v1.0.1 // indirect github.com/lestrrat-go/option/v2 v2.0.0 // indirect github.com/segmentio/asm v1.2.1 // indirect github.com/valyala/fastjson v1.6.10 // indirect - golang.org/x/crypto v0.50.0 // indirect - golang.org/x/sys v0.43.0 // indirect + golang.org/x/crypto v0.53.0 // indirect + golang.org/x/sys v0.46.0 // indirect ) diff --git a/packages/system/dashboard/images/token-proxy/go.sum b/packages/system/dashboard/images/token-proxy/go.sum index 4c75483c6..ad9542565 100644 --- a/packages/system/dashboard/images/token-proxy/go.sum +++ b/packages/system/dashboard/images/token-proxy/go.sum @@ -11,16 +11,16 @@ github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kX github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo= github.com/lestrrat-go/blackmagic v1.0.4 h1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA= github.com/lestrrat-go/blackmagic v1.0.4/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw= -github.com/lestrrat-go/dsig v1.2.1 h1:MwxzZhE4+4fguHi+uDALKVlC3Cn+O1QU1Q/F8D7hVIc= -github.com/lestrrat-go/dsig v1.2.1/go.mod h1:RD2eOaidyPvpc7IJQoO3Qq52RWdy8ZcJs8lrOnoa1Kc= +github.com/lestrrat-go/dsig v1.3.0 h1:phjMOCXvYzhuIgn7Voe2rex8z166vGfxRxmqM25P9/Q= +github.com/lestrrat-go/dsig v1.3.0/go.mod h1:RD2eOaidyPvpc7IJQoO3Qq52RWdy8ZcJs8lrOnoa1Kc= github.com/lestrrat-go/dsig-secp256k1 v1.0.0 h1:JpDe4Aybfl0soBvoVwjqDbp+9S1Y2OM7gcrVVMFPOzY= github.com/lestrrat-go/dsig-secp256k1 v1.0.0/go.mod h1:CxUgAhssb8FToqbL8NjSPoGQlnO4w3LG1P0qPWQm/NU= github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE= github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E= -github.com/lestrrat-go/httprc/v3 v3.0.5 h1:S+Mb4L2I+bM6JGTibLmxExhyTOqnXjqx+zi9MoXw/TM= -github.com/lestrrat-go/httprc/v3 v3.0.5/go.mod h1:mSMtkZW92Z98M5YoNNztbRGxbXHql7tSitCvaxvo9l0= -github.com/lestrrat-go/jwx/v3 v3.1.0 h1:AyyLtxc0QM75F75JroWgt1phwC7X+wOb3XKhH7XBZWw= -github.com/lestrrat-go/jwx/v3 v3.1.0/go.mod h1:uw/MN2M/Xiu4FhwcIwH11Zsh9JWx9SWzgALl7/uIEkU= +github.com/lestrrat-go/httprc/v3 v3.0.6 h1:4FpLQ18KK/ypPbVU3NLWJNRvH3kcYiqKqWfKGqNWxxI= +github.com/lestrrat-go/httprc/v3 v3.0.6/go.mod h1:mSMtkZW92Z98M5YoNNztbRGxbXHql7tSitCvaxvo9l0= +github.com/lestrrat-go/jwx/v3 v3.1.1 h1:yd9AdPmZ4INnQ7k42IrzXYpnEG803+SrQ6hdMvzHJzw= +github.com/lestrrat-go/jwx/v3 v3.1.1/go.mod h1:uw/MN2M/Xiu4FhwcIwH11Zsh9JWx9SWzgALl7/uIEkU= github.com/lestrrat-go/option/v2 v2.0.0 h1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss= github.com/lestrrat-go/option/v2 v2.0.0/go.mod h1:oSySsmzMoR0iRzCDCaUfsCzxQHUEuhOViQObyy7S6Vg= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= @@ -33,10 +33,10 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/valyala/fastjson v1.6.10 h1:/yjJg8jaVQdYR3arGxPE2X5z89xrlhS0eGXdv+ADTh4= github.com/valyala/fastjson v1.6.10/go.mod h1:e6FubmQouUNP73jtMLmcbxS6ydWIpOfhz34TSfO3JaE= -golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI= -golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q= -golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= -golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto= +golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio= +golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= +golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= diff --git a/packages/system/kubeovn-webhook/.gitignore b/packages/system/kubeovn-webhook/.gitignore new file mode 100644 index 000000000..ae3f7df3f --- /dev/null +++ b/packages/system/kubeovn-webhook/.gitignore @@ -0,0 +1 @@ +images/kubeovn-webhook/kube-ovn-webhook diff --git a/packages/system/kubeovn-webhook/images/kubeovn-webhook/go.mod b/packages/system/kubeovn-webhook/images/kubeovn-webhook/go.mod index d8b4a7547..408cfd209 100644 --- a/packages/system/kubeovn-webhook/images/kubeovn-webhook/go.mod +++ b/packages/system/kubeovn-webhook/images/kubeovn-webhook/go.mod @@ -1,46 +1,58 @@ module kube-ovn-webhook -go 1.26.2 +go 1.26.4 require ( github.com/mattbaird/jsonpatch v0.0.0-20240118010651-0ba75a80ca38 - k8s.io/api v0.26.0 - k8s.io/apimachinery v0.26.0 - k8s.io/client-go v0.26.0 + k8s.io/api v0.36.2 + k8s.io/apimachinery v0.36.2 + k8s.io/client-go v0.36.2 ) require ( - github.com/davecgh/go-spew v1.1.1 // indirect - github.com/emicklei/go-restful/v3 v3.9.0 // indirect - github.com/go-logr/logr v1.2.3 // indirect - github.com/go-openapi/jsonpointer v0.19.5 // indirect - github.com/go-openapi/jsonreference v0.20.0 // indirect - github.com/go-openapi/swag v0.19.14 // indirect - github.com/gogo/protobuf v1.3.2 // indirect - github.com/golang/protobuf v1.5.2 // indirect - github.com/google/gnostic v0.5.7-v3refs // indirect - github.com/google/go-cmp v0.7.0 // indirect - github.com/google/gofuzz v1.1.0 // indirect - github.com/josharian/intern v1.0.0 // indirect + github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect + github.com/emicklei/go-restful/v3 v3.13.0 // indirect + github.com/evanphx/json-patch v0.5.2 // indirect + github.com/fxamacker/cbor/v2 v2.9.2 // indirect + github.com/go-logr/logr v1.4.3 // indirect + github.com/go-openapi/jsonpointer v0.23.1 // indirect + github.com/go-openapi/jsonreference v0.21.6 // indirect + github.com/go-openapi/swag v0.26.1 // indirect + github.com/go-openapi/swag/cmdutils v0.26.1 // indirect + github.com/go-openapi/swag/conv v0.26.1 // indirect + github.com/go-openapi/swag/fileutils v0.26.1 // indirect + github.com/go-openapi/swag/jsonname v0.26.1 // indirect + github.com/go-openapi/swag/jsonutils v0.26.1 // indirect + github.com/go-openapi/swag/loading v0.26.1 // indirect + github.com/go-openapi/swag/mangling v0.26.1 // indirect + github.com/go-openapi/swag/netutils v0.26.1 // indirect + github.com/go-openapi/swag/stringutils v0.26.1 // indirect + github.com/go-openapi/swag/typeutils v0.26.1 // indirect + github.com/go-openapi/swag/yamlutils v0.26.1 // indirect + github.com/google/gnostic-models v0.7.1 // indirect + github.com/google/uuid v1.6.0 // indirect github.com/json-iterator/go v1.1.12 // indirect - github.com/mailru/easyjson v0.7.6 // indirect + github.com/kr/text v0.2.0 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect - github.com/modern-go/reflect2 v1.0.2 // indirect + github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect - golang.org/x/net v0.53.0 // indirect + github.com/x448/float16 v0.8.4 // indirect + go.yaml.in/yaml/v2 v2.4.4 // indirect + go.yaml.in/yaml/v3 v3.0.4 // indirect + golang.org/x/net v0.56.