Repository navigation
chore(platform): raise Go toolchain to 1.26 across first-party images - #2941
Conversation
github-actions
Bot
added
area/uncategorized
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (3)
📒 Files selected for processing (12)
✅ Files skipped from review due to trivial changes (6)
🚧 Files skipped from review as they are similar to previous changes (5)
📝 WalkthroughWalkthroughGo builder stage base images are bumped to ChangesGo 1.26 Toolchain Upgrade
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related issues
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
dosubot
Bot
added
the
area/build
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request completes the modernization of the Go toolchain across all first-party images, aligning them with Go 1.26.4. This update is crucial for clearing standard-library security advisories and ensuring that all components are built with a current and supported Go version. The changes involve updating Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
|
Warning Gemini encountered an error creating the review. You can try again by commenting |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/system/kubeovn-webhook/.gitignore`:
- Line 1: The .gitignore entry references kube-ovn-webhook but the Dockerfile in
packages/system/kubeovn-webhook/images/kubeovn-webhook/Dockerfile actually
builds a binary named webhook. Update the .gitignore entry from
images/kubeovn-webhook/kube-ovn-webhook to images/kubeovn-webhook/webhook to
match the actual build artifact filename so it will be properly ignored by git.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 95a2ae00-adf7-4621-93a6-a61af1163255
⛔ Files ignored due to path filters (3)
packages/apps/kubernetes/images/kubevirt-csi-driver/go.sumis excluded by!**/*.sumpackages/system/dashboard/images/token-proxy/go.sumis excluded by!**/*.sumpackages/system/kubeovn-webhook/images/kubeovn-webhook/go.sumis excluded by!**/*.sum
📒 Files selected for processing (13)
packages/apps/kubernetes/.gitignorepackages/apps/kubernetes/images/cluster-autoscaler/Dockerfilepackages/apps/kubernetes/images/kubevirt-cloud-provider/Dockerfilepackages/apps/kubernetes/images/kubevirt-csi-driver/go.modpackages/system/dashboard/images/token-proxy/go.modpackages/system/keycloak-operator/images/keycloak-operator/Dockerfilepackages/system/kilo/images/kilo/Dockerfilepackages/system/kubeovn-webhook/.gitignorepackages/system/kubeovn-webhook/images/kubeovn-webhook/go.modpackages/system/linstor/images/linstor-csi/Dockerfilepackages/system/multus/images/multus-cni/Dockerfilepackages/system/objectstorage-controller/images/objectstorage/Dockerfilepackages/system/redis-operator/images/redis-operator/Dockerfile
38967e0 to
80c83ec
Compare
80c83ec to
1fc269e
Compare
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Go builder image version to 1.26 across multiple Dockerfiles (including cluster-autoscaler, kubevirt-cloud-provider, keycloak-operator, kilo, linstor-csi, multus-cni, objectstorage, and redis-operator). It also bumps the Go version to 1.26.4 and updates various dependencies in several go.mod files, notably upgrading Kubernetes client libraries to v0.36.2 in kubeovn-webhook. Feedback points out that the commit or PR scope 'deps' is invalid according to the repository style guide, and suggests using a valid scope such as 'platform' or package-specific scopes.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| @@ -1,5 +1,5 @@ | |||
| # Source: https://raw.githubusercontent.com/kubernetes/autoscaler/refs/heads/master/cluster-autoscaler/Dockerfile.amd64 | |||
| ARG builder_image=docker.io/library/golang:1.23.4 | |||
| ARG builder_image=docker.io/library/golang:1.26 | |||
There was a problem hiding this comment.
According to the repository style guide (Commit and PR Requirements), the scope 'deps' used in the PR title and release notes is not a valid scope. Please update the PR title and release notes to use a valid scope, such as 'platform' (which is a valid System scope), or split the changes into multiple commits with package-specific scopes (e.g., 'kubernetes', 'dashboard', 'kilo', etc.). Valid scopes include: System (dashboard, platform, cilium, kube-ovn, linstor, fluxcd, cluster-api), Apps (postgres, mariadb, redis, kafka, clickhouse, kubernetes, virtual-machine), Meta (api, hack, tests, ci, docs), or any package-specific name matching a directory under packages/.
References
- Each commit must follow Conventional Commits format: type(scope): brief description. Valid scopes are strictly defined in the repository style guide. Flag any PR whose commits lack the Conventional Commits format. (link)
There was a problem hiding this comment.
Switched the PR title and release-note scope from deps to platform. deps is not in the styleguide's valid-scope list (.gemini/styleguide.md:42) and the labeler has no deps → area/* mapping, so it fell back to area/uncategorized. platform is the valid System catch-all for this cross-cutting first-party-image toolchain sweep and maps to area/platform.
