fix: bump Go version to 1.26 by behzad-mir · Pull Request #4370 · Azure/azure-container-networking

behzad-mir · 2026-04-21T22:47:36Z

Summary

Upgrade Go toolchain from 1.24 to 1.26 across all build configurations. Go 1.26 enforces FIPS-compliant system crypto for Microsoft compliance.

Note: This PR targets the behzadm/fips-base-image-migration branch (#4369) which must merge first.

Changes

Source of truth

build/images.mk: GO_IMG → 1.26-azurelinux3.0
go.mod: go 1.24.1 → go 1.26

Manual (non-template) files

.pipelines/build/scripts/install-go.sh: DEFAULT_IMAGE updated to Go 1.26 azurelinux3.0 SHA
bpf-prog/ipv6-hp-bpf/linux.Dockerfile: updated to Go 1.26 MCR SHA
npm/linux.Dockerfile, npm/windows.Dockerfile: 1.25.5 → 1.26
.devcontainer/Dockerfile: VARIANT 1.24 → 1.26

Auto-regenerated via `make dockerfiles`

All template Dockerfiles updated with new Go 1.26 SHA.

SHAs

azurelinux3.0: sha256:eb3ce814e96f3319f1b5985021021682b47975f6decfe00eaac84abff0ae25c9
MCR golang:1.26: sha256:6c27ae470941ef215b3eea86fcd6632a7ab975f391e5a75f546d3a76fd686705

Testing

docker run --rm mcr.microsoft.com/oss/go/microsoft/golang@sha256:eb3ce814... go version confirms Go 1.26
Pipeline passes — check "Install msft-go" logs for correct SHA
ARM and AMD builds succeed
Signed binary pipeline uses correct Go version

Resolves #4365
Depends on #4369

jpayne3506

need to run go mod tidy and update workflows as well.

Once all image changes are complete we should use /azp run to run NPM + CNI Release Test pipelines

jpayne3506 · 2026-04-23T21:31:10Z

 FILE_EXT=''

 export CGO_ENABLED=0
+export GOEXPERIMENT=systemcrypto


wrong goexperiment for CGO = 0

This is actually correct for Go 1.26 with the MS Go fork. Unlike the old boringcrypto experiment (which required CGO), systemcrypto uses dlopen at runtime to load system crypto libraries — it works with CGO_ENABLED=0.

From the MS Go FIPS User Guide:

Go 1.26 introduces GOEXPERIMENT=systemcrypto which dynamically loads system crypto libraries via dlopen. This does not require CGO at build time.

The tradeoff is that the runtime image must have crypto libs available (hence the distroless/base migration in PR #4369 — base includes libcrypto vs minimal/scratch which do not).

Also ran go mod tidy and bumped tools.go.mod to 1.26 as requested. All CI workflows already use go-version-file: go.mod so they will automatically pick up the new version.

This has been corrected. cilium-log-collector is the only component that retains GOEXPERIMENT=systemcrypto because it builds with CGO_ENABLED=1 and -buildmode=c-shared. It produces a .so shared library(out_azure_app_insights.so) that Fluent Bit loads as a plugin at runtime. The C-shared build mode inherently requires CGO, so the systemcrypto experiment works as intended here — thebinary will dlopen the system's FIPS-validated crypto library.

behzad-mir · 2026-04-30T21:56:28Z

Addressed review feedback:

✅ Ran go mod tidy on both go.mod and tools.go.mod — no changes to go.mod/go.sum (already clean), but tools.go.mod dependencies updated
✅ Bumped tools.go.mod from go 1.24.1 → go 1.26
✅ Verified all CI workflows use go-version-file: go.mod — no hardcoded Go versions to update
✅ Replied to inline comment about GOEXPERIMENT=systemcrypto + CGO_ENABLED=0 (this is correct per MS Go 1.26 dlopen approach)

Ready for /azp run once PR #4369 (base image migration) is merged first (this PR depends on it).

jpayne3506 · 2026-05-11T23:21:45Z

 	sigs.k8s.io/controller-tools/cmd/controller-gen
 )

+require (


Looks like go 1.26 has a hidden change to go mod tidy, TLDR stricter checks/validation on require( ) directive in conjunction with module github.com/Azure/azure-container-networking .

