[do not merge] test custom go-build changes

.semaphore/semaphore-scheduled-builds.yml

@@ -675,6 +675,7 @@ blocks:
             - export UPPER_CONSTRAINTS_FILE=https://releases.openstack.org/constraints/upper/yoga
             - export NC_PLUGIN_REPO=$(dirname $(pwd))
             - export NC_PLUGIN_REF=$(git rev-parse --abbrev-ref HEAD)
+            - sudo git config --system --add safe.directory ${NC_PLUGIN_REPO}/.git
             - TEMPEST=true DEVSTACK_BRANCH=unmaintained/yoga ./devstack/bootstrap.sh
       epilogue:
         on_fail:

.semaphore/semaphore.yml

@@ -675,6 +675,7 @@ blocks:
             - export UPPER_CONSTRAINTS_FILE=https://releases.openstack.org/constraints/upper/yoga
             - export NC_PLUGIN_REPO=$(dirname $(pwd))
             - export NC_PLUGIN_REF=$(git rev-parse --abbrev-ref HEAD)
+            - sudo git config --system --add safe.directory ${NC_PLUGIN_REPO}/.git
             - TEMPEST=true DEVSTACK_BRANCH=unmaintained/yoga ./devstack/bootstrap.sh
       epilogue:
         on_fail:

.semaphore/semaphore.yml.tpl

@@ -673,6 +673,7 @@ blocks:
             - export UPPER_CONSTRAINTS_FILE=https://releases.openstack.org/constraints/upper/yoga
             - export NC_PLUGIN_REPO=$(dirname $(pwd))
             - export NC_PLUGIN_REF=$(git rev-parse --abbrev-ref HEAD)
+            - sudo git config --system --add safe.directory ${NC_PLUGIN_REPO}/.git
             - TEMPEST=true DEVSTACK_BRANCH=unmaintained/yoga ./devstack/bootstrap.sh
       epilogue:
         on_fail:

api/go.mod

@@ -1,13 +1,13 @@
 module github.com/projectcalico/api
 
-go 1.21
+go 1.22
 
 require (
 	github.com/onsi/ginkgo v1.16.5
 	github.com/onsi/gomega v1.27.10
-	k8s.io/api v0.27.15
-	k8s.io/apimachinery v0.27.15
-	k8s.io/client-go v0.27.15
+	k8s.io/api v0.27.16
+	k8s.io/apimachinery v0.27.16
+	k8s.io/client-go v0.27.16
 	k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f
 )
 
@@ -55,30 +55,30 @@ require (
 )
 
 replace (
-	k8s.io/api => k8s.io/api v0.27.15
-	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.27.15
-	k8s.io/apimachinery => k8s.io/apimachinery v0.27.15
-	k8s.io/apiserver => k8s.io/apiserver v0.27.15
-	k8s.io/cli-runtime => k8s.io/cli-runtime v0.27.15
-	k8s.io/client-go => k8s.io/client-go v0.27.15
-	k8s.io/cloud-provider => k8s.io/cloud-provider v0.27.15
-	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.27.15
-	k8s.io/code-generator => k8s.io/code-generator v0.27.15
-	k8s.io/component-base => k8s.io/component-base v0.27.15
-	k8s.io/component-helpers => k8s.io/component-helpers v0.27.15
-	k8s.io/controller-manager => k8s.io/controller-manager v0.27.15
-	k8s.io/cri-api => k8s.io/cri-api v0.27.15
-	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.27.15
-	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.27.15
-	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.27.15
+	k8s.io/api => k8s.io/api v0.27.16
+	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.27.16
+	k8s.io/apimachinery => k8s.io/apimachinery v0.27.16
+	k8s.io/apiserver => k8s.io/apiserver v0.27.16
+	k8s.io/cli-runtime => k8s.io/cli-runtime v0.27.16
+	k8s.io/client-go => k8s.io/client-go v0.27.16
+	k8s.io/cloud-provider => k8s.io/cloud-provider v0.27.16
+	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.27.16
+	k8s.io/code-generator => k8s.io/code-generator v0.27.16
+	k8s.io/component-base => k8s.io/component-base v0.27.16
+	k8s.io/component-helpers => k8s.io/component-helpers v0.27.16
+	k8s.io/controller-manager => k8s.io/controller-manager v0.27.16
+	k8s.io/cri-api => k8s.io/cri-api v0.27.16
+	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.27.16
+	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.27.16
+	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.27.16
 	k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20230303024457-afdc3dddf62d
-	k8s.io/kube-proxy => k8s.io/kube-proxy v0.27.15
-	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.27.15
-	k8s.io/kubectl => k8s.io/kubectl v0.27.15
-	k8s.io/kubelet => k8s.io/kubelet v0.27.15
-	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.27.15
-	k8s.io/metrics => k8s.io/metrics v0.27.15
-	k8s.io/mount-utils => k8s.io/mount-utils v0.27.15
-	k8s.io/node-api => k8s.io/node-api v0.27.15
-	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.27.15
+	k8s.io/kube-proxy => k8s.io/kube-proxy v0.27.16
+	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.27.16
+	k8s.io/kubectl => k8s.io/kubectl v0.27.16
+	k8s.io/kubelet => k8s.io/kubelet v0.27.16
+	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.27.16
+	k8s.io/metrics => k8s.io/metrics v0.27.16
+	k8s.io/mount-utils => k8s.io/mount-utils v0.27.16
+	k8s.io/node-api => k8s.io/node-api v0.27.16
+	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.27.16
 )

