[WIP] CNTRLPLANE-371: Update to Kubernetes v1.33

.ci-operator.yaml

@@ -1,4 +1,4 @@
 build_root_image:
   name: release
   namespace: openshift
-  tag: rhel-9-release-golang-1.23-openshift-4.19
+  tag: rhel-9-release-golang-1.24-nofips-openshift-4.19

hack/update-generated.sh

@@ -16,7 +16,7 @@ go run -mod vendor ./cmd/openshift-tests render test-report --output-dir=./zz_ge
 # By default, "openshift-tests images" lists images from external binaries. However, we force
 # this script to list images from built-in tests in order to avoid requiring an OCP release image.
 echo "# This file is generated by hack/update-generated.sh" > test/extended/util/image/zz_generated.txt
-OPENSHIFT_SKIP_EXTERNAL_TESTS=1 go run -mod vendor ./cmd/openshift-tests images --upstream --to-repository quay.io/openshift/community-e2e-images >> test/extended/util/image/zz_generated.txt
+OPENSHIFT_SKIP_EXTERNAL_TESTS=1 go run -mod vendor ./cmd/openshift-tests images --upstream --to-repository quay.io/openshift/community-e2e-images | grep -v "Setting language to" >> test/extended/util/image/zz_generated.txt
 
 os::build::setup_env
 

images/tests/Dockerfile.rhel

@@ -1,4 +1,4 @@
-FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.23-openshift-4.19 AS builder
+FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-nofips-openshift-4.19 AS builder
 WORKDIR /go/src/github.com/openshift/origin
 COPY . .
 RUN make; \
@@ -22,5 +22,5 @@ RUN PACKAGES="git gzip util-linux" && \
 LABEL io.k8s.display-name="OpenShift End-to-End Tests" \
     io.openshift.release.operator=true \
     io.k8s.description="OpenShift is a platform for developing, building, and deploying containerized applications." \
-    io.openshift.build.versions="kubernetes-tests=1.32.4" \
+    io.openshift.build.versions="kubernetes-tests=1.33.3" \
     io.openshift.tags="openshift,tests,e2e"

pkg/clioptions/suiteselection/suite_flags.go

@@ -80,7 +80,7 @@ func (f *TestSuiteSelectionFlags) SelectSuite(
 		}
 	}
 	if suite == nil && len(args) == 0 {
-		fmt.Fprintf(f.ErrOut, SuitesString(suites, "Select a test suite to run against the server:\n\n"))
+		fmt.Fprint(f.ErrOut, SuitesString(suites, "Select a test suite to run against the server:\n\n"))
 		return nil, fmt.Errorf("specify a test suite to run, for example: %s run %s", filepath.Base(os.Args[0]), suites[0].Name)
 	}
 	if suite == nil && len(args) > 0 {
@@ -92,7 +92,7 @@ func (f *TestSuiteSelectionFlags) SelectSuite(
 		}
 	}
 	if suite == nil {
-		fmt.Fprintf(f.ErrOut, SuitesString(suites, "Select a test suite to run against the server:\n\n"))
+		fmt.Fprint(f.ErrOut, SuitesString(suites, "Select a test suite to run against the server:\n\n"))
 		return nil, fmt.Errorf("suite %q does not exist", args[0])
 	}
 
@@ -207,7 +207,7 @@ func (f *TestSuiteSelectionFlags) testFileMatchFunc() (testginkgo.TestMatchFunc,
 // printed at the beginning of the output.
 func SuitesString(suites []*testginkgo.TestSuite, prefix string) string {
 	buf := &bytes.Buffer{}
-	fmt.Fprintf(buf, prefix)
+	fmt.Fprint(buf, prefix)
 	for _, suite := range suites {
 		fmt.Fprintf(buf, "%s\n  %s\n\n", suite.Name, suite.Description)
 	}

pkg/disruption/backend/shutdown/handler.go

@@ -60,7 +60,7 @@ func (h *ciShutdownIntervalHandler) Handle(shutdown *shutdownInterval) {
 	message = fmt.Sprintf("%s: load balancer took new(%s) reused(%s) to switch to a new host", message,
 		shutdown.MaxElapsedWithNewConnection.Round(time.Second), shutdown.MaxElapsedWithConnectionReuse.Round(time.Second))
 	message = fmt.Sprintf("reason/%s locator/%s %s: %s", reason, h.descriptor.ShutdownLocator(), message, shutdown.String())
-	framework.Logf(message)
+	framework.Logf("%s", message)
 
 	if level == monitorapi.Error {
 		h.eventRecorder.Eventf(

pkg/monitor/backenddisruption/disruption_backend_sampler.go

@@ -622,7 +622,7 @@ func (b *disruptionSampler) consumeSamples(ctx context.Context, consumerDoneCh c
 
