Update k8s libs to v1.27.16 and use go-build v0.89 (golang v1.22.9) (#…

…9461)

.semaphore/semaphore-scheduled-builds.yml

@@ -675,6 +675,7 @@ blocks:
             - export UPPER_CONSTRAINTS_FILE=https://releases.openstack.org/constraints/upper/yoga
             - export NC_PLUGIN_REPO=$(dirname $(pwd))
             - export NC_PLUGIN_REF=$(git rev-parse --abbrev-ref HEAD)
+            - sudo git config --system --add safe.directory ${NC_PLUGIN_REPO}/.git
             - TEMPEST=true DEVSTACK_BRANCH=unmaintained/yoga ./devstack/bootstrap.sh
       epilogue:
         on_fail:

.semaphore/semaphore.yml

@@ -675,6 +675,7 @@ blocks:
             - export UPPER_CONSTRAINTS_FILE=https://releases.openstack.org/constraints/upper/yoga
             - export NC_PLUGIN_REPO=$(dirname $(pwd))
             - export NC_PLUGIN_REF=$(git rev-parse --abbrev-ref HEAD)
+            - sudo git config --system --add safe.directory ${NC_PLUGIN_REPO}/.git
             - TEMPEST=true DEVSTACK_BRANCH=unmaintained/yoga ./devstack/bootstrap.sh
       epilogue:
         on_fail:

.semaphore/semaphore.yml.tpl

@@ -673,6 +673,7 @@ blocks:
             - export UPPER_CONSTRAINTS_FILE=https://releases.openstack.org/constraints/upper/yoga
             - export NC_PLUGIN_REPO=$(dirname $(pwd))
             - export NC_PLUGIN_REF=$(git rev-parse --abbrev-ref HEAD)
+            - sudo git config --system --add safe.directory ${NC_PLUGIN_REPO}/.git
             - TEMPEST=true DEVSTACK_BRANCH=unmaintained/yoga ./devstack/bootstrap.sh
       epilogue:
         on_fail:

api/go.mod

@@ -1,13 +1,13 @@
 module github.com/projectcalico/api
 
-go 1.21
+go 1.22
 
 require (
 	github.com/onsi/ginkgo v1.16.5
 	github.com/onsi/gomega v1.27.10
-	k8s.io/api v0.27.15
-	k8s.io/apimachinery v0.27.15
-	k8s.io/client-go v0.27.15
+	k8s.io/api v0.27.16
+	k8s.io/apimachinery v0.27.16
+	k8s.io/client-go v0.27.16
 	k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f
 )
 
@@ -55,30 +55,30 @@ require (
 )
 
 replace (
-	k8s.io/api => k8s.io/api v0.27.15
-	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.27.15
-	k8s.io/apimachinery => k8s.io/apimachinery v0.27.15
-	k8s.io/apiserver => k8s.io/apiserver v0.27.15
-	k8s.io/cli-runtime => k8s.io/cli-runtime v0.27.15
-	k8s.io/client-go => k8s.io/client-go v0.27.15
-	k8s.io/cloud-provider => k8s.io/cloud-provider v0.27.15
-	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.27.15
-	k8s.io/code-generator => k8s.io/code-generator v0.27.15
-	k8s.io/component-base => k8s.io/component-base v0.27.15
-	k8s.io/component-helpers => k8s.io/component-helpers v0.27.15
-	k8s.io/controller-manager => k8s.io/controller-manager v0.27.15
-	k8s.io/cri-api => k8s.io/cri-api v0.27.15
-	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.27.15
-	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.27.15
-	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.27.15
+	k8s.io/api => k8s.io/api v0.27.16
+	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.27.16
+	k8s.io/apimachinery => k8s.io/apimachinery v0.27.16
+	k8s.io/apiserver => k8s.io/apiserver v0.27.16
+	k8s.io/cli-runtime => k8s.io/cli-runtime v0.27.16
+	k8s.io/client-go => k8s.io/client-go v0.27.16
+	k8s.io/cloud-provider => k8s.io/cloud-provider v0.27.16
+	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.27.16
+	k8s.io/code-generator => k8s.io/code-generator v0.27.16
+	k8s.io/component-base => k8s.io/component-base v0.27.16
+	k8s.io/component-helpers => k8s.io/component-helpers v0.27.16
+	k8s.io/controller-manager => k8s.io/controller-manager v0.27.16
+	k8s.io/cri-api => k8s.io/cri-api v0.27.16
+	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.27.16
+	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.27.16
+	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.27.16
 	k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20230303024457-afdc3dddf62d
-	k8s.io/kube-proxy => k8s.io/kube-proxy v0.27.15
-	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.27.15
-	k8s.io/kubectl => k8s.io/kubectl v0.27.15
-	k8s.io/kubelet => k8s.io/kubelet v0.27.15
-	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.27.15
-	k8s.io/metrics => k8s.io/metrics v0.27.15
-	k8s.io/mount-utils => k8s.io/mount-utils v0.27.15
-	k8s.io/node-api => k8s.io/node-api v0.27.15
-	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.27.15
+	k8s.io/kube-proxy => k8s.io/kube-proxy v0.27.16
+	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.27.16
+	k8s.io/kubectl => k8s.io/kubectl v0.27.16
+	k8s.io/kubelet => k8s.io/kubelet v0.27.16
+	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.27.16
+	k8s.io/metrics => k8s.io/metrics v0.27.16
+	k8s.io/mount-utils => k8s.io/mount-utils v0.27.16
+	k8s.io/node-api => k8s.io/node-api v0.27.16
+	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.27.16
 )