api/go.sum

@@ -233,12 +233,12 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-k8s.io/api v0.27.15 h1:+bR5ju3H+OjePA1DMEmHm33EzhtmqWBuQvqhTVYFXD0=
-k8s.io/api v0.27.15/go.mod h1:x/uHpsq4NAAGMiHWhq3P5W1ABiw4/aUWpIeGq1XmegY=
-k8s.io/apimachinery v0.27.15 h1:wT8HeVe/KNcX+QavW97ZpKiGxSN5glW39Dxvj/8wMPU=
-k8s.io/apimachinery v0.27.15/go.mod h1:TWo+8wOIz3CytsrlI9k/LBWXLRr9dqf5hRSCbbggMAg=
-k8s.io/client-go v0.27.15 h1:SDUs0ap/VuHPyoRiEChUhXQlh25UZAeXcm82J3TYy2w=
-k8s.io/client-go v0.27.15/go.mod h1:/ULqZ7zjeuEm/fSf7A5kKmbWb2GY/CnCiquS5XzAdzo=
+k8s.io/api v0.27.16 h1:70IBoTuiPfd+Tm68WH0tGXQRSQq0R1xnbyhTRe8WYQY=
+k8s.io/api v0.27.16/go.mod h1:5j0Cgo6X4qovBOu3OjzRwETDEYqMxq2qafhDQXOPy3A=
+k8s.io/apimachinery v0.27.16 h1:Nmbei3P/6w6vxbNxV8/sDCZz+TQrJ9A4+bVIRjDufuM=
+k8s.io/apimachinery v0.27.16/go.mod h1:TWo+8wOIz3CytsrlI9k/LBWXLRr9dqf5hRSCbbggMAg=
+k8s.io/client-go v0.27.16 h1:x06Jk6/SIQQ6kAsWs5uzQIkBLHtcAQlbTAgmj1tZzG0=
+k8s.io/client-go v0.27.16/go.mod h1:bPZUNRj8XsHa+JVS5jU6qeU2H/Za8+7riWA08FUjaA8=
 k8s.io/klog/v2 v2.90.1 h1:m4bYOKall2MmOiRaR1J+We67Do7vm9KiQVlT96lnHUw=
 k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/kube-openapi v0.0.0-20230303024457-afdc3dddf62d h1:VcFq5n7wCJB2FQMCIHfC+f+jNcGgNMar1uKd6rVlifU=