Original intent for tools.go.mod was to move tool usage out of our root go.mod to help with dependency maintenance and module downloads. Keeping it at the root level was to ensure there was visibility on it.... Went back and forth on how to move forward.. Only good solution to this to ensure that we don't bring in other dependencies that the repo is dependent on is to move this into its own directory... I think /tools-go is a good name, but will go with what you think is best.

336e6a5

Here is a commit that covers the change(s)

Moved tools.go.mod → tools-go/go.mod with a distinct module path. This solves the Go 1.26 go mod tidy issue because the tools module is now a separate module

jpayne3506 · 2026-05-11T23:23:03Z

 module github.com/Azure/azure-container-networking

-go 1.24.1
+go 1.26


we should specify patch version .1 otherwise it defaults to .0.

.0 should be seen as a pre-release version with .1 being the first true stable version for a minor.

updated go.mod from go 1.26 to go 1.26.1

github-actions · 2026-05-26T00:20:41Z

This pull request is stale because it has been open for 2 weeks with no activity. Remove stale label or comment or this will be closed in 7 days

Upgrade Go toolchain from 1.24 to 1.26 across all build configurations. Go 1.26 enforces FIPS-compliant system crypto for Microsoft compliance. Changes: - build/images.mk: GO_IMG 1.24 → 1.26-azurelinux3.0 - go.mod: go 1.24.1 → go 1.26 - install-go.sh: DEFAULT_IMAGE updated to Go 1.26 azurelinux3.0 SHA - bpf-prog/ipv6-hp-bpf/linux.Dockerfile: updated to Go 1.26 MCR SHA - npm/linux.Dockerfile, npm/windows.Dockerfile: 1.25.5 → 1.26 - .devcontainer/Dockerfile: VARIANT 1.24 → 1.26 - Regenerated all template Dockerfiles via make dockerfiles SHAs: - azurelinux3.0: sha256:eb3ce814e96f3319f1b5985021021682b47975f6decfe00eaac84abff0ae25c9 - MCR golang:1.26: sha256:6c27ae470941ef215b3eea86fcd6632a7ab975f391e5a75f546d3a76fd686705 Resolves #4365 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Update tools.go.mod Go directive from 1.24.1 to 1.26 - Run go mod tidy on both go.mod and tools.go.mod - All CI workflows use go-version-file: go.mod (no hardcoded versions) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…to 1.26.1 - Move tools.go.mod to tools-go/go.mod with own module path - Update all Makefile and script references to tools-go/go.mod - Remove GOEXPERIMENT=systemcrypto from CGO_ENABLED=0 scripts and Dockerfiles - Bump go directive from 1.26 to 1.26.1 per reviewer feedback - Run go mod tidy on both root and tools-go modules Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Upgrades the repository’s Go toolchain and build images to Go 1.26 (go directive 1.26.1) to align with the FIPS/system-crypto requirements, and updates repo tooling to use the new tools-go/ modfile layout.

Changes:

Bumped root Go version to 1.26.1 and updated toolchain module (tools-go/) accordingly.
Updated builder Dockerfiles and pipeline Go-install logic to use Go 1.26 image references/digests.
Enabled GOEXPERIMENT=systemcrypto for cilium-log-collector build paths.