 			// start a new interval with the new error
 			message, eventReason, level := DisruptionBegan(b.backendSampler.GetLocator().OldLocator(), b.backendSampler.GetConnectionType(), currentError, currSample.getRequestAuditID())
-			framework.Logf(message.BuildString())
+			framework.Logf("%s", message.BuildString())
 			eventRecorder.Eventf(
 				&v1.ObjectReference{Kind: "OpenShiftTest", Namespace: "kube-system", Name: b.backendSampler.GetDisruptionBackendName()}, nil,
 				v1.EventTypeWarning, string(eventReason), "detected", message.BuildString())
@@ -654,7 +654,7 @@ func (b *disruptionSampler) consumeSamples(ctx context.Context, consumerDoneCh c
 			}
 
 			message, eventReason, level := DisruptionBegan(b.backendSampler.GetLocator().OldLocator(), b.backendSampler.GetConnectionType(), currentError, currSample.getRequestAuditID())
-			framework.Logf(message.BuildString())
+			framework.Logf("%s", message.BuildString())
 			eventRecorder.Eventf(
 				&v1.ObjectReference{Kind: "OpenShiftTest", Namespace: "kube-system", Name: b.backendSampler.GetDisruptionBackendName()}, nil,
 				v1.EventTypeWarning, string(eventReason), "detected", message.BuildString())

pkg/monitortestlibrary/pathologicaleventlibrary/duplicated_events_test.go

@@ -407,7 +407,7 @@ func TestPathologicalEventsWithNamespaces(t *testing.T) {
 					assert.Equal(t, test.expectedMessage, junit.FailureOutput.Output)
 				} else {
 					if !assert.Nil(t, junit.FailureOutput, "expected success but got failure output") {
-						t.Logf(junit.FailureOutput.Output)
+						t.Log(junit.FailureOutput.Output)
 					}
 				}
 			}
@@ -658,7 +658,7 @@ func TestPathologicalEventsTopologyAwareHintsDisabled(t *testing.T) {
 					assert.Equal(t, test.expectedMessage, junit.FailureOutput.Output)
 				} else {
 					if !assert.Nil(t, junit.FailureOutput, "expected success but got failure output for junit: %s", junit.Name) {
-						t.Logf(junit.FailureOutput.Output)
+						t.Log(junit.FailureOutput.Output)
 					}
 				}
 			}

pkg/monitortests/network/disruptionpodnetwork/monitortest.go

@@ -212,7 +212,7 @@ func (pna *podNetworkAvalibility) serviceHasEndpoints(ctx context.Context) (bool
 	}
 	endpointSlices, err := pna.kubeClient.DiscoveryV1().EndpointSlices(pna.targetService.Namespace).List(ctx, listOptions)
 	if err != nil {
-		klog.Errorf(err.Error())
+		klog.Error(err.Error())
 		return false, nil
 	}
 

pkg/monitortests/network/disruptionserviceloadbalancer/monitortest.go

@@ -19,6 +19,7 @@ import (
 	configv1 "github.com/openshift/api/config/v1"
 	configclient "github.com/openshift/client-go/config/clientset/versioned"
 	"github.com/openshift/library-go/pkg/operator/resource/resourceread"
+	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	utilnet "k8s.io/apimachinery/pkg/util/net"
@@ -192,28 +193,28 @@ func (w *availability) PrepareCollection(ctx context.Context, adminRESTConfig *r
 	svcPort := int(tcpService.Spec.Ports[0].Port)
 
 	fmt.Fprintf(os.Stderr, "creating RC to be part of service %v\n", serviceName)
-	rc, err := jig.Run(ctx, func(rc *corev1.ReplicationController) {
+	rc, err := jig.Run(ctx, func(d *appsv1.Deployment) {
 		// ensure the pod waits long enough during update for the LB to see the newly ready pod, which
 		// must be longer than the worst load balancer above (GCP at 32s)
-		rc.Spec.MinReadySeconds = 33
+		d.Spec.MinReadySeconds = 33
 
 		// use a readiness endpoint that will go not ready before the pod terminates.
 		// the probe will go false when the sig-term is sent.
-		rc.Spec.Template.Spec.Containers[0].ReadinessProbe.HTTPGet.Path = "/readyz"
+		d.Spec.Template.Spec.Containers[0].ReadinessProbe.HTTPGet.Path = "/readyz"
 
 		// delay shutdown long enough to go readyz=false before the process exits when the pod is deleted.
 		// 80 second delay was found to not show disruption in testing
-		rc.Spec.Template.Spec.Containers[0].Args = append(rc.Spec.Template.Spec.Containers[0].Args, "--delay-shutdown=80")
+		d.Spec.Template.Spec.Containers[0].Args = