go tool's output format changed with Go 1.27; it now shows
command (module)
This updates hack/update-tools.sh to handle the new format.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This ensures that new upstream versions are made visible using
standard Go tools; it also avoids repeated "go install"s of the same
version of the tool.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This ensures that new upstream versions are made visible using
standard Go tools; it also avoids repeated "go install"s of the same
version of the tool.
Since the version of zeitgeist is tracked in hack/tools/go.mod, this
also removes the version tracking in zeitgeist's own
build/dependencies.yaml, and updates the introductory comment there.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This ensures that upstream changes aren't applied without review; it
also avoids repeated "go install"s of the same version of the tool.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
govulncheck complains about publishing-verifier's use of glog:
The package pattern matched the following 2 root packages:
k8s.io/kubernetes/hack/tools/publishing-verifier
k8s.io/kubernetes/hack/tools/traceparse
Govulncheck scanned the following 6 modules and the go1.27.3 standard library:
k8s.io/kubernetes/hack/tools
github.com/golang/glog@v1.2.2
golang.org/x/exp@v0.0.0-20260212183809-81e46e3db34a
golang.org/x/mod@v0.41.0
gopkg.in/yaml.v2@v2.4.0
k8s.io/publishing-bot@v0.5.0
=== Symbol Results ===
Vulnerability #1: GO-2025-3372
Vulnerability when creating log files in github.com/golang/glog
More info: https://pkg.go.dev/vuln/GO-2025-3372
Module: github.com/golang/glog
Found in: github.com/golang/glog@v1.2.2
Fixed in: github.com/golang/glog@v1.2.4
Example traces found:
#1: publishing-verifier/publishing-verifier.go:167:32: publishing.verifyPublishingBotRules calls config.LoadRules, which calls glog.Infof
=== Package Results ===
No other vulnerabilities found.
=== Module Results ===
No other vulnerabilities found.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This allows v1.41.0 to be dropped from the tree entirely. v1.37.0 is
still present because otel references it for backwards-compatibility;
v1.40.0 is still present for etcd.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
%d doesn't dereference pointers, so pointers are logged as such rather
than showing the value they point to. golangci-lint v2.14.0 now flags
this.
Most of these are obvious and safe because the pointer is dereferenced
before the log. flowcontrol/format/formatting.go is slightly more
involved, and formatting_test.go is added to illustrate the problem.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This is now a proper Go module; its dependency on google/btree is thus
apparent in unwanted-dependencies.json.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Two modules replace github.com/container-storage-interface/spec with
github.com/gnufied/spec v1.7.1-0.20260718120346-8e06851c4133, but now
that we use v1.13.0 of the spec, all the changes in the fork are
included. Since the replacement no longer seems necessary or useful,
this removes it.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Now that all supported branches are on Go 1.25+, we can enable the
waitgroupgo hint to encourage the use of waitgroup.Go instead of
waitgroup.Add/waitgrou.Done in new code.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
The setup and teardown functions intended for TestOSFileTypeChecker
suggest that it was intended to use real files where possible, but it
doesn't (or no longer does). This reworks the test function to use a
temporary directory and real files for all appropriate tests (based on
directories and files), and adds scenarios to cover the various code
paths in the checkType().
The resulting coverage includes all the code covered by
TestHostPathTypeCheckerInternal, so the latter can be dropped, which
allows checkType() to be simplified and the whole hostPathTypeChecker
interface and implementations to be dropped. Type checks all end up
comparing strings returned by HostUtils, so the IsDir(), IsFile()
etc. functions are also dropped in favour of direct type comparisons.
Overall hostpath test coverage increases from 65.8% to 68.1%, on fewer
lines of code.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
The package is entirely deprecated, has a single user in k/k, with a
trivial replacement. This drops it and prevents its re-introduction.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
A newer version of staticcheck is available through golangci-lint, and
that is what the project is using. The direct dependency in tools is
unnecessary, this removes that.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
The dependency on semconv v1.17.0 is only used for its definition of
the http.target attribute; since that definition is used for a
workaround, and the attribute has been removed in later versions of
semconv (and is unlikely to come back), we might as well define it
ourselves and avoid the dependency entirely.
Vendored files will be removed once etcd upgrades its semconv
dependency.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This aligns with other uses and allows v1.12.0 to be dropped.