Reviewed changes

Copilot reviewed 26 out of 28 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tools-go/go.sum	Adds the dependency checksum set for the dedicated tools module.
tools-go/go.mod	Converts tooling into a dedicated `tools-go` module, updates Go version, refreshes tool deps.
scripts/install-protoc.sh	Switches `-modfile` usage to `tools-go/go.mod` for installing protoc plugins.
platform/Makefile	Points `mockgen` invocation at `tools-go/go.mod`.
npm/windows.Dockerfile	Bumps Go builder image to 1.26 for Windows NPM build.
npm/pkg/dataplane/Makefile	Points `mockgen` invocation at `tools-go/go.mod`.
npm/linux.Dockerfile	Bumps Go builder image to 1.26 for Linux NPM build.
Makefile	Updates the canonical tools modfile path to `tools-go/go.mod`.
go.mod	Updates root module Go version to 1.26.1.
crd/overlayextensionconfig/Makefile	Points `controller-gen` invocation at `tools-go/go.mod`.
crd/nodenetworkconfig/Makefile	Points `controller-gen` invocation at `tools-go/go.mod`.
crd/multitenantnetworkcontainer/Makefile	Points `controller-gen` invocation at `tools-go/go.mod`.
crd/multitenancy/Makefile	Points `controller-gen` invocation at `tools-go/go.mod`.
crd/clustersubnetstate/Makefile	Points `controller-gen` invocation at `tools-go/go.mod`.
cns/multitenantcontroller/mockclients/Makefile	Points `mockgen` invocation at `tools-go/go.mod`.
cns/Dockerfile	Updates Go builder stage to 1.26 azurelinux3.0 digest.
cni/Dockerfile	Updates Go builder stage to 1.26 azurelinux3.0 digest.
cilium-log-collector/Dockerfile.tmpl	Adds `GOEXPERIMENT=systemcrypto` to the Go build stage template.
cilium-log-collector/Dockerfile	Regenerated Dockerfile to Go 1.26 digest + `GOEXPERIMENT=systemcrypto`.
build/images.mk	Bumps `GO_IMG` source tag to `1.26-azurelinux3.0`.
bpf-prog/ipv6-hp-bpf/linux.Dockerfile	Updates Go builder stage to 1.26 digest for the BPF build.
azure-iptables-monitor/Dockerfile	Updates Go builder stage to 1.26 azurelinux3.0 digest.
azure-ipam/Dockerfile	Updates Go builder stage to 1.26 azurelinux3.0 digest.
azure-ip-masq-merger/Dockerfile	Updates Go builder stage to 1.26 azurelinux3.0 digest.
.pipelines/build/scripts/install-go.sh	Updates fallback msft-go image digest to 1.26 azurelinux3.0.
.pipelines/build/scripts/cilium-log-collector.sh	Exports `GOEXPERIMENT=systemcrypto` for the cilium-log-collector pipeline build.
.devcontainer/Dockerfile	Bumps devcontainer Go variant to 1.26.

Go 1.26 enables systemcrypto by default, which requires CGO on Linux (uses dlopen for OpenSSL). Since all ACN components except cilium-log-collector build with CGO_ENABLED=0, they need the experimental ms_nocgo_opensslcrypto backend that calls OpenSSL without requiring cgo. - Pipeline scripts: export GOEXPERIMENT=ms_nocgo_opensslcrypto (Linux only) - Dockerfile templates: ENV GOEXPERIMENT=ms_nocgo_opensslcrypto - Makefile: ACN_GOEXPERIMENT variable for binary build targets - cilium-log-collector: explicitly uses CGO_ENABLED=1 + systemcrypto Reference: https://github.com/microsoft/go/blob/microsoft/main/eng/doc/fips/README.md#usage-common-configurations Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Address Copilot review comments: - install-go.sh: update skopeo hint comment from 1.24 to 1.26 and refresh the DEFAULT_IMAGE digest to the latest 1.26-azurelinux3.0 - npm/linux.Dockerfile: pin builder image to sha256 digest - npm/windows.Dockerfile: pin builder image to sha256 digest Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 42 out of 44 changed files in this pull request and generated 16 comments.

+# Go 1.26 on Linux: systemcrypto (default) requires CGO; use nocgo OpenSSL backend for CGO_ENABLED=0 builds
+# Only applied to binary build targets, not tooling (renderkit, mockgen, etc.)
+ifneq ($(GOOS),windows)
+ACN_GOEXPERIMENT := ms_nocgo_opensslcrypto
+endif


+ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-container-networking
 COPY . .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-cns -ldflags "-s -w -X main.version="$VERSION" -X "$CNS_AI_PATH"="$CNS_AI_ID"" -gcflags="-dwarflocationlists=true" cns/service/*.go


+ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-container-networking
 COPY . .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-vnet -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" cni/network/plugin/main.go


+ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 RUN go mod download github.com/azure/azure-container-networking/dropgz@$DROPGZ_VERSION
 WORKDIR /go/pkg/mod/github.com/azure/azure-container-networking/dropgz\@$DROPGZ_VERSION
 COPY --from=compressor /payload/* pkg/embed/fs/


+ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-ipam
 COPY ./azure-ipam .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-ipam -trimpath -ldflags "-s -w -X main.version="$VERSION" -X github.com/Azure/azure-container-networking/azure-ipam/internal/buildinfo.Version="$VERSION"" -gcflags="-dwarflocationlists=true" .


