build: bump Go to 1.27.0 and align the go-build image with k8s 1.37.0 - #5295
Draft
electricjesus wants to merge 1 commit into
Draft
build: bump Go to 1.27.0 and align the go-build image with k8s 1.37.0#5295electricjesus wants to merge 1 commit into
electricjesus wants to merge 1 commit into
Conversation
calico-private and calico OSS are both already on GO_VERSION=1.27.0 and K8S_VERSION=v1.37.0. The operator was still on 1.26.5, and it has to move, because Envoy Gateway v1.9.1 declares go 1.26.7 and there is no calico/go-build image for 1.26.6 or 1.26.7. The container also runs GOTOOLCHAIN=local, so it will not fetch a newer toolchain by itself. 1.27.0 is the only tag that pairs with a k8s1.37 image, which is why K8S_VERSION moves too. K8S_VERSION only feeds GO_BUILD_VER; ENVTEST_K8S_VERSION is separate and unchanged. Two knock-on changes come with the newer toolchain: The 1.27.0 gofmt reindents multi-value returns of composite literals, which shows up in pkg/render/gateway/component.go. The image also carries golangci-lint 2.13.1 instead of 2.12.2, which reports seven pre-existing staticcheck issues. The two namespace-migration requeues in core_controller.go now use RequeueAfter with utils.StandardRetry, matching the rest of the controllers. That trades escalating backoff for a flat 30s, and the old path already exceeded 30s per attempt after about 13 requeues. PacketCaptureAPIPolicy returns NewPassthrough, which is never nil, so its dead nil check is gone. The other four keep their current behaviour and get a targeted nolint with a reason, matching the ones already in the tree. Three are deprecated fields we still want: the prometheus-operator BearerTokenSecret pair, where moving to authorization would change the rendered ServiceMonitor, and the FluentdDaemonSet alias, which that test exists to cover. The fourth is the LogStorage status conflict retry, which wants to be prompt; a flat 30s would leave the conditions stale after any conflicting write.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Moves the operator to
GO_VERSION=1.27.0andK8S_VERSION=v1.37.0, where calico-private and calico OSS already are.This unblocks the Envoy Gateway v1.9.1 bump, which stacks on top of this PR. EG v1.9.1 declares
go 1.26.7. There is nocalico/go-buildimage for 1.26.6 or 1.26.7, and the container runsGOTOOLCHAIN=local, so it will not fetch one. 1.27.0 is the only tag paired with a k8s1.37 image, soK8S_VERSIONmoves with it.K8S_VERSIONonly feedsGO_BUILD_VER;ENVTEST_K8S_VERSIONstays at1.34.x.The 1.27.0 image carries golangci-lint 2.13.1 instead of 2.12.2, which reports seven pre-existing staticcheck issues. They are not from this diff: linting clean
masterwith the same image gives the identical seven at the same lines.Three are fixed. The two namespace-migration requeues in
core_controller.gomove from rate-limited backoff to a flat 30sRequeueAfter, matching the other controllers; the old path already exceeded 30s per attempt after about 13 requeues.PacketCaptureAPIPolicyreturnsNewPassthrough, which is never nil, so its dead nil check is gone.Four keep their behaviour and take a targeted
nolintwith a reason, matching ones already in the tree. Three are deprecated fields we still want: the prometheus-operatorBearerTokenSecretpair, where moving toauthorizationwould change the rendered ServiceMonitor, and theFluentdDaemonSetalias, which that test exists to cover. The fourth is the LogStorage status conflict retry, which wants to be prompt; a flat 30s would leave the conditions stale after a conflicting write.pkg/render/gateway/component.gois gofmt-only. The 1.27.0 gofmt reindents multi-value returns of composite literals.Test plan
make static-checks: 0 issues. Reports 7 without this change.make ut: 109 suites, all passed, 10m28s.go build ./...andgo vet ./...clean.Not covered: nothing here runs against a live cluster. The migration requeue path needs an upgrade that actually triggers namespace migration, which CI does not do.
Release Note