Chore: bump k8s deps to v0.35.6 and controller-runtime to v0.23.3 by anishbista60 · Pull Request #241 · kubevela/workflow

anishbista60 · 2026-07-22T12:21:50Z

Same as title

Summary by cubic

Upgrade Kubernetes deps to v0.35.6 and sigs.k8s.io/controller-runtime to v0.23.3, move builds/CI to Go 1.25.12, migrate to github.com/crossplane/crossplane-runtime/v2, update the conversion webhook, align tests to Kubernetes v1.35, and fix TLS tests by switching to SHA256 certs and deconflicting test ports.

Dependencies
- k8s.io/api, k8s.io/apimachinery, k8s.io/client-go, k8s.io/apiextensions-apiserver, k8s.io/apiserver, k8s.io/component-base -> v0.35.6.
- sigs.k8s.io/controller-runtime -> v0.23.3.
- github.com/crossplane/crossplane-runtime/v2 -> v2.3.3 (imports updated; tests use pkg/test from v2).
- Go -> 1.25.12; Dockerfiles and CI workflows updated.
- golangci-lint -> v2.12.2; action -> v8; .golangci.yml migrated to v2 (SA1019 excluded). staticcheck -> v0.7.0.
- E2E/envtest Kubernetes -> v1.35 (k3d, webhook validation, and envtest assets).
- Replace directives refreshed (incl. github.com/kubevela/pkg); updated github.com/oam-dev/cluster-gateway replace and dropped the indirect apiserver-runtime replace.
Migration
- Conversion webhook now registers via conversion.NewWebhookHandler(scheme, conversion.NewRegistry()). If you maintain custom conversions, migrate to the conversion.Registry pattern.

^{Written for commit e7e13c2. Summary will update on new commits.}

cubic-dev-ai

All reported issues were addressed across 3 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

anishbista60 · 2026-07-23T12:20:06Z

Also bumped golangci-lint to v2.12.2 in this PR (migrated .golangci.yml to the v2 schema, bumped golangci-lint-action to v8, aligned the Dockerfile Go image to 1.25.12). make lint passes clean; a handful of pre-existing findings newly surfaced by v2's stricter defaults are suppressed with TODOs to fix in a follow-up.

One note on 4f137ec: the controller-runtime v0.23 bump broke compilation of crossplane-runtime's pkg/test.MockClient — it doesn't implement the newer client.Client interface (missing Apply), and no released crossplane-runtime version fixes this. I added a small local pkg/mock.Client test double (Get/Create/Update/Patch, mirroring the same function-field pattern) as a stopgap so the 9 affected test files compile again.

This is a pragmatic fix, not the most idiomatic long-term one: it embeds a nil client.Client for forward-compat, so calling an unmocked method (List, Delete, Status(), etc.) would nil-pointer panic rather than fail clearly. The better long-term fix is migrating these tests to controller-runtime's own sigs.k8s.io/controller-runtime/pkg/client/fake builder, which maintains real object state and won't rot again as the interface grows. Didn't do that here since these tests use unstructured.Unstructured objects requiring scheme/GVK registration — a bigger rewrite than fits a version-bump PR. Planning that as a follow-up.

codecov · 2026-07-23T12:27:10Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 24.52%. Comparing base (d7db9c4) to head (e7e13c2).
⚠️ Report is 19 commits behind head on main.

❗ There is a different number of reports uploaded between BASE (d7db9c4) and HEAD (e7e13c2). Click for more details.