Remaining users of older semconv versions (v1.17.0) use http.target
which is no longer defined after v1.25.0.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
bloop was disabled because of its impact on small benchmarks (see
https://cs.opensource.google/go/x/tools/+/267fc6b81a168aa829f97c9209c2cacb503a56f2
for details), this removes it from the disabled entries.
stringscut was introduced in x/tools 0.40.0 and is disabled for
existing code.
ginkgolinter's Success matcher check doesn't know about TContext, so
it's disabled for k/k.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This eliminates the last two remaining three-step value swaps (t =
a; a = b; b = t instead of a, b = b, a) and enables linting to prevent
new ones being added in future.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This replaces functions that wrap another function with no change with
a direct reference to the wrapped function.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
The golangci-lint docs indicate that, for gocritic, disabled-checks
and enabled-checks can't be combined. That is however not accurate;
enabled-checks adds checks, disabled-checks disables them, in that
order. If disable-all isn't set, then the setup starts with the checks
enabled by default, adds any additional checks specified in
enabled-checks, and removes checks specified in disabled-checks.
This means that instead of filtering unwanted checks, we can disable
them entirely. This makes the set of disabled checks easier to read,
and perhaps easier to clean up in future.
For singleCaseSwitch and wrapperFunc, we only want to ignore specific
instances, so this is still done by filtering.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
mockery has introduced breaking changes and switched to a v3 branch,
this migrates to that, mostly using the built-in migration tool. Mocks
are now generated in single files per package, except in packages
containing mocks for multiple interface packages (in
pkg/kubelet/container/testing).
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This brings a few fixes, drops github.com/pkg/errors (as a direct
dependency), and bumps many transitive dependencies. The
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp bump to
v0.61.0 breaks "k8s.io/kubernetes/test/integration/apiserver: tracing"
consistently, so it's held back for now.
github.com/containerd/containerd/api pulls in gopkg.in/yaml.v3 so that
needs to be added to the exceptions in unwanted-dependencies.json.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This comes up periodically; bumping to v5 introduces issues with
replace operations in JSON patches. k/k relies on non-RFC-compliant
operations which v5 no longer allows.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
kubeadm has replaced pkg/errors with an internal implementation, which
means that pkg/errors can be marked as unwanted (once a final
straggler is replaced).
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Now that all other uses have been removed, this configures depguard to
ensure that new ones aren't added outside kubeadm.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
The package is unmaintained, and the tests don't rely on the
functionality it provides on top of Golang errors (stack traces).
Signed-off-by: Stephen Kitt <skitt@redhat.com>
The package is unmaintained, and kubelet doesn't appear to rely on the
functionality it provides on top of Golang errors (stack traces).
Signed-off-by: Stephen Kitt <skitt@redhat.com>
The package is unmaintained, and kubectl doesn't rely on the
functionality it provides on top of Golang errors (stack traces).
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Check that Elem is non-nil before dereferencing it. Also handle
non-empty names for named non-pointer embedded members.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
All the features of securejoin used in k/k can be replaced by
equivalents in Go 1.24's new os.Root() feature.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
The last dependency pulling in the tips of go-difflib and go-spew has
reverted to the last release of both projects, so k/k can revert to
the releases too. As can be seen from the contents of vendor, this
doesn't result in any actual change in the code.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
CreateOrRetain is supposed to operate on an object name which isn't
necessarily the given object's name (for use in migrations), this
restores that feature.
Replace all uses of deprecated functions with their generic variants.
Providing the context externally isn't useful right now, drop it from
the new functions and use context.Background() where needed.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This uses generics to generalise the various CreateOrUpdate,
CreateOrRetain etc. functions. Where appropriate, the context is added
as an initial argument to the new functions.
ConfigMapMutator isn't used anywhere else, so it's dropped in favour
of the private objectMutator added in this commit.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This release fixes a race in MkdirAll; the latter isn't currently used
in k/k, but it seems safer to upgrade to avoid issues if it starts
being used.
The latest version is 0.3.6 but that only reduces the Go requirements,
which isn't relevant for k/k and adds a couple hundred lines of code.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Given the ongoing work on generifying client-go, it might make sense
for me to be a reviewer (at least to keep better track of changes
being made before they go in).