api/go.sum

@@ -233,12 +233,12 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-k8s.io/api v0.27.15 h1:+bR5ju3H+OjePA1DMEmHm33EzhtmqWBuQvqhTVYFXD0=
-k8s.io/api v0.27.15/go.mod h1:x/uHpsq4NAAGMiHWhq3P5W1ABiw4/aUWpIeGq1XmegY=
-k8s.io/apimachinery v0.27.15 h1:wT8HeVe/KNcX+QavW97ZpKiGxSN5glW39Dxvj/8wMPU=
-k8s.io/apimachinery v0.27.15/go.mod h1:TWo+8wOIz3CytsrlI9k/LBWXLRr9dqf5hRSCbbggMAg=
-k8s.io/client-go v0.27.15 h1:SDUs0ap/VuHPyoRiEChUhXQlh25UZAeXcm82J3TYy2w=
-k8s.io/client-go v0.27.15/go.mod h1:/ULqZ7zjeuEm/fSf7A5kKmbWb2GY/CnCiquS5XzAdzo=
+k8s.io/api v0.27.16 h1:70IBoTuiPfd+Tm68WH0tGXQRSQq0R1xnbyhTRe8WYQY=
+k8s.io/api v0.27.16/go.mod h1:5j0Cgo6X4qovBOu3OjzRwETDEYqMxq2qafhDQXOPy3A=
+k8s.io/apimachinery v0.27.16 h1:Nmbei3P/6w6vxbNxV8/sDCZz+TQrJ9A4+bVIRjDufuM=
+k8s.io/apimachinery v0.27.16/go.mod h1:TWo+8wOIz3CytsrlI9k/LBWXLRr9dqf5hRSCbbggMAg=
+k8s.io/client-go v0.27.16 h1:x06Jk6/SIQQ6kAsWs5uzQIkBLHtcAQlbTAgmj1tZzG0=
+k8s.io/client-go v0.27.16/go.mod h1:bPZUNRj8XsHa+JVS5jU6qeU2H/Za8+7riWA08FUjaA8=
 k8s.io/klog/v2 v2.90.1 h1:m4bYOKall2MmOiRaR1J+We67Do7vm9KiQVlT96lnHUw=
 k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/kube-openapi v0.0.0-20230303024457-afdc3dddf62d h1:VcFq5n7wCJB2FQMCIHfC+f+jNcGgNMar1uKd6rVlifU=

felix/Makefile

@@ -258,10 +258,10 @@ FELIX_IMAGE_ID=$(shell docker images -q $(FELIX_IMAGE_WITH_TAG))
 $(FELIX_IMAGE)-$(ARCH): $(FELIX_CONTAINER_CREATED)
 $(FELIX_CONTAINER_CREATED): docker-image/calico-felix-wrapper \
                             docker-image/felix.cfg \
-                            docker-image/Dockerfile* \
+                            docker-image/Dockerfile \
                             $(shell test "$(FELIX_IMAGE_ID)" || echo force-rebuild)
 	$(MAKE) register
-	$(DOCKER_BUILD) -t $(FELIX_IMAGE_WITH_TAG) --file ./docker-image/Dockerfile.$(ARCH) docker-image --load;
+	$(DOCKER_BUILD) -t $(FELIX_IMAGE_WITH_TAG) -f ./docker-image/Dockerfile docker-image
 	$(MAKE) retag-build-images-with-registries VALIDARCHES=$(ARCH) IMAGETAG=latest
 	touch $(FELIX_CONTAINER_CREATED)
 

felix/docker-image/Dockerfile.amd64 → felix/docker-image/Dockerfile

@@ -17,16 +17,18 @@
 # This ensures that testing of Felix in this repository is done in the same
 # userspace environment as it will be deployed in calico/node.
 