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/sys v0.43.0 // indirect - golang.org/x/term v0.42.0 // indirect - golang.org/x/text v0.36.0 // indirect - golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect - google.golang.org/protobuf v1.36.11 // indirect + golang.org/x/sys v0.46.0 // indirect + golang.org/x/term v0.44.0 // indirect + golang.org/x/text v0.38.0 // indirect + golang.org/x/time v0.15.0 // indirect + google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect + gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect - gopkg.in/yaml.v2 v2.4.0 // indirect - gopkg.in/yaml.v3 v3.0.1 // indirect - k8s.io/klog/v2 v2.80.1 // indirect - k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect - k8s.io/utils v0.0.0-20221107191617-1a15be271d1d // indirect - sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect - sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect - sigs.k8s.io/yaml v1.3.0 // indirect + k8s.io/klog/v2 v2.140.0 // indirect + k8s.io/kube-openapi v0.0.0-20260603220949-865597e52e25 // indirect + k8s.io/utils v0.0.0-20260507154919-ff6756f316d2 // indirect + sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect + sigs.k8s.io/randfill v1.0.0 // indirect + sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect + sigs.k8s.io/yaml v1.6.0 // indirect ) diff --git a/packages/system/kubeovn-webhook/images/kubeovn-webhook/go.sum b/packages/system/kubeovn-webhook/images/kubeovn-webhook/go.sum index 62f9d1759..f0238dbbe 100644 --- a/packages/system/kubeovn-webhook/images/kubeovn-webhook/go.sum +++ b/packages/system/kubeovn-webhook/images/kubeovn-webhook/go.sum @@ -1,209 +1,135 @@ -cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= -github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= -github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= -github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE= -github.com/emicklei/go-restful/v3 v3.9.0 h1:XwGDlfxEnQZzuopoqxwSEllNcCOM9DhhFyhFIIGKwxE= -github.com/emicklei/go-restful/v3 v3.9.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= -github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= -github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c= -github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84= -github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk= -github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0= -github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= -github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY= -github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= -github.com/go-openapi/jsonreference v0.20.0 h1:MYlu0sBgChmCfJxxUKZ8g1cPWFOB37YSZqewK7OKeyA= -github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXymS4zJbYVCZmcgkasdo= -github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk= -github.com/go-openapi/swag v0.19.14 h1:gm3vOOXfiuw5i9p5N9xJvfjvuofpyvLA9Wr6QfK5Fng= -github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ= -github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= -github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= -github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= -github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A= -github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= -github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= -github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8= -github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA= -github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs= -github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w= -github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0= -github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8= -github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= -github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw= -github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= -github.com/google/gnostic v0.5.7-v3refs h1:FhTMOKj2VhjpouxvWJAV1TL304uMlb9zcDqkl6cEI54= -github.com/google/gnostic v0.5.7-v3refs/go.mod h1:73MKFl6jIHelAJNaBGFzt3SPtZULs9dYrGFt8OiIsHQ= -github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M= -github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= -github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= -github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes= +github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= +github.com/evanphx/json-patch v0.5.2 h1:xVCHIVMUu1wtM/VkR9jVZ45N3FhZfYMMYGorLCR8P3k= +github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ= +github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78= +github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= +github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= +github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-openapi/jsonpointer v0.23.1 h1:1HBACs7XIwR2RcmItfdSFlALhGbe6S92p0ry4d1GWg4= +github.com/go-openapi/jsonpointer v0.23.1/go.mod h1:iWRmZTrGn7XwYhtPt/fvdSFj1OfNBngqRT2UG3BxSqY= +github.com/go-openapi/jsonreference v0.21.6 h1:NZ5nGfnaM1n4I43Xjm1e5/M2GjOwQwndQz22uhxwD+Y= +github.com/go-openapi/jsonreference v0.21.6/go.mod h1:xzbgtQ3ZbWxvET3AxdzCJlJt6vkovbf+IfSPJjD0tUY= +github.com/go-openapi/swag v0.26.1 h1:l5sVEyVpwj+DDYeZyo7wQI/Ebn/mKYIyGB/pFwAfGoQ= +github.com/go-openapi/swag v0.26.1/go.mod h1:yNY38BbIVthxbkDtq1UHBCGasBqjakW3lCR6ANzdBEw= +github.com/go-openapi/swag/cmdutils v0.26.1 h1:f2iE1ijYaJ3nuu5PaEMx3zpEhzhZFgivCJObWEObLIQ= +github.com/go-openapi/swag/cmdutils v0.26.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM= +github.com/go-openapi/swag/conv v0.26.1 h1:slr5FVkg9Wc3Y5zcwenD8Sd/PQ94b2I/QJI7N7KTBpg= +github.com/go-openapi/swag/conv v0.26.1/go.mod h1:mvQXgPptZk9GTrFgGwWvT4q+dN+zQej9JfmGwnipz1A= +github.com/go-openapi/swag/fileutils v0.26.1 h1:K1XCM2CGhfNsc6YDt6v7Q5+1e59rftYWdcu/isZhvFw= +github.com/go-openapi/swag/fileutils v0.26.1/go.mod h1:mYUgxQAKX4ShS3qvvySx+/9yrlUnDhjiD1CalaQl8lQ= +github.com/go-openapi/swag/jsonname v0.26.1 h1:VReupaV6WxlAsCn0e4DUfgV6bPmINnPpyJDLqSfNPcE= +github.com/go-openapi/swag/jsonname v0.26.1/go.mod h1:OvdW6BoWoj33pTfi7x9vFrgmT+fk7aw0BRwvCE0YOuc= +github.com/go-openapi/swag/jsonutils v0.26.1 h1:2hdBfFkHg+7Wrz2VsCbeyR6hzkRDs7AztnMR2u84yOY= +github.com/go-openapi/swag/jsonutils v0.26.1/go.mod h1:U+RMJH3wa+6BRiphuRtIyI8fW9HPFqFQ4sHk2oRx0UQ= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.1 h1:1CD7NiLLb/TXl3tOnFYU4b+mNfb5rtgHkaA+q7RMYYQ= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.1/go.mod h1:ZWafc8nMdYzTE3uYY6W86f0n46+IF0g4uUyRhJw/kXc= +github.com/go-openapi/swag/loading v0.26.1 h1:E9K4wqXeROlhjFQ13K9zMz6ojFGXIggGe+ad1odrK9w= +github.com/go-openapi/swag/loading v0.26.1/go.mod h1:3qvRIlWzWdq1HvmldwmuJ2ohpcAryN6xVt2OTKd0/7E= +github.com/go-openapi/swag/mangling v0.26.1 h1:gpYI4WuPKFJJVjV5cDLGlDVJhFIxYjQc7yN5eEb4CqM= +github.com/go-openapi/swag/mangling v0.26.1/go.mod h1:POETDH01hqAdASXfw7ISEd9bCOE6xBHOt8NHmGZRmYM= +github.com/go-openapi/swag/netutils v0.26.1 h1:BNctoc39WTAUMxyAs355fExOPzMZtPbZ0ZZ1Am2FR5M= +github.com/go-openapi/swag/netutils v0.26.1/go.mod h1:y02vByhZhQPAVwOX+0KipXFZ/hUbk6G/Enhf5rGaOkQ= +github.com/go-openapi/swag/stringutils v0.26.1 h1:f88uYyTso7TnHrKM/bUBsQ5e2wKf37cpgo6pvbzd9yU= +github.com/go-openapi/swag/stringutils v0.26.1/go.mod h1:Sc6d3bU8fgk5AyZR8/8jEQ+Is/Ald+TD/IIggPN8UJk= +github.com/go-openapi/swag/typeutils v0.26.1 h1:yg42FgMzRR6PVQ3M3qHz1s+Y6/P4HoJ3cBarXa3OVnU= +github.com/go-openapi/swag/typeutils v0.26.1/go.mod h1:VfnV+oUtSP2vCSCn2aJgnr8OevUYemyIzzS1VOzS10o= +github.com/go-openapi/swag/yamlutils v0.26.1 h1:0TSLK+lXs9vfIhAWzBeI/lOzEnIoot6WTCO1aAeWFTk= +github.com/go-openapi/swag/yamlutils v0.26.1/go.mod h1:7W5b7PRX9MxwL7TjeG7H8HkyBGRsIDRObhyMWFgBI2M= +github.com/go-openapi/testify/enable/yaml/v2 v2.5.1 h1:q9NtHwK4qHF7yZziBPvZyv7zWAIk8ok88Gh2mR6Jpc8= +github.com/go-openapi/testify/enable/yaml/v2 v2.5.1/go.mod h1:JW0MXIotCYps/XsgJnG3a8Q7rE5xAiBwoOD5OfaIQBk= +github.com/go-openapi/testify/v2 v2.5.1 h1:TMdhCaw8fUNraVSf3Omoob1dO/AzBfhtFAPW0an6sBo= +github.com/go-openapi/testify/v2 v2.5.1/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw= +github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c= +github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= -github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g= -github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= -github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= -github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= +github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= +github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI= github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= -github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= -github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= -github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= -github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= -github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= +github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= +github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= -github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= -github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= -github.com/mailru/easyjson v0.7.6 h1:8yTIVnZgCoiM1TgqoeTl+LfU5Jg6/xL3QhGQnimLYnA= -github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= github.com/mattbaird/jsonpatch v0.0.0-20240118010651-0ba75a80ca38 h1:hQWBtNqRYrI7CWIaUSXXtNKR90KzcUA5uiuxFVWw7sU= github.com/mattbaird/jsonpatch v0.0.0-20240118010651-0ba75a80ca38/go.mod h1:M1qoD/MqPgTZIk0EWKB38wE28ACRfVcn+cU08jyArI0= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= -github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M= github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= +github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8= +github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= -github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs= -github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno= -github.com/onsi/ginkgo/v2 v2.4.0 h1:+Ig9nvqgS5OBSACXNk15PLdp0U9XPYROt9CFzVdFGIs= -github.com/onsi/ginkgo/v2 v2.4.0/go.mod h1:iHkDK1fKGcBoEHT5W7YBq4RFWaQulw+caOMkAt4OrFo= -github.com/onsi/gomega v1.23.0 h1:/oxKu9c2HVap+F3PfKort2Hw5DEU+HGlW8n+tguWsys= -github.com/onsi/gomega v1.23.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2vQAg= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= -github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= -github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= -github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= -github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= +github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= +github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= +github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= +github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= -github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= -github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk= -github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= -github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= -github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= -golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= -golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= -golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= -golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= -golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU= -golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= -golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= -golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= -golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= -golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= -golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= -golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= -golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA= -golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs= -golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= +github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= +github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= +github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= +go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= +go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= +go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= +go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= +golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= -golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= -golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY= -golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY= -golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= -golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg= -golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164= -golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 h1:vVKdlvoWBphwdxWKrFZEuM0kGgGLxUOYcY4U/2Vjg44= -golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= -golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= -golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= -golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY= -golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= -golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q= -golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= -golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= -golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= -google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= -google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= -google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc= -google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo= -google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= -google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg= -google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= -google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= -google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= -google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= -google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE= -google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo= -google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= -google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= -google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4= -google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= -google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= -google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= -google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= +golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= +golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc= +golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y= +golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= +golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= +golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= +golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= +google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= +google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU= -gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= +gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo= +gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M= gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc= gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= -gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= -gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= -gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= -gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= -gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= -honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= -k8s.io/api v0.26.0 h1:IpPlZnxBpV1xl7TGk/X6lFtpgjgntCg8PJ+qrPHAC7I= -k8s.io/api v0.26.0/go.mod h1:k6HDTaIFC8yn1i6pSClSqIwLABIcLV9l5Q4EcngKnQg= -k8s.io/apimachinery v0.26.0 h1:1feANjElT7MvPqp0JT6F3Ss6TWDwmcjLypwoPpEf7zg= -k8s.io/apimachinery v0.26.0/go.mod h1:tnPmbONNJ7ByJNz9+n9kMjNP8ON+1qoAIIC70lztu74= -k8s.io/client-go v0.26.0 h1:lT1D3OfO+wIi9UFolCrifbjUUgu7CpLca0AD8ghRLI8= -k8s.io/client-go v0.26.0/go.mod h1:I2Sh57A79EQsDmn7F7ASpmru1cceh3ocVT9KlX2jEZg= -k8s.io/klog/v2 v2.80.1 h1:atnLQ121W371wYYFawwYx1aEY2eUfs4l3J72wtgAwV4= -k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= -k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+OGxg8HsuBr/5f6tVAjDu6E= -k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4= -k8s.io/utils v0.0.0-20221107191617-1a15be271d1d h1:0Smp/HP1OH4Rvhe+4B8nWGERtlqAGSftbSbbmm45oFs= -k8s.io/utils v0.0.0-20221107191617-1a15be271d1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= -sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k= -sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= -sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE= -sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E= -sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo= -sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8= +k8s.io/api