felix/Makefile

@@ -258,10 +258,10 @@ FELIX_IMAGE_ID=$(shell docker images -q $(FELIX_IMAGE_WITH_TAG))
 $(FELIX_IMAGE)-$(ARCH): $(FELIX_CONTAINER_CREATED)
 $(FELIX_CONTAINER_CREATED): docker-image/calico-felix-wrapper \
                             docker-image/felix.cfg \
-                            docker-image/Dockerfile* \
+                            docker-image/Dockerfile \
                             $(shell test "$(FELIX_IMAGE_ID)" || echo force-rebuild)
 	$(MAKE) register
-	$(DOCKER_BUILD) -t $(FELIX_IMAGE_WITH_TAG) --file ./docker-image/Dockerfile.$(ARCH) docker-image --load;
+	$(DOCKER_BUILD) -t $(FELIX_IMAGE_WITH_TAG) -f ./docker-image/Dockerfile docker-image
 	$(MAKE) retag-build-images-with-registries VALIDARCHES=$(ARCH) IMAGETAG=latest
 	touch $(FELIX_CONTAINER_CREATED)
 

felix/bpf-apache/Makefile

@@ -32,8 +32,8 @@ CFLAGS +=  \
 TRIPLET := $(shell gcc -dumpmachine)
 CFLAGS += -I/usr/include/$(TRIPLET)
 
-CC := clang-15
-LD := llc-15
+CC := clang
+LD := llc
 
 C_FILES:=filter.c redir.c sockops.c
 OBJS:=$(addprefix bin/,$(C_FILES:.c=.o))

felix/bpf-gpl/Makefile

@@ -48,8 +48,8 @@ ifeq ($(ARCH),amd64)
 else ifeq ($(ARCH),arm64)
 	CFLAGS += -D__TARGET_ARCH_arm64
 endif
-CC := clang-15
-LD := llc-15
+CC := clang
+LD := llc
 
 UT_C_FILES:=$(shell find ut -name '*.c')
 UT_OBJS:=$(UT_C_FILES:.c=.o) $(shell ./list-ut-objs)

felix/docker-image/Dockerfile.amd64 → felix/docker-image/Dockerfile

@@ -17,16 +17,18 @@
 # This ensures that testing of Felix in this repository is done in the same
 # userspace environment as it will be deployed in calico/node.
 
-FROM ubuntu:focal AS wgtool
+ARG QEMU_IMAGE
 
-RUN apt-get update && \
-    apt-get install --no-install-recommends wireguard-tools -y
+FROM ${QEMU_IMAGE} AS qemu
 
 FROM calico/bpftool:v7.4.0 AS bpftool
 
-FROM debian:10-slim
+FROM debian:11-slim as source
+
 LABEL maintainer="Shaun Crampton <shaun@tigera.io>"
 
+COPY --from=qemu /usr/bin/qemu-*-static /usr/bin
+
 # Install remaining runtime deps required for felix from the global repository
 RUN apt-get update && apt-get install -y \
     ipset \
@@ -50,20 +52,33 @@ RUN apt-get update && apt-get install -y \
     # Felix FV tests require these
     wget \
     ethtool \
-    tcpdump \
-    hping3
+    hping3 \
+    libpcap0.8 \
+    tcpdump
 
-# Copy in wg tool from stage 1.
-COPY --from=wgtool /usr/bin/wg /usr/bin/wg
+RUN apt-get install --no-install-recommends -y wireguard-tools
+
+RUN apt-get clean
 
 # Default to the xtables backend of iptables.
 RUN update-alternatives --set iptables /usr/sbin/iptables-legacy
 RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
 
-ADD felix.cfg /etc/calico/felix.cfg
-ADD calico-felix-wrapper /usr/bin
+# Felix is built with RHEL/UBI and links against libpcap.so.1. We need this symbolic link
+# until Debian changes the soname from .0.8 to .1.
+RUN ln -s $(readlink /usr/lib/*-linux-gnu/libpcap.so.0.8) $(ldconfig -v 2>/dev/null | grep /usr/lib/ | head -n 1 | sed -e 's/://')/libpcap.so.1
+
+COPY felix.cfg /etc/calico/felix.cfg
+COPY calico-felix-wrapper /usr/bin
 
 COPY --from=bpftool /bpftool /usr/bin
+
+RUN rm -f /usr/bin/qemu-*-static
+
+FROM scratch
+
+COPY --from=source / /
+
 WORKDIR /code
 
 # Run felix (via the wrapper script) by default