Signed-off-by: Stephen Kitt <skitt@redhat.com>
"Real" clients use objectWithMeta to enforce support for meta.Object;
strictly speaking, fakes don't need this, but it's best to align them
with the real clients to ensure that fakes don't end up allowing types
that can't be used with the real clients.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This adds a generic implementation of a fake clientset, and uses it to
replace the template code in generated fake clientsets for the default
methods. The templates are preserved as-is (or as close as they can
be) for use in extensions, whether for resources or subresources.
Fake clientsets with no extensions are reduced to their main getter,
their specific struct, and their constructor. All method
implementations are provided by the generic implementation. The
dedicated struct is preserved to allow extensions and expansions to be
defined where necessary.
Instead of handling the variants (with/without list, apply) with a
complex sequence of if statements, build up an index into an array
containing the various declarations.
Similarly, instead of calling different action constructors for
namespaced and non-namespaced clientsets, assume the current behaviour
of non-namespaced action creation (equivalent to creating a namespaced
action with an empty namespace) and document that assumption in the
action implementation.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Using securejoin.SecureJoin() ensures that paths are bound within a
given root, but it doesn't protect from changes happening between the
construction of the path and its use. securejoin 0.3 introduces a new
Linux-specific API which avoids this by making rooted open operations
explicit; this migrates kubelet's log retrieval to use that.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Since we have a Kubernetes-specific fork of go-yaml, use that
consistently throughout the project. This doesn't eliminate the
dependencies on gopkg.in/yaml, which are still used indirectly; but it
ensures that the whole project benefits from fixes or changes to
sigs.k8s.io/yaml.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
The azure and gcp plugins no longer do anything other than point to
the corresponding external credential plugins. Client code should no
longer try to load them, so they should be removed from the examples.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This is a follow-up for commit beb51e1 ("make verify: run checks in
all module hack directories"). Checking only modules known to go ends
up ignoring modules which aren't dependencies, such as
./staging/src/k8s.io/code-generator/examples/hack; but the checks
should be run there too. So this finds modules by looking for go.mod
files.
Use PWD in run-checks to record failing verification scripts instead
of a hidden dependency on an externally-set variable.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
These scripts rely on the system's default go; this changes that using
kube::golang::setup_env so that the appropriate go is used when the
system's isn't sufficient.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
The examples directory has a .gitignore file to ignore go.work.sum;
this isn't reproduced by codegen and fails the diff.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Now that imports aren't automatically added, the client-go generator
produces broken code for extensions since it references a few
functions and types directly without declaring them properly
(klog.Warningf, time.Duration, time.Second).
The generated code also references c.client and c.ns which are no
longer accessible following the generic refactor.
This fixes both issues by adding missing template functions and types,
and going through the appropriate getters.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
The new k8s.io/utils/ptr package provides generic wrapper functions,
which can be used instead of type-specific pointer wrapper functions.
This replaces the latter with the former, and migrates other uses of
the deprecated pointer package to ptr in affacted files.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This adds the expected verb name to the template map, and uses that in
the template instead of replacing the verb name in the template before
processing.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
These are long gone, removed in 2016:
* AuthPath removal: https://github.com/kubernetes/kubernetes/pull/29216
* Flag removal: https://github.com/kubernetes/kubernetes/pull/40048
This removes the remnants from clientcmd, mostly in the comments
describing how the configuration is loaded.
Since getServerIdentificationPartialConfig can no longer fail (it
copies fields from one struct to another), this drops the error
return, along with the error handling in the caller.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
With embedded structs, objects can end up with conflicting members.
These aren't ambiguous in Go, but applyconfiguration-gen's generated
functions ignore this possibility and produce ambiguous member
accesses and duplicate methods.
This resolves the problem by qualifying embedded member accesses with
their types when appropriate, and by memoizing generated function
names to avoid duplicates. When conflicting members are encountered,
functions are generated for the first one; this is assumed to produce
correct results.
For applyconfiguration-gen, a more correct approach would be to only
generate With... and Get... functions for the specific members the
generator is interested in; but that would be a breaking change for
any client code relying on the other With... functions.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
mockery is set up to generate headers in all the mocks it produces, so
the separate header generation in update-mocks.sh is no longer useful
(and leads to duplicate headers in three cases). This removes the
relevant parts of the shell script.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Instead of hard-coding gentype in the templates, use template function
declarations; this ensures that the package is correctly imported.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Stephen Kitt