v0.36.2 h1:TF6YDLIzKfccK7cq9YpTcGX8TJmEkHVRv78DM51fRYY= +k8s.io/api v0.36.2/go.mod h1:F4LbMO4brjZYh7yFkXWhynSvtB7YauxV4c+HHkNRGNg= +k8s.io/apimachinery v0.36.2 h1:0PE/W/WNy1UX61NLbXY5TMbJ6UwLL6E6lAPkYrKFxbQ= +k8s.io/apimachinery v0.36.2/go.mod h1:fvf/HOLXq9RId0rnDIbN1OEBvHXdQbLMM8nu0LcBUf4= +k8s.io/client-go v0.36.2 h1:bfgxmFKc9CgqsgX4xKLAAdmTQlWee7Ob/HlDOrJ5TBI= +k8s.io/client-go v0.36.2/go.mod h1:1vgO4OAlfPnoLcb+Rze2GF5rAr14w8qjrYMoyXJzQj0= +k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc= +k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0= +k8s.io/kube-openapi v0.0.0-20260603220949-865597e52e25 h1:mPMaPMpBij2V1Wv/fR+HW124vVGXXvOSS9ver/9yjWs= +k8s.io/kube-openapi v0.0.0-20260603220949-865597e52e25/go.mod h1:V/QaCUYDa+0QpcHhVVc5l99Uz56wEMEXBSj9oCDkNDY= +k8s.io/utils v0.0.0-20260507154919-ff6756f316d2 h1:wU4tMEhLGgIbLvXQb1cfN+EcM0wf7zC6CPF+C79jroc= +k8s.io/utils v0.0.0-20260507154919-ff6756f316d2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= +sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg= +sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg= +sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU= +sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY= +sigs.k8s.io/structured-merge-diff/v6 v6.4.0 h1:qmp2e3ZfFi1/jJbDGpD4mt3wyp6PE1NfKHCYLqgNQJo= +sigs.k8s.io/structured-merge-diff/v6 v6.4.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE= +sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs= +sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4= From 9c5fbb69a506ea631397d5d693cfd79b46d2ce06 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Wed, 17 Jun 2026 13:21:24 +0300 Subject: [PATCH 12/18] chore(images): modernize Go builder images to 1.26 Several first-party images still built their Go binaries with EOL or behind-latest toolchains (golang 1.20, 1.20.6, 1.23.4, 1.24, 1.25), so a plain rebuild kept shipping standard-library versions that the current 1.26 toolchain fixes. Raise every Go builder image (FROM and the builder_image ARG defaults) to golang:1.26 across cluster-autoscaler, kubevirt-cloud-provider, redis-operator, multus-cni, keycloak-operator, objectstorage, kilo and linstor-csi. This is the build-time counterpart to raising the go directive in the first-party Go modules: the toolchain that compiles the binary, not the go.mod minimum, determines the standard-library version baked into the image. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/apps/kubernetes/images/cluster-autoscaler/Dockerfile | 2 +- .../apps/kubernetes/images/kubevirt-cloud-provider/Dockerfile | 2 +- .../keycloak-operator/images/keycloak-operator/Dockerfile | 2 +- packages/system/kilo/images/kilo/Dockerfile | 2 +- packages/system/linstor/images/linstor-csi/Dockerfile | 2 +- .../objectstorage-controller/images/objectstorage/Dockerfile | 2 +- packages/system/redis-operator/images/redis-operator/Dockerfile | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/packages/apps/kubernetes/images/cluster-autoscaler/Dockerfile b/packages/apps/kubernetes/images/cluster-autoscaler/Dockerfile index 7f9ff8963..4a0acd58e 100644 --- a/packages/apps/kubernetes/images/cluster-autoscaler/Dockerfile +++ b/packages/apps/kubernetes/images/cluster-autoscaler/Dockerfile @@ -1,5 +1,5 @@ # Source: https://raw.githubusercontent.com/kubernetes/autoscaler/refs/heads/master/cluster-autoscaler/Dockerfile.amd64 -ARG builder_image=docker.io/library/golang:1.23.4 +ARG builder_image=docker.io/library/golang:1.26 ARG BASEIMAGE=gcr.io/distroless/static:nonroot-${TARGETARCH} FROM ${builder_image} AS builder diff --git a/packages/apps/kubernetes/images/kubevirt-cloud-provider/Dockerfile b/packages/apps/kubernetes/images/kubevirt-cloud-provider/Dockerfile index 58a4d0390..37e8a9176 100644 --- a/packages/apps/kubernetes/images/kubevirt-cloud-provider/Dockerfile +++ b/packages/apps/kubernetes/images/kubevirt-cloud-provider/Dockerfile @@ -1,5 +1,5 @@ # Source: https://github.com/kubevirt/cloud-provider-kubevirt/blob/main/build/images/kubevirt-cloud-controller-manager/Dockerfile -FROM golang:1.20.6 AS builder +FROM golang:1.26 AS builder ARG TARGETOS ARG TARGETARCH diff --git a/packages/system/keycloak-operator/images/keycloak-operator/Dockerfile b/packages/system/keycloak-operator/images/keycloak-operator/Dockerfile index 8167042f1..7a3e2a2a5 100644 --- a/packages/system/keycloak-operator/images/keycloak-operator/Dockerfile +++ b/packages/system/keycloak-operator/images/keycloak-operator/Dockerfile @@ -11,7 +11,7 @@ RUN curl -sSL https://github.com/epam/edp-keycloak-operator/archive/${COMMIT_REF COPY patches /patches RUN git apply /patches/*.diff -FROM --platform=$BUILDPLATFORM docker.io/golang:1.24 AS builder +FROM --platform=$BUILDPLATFORM docker.io/golang:1.26 AS builder ARG TARGETOS ARG TARGETARCH diff --git a/packages/system/kilo/images/kilo/Dockerfile b/packages/system/kilo/images/kilo/Dockerfile index e1d5f0094..b20da859c 100644 --- a/packages/system/kilo/images/kilo/Dockerfile +++ b/packages/system/kilo/images/kilo/Dockerfile @@ -1,5 +1,5 @@ # Build the kg binary -FROM --platform=$BUILDPLATFORM golang:1.25 AS builder +FROM --platform=$BUILDPLATFORM golang:1.26 AS builder ARG VERSION=944dff5745d747c06555a964c2137b9a986ff6ec ARG TARGETOS diff --git a/packages/system/linstor/images/linstor-csi/Dockerfile b/packages/system/linstor/images/linstor-csi/Dockerfile index df5d179dd..ac482c563 100644 --- a/packages/system/linstor/images/linstor-csi/Dockerfile +++ b/packages/system/linstor/images/linstor-csi/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.25 AS builder +FROM golang:1.26 AS builder ARG VERSION=v1.10.6 ARG LINSTOR_WAIT_UNTIL_VERSION=v0.3.1 diff --git