-FROM ubuntu:focal AS wgtool
+ARG QEMU_IMAGE
 
-RUN apt-get update && \
-    apt-get install --no-install-recommends wireguard-tools -y
+FROM ${QEMU_IMAGE} AS qemu
 
 FROM calico/bpftool:v7.4.0 AS bpftool
 
-FROM debian:10-slim
+FROM debian:11-slim as source
+
 LABEL maintainer="Shaun Crampton <shaun@tigera.io>"
 
+COPY --from=qemu /usr/bin/qemu-*-static /usr/bin
+
 # Install remaining runtime deps required for felix from the global repository
 RUN apt-get update && apt-get install -y \
     ipset \
@@ -50,20 +52,33 @@ RUN apt-get update && apt-get install -y \
     # Felix FV tests require these
     wget \
     ethtool \
-    tcpdump \
-    hping3
+    hping3 \
+    libpcap0.8 \
+    tcpdump
 
-# Copy in wg tool from stage 1.
-COPY --from=wgtool /usr/bin/wg /usr/bin/wg
+RUN apt-get install --no-install-recommends -y wireguard-tools
+
+RUN apt-get clean
 
 # Default to the xtables backend of iptables.
 RUN update-alternatives --set iptables /usr/sbin/iptables-legacy
 RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
 
-ADD felix.cfg /etc/calico/felix.cfg
-ADD calico-felix-wrapper /usr/bin
+# Felix is built with RHEL/UBI and links against libpcap.so.1. We need this symbolic link
+# until Debian changes the soname from .0.8 to .1.
+RUN ln -s $(readlink /usr/lib/*-linux-gnu/libpcap.so.0.8) $(ldconfig -v 2>/dev/null | grep /usr/lib/ | head -n 1 | sed -e 's/://')/libpcap.so.1
+
+COPY felix.cfg /etc/calico/felix.cfg
+COPY calico-felix-wrapper /usr/bin
 
 COPY --from=bpftool /bpftool /usr/bin
+
+RUN rm -f /usr/bin/qemu-*-static
+
+FROM scratch
+
+COPY --from=source / /
+
 WORKDIR /code
 
 # Run felix (via the wrapper script) by default

go.mod

@@ -1,6 +1,6 @@
 module github.com/projectcalico/calico
 
-go 1.21
+go 1.22
 
 require (
 	github.com/BurntSushi/toml v1.3.2
@@ -87,16 +87,16 @@ require (
 	gopkg.in/go-playground/validator.v9 v9.30.2
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0
 	gopkg.in/yaml.v2 v2.4.0
-	k8s.io/api v0.27.15
-	k8s.io/apiextensions-apiserver v0.27.8
-	k8s.io/apimachinery v0.27.15
-	k8s.io/apiserver v0.27.15
-	k8s.io/client-go v0.27.15
-	k8s.io/code-generator v0.27.15
-	k8s.io/component-base v0.27.15
+	k8s.io/api v0.27.16
+	k8s.io/apiextensions-apiserver v0.27.16
+	k8s.io/apimachinery v0.27.16
+	k8s.io/apiserver v0.27.16
+	k8s.io/client-go v0.27.16
+	k8s.io/code-generator v0.27.16
+	k8s.io/component-base v0.27.16
 	k8s.io/klog/v2 v2.90.1
 	k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f
-	k8s.io/kubernetes v1.27.15
+	k8s.io/kubernetes v1.27.16
 	k8s.io/utils v0.0.0-20230313181309-38a27ef9d749
 	modernc.org/memory v1.7.1
 	sigs.k8s.io/kind v0.20.0
@@ -277,20 +277,20 @@ require (
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/warnings.v0 v0.1.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/cloud-provider v0.27.15 // indirect
-	k8s.io/component-helpers v0.27.15 // indirect
-	k8s.io/controller-manager v0.27.15 // indirect
+	k8s.io/cloud-provider v0.27.16 // indirect
+	k8s.io/component-helpers v0.27.16 // indirect
+	k8s.io/controller-manager v0.27.16 // indirect
 	k8s.io/cri-api v0.25.0 // indirect
-	k8s.io/csi-translation-lib v0.27.8 // indirect
-	k8s.io/dynamic-resource-allocation v0.27.8 // indirect
+	k8s.io/csi-translation-lib v0.27.16 // indirect
+	k8s.io/dynamic-resource-allocation v0.27.16 // indirect
 	k8s.io/gengo v0.0.0-20220902162205-c0856e24416d // indirect
-	k8s.io/kms v0.27.15 // indirect
+	k8s.io/kms v0.27.16 // indirect
 	k8s.io/kube-proxy v0.0.0 // indirect
 	k8s.io/kube-scheduler v0.0.0 // indirect
 	k8s.io/kubectl v0.0.0 // indirect
-	k8s.io/kubelet v0.27.8 // indirect
+	k8s.io/kubelet v0.27.16 // indirect
 	k8s.io/legacy-cloud-providers v0.0.0 // indirect
-	k8s.io/mount-utils v0.27.8 // indirect
+	k8s.io/mount-utils v0.27.16 // indirect
 	k8s.io/pod-security-admission v0.0.0 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.1.2 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
@@ -300,34 +300,34 @@ require (
 replace (
 	github.com/projectcalico/api => ./api
 