The token-proxy, kube-ovn-webhook and kubevirt-csi-driver image modules still pinned go 1.26.2, so their binaries shipped standard-library versions that the 1.26.4 toolchain fixes. Raise the go directive and refresh module dependencies to current releases. token-proxy and kube-ovn-webhook take a full dependency refresh; kube-ovn-webhook also moves k8s.io/* from 0.26.0 to 0.36.2 (only long-stable admission/core API is used, so no code change is needed). kubevirt-csi-driver keeps its existing replace-based k8s.io/* alignment at 0.36.0 and only raises the go directive; a blanket go get -u is avoided there because it pulls transitive bumps that break compilation of the pinned vendored upstream csi-driver source. Also ignore the locally-built binaries under the two image directories so they cannot be committed by accident. Assisted-By: Claude <[email protected]> Signed-off-by: Aleksei Sviridkin <[email protected]>
Several first-party images still built their Go binaries with EOL or behind-latest toolchains (golang 1.20, 1.20.6, 1.23.4, 1.24, 1.25), so a plain rebuild kept shipping standard-library versions that the current 1.26 toolchain fixes. Raise every Go builder image (FROM and the builder_image ARG defaults) to golang:1.26 across cluster-autoscaler, kubevirt-cloud-provider, redis-operator, multus-cni, keycloak-operator, objectstorage, kilo and linstor-csi. This is the build-time counterpart to raising the go directive in the first-party Go modules: the toolchain that compiles the binary, not the go.mod minimum, determines the standard-library version baked into the image. Assisted-By: Claude <[email protected]> Signed-off-by: Aleksei Sviridkin <[email protected]>
A local `go build` emits the module-named binary (kube-ovn-webhook), while the Dockerfile builds `-o webhook`. Ignore both names so neither local binary is accidentally committed. Assisted-By: Claude <[email protected]> Signed-off-by: Aleksei Sviridkin <[email protected]>
Clear the reachable GO-2026-5026 advisory: idna.ToASCII is reached through the KubeVirt client path, and the fix landed in x/net v0.55.0. Bump to v0.56.0, pulling x/sys, x/term and x/text forward as required; govulncheck then reports the module clean. Assisted-By: Claude <[email protected]> Signed-off-by: Aleksei Sviridkin <[email protected]>
1fc269e to
d09d52e
Compare
Aleksei Sviridkin (lexfrei)
changed the title
github-actions
Bot
added
the
area/platform
myasnikovdaniil
left a comment
myasnikovdaniil
left a comment
There was a problem hiding this comment.
LGTM — build-time toolchain sweep; all three refreshed Go modules build/vet/tidy clean on Go 1.26.4 and CI is green (the image Build and E2E jobs exercise the new dependencies).
Business context: Build-time counterpart to #2852 — moves 7 first-party Dockerfile builders to golang:1.26 and refreshes three in-image Go modules (token-proxy, kube-ovn-webhook, kubevirt-csi-driver) to go 1.26.4 with patched golang.org/x/* and k8s deps, so rebuilt binaries bake in the patched standard library instead of shipping unpatched stdlib on a plain rebuild.
Verified locally (Go 1.26.4, matching the go directive):
go build ./...,go vet ./..., andgo mod tidy -diffare clean / no-op for all three modules — confirms the "tidy is a no-op" claim.- The
kube-ovn-webhookk8s.io/*0.26 → 0.36.2 jump is safe: the source only uses long-stable surface (admission/v1AdmissionReview/AdmissionResponse/PatchTypeJSONPatch,core/v1.Pod,metav1.GetOptions,client-goCoreV1().Namespaces().Get+rest). Compiles and vets unchanged. - All three modules already build on
golang:1.26, so thego 1.26.4directive matches the builder — no mismatch. - Post-PR, every first-party Go builder is on
golang:1.26[-alpine](only the pre-existings3manageruses the loosergolang:1); nothing is left behind on 1.20/1.23/1.24/1.25.
Non-blocking:
- The description lists
multus-cniamong the bumped builders, but its Dockerfile is already ongolang:1.26onmainand isn't in this diff — the sweep touches 7 Dockerfiles, not 8. Worth trimming so the release note matches what shipped. kubevirt-cloud-provider(1.20.6) andcluster-autoscaler(1.23.4) move from patch-pinned to floatinggolang:1.26. Consistent with the rest of the repo and the right call for auto-absorbing stdlib patches — just noting the reproducibility trade-off.
2 participants
What this PR does
Completes the Go-toolchain modernization for first-party images — the build-time counterpart to #2852, which raised the root and
api/modules to Go 1.26.4.token-proxy,kube-ovn-webhook,kubevirt-csi-driver): raise thegodirective and refresh dependencies.kube-ovn-webhookmovesk8s.io/*0.26 → 0.36.2 (only long-stable admission/core API is used);kubevirt-csi-driverkeeps its existing replace-based k8s alignment at 0.36.0 (main's refactor owns that module's pin) and raises thegodirective, with thegolang.org/x/net0.56.0 security bump — which clears the reachable GO-2026-5026 — reapplied. Adds two.gitignorefiles so the locally-built binaries can't be committed.golang:1.26across 8 images still on EOL/behind toolchains (golang 1.20, 1.20.6, 1.23.4, 1.24, 1.25):cluster-autoscaler,kubevirt-cloud-provider,redis-operator,multus-cni,keycloak-operator,objectstorage,kilo,linstor-csi. The builder image tag — not the go.mod minimum — sets the standard-library version baked into the binary, so these still shipped unpatched stdlib on a plain rebuild.Verified:
GOOS=linux go build/go vetpass for all three modules andgo mod tidyis a no-op; the three biggest builder jumps (redis-operator, kubevirt-cloud-provider, cluster-autoscaler — all formerly Go 1.20.x/1.23.x) were verified with a localdocker build; the remaining five (1.24/1.25 → 1.26) are covered by CI image builds.Release note
Summary by CodeRabbit