HEAD has 1 upload less than BASE

Flag BASE (d7db9c4) HEAD (e7e13c2)

unit-test 1 0

Additional details and impacted files

@@             Coverage Diff             @@
##             main     #241       +/-   ##
===========================================
- Coverage   62.49%   24.52%   -37.97%     
===========================================
  Files          62       64        +2     
  Lines        4415     5227      +812     
===========================================
- Hits         2759     1282     -1477     
- Misses       1324     3713     +2389     
+ Partials      332      232      -100

Flag	Coverage Δ
e2etests	`24.52% <100.00%> (?)`
unit-test	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

cubic-dev-ai

3 issues found across 20 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="makefiles/dependency.mk">

<violation number="1" location="makefiles/dependency.mk:46">
P3: `make staticcheck` still uses any existing PATH binary, so developers with an older Staticcheck do not receive v0.7.0. Version-check the discovered binary and install the pinned release when it differs.</violation>

<violation number="2" location="makefiles/dependency.mk:65">
P2: `make lint` still accepts an arbitrary preinstalled golangci-lint, so the v2.12.2 upgrade is skipped on machines with an older binary. Check the discovered version and reinstall/use the pinned release on mismatch.</violation>
</file>

<file name=".golangci.yml">

<violation number="1" location=".golangci.yml:92">
P3: Future instances of these lint rules anywhere in the repository will be silently accepted, even after the current findings are addressed. Scope each temporary exception to affected paths or fix the known violations instead of excluding the diagnostic repo-wide.</violation>
</file>

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic}

cubic-dev-ai · 2026-07-23T12:41:37Z

 endif

-GOLANGCILINT_VERSION ?= v1.60.0
+GOLANGCILINT_VERSION ?= v2.12.2


P2: make lint still accepts an arbitrary preinstalled golangci-lint, so the v2.12.2 upgrade is skipped on machines with an older binary. Check the discovered version and reinstall/use the pinned release on mismatch.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At makefiles/dependency.mk, line 65: <comment>`make lint` still accepts an arbitrary preinstalled golangci-lint, so the v2.12.2 upgrade is skipped on machines with an older binary. Check the discovered version and reinstall/use the pinned release on mismatch.</comment> <file context> @@ -62,7 +62,7 @@ else endif -GOLANGCILINT_VERSION ?= v1.60.0 +GOLANGCILINT_VERSION ?= v2.12.2 .PHONY: golangci </file context>

cubic-dev-ai · 2026-07-23T12:41:37Z

 	set -e ;\
 	echo 'installing honnef.co/go/tools/cmd/staticcheck ' ;\
-	go install honnef.co/go/tools/cmd/staticcheck@v0.5.1 ;\
+	go install honnef.co/go/tools/cmd/staticcheck@v0.7.0 ;\


P3: make staticcheck still uses any existing PATH binary, so developers with an older Staticcheck do not receive v0.7.0. Version-check the discovered binary and install the pinned release when it differs.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At makefiles/dependency.mk, line 46: <comment>`make staticcheck` still uses any existing PATH binary, so developers with an older Staticcheck do not receive v0.7.0. Version-check the discovered binary and install the pinned release when it differs.</comment> <file context> @@ -43,7 +43,7 @@ ifeq (, $(shell which staticcheck)) set -e ;\ echo 'installing honnef.co/go/tools/cmd/staticcheck ' ;\ - go install honnef.co/go/tools/cmd/staticcheck@v0.5.1 ;\ + go install honnef.co/go/tools/cmd/staticcheck@v0.7.0 ;\ } STATICCHECK=$(GOBIN)/staticcheck </file context>

cubic-dev-ai · 2026-07-23T12:41:37Z

+        text: 'occurrences, make it a constant'
+      - linters:
+          - staticcheck
+        text: 'QF1008:'


P3: Future instances of these lint rules anywhere in the repository will be silently accepted, even after the current findings are addressed. Scope each temporary exception to affected paths or fix the known violations instead of excluding the diagnostic repo-wide.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .golangci.yml, line 92: <comment>Future instances of these lint rules anywhere in the repository will be silently accepted, even after the current findings are addressed. Scope each temporary exception to affected paths or fix the known violations instead of excluding the diagnostic repo-wide.</comment> <file context> @@ -1,207 +1,135 @@ + text: 'occurrences, make it a constant' + - linters: + - staticcheck + text: 'QF1008:' + - linters: + - staticcheck </file context>

controller-runtime's conversion.NewWebhookHandler now takes a conversion.Registry; pass an empty one to preserve existing scheme-default conversion behavior. Signed-off-by: anish bista <anishbista053@gmail.com>