-	k8s.io/api => k8s.io/api v0.27.15
-	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.27.15
-	k8s.io/apimachinery => k8s.io/apimachinery v0.27.15
-	k8s.io/apiserver => k8s.io/apiserver v0.27.15
-	k8s.io/cli-runtime => k8s.io/cli-runtime v0.27.15
-	k8s.io/client-go => k8s.io/client-go v0.27.15
-	k8s.io/cloud-provider => k8s.io/cloud-provider v0.27.15
-	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.27.15
-	k8s.io/code-generator => k8s.io/code-generator v0.27.15
-	k8s.io/component-base => k8s.io/component-base v0.27.15
-	k8s.io/component-helpers => k8s.io/component-helpers v0.27.15
-	k8s.io/controller-manager => k8s.io/controller-manager v0.27.15
-	k8s.io/cri-api => k8s.io/cri-api v0.27.15
-	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.27.15
-	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.27.15
-	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.27.15
-	k8s.io/kube-proxy => k8s.io/kube-proxy v0.27.15
-	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.27.15
-	k8s.io/kubectl => k8s.io/kubectl v0.27.15
-	k8s.io/kubelet => k8s.io/kubelet v0.27.15
+	k8s.io/api => k8s.io/api v0.27.16
+	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.27.16
+	k8s.io/apimachinery => k8s.io/apimachinery v0.27.16
+	k8s.io/apiserver => k8s.io/apiserver v0.27.16
+	k8s.io/cli-runtime => k8s.io/cli-runtime v0.27.16
+	k8s.io/client-go => k8s.io/client-go v0.27.16
+	k8s.io/cloud-provider => k8s.io/cloud-provider v0.27.16
+	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.27.16
+	k8s.io/code-generator => k8s.io/code-generator v0.27.16
+	k8s.io/component-base => k8s.io/component-base v0.27.16
+	k8s.io/component-helpers => k8s.io/component-helpers v0.27.16
+	k8s.io/controller-manager => k8s.io/controller-manager v0.27.16
+	k8s.io/cri-api => k8s.io/cri-api v0.27.16
+	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.27.16
+	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.27.16
+	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.27.16
+	k8s.io/kube-proxy => k8s.io/kube-proxy v0.27.16
+	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.27.16
+	k8s.io/kubectl => k8s.io/kubectl v0.27.16
+	k8s.io/kubelet => k8s.io/kubelet v0.27.16
 
 	// Need replacements for all the k8s subsidiary projects that are pulled in indirectly because
 	// the kubernets repo pulls them in via a replacement to its own vendored copies, which doesn't work for
 	// transient imports.
-	k8s.io/kubernetes => k8s.io/kubernetes v1.27.15
-	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.27.15
-	k8s.io/metrics => k8s.io/metrics v0.27.15
-	k8s.io/mount-utils => k8s.io/mount-utils v0.27.15
-	k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.27.15
-	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.27.15
+	k8s.io/kubernetes => k8s.io/kubernetes v1.27.16
+	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.27.16
+	k8s.io/metrics => k8s.io/metrics v0.27.16
+	k8s.io/mount-utils => k8s.io/mount-utils v0.27.16
+	k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.27.16
+	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.27.16
 )