 ARG CNI_AI_ID
+ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-container-networking
 COPY . .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-vnet -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" cni/network/plugin/main.go


+ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 RUN go mod download github.com/azure/azure-container-networking/dropgz@$DROPGZ_VERSION
 WORKDIR /go/pkg/mod/github.com/azure/azure-container-networking/dropgz\@$DROPGZ_VERSION
 COPY --from=compressor /payload/* pkg/embed/fs/


 ARG OS
 ARG VERSION
+ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-ipam
 COPY ./azure-ipam .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/azure-ipam -trimpath -ldflags "-s -w -X main.version="$VERSION" -X github.com/Azure/azure-container-networking/azure-ipam/internal/buildinfo.Version="$VERSION"" -gcflags="-dwarflocationlists=true" .


+ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 RUN go mod download github.com/azure/azure-container-networking/dropgz@$DROPGZ_VERSION
 WORKDIR /go/pkg/mod/github.com/azure/azure-container-networking/dropgz\@$DROPGZ_VERSION
 COPY --from=compressor /payload/* pkg/embed/fs/


 ARG OS
 ARG VERSION
+ENV GOEXPERIMENT=ms_nocgo_opensslcrypto
 WORKDIR /azure-ip-masq-merger
 COPY ./azure-ip-masq-merger .
 RUN GOOS=$OS CGO_ENABLED=0 go build -a -o /go/bin/ip-masq-merger -trimpath -ldflags "-s -w -X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" .


Copilot

Pull request overview

Copilot reviewed 42 out of 44 changed files in this pull request and generated 16 comments.

Comments suppressed due to low confidence (1)

tools-go/go.mod:6

This comment suggests using -modfile=tools-go/go.mod, but tools-go is now a separate module in a subdirectory. If tooling is meant to be invoked from that module, the more reliable pattern is go -C tools-go … (or cd tools-go) rather than -modfile from the repo root. Otherwise, readers may follow this and hit -modfile path restrictions.

 REPO_ROOT = $(shell git rev-parse --show-toplevel)
-MOCKGEN = go tool -modfile=$(REPO_ROOT)/tools.go.mod mockgen
+MOCKGEN = go tool -modfile=$(REPO_ROOT)/tools-go/go.mod mockgen


 REPO_ROOT = $(shell git rev-parse --show-toplevel)
-MOCKGEN = go tool -modfile=$(REPO_ROOT)/tools.go.mod mockgen
+MOCKGEN = go tool -modfile=$(REPO_ROOT)/tools-go/go.mod mockgen


 REPO_ROOT = $(shell git rev-parse --show-toplevel)
-MOCKGEN = go tool -modfile=$(REPO_ROOT)/tools.go.mod mockgen
+MOCKGEN = go tool -modfile=$(REPO_ROOT)/tools-go/go.mod mockgen


 REPO_ROOT = $(shell git rev-parse --show-toplevel)
-CONTROLLER_GEN = go tool -modfile=$(REPO_ROOT)/tools.go.mod controller-gen
+CONTROLLER_GEN = go tool -modfile=$(REPO_ROOT)/tools-go/go.mod controller-gen


 REPO_ROOT = $(shell git rev-parse --show-toplevel)
-CONTROLLER_GEN = go tool -modfile=$(REPO_ROOT)/tools.go.mod controller-gen
+CONTROLLER_GEN = go tool -modfile=$(REPO_ROOT)/tools-go/go.mod controller-gen


 export CGO_ENABLED=0
+# Go 1.26 Linux-only: use nocgo OpenSSL backend (systemcrypto default requires CGO)
+export GOEXPERIMENT=ms_nocgo_opensslcrypto



 # To update the fallback, run:
-#   skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.24-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
-DEFAULT_IMAGE="mcr.microsoft.com/oss/go/microsoft/golang@sha256:3999f970bb52b7413ef9be2803173d4fd7f1f3c59362a98a0c78d155e3a0e59f"
+#   skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
+DEFAULT_IMAGE="mcr.microsoft.com/oss/go/microsoft/golang@sha256:5f95bf70f4c437de4a6ba1f72ef1532f69fca392c131fff2172993cabbea359c"


 # install protoc-gen-go
 if [ ! -f ${GOPATH}/bin/protoc-gen-go ]; then
 	echo "Installing protoc-gen-go"
-	go install -modfile=${REPO_ROOT}/tools.go.mod github.com/golang/protobuf/protoc-gen-go
+	go install -modfile=${REPO_ROOT}/tools-go/go.mod github.com/golang/protobuf/protoc-gen-go
 else


 # install protoc-gen-go-grpc
 if [ ! -f ${GOPATH}/bin/protoc-gen-go-grpc ]; then
 	echo "Installing protoc-gen-go-grpc"
-	go install -modfile=${REPO_ROOT}/tools.go.mod google.golang.org/grpc/cmd/protoc-gen-go-grpc
+	go install -modfile=${REPO_ROOT}/tools-go/go.mod google.golang.org/grpc/cmd/protoc-gen-go-grpc
 else


 module github.com/Azure/azure-container-networking

-go 1.24.1
+go 1.26.1


behzad-mir force-pushed the behzadm/go-1.26-bump branch from 2b164ef to 53ec62e Compare April 21, 2026 22:56

jpayne3506 requested changes Apr 23, 2026

View reviewed changes

behzad-mir force-pushed the behzadm/fips-base-image-migration branch from d5e33a7 to f10c036 Compare April 30, 2026 21:47

behzad-mir requested a review from jpayne3506 May 4, 2026 21:38

jpayne3506 reviewed May 11, 2026

View reviewed changes

github-actions Bot added the stale Stale due to inactivity. label May 26, 2026

Base automatically changed from behzadm/fips-base-image-migration to master May 28, 2026 19:36

github-actions Bot removed the stale Stale due to inactivity. label May 29, 2026

behzad-mir and others added 3 commits June 2, 2026 20:24

behzad-mir force-pushed the behzadm/go-1.26-bump branch from 8887f75 to ebfba40 Compare June 2, 2026 22:07

behzad-mir marked this pull request as ready for review June 2, 2026 22:07

Copilot AI review requested due to automatic review settings June 2, 2026 22:07

behzad-mir requested review from a team, QxBytes, camrynl and santhoshmprabhu as code owners June 2, 2026 22:07

behzad-mir requested a review from rayaisaiah June 2, 2026 22:07

Copilot started reviewing on behalf of behzad-mir June 2, 2026 22:07 View session

Copilot AI reviewed Jun 2, 2026

View reviewed changes

Comment thread .pipelines/build/scripts/install-go.sh Outdated

Comment thread scripts/install-protoc.sh

Comment thread npm/linux.Dockerfile Outdated

Comment thread npm/windows.Dockerfile Outdated

behzad-mir requested a review from jpayne3506 June 3, 2026 19:03

behzad-mir and others added 2 commits June 3, 2026 21:08

behzad-mir requested a review from Copilot June 3, 2026 21:14

Copilot started reviewing on behalf of behzad-mir June 3, 2026 21:14 View session

Copilot AI reviewed Jun 3, 2026

View reviewed changes

behzad-mir requested a review from Copilot June 3, 2026 21:42

Copilot started reviewing on behalf of behzad-mir June 3, 2026 21:42 View session

Copilot AI reviewed Jun 3, 2026

View reviewed changes

Conversation

behzad-mir commented Apr 21, 2026

Summary

Changes

Source of truth

Manual (non-template) files

Auto-regenerated via make dockerfiles

SHAs

Testing

Uh oh!

jpayne3506 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

behzad-mir commented Apr 30, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Auto-regenerated via `make dockerfiles`