Signed-off-by: anish bista <anishbista053@gmail.com>

…ation crossplane-runtime's pkg/test.MockClient no longer implements controller-runtime's client.Client interface after the v0.23 bump (missing Apply), breaking compilation of every test that imports it. Add a minimal local mock.Client covering Get/Create/Update/Patch and switch all affected tests over to it. Signed-off-by: anish bista <anishbista053@gmail.com>

Migrate .golangci.yml to the v2 config schema, bump the golangci-lint-action to v8 (required for v2 support), and pin the version in CI and makefiles/dependency.mk. Bump the Dockerfile and Dockerfile.e2e base image to golang:1.25.12-alpine3.24 to match the go.mod Go version. Suppress a handful of pre-existing findings newly surfaced by v2's stricter defaults, to be addressed in a follow-up PR. Signed-off-by: anish bista <anishbista053@gmail.com>

staticcheck v0.5.1 fails to build under Go 1.25.12 (x/tools incompatibility); bump the CI/Makefile pin to v0.7.0, which builds and passes cleanly. Also exclude SA1019 in .golangci.yml so golangci-lint's staticcheck agrees with staticcheck.conf, which already ignores SA1019 repo-wide pending the CUE upgrade work. golangci-lint doesn't read staticcheck.conf, so without this it flags cmd/main.go's use of the deprecated GetEventRecorderFor - which can't be swapped for GetEventRecorder without an upstream crossplane-runtime change, since NewAPIRecorder still expects the old record.EventRecorder type. Signed-off-by: anish bista <anishbista053@gmail.com>

The k3d cluster version used by e2e and webhook-upgrade-validation, and the envtest kube-apiserver version used by unit tests, were still pinned to v1.31 even though go.mod now targets the v0.35 k8s.io line. Bump K3D_IMAGE_VERSION(S) in e2e.yaml, the k3d version in webhook-upgrade-validation.yml, and ENVTEST_K8S_VERSION in makefiles/const.mk (the value make test actually uses) to v1.35, and align unit-test.yaml's kubebuilder-action kubernetesVersion accordingly. go.mod/go.sum changes are from go mod tidy dropping a now-unused indirect dependency. Signed-off-by: anish bista <anishbista053@gmail.com>

Go 1.25.12's crypto/x509 rejects the hardcoded CA/server/client test certs in pkg/providers/http and pkg/providers/legacy/http/testdata because they were signed with SHA1-RSA, breaking TestHTTPSDo in CI. Regenerate all three as SHA256-signed certs (same CA covering server cert SAN 127.0.0.1 and a client cert for mTLS), verified against the actual handshake used by these tests. Once that let both packages' TLS tests actually reach the network layer, they collided: pkg/providers/http and pkg/providers/legacy/http hardcode the same ports (1229, 8443) and race when go test runs packages in parallel. Move the legacy package to distinct ports (1329/8543). Signed-off-by: anish bista <anishbista053@gmail.com>

crossplane-runtime/v2's test.MockClient implements the Apply method controller-runtime v0.22+ requires on client.Client, so the local pkg/mock.Client workaround is no longer needed. Switch all imports to the v2 module and revert tests back to test.MockClient. Signed-off-by: anish bista <anishbista053@gmail.com>

Signed-off-by: anish bista <anishbista053@gmail.com> # Conflicts: # controllers/suite_test.go # go.mod # go.sum

pkg/executor now imports github.com/kubevela/pkg/cache (from the merged StepStatusCache refactor), which the previously pinned pkg fork commit predates. Signed-off-by: anish bista <anishbista053@gmail.com>

Points github.com/oam-dev/cluster-gateway at the latest commit on its replace-apiserver-runtime branch. apiserver-runtime was only ever an indirect, transitive dependency here (no source in this repo imports it), so once the upstream chain no longer needs it, go mod tidy drops it entirely. Signed-off-by: anish bista <anishbista053@gmail.com>

anishbista60 requested review from FogDong, Somefive, anoop2811, briankane, jguionnet, leejanee and wonderflow as code owners July 22, 2026 12:21

anishbista60 mentioned this pull request Jul 22, 2026

[Enhancement] Upgrade Kubernetes dependency version across the KubeVela ecosystem (target: v1.35.x) kubevela/kubevela#7238

Open

14 tasks

cubic-dev-ai Bot reviewed Jul 22, 2026

View reviewed changes

Comment thread go.mod Outdated

Comment thread go.mod

anishbista60 force-pushed the bump-k8s-1.35 branch from 8003464 to 64766f7 Compare July 23, 2026 12:31

anishbista60 changed the title ~~chore: bump k8s deps to v0.35.6 line and controller-runtime to v0.23.3~~ chore: bump k8s deps to v0.35.6 and controller-runtime to v0.23.3 Jul 23, 2026

anishbista60 changed the title ~~chore: bump k8s deps to v0.35.6 and controller-runtime to v0.23.3~~ Chore: bump k8s deps to v0.35.6 and controller-runtime to v0.23.3 Jul 23, 2026

cubic-dev-ai Bot reviewed Jul 23, 2026

View reviewed changes

anishbista60 added 8 commits July 24, 2026 12:58

chore: bump k8s deps to v0.35.6 line and controller-runtime to v0.23.3

e4fca8b

controller-runtime's conversion.NewWebhookHandler now takes a conversion.Registry; pass an empty one to preserve existing scheme-default conversion behavior. Signed-off-by: anish bista <anishbista053@gmail.com>

chore: bump CI go version to 1.25.12

89ff17a

Signed-off-by: anish bista <anishbista053@gmail.com>

chore: point replaces to latest fork commits (with CI bump)

d762886

Signed-off-by: anish bista <anishbista053@gmail.com>

anishbista60 force-pushed the bump-k8s-1.35 branch from 7b85f34 to db7336a Compare July 24, 2026 07:31

anishbista60 force-pushed the bump-k8s-1.35 branch from db7336a to b571dbc Compare July 24, 2026 07:33

anishbista60 added 3 commits July 30, 2026 15:17

Merge remote-tracking branch 'upstream/main' into bump-k8s-1.35

611373f

Signed-off-by: anish bista <anishbista053@gmail.com> # Conflicts: # controllers/suite_test.go # go.mod # go.sum

chore: bump kubevela/pkg replace to pick up the cache package

f5b1a56

pkg/executor now imports github.com/kubevela/pkg/cache (from the merged StepStatusCache refactor), which the previously pinned pkg fork commit predates. Signed-off-by: anish bista <anishbista053@gmail.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Chore: bump k8s deps to v0.35.6 and controller-runtime to v0.23.3 - #241

Chore: bump k8s deps to v0.35.6 and controller-runtime to v0.23.3#241
anishbista60 wants to merge 12 commits into
kubevela:mainfrom
anishbista60:bump-k8s-1.35

anishbista60 commented Jul 22, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

anishbista60 commented Jul 23, 2026

Uh oh!

codecov Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cubic-dev-ai Bot Jul 23, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot Jul 23, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot Jul 23, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

anishbista60 commented Jul 22, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

anishbista60 commented Jul 23, 2026

Uh oh!

codecov Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

anishbista60 commented Jul 22, 2026 •

edited by cubic-dev-ai Bot

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

codecov Bot commented Jul 23, 2026 •

edited

Loading

cubic-dev-ai Bot Jul 23, 2026 •

edited

Loading

cubic-dev-ai Bot Jul 23, 2026 •

edited

Loading

cubic-dev-ai Bot Jul 23, 2026 •

edited

Loading