REPLACE-WITH-JIRA-KEY: Bump Kubernetes dependencies to v1.36.2#736
REPLACE-WITH-JIRA-KEY: Bump Kubernetes dependencies to v1.36.2#736dfarrell07 wants to merge 7 commits into
Conversation
go get k8s.io/api@v0.36.2 go get k8s.io/apiextensions-apiserver@v0.36.2 go get k8s.io/apimachinery@v0.36.2 go get k8s.io/apiserver@v0.36.2 go get k8s.io/client-go@v0.36.2 go get k8s.io/component-base@v0.36.2 go get sigs.k8s.io/controller-runtime@v0.24.1 go get github.com/openshift/api go get github.com/openshift/library-go go get k8s.io/klog go get k8s.io/klog/v2 go get k8s.io/kube-openapi go get k8s.io/kubernetes go get k8s.io/utils go get sigs.k8s.io/apiserver-network-proxy/konnectivity-client go get sigs.k8s.io/json go get sigs.k8s.io/randfill go get sigs.k8s.io/structured-merge-diff/v6 go get sigs.k8s.io/yaml go mod tidy Signed-off-by: Daniel Farrell <dfarrell@redhat.com> Assisted-by: Claude Code <noreply@anthropic.com>
./Dockerfile ./Dockerfile.daemon Makefile Signed-off-by: Daniel Farrell <dfarrell@redhat.com> Assisted-by: Claude Code <noreply@anthropic.com>
The IntOrString type does not satisfy the %q verb directly. Use .String() to convert before formatting. Signed-off-by: Daniel Farrell <dfarrell@redhat.com> Assisted-by: Claude Code <noreply@anthropic.com>
golangci-lint v1 cannot parse Go 1.26 source. Update the version in both the Makefile prereqs target and hack/lint.sh container invocation. The v2 import path uses golangci-lint/v2/cmd/. Signed-off-by: Daniel Farrell <dfarrell@redhat.com> Assisted-by: Claude Code <noreply@anthropic.com>
Update the kindest/node image from v1.27.3 to v1.36.1 to match
the k8s 1.36 rebase. Convert kubeadm extraArgs from the old
map format to the v1beta4 list-of-{name,value} format.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Assisted-by: Claude Code <noreply@anthropic.com>
Replace io/ioutil.ReadFile with os.ReadFile and io/ioutil.ReadDir with os.ReadDir. Migrate klog v1 imports to klog/v2. io/ioutil was removed in Go 1.24, and klog v1 is deprecated in favor of v2. Signed-off-by: Daniel Farrell <dfarrell@redhat.com> Assisted-by: Claude Code <noreply@anthropic.com>
All imports have migrated to klog/v2. Remove the unused v1 dependency and its vendored files. Signed-off-by: Daniel Farrell <dfarrell@redhat.com> Assisted-by: Claude Code <noreply@anthropic.com>
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dfarrell07 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
WalkthroughGo 1.26, Kubernetes 1.36, dependency, container, development-tool, Kind configuration, logging, standard-library, and error-formatting updates are applied across the project. ChangesToolchain modernization
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
Dockerfile.daemon (1)
7-10: 🔒 Security & Privacy | 🔴 Critical | ⚡ Quick winAdd a non-root USER and a HEALTHCHECK directive.
As per path instructions for container security, the final image must not run as root (specify a
USERdirective) and must define aHEALTHCHECK.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfile.daemon` around lines 7 - 10, Add a non-root USER directive and a HEALTHCHECK directive to the final image stage after the daemon and syslog binaries are copied, ensuring the container runs as an unprivileged user and exposes a health-check command.Sources: Path instructions, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 1: Pin the golang base images in the Dockerfile and Dockerfile.daemon
FROM directives by replacing the mutable golang:1.26 tag with the approved
sha256 digest, preserving the existing image usage and build configuration.
In `@Dockerfile.daemon`:
- Line 3: Replace the broad COPY instruction in the Docker build with explicit
COPY directives for only the files and directories required by the daemon image.
Exclude secrets, local environment artifacts, and unrelated build-context files
while preserving the image’s existing build requirements.
---
Outside diff comments:
In `@Dockerfile.daemon`:
- Around line 7-10: Add a non-root USER directive and a HEALTHCHECK directive to
the final image stage after the daemon and syslog binaries are copied, ensuring
the container runs as an unprivileged user and exposes a health-check command.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1,5 +1,5 @@ | |||
| # Build the manager binary | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pin non-Red Hat container images by digest.
As per path instructions for container security, non-Red Hat images must be pinned by digest (e.g., @sha256:...) instead of relying on mutable tags to ensure supply chain security and deterministic builds.
Dockerfile#L2-2: Replace thegolang:1.26tag with its sha256 digest.Dockerfile.daemon#L1-1: Replace thegolang:1.26tag with its sha256 digest.
🧰 Tools
🪛 Trivy (0.72.0)
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 1, Pin the golang base images in the Dockerfile and
Dockerfile.daemon FROM directives by replacing the mutable golang:1.26 tag with
the approved sha256 digest, preserving the existing image usage and build
configuration.
Source: Path instructions
| FROM golang:1.25 AS builder | ||
| FROM golang:1.26 AS builder | ||
| WORKDIR /go/src/github.com/openshift/ingress-node-firewall | ||
| COPY . . |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Copy specific files instead of the entire context.
As per path instructions for container security, you must copy specific files rather than the entire build context (COPY . .). This prevents unintended files (e.g., secrets, local environment artifacts) from leaking into the container and improves cache efficiency.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile.daemon` at line 3, Replace the broad COPY instruction in the
Docker build with explicit COPY directives for only the files and directories
required by the daemon image. Exclude secrets, local environment artifacts, and
unrelated build-context files while preserving the image’s existing build
requirements.
Source: Path instructions
1 participant
Summary
Bump all k8s.io/* dependencies from v0.35.2 to v0.36.2 (Kubernetes 1.36.2),
Go from 1.25.0 to 1.26.0, and controller-runtime from v0.20.4 to v0.24.1.
What changed
apiextensions-apiserver, component-base, controller-manager, streaming
all bumped to v0.36.2. controller-runtime bumped to v0.24.1.
.golangci.yml: Added for golangci-lint v2 configurationerror strings (ST1005), suppressed pre-existing staticcheck warnings
Commits
Verification
go build ./...— PASSgo vet ./...— PASSgolangci-lint run— PASSgo test -run='^$' ./...— PASS (test compilation verified)All commits carry
Assisted-by: Claude CodeandSigned-off-bytrailers.Summary by CodeRabbit
Improvements
Bug Fixes