a/packages/system/objectstorage-controller/images/objectstorage/Dockerfile b/packages/system/objectstorage-controller/images/objectstorage/Dockerfile index d71e5566b..abaa0c3c9 100644 --- a/packages/system/objectstorage-controller/images/objectstorage/Dockerfile +++ b/packages/system/objectstorage-controller/images/objectstorage/Dockerfile @@ -11,7 +11,7 @@ RUN curl -sSL https://github.com/kubernetes-sigs/container-object-storage-interf COPY patches /patches RUN git apply /patches/*.diff -FROM --platform=$BUILDPLATFORM docker.io/golang:1.24 AS builder +FROM --platform=$BUILDPLATFORM docker.io/golang:1.26 AS builder ARG TARGETOS ARG TARGETARCH diff --git a/packages/system/redis-operator/images/redis-operator/Dockerfile b/packages/system/redis-operator/images/redis-operator/Dockerfile index c06bb2de0..fa1806c33 100644 --- a/packages/system/redis-operator/images/redis-operator/Dockerfile +++ b/packages/system/redis-operator/images/redis-operator/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.20 AS builder +FROM golang:1.26 AS builder ARG VERSION=v1.3.0-rc1 From 3659803dccd819355b4599072fb1e14863726f2e Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Mon, 22 Jun 2026 17:57:54 +0300 Subject: [PATCH 13/18] chore(kubeovn-webhook): ignore local build artifacts A local `go build` emits the module-named binary (kube-ovn-webhook), while the Dockerfile builds `-o webhook`. Ignore both names so neither local binary is accidentally committed. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/system/kubeovn-webhook/.gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/packages/system/kubeovn-webhook/.gitignore b/packages/system/kubeovn-webhook/.gitignore index ae3f7df3f..31816768e 100644 --- a/packages/system/kubeovn-webhook/.gitignore +++ b/packages/system/kubeovn-webhook/.gitignore @@ -1 +1,2 @@ images/kubeovn-webhook/kube-ovn-webhook +images/kubeovn-webhook/webhook From d09d52e8dc9576e2188db4d568fa49b72ef1ce93 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Mon, 22 Jun 2026 18:11:59 +0300 Subject: [PATCH 14/18] chore(kubevirt-csi-driver): bump golang.org/x/net to v0.56.0 Clear the reachable GO-2026-5026 advisory: idna.ToASCII is reached through the KubeVirt client path, and the fix landed in x/net v0.55.0. Bump to v0.56.0, pulling x/sys, x/term and x/text forward as required; govulncheck then reports the module clean. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- .../images/kubevirt-csi-driver/go.mod | 8 ++++---- .../images/kubevirt-csi-driver/go.sum | 20 +++++++++---------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod b/packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod index dcf5441f8..1bf8f3c62 100644 --- a/packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod +++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod @@ -44,11 +44,11 @@ require ( github.com/x448/float16 v0.8.4 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/net v0.53.0 // indirect + golang.org/x/net v0.56.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/sys v0.43.0 // indirect - golang.org/x/term v0.42.0 // indirect - golang.org/x/text v0.36.0 // indirect + golang.org/x/sys v0.46.0 // indirect + golang.org/x/term v0.44.0 // indirect + golang.org/x/text v0.38.0 // indirect golang.org/x/time v0.14.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/go.sum b/packages/apps/kubernetes/images/kubevirt-csi-driver/go.sum index e35cea75d..fa10984f9 100644 --- a/packages/apps/kubernetes/images/kubevirt-csi-driver/go.sum +++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/go.sum @@ -282,8 +282,8 @@ golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210= golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU= golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY= golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8= -golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA= -golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs= +golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= +golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -340,8 +340,8 @@ golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= -golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= +golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFKnoM1ldnzKoxTIn14Yxz928LQRYYgIN0= golang.org/x/telemetry v0.0.0-20250710130107-8d8967aff50b/go.mod h1:4ZwOYna0/zsOKwuR5X/m0QFOJpSZvAxFfkQT+Erd9D4= @@ -368,8 +368,8 @@ golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss= golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254= golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg= golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww= -golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY= -golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY= +golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc= +golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= @@ -391,8 +391,8 @@ golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM= golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM= golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY= golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8= -golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg= -golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164= +golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= +golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -420,8 +420,8 @@ golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ= golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc= golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg= -golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s= -golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0= +golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8= +golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0= golang.org/x/tools/go/expect v0.1.0-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY= golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY= golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8= From 192246e8b64ce40fbdebd25340e2b7537355e83b Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Wed, 17 Jun 2026 12:47:02 +0300 Subject: [PATCH 15/18] chore(kubevirt-operator): update to v1.8.4 Refresh the vendored virt-operator manifest from v1.8.2 to v1.8.4. The release backports validation of the VMI checksum status fields as a uint32 range, required on Kubernetes 1.36 where strict CRD numeric format validation otherwise leaves VMIs stuck in Scheduled. Remaining changes are bug fixes and CVE remediations; the embedded CRDs and RBAC are unchanged, so only the operator image tag moves. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/system/kubevirt-operator/Makefile | 4 ++-- .../kubevirt-operator/templates/kubevirt-operator.yaml | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/packages/system/kubevirt-operator/Makefile b/packages/system/kubevirt-operator/Makefile index 9aeb6de1a..3f3a22649 100644 --- a/packages/system/kubevirt-operator/Makefile +++ b/packages/system/kubevirt-operator/Makefile @@ -6,8 +6,8 @@ include ../../../hack/package.mk update: rm -rf templates mkdir templates - # v1.7.0 blocked by https://github.com/kubevirt/kubevirt/issues/16386 - export RELEASE=v1.8.2 && \ + # Skipping v1.7.x: live-migration regression, https://github.com/kubevirt/kubevirt/issues/16386 + export RELEASE=v1.8.4 && \ wget https://github.com/kubevirt/kubevirt/releases/download/$${RELEASE}/kubevirt-operator.yaml -O templates/kubevirt-operator.yaml && \ sed -i 's/namespace: kubevirt/namespace: $(NAMESPACE)/g' templates/kubevirt-operator.yaml awk -i inplace -v RS="---" '!/kind: Namespace/{printf "%s", $$0 RS}' templates/kubevirt-operator.yaml diff --git a/packages/system/kubevirt-operator/templates/kubevirt-operator.yaml b/packages/system/kubevirt-operator/templates/kubevirt-operator.yaml index 8d73f9822..f6acbc37d 100644 --- a/packages/system/kubevirt-operator/templates/kubevirt-operator.yaml +++ b/packages/system/kubevirt-operator/templates/kubevirt-operator.yaml @@ -8536,14 +8536,14 @@ spec: - virt-operator env: - name: VIRT_OPERATOR_IMAGE - value: quay.io/kubevirt/virt-operator:v1.8.2 + value: quay.io/kubevirt/virt-operator:v1.8.4 - name: WATCH_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.annotations['olm.targetNamespaces'] - name: KUBEVIRT_VERSION - value: v1.8.2 - image: quay.io/kubevirt/virt-operator:v1.8.2 + value: v1.8.4 + image: quay.io/kubevirt/virt-operator:v1.8.4 imagePullPolicy: IfNotPresent livenessProbe: httpGet: From 7e4af79b3151ddfe430ce98b35b971e24c1f232d Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Wed, 24 Jun 2026 19:49:16 +0300 Subject: [PATCH 16/18] fix(kamaji): rebuild image to pick up Go stdlib security fixes The shipped kamaji binary was compiled with go1.26.3, which trivy flags for the standard-library CVEs fixed in go1.26.4: crypto/x509 CVE-2026-27145, mime CVE-2026-42504, and net/textproto CVE-2026-42507. The image base is distroless/static, so the remaining OS-package CVEs from the scan do not apply to it. Advance the build source from 26.3.5-edge to 26.3.6-edge, the next patch on the same edge line (identical k8s.io/api v0.35.0 and controller-runtime v0.22.4, staying clear of the k8s 1.36 line that regresses tenant control-plane RBAC). The version change busts the build-layer cache so the release rebuild compiles against the current golang:1.26 toolchain, which resolves to 1.26.4 and closes the stdlib CVEs. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/system/kamaji/images/kamaji/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/system/kamaji/images/kamaji/Dockerfile b/packages/system/kamaji/images/kamaji/Dockerfile index 4dd0bb3ff..b67f934f0 100644 --- a/packages/system/kamaji/images/kamaji/Dockerfile +++ b/packages/system/kamaji/images/kamaji/Dockerfile @@ -1,7 +1,7 @@ # Build the manager binary FROM golang:1.26 AS builder -ARG VERSION=26.3.5-edge +ARG VERSION=26.3.6-edge ARG TARGETOS ARG TARGETARCH From 13ca721bfda6c6666acbde6a5029607e7f08ba6c Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Wed, 24 Jun 2026 20:07:46 +0300 Subject: [PATCH 17/18] fix(kamaji): overlay patched x/net, x/crypto and otel/sdk modules The kamaji source up to the 26.6.4-edge tag pins Go modules that carry known advisories compiled into the manager binary: golang.org/x/net below 0.55.0, golang.org/x/crypto below 0.52.0 and go.opentelemetry.io/otel/sdk below 1.43.0. Unlike the distroless OS-package findings, these advisories ship inside the Go binary and are reported against the deployed image. Force the fixed module versions during the build, after applying the source patches and before compiling, so the binary embeds them. No edge tag ships the fixes, and the tags that advance these modules also bring the k8s 1.36 kubeadm change that regresses tenant control-plane RBAC, so a source version bump is not a viable alternative. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/system/kamaji/images/kamaji/Dockerfile | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/packages/system/kamaji/images/kamaji/Dockerfile b/packages/system/kamaji/images/kamaji/Dockerfile index b67f934f0..144c67118 100644 --- a/packages/system/kamaji/images/kamaji/Dockerfile +++ b/packages/system/kamaji/images/kamaji/Dockerfile @@ -12,6 +12,13 @@ RUN curl -sSL https://github.com/clastix/kamaji/archive/refs/tags/${VERSION}.tar COPY patches /patches RUN git apply /patches/*.diff +# Overlay patched Go modules. The kamaji edge tags up to 26.6.4 still pin +# vulnerable golang.org/x/net (< 0.55.0), golang.org/x/crypto (< 0.52.0) and +# go.opentelemetry.io/otel/sdk (< 1.43.0). These advisories ship inside the +# compiled binary, so force the fixed versions before building. +RUN go get golang.org/x/net@v0.55.0 golang.org/x/crypto@v0.52.0 go.opentelemetry.io/otel/sdk@v1.43.0 && \ + go mod tidy + RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build \ -ldflags "-X github.com/clastix/kamaji/internal.GitRepo=$GIT_REPO -X github.com/clastix/kamaji/internal.GitTag=$GIT_LAST_TAG -X github.com/clastix/kamaji/internal.GitCommit=$GIT_HEAD_COMMIT -X github.com/clastix/kamaji/internal.GitDirty=$GIT_MODIFIED -X github.com/clastix/kamaji/internal.BuildTime=$BUILD_DATE" \ -a -o kamaji main.go From bfc1fbd555695d8cee954050837bd22bc8a7dc7e Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Thu, 25 Jun 2026 13:39:34 +0300 Subject: [PATCH 18/18] fix(seaweedfs): raise master probe timeouts above the cluster-status backoff MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The master's /cluster/status:9333 handler calls topo.Leader(), which spins an exponential backoff with MaxElapsedTime=20s before returning 200 whenever the node has no leader in its view — e.g. a master that was briefly the initial raft leader during bootstrap and then was demoted. The chart's master liveness and readiness probes both httpGet /cluster/status with timeoutSeconds: 10, which is shorter than that worst-case backoff. Such a master is then liveness-killed roughly every 137s into a permanent CrashLoop, the master StatefulSet never reaches full readiness, and the helm --wait install times out. Raise both master probe timeouts to 30s so each probe outlasts the 20s backoff (the volume component already uses 30s). The override sets only timeoutSeconds and relies on Helm's deep-merge to keep the rest of the subchart probe defaults. Both probes must be raised: leaving readiness at 10s would keep the master from becoming Ready and still stall the StatefulSet. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- .../tests/master_probe_timeout_test.yaml | 64 +++++++++++++++++++ packages/system/seaweedfs/values.yaml | 13 ++++ 2 files changed, 77 insertions(+) create mode 100644 packages/system/seaweedfs/tests/master_probe_timeout_test.yaml diff --git a/packages/system/seaweedfs/tests/master_probe_timeout_test.yaml b/packages/system/seaweedfs/tests/master_probe_timeout_test.yaml new file mode 100644 index 000000000..dabcfb963 --- /dev/null +++ b/packages/system/seaweedfs/tests/master_probe_timeout_test.yaml @@ -0,0 +1,64 @@ +suite: seaweedfs master probe timeouts + +# Pins the master probe timeout overrides that keep master-0 alive during raft +# bootstrap. The master's /cluster/status handler calls topo.Leader(), which +# backs off up to ~20s (MaxElapsedTime=20s) while the node has no leader in +# view — e.g. a master that was briefly the initial raft leader then was demoted. +# The subchart default 10s probe timeout is shorter than that worst case, so such +# a master is liveness-killed into a permanent CrashLoop and the master +# StatefulSet never reaches full readiness. Both probes must allow more than the +# 20s backoff. The overlay overrides only timeoutSeconds and relies on Helm's +# deep-merge to keep every other subchart probe field, so this also guards that +# the merge does not drop the surrounding probe configuration. + +templates: + - charts/seaweedfs/templates/master/master-statefulset.yaml + +release: + name: seaweedfs + namespace: cozy-seaweedfs + +tests: + - it: raises both master probe timeouts above the cluster-status backoff + asserts: + - equal: + path: spec.template.spec.containers[0].livenessProbe.timeoutSeconds + value: 30 + - equal: + path: spec.template.spec.containers[0].readinessProbe.timeoutSeconds + value: 30 + + - it: preserves the other master probe fields through the deep-merge + asserts: + # liveness: only timeoutSeconds is overridden, the rest survive + - equal: + path: spec.template.spec.containers[0].livenessProbe.httpGet.path + value: /cluster/status + - equal: + path: spec.template.spec.containers[0].livenessProbe.failureThreshold + value: 4 + - equal: + path: spec.template.spec.containers[0].livenessProbe.successThreshold + value: 1 + - equal: + path: spec.template.spec.containers[0].livenessProbe.initialDelaySeconds + value: 20 + - equal: + path: spec.template.spec.containers[0].livenessProbe.periodSeconds + value: 30 + # readiness: only timeoutSeconds is overridden, the rest survive + - equal: + path: spec.template.spec.containers[0].readinessProbe.httpGet.path + value: /cluster/status + - equal: + path: spec.template.spec.containers[0].readinessProbe.failureThreshold + value: 100 + - equal: + path: spec.template.spec.containers[0].readinessProbe.successThreshold + value: 2 + - equal: + path: spec.template.spec.containers[0].readinessProbe.initialDelaySeconds + value: 10 + - equal: + path: spec.template.spec.containers[0].readinessProbe.periodSeconds + value: 45 diff --git a/packages/system/seaweedfs/values.yaml b/packages/system/seaweedfs/values.yaml index ac31fe81d..62612eae3 100644 --- a/packages/system/seaweedfs/values.yaml +++ b/packages/system/seaweedfs/values.yaml @@ -32,6 +32,19 @@ seaweedfs: type: "emptyDir" logs: type: "" + # The master's /cluster/status handler calls topo.Leader(), which backs off + # up to ~20s (MaxElapsedTime=20s) while the node has no leader in view — e.g. + # a master that was briefly the initial raft leader then was demoted during + # bootstrap. The default 10s probe timeout is shorter than that worst case, so + # such a master is liveness-killed every ~137s into a permanent CrashLoop and + # the master StatefulSet never reaches full readiness, timing out the install. + # Both probes must allow more than the 20s backoff (the volume component in + # this chart already uses 30s). Override only timeoutSeconds; Helm deep-merges + # these onto the subchart defaults, keeping enabled/path/initialDelay/etc. + livenessProbe: + timeoutSeconds: 30 + readinessProbe: + timeoutSeconds: 30 volume: replicas: 2 resizeHook: