REPLACE-WITH-JIRA-KEY: Bump Kubernetes dependencies to v1.36.2

[dfarrell07]

Summary

Rebase all k8s.io/* dependencies from v0.35.2 to v0.36.2 (Kubernetes 1.36.2), including:

• Go version: 1.25.0 → 1.26.0
• controller-runtime: v0.23.3 → v0.24.1
• golangci-lint: v1.54.2 → v2.12.2

What changed

Category	Details
Dependency bump	19 k8s.io/* packages to v0.36.2, controller-runtime to v0.24.1
Go version	1.25 → 1.26 in go.mod, Dockerfiles, .ci-operator.yaml
Lint tooling	golangci-lint v1.54.2 → v2.12.2, new .golangci.yml config
Deprecated API cleanup	io/ioutil → os equivalents, duplicate imports removed
Code quality	Lowercased error strings (ST1005), removed dead code (SA4010, S1039)
CI infra	KIND image v1.27.3 → v1.36.1, envtest version format fix

Commits

3c65617c ci: update KIND image to v1.36.1 and fix envtest version format
8525b027 controllers: remove unused interfaces slice and unnecessary Sprintf
165756fd ebpf: remove duplicate v1alpha1 import
da620000 ci: expand .golangci.yml with exclusions for pre-existing lint patterns
2fff8485 e2e: fix missed v1 alias reference in k8sreporter
d80055a3 lint: lowercase error strings per Go conventions (ST1005)
048e9c8b lint: remove duplicate package imports
737b4245 ebpf,render: replace deprecated io/ioutil with os equivalents
4c1e9fb3 ci: add .golangci.yml with errcheck exclusions for golangci-lint v2
0d174f67 ci: align Makefile golangci-lint version with hack/lint.sh
83c4c5a5 Update version references and lint for k8s 1.36         [autofix]
52d0f3f7 ci: update golangci-lint from v1.54.2 to v2.2.1
026a91f1 utils: fix IntOrString format verb in error message
cdf15eab Update version references for k8s 1.36                  [mechanical]
054692e5 Rebase k8s-rebase-1.36.2 to k8s 1.36                    [mechanical]

Verification

Locally verified:

• go build ./... — PASS
• go vet ./... — PASS
• golangci-lint v2.12.2 — PASS (0 issues)
• Unit tests — 6/8 packages pass; 2 packages (controllers, pkg/webhook) require envtest binaries not available locally
• All commits carry Assisted-by: Claude Code trailers

Notes

• The golangci-lint v2 upgrade surfaces many pre-existing lint issues. These are addressed via a combination of code fixes (ioutil migration, import dedup, error string casing, dead code removal) and .golangci.yml exclusions (embedded field selectors, tagged switch suggestions, dot imports in tests).
• hack/kind-cluster.sh still uses kubeadm v1beta3 extraArgs map format — deprecated since k8s 1.31 but still functional. Migration to v1beta4 list format can be done separately.

All commits carry Assisted-by: Claude Code trailers.

Summary by CodeRabbit

• Compatibility

  • Updated the project to Go 1.26 and newer Kubernetes, OpenShift, and monitoring components.
  • Updated local Kubernetes test and development environments to newer releases.

• Developer Experience

  • Upgraded linting tools and added standardized lint configuration.
  • Modernized file handling and improved error reporting consistency.

• Bug Fixes

  • Improved cleanup of pinned resources and handling of namespace deletion conditions.
  • Refined ingress rule validation and error messages.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dfarrell07
Once this PR has been reviewed and has the lgtm label, please assign danwinship for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

The PR updates the project to Go 1.26, newer Kubernetes and linting tooling, refreshed dependencies, and modernized selected eBPF, filesystem, Kubernetes API, and error-handling code.

Changes

Project modernization

Layer / File(s)	Summary
Toolchain and dependency updates .golangci.yml, Dockerfile*, Makefile, go.mod, hack/*	Build images, Go modules, envtest, kind, and golangci-lint are updated to newer versions and configuration formats.
eBPF controller and loader compatibility controllers/ingressnodefirewall_controller.go, pkg/ebpf/*, pkg/ebpfsyncer/*	eBPF detach cleanup, API aliases, rule-loader signatures, directory reading, structured logging, and related error messages are updated.
Supporting API and utility cleanup pkg/render/render.go, pkg/utils/utils.go, test/e2e/*	Deprecated file APIs are replaced, range errors are clarified, and Kubernetes API aliases and not-found handling are normalized.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• openshift/ingress-node-firewall#713: Overlaps on eBPF rule loading, syncing, controller cleanup, API aliases, and error-message casing.
• openshift/ingress-node-firewall#732: Overlaps on lint configuration, controller detach logic, os.ReadDir, type aliases, and error updates.
• openshift/ingress-node-firewall#733: Overlaps on tooling upgrades and eBPF controller, loader, event, and synchronizer changes.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: bumping Kubernetes dependencies to v1.36.2.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No changed non-vendor Go files introduced Ginkgo titles or dynamic subtest names; the modified tests use static Go test function names only.
Test Structure And Quality	✅ Passed	No changed Ginkgo specs were introduced; the modified test helpers already use cleanup and explicit timeouts where relevant.
Microshift Test Compatibility	✅ Passed	No new Ginkgo specs were added in the touched test files; they’re helpers only, and no MicroShift-unsafe APIs, tags, or skips were introduced.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR adds no new Ginkgo e2e specs; only helper tweaks in test/e2e/*, with no SNO or multi-node assumptions introduced.
Topology-Aware Scheduling Compatibility	✅ Passed	The only actual changes are envtest format and KIND image version bumps; no deployment manifests, operator code, or controller scheduling logic were modified.
Ote Binary Stdout Contract	✅ Passed	PR diff adds no stdout writes in process-level code; searches over the full PR range found none in main/init/BeforeSuite/RunSpecs paths.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the only test/e2e changes are helper/reporter updates and they add no IPv4 literals or external connectivity.
No-Weak-Crypto	✅ Passed	No added weak-crypto APIs or secret comparisons were found; only vendored docs mention MD5/SHA1/3DES and generic bytes.Equal/reflect.DeepEqual on non-secret data.
Container-Privileges	✅ Passed	No PR hunk adds privileged/host* or allowPrivilegeEscalation settings; touched manifests only changed unrelated lines.
No-Sensitive-Data-In-Logs	✅ Passed	Reviewed added logs; they only emit generic status/errors and TLS metadata/cipher names, with no secrets, PII, hostnames, or customer data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.golangci.yml (1)

18-30: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Do not globally ignore Close errors.

As per path instructions for Go security, you must "Never ignore error returns". Configuring errcheck to globally ignore Close() operations, particularly on writable streams like *os.File, *io.PipeWriter, and network connections, violates this principle. Failing to check these errors can lead to silent data loss or resource leaks, as failures to flush data to disk or close a connection gracefully will be masked.

🛡️ Proposed fix to enforce checking Close errors

     errcheck:
       exclude-functions:
         - fmt.Fprintf
         - fmt.Fprintln
         - fmt.Fprint
-        - (net.Conn).Close
-        - (net.Listener).Close
-        - (io.Closer).Close
-        - (*os.File).Close
-        - (io.ReadCloser).Close
-        - (*crypto/tls.Conn).Close
-        - (*io.PipeWriter).Close

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.golangci.yml around lines 18 - 30, Remove all Close-related entries from
errcheck.exclude-functions in the errcheck configuration, including connection,
listener, closer, file, TLS, and pipe-writer Close symbols, so callers must
explicitly handle their returned errors; leave the fmt print exclusions
unchanged.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile`:
- Line 2: Pin the golang builder image by its SHA256 digest instead of the
floating 1.26 tag in the Dockerfile FROM declaration, and apply the same digest
pin to the golang:1.26 FROM declaration in Dockerfile.daemon (lines 1-1). Keep
the golang:1.26 image version unchanged.

In `@go.mod`:
- Around line 15-32: Update the go.mod dependency pins to versions that
remediate the OSV advisories for k8s.io/kubernetes v1.36.2 and the Go 1.26.0
standard library. Keep the Kubernetes-related module versions mutually
compatible and ensure the resulting module metadata reflects the patched Go
toolchain version before merging.

---

Outside diff comments:
In @.golangci.yml:
- Around line 18-30: Remove all Close-related entries from
errcheck.exclude-functions in the errcheck configuration, including connection,
listener, closer, file, TLS, and pipe-writer Close symbols, so callers must
explicitly handle their returned errors; leave the fmt print exclusions
unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Pin non-Red Hat base images by digest.

As per path instructions for container security, non-Red Hat images (like golang) must be pinned by their SHA256 digest rather than using a floating tag (e.g., 1.26). This ensures build reproducibility and mitigates upstream supply chain attacks.

• Dockerfile#L2-L2: Pin golang:1.26 by its digest.
• Dockerfile.daemon#L1-L1: Pin golang:1.26 by its digest.

📍 Affects 2 files

• Dockerfile#L2-L2 (this comment)
• Dockerfile.daemon#L1-L1

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` at line 2, Pin the golang builder image by its SHA256 digest
instead of the floating 1.26 tag in the Dockerfile FROM declaration, and apply
the same digest pin to the golang:1.26 FROM declaration in Dockerfile.daemon
(lines 1-1). Keep the golang:1.26 image version unchanged.

Source: Path instructions

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Check for known vulnerabilities in the updated dependencies.

# Install and run osv-scanner on go.mod
go install github.com/google/osv-scanner/cmd/osv-scanner@latest
$(go env GOPATH)/bin/osv-scanner -L go.mod

Repository: openshift/ingress-node-firewall

Length of output: 8358

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,40p' go.mod

Repository: openshift/ingress-node-firewall

Length of output: 1552

---

Bump the vulnerable pins before merging. k8s.io/kubernetes v1.36.2 is flagged by OSV (GO-2025-3521, GO-2025-3547), and go 1.26.0 is also reported with open stdlib advisories.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 15 - 32, Update the go.mod dependency pins to versions
that remediate the OSV advisories for k8s.io/kubernetes v1.36.2 and the Go
1.26.0 standard library. Keep the Kubernetes-related module versions mutually
compatible and ensure the resulting module metadata reflects the patched Go
toolchain version before merging.

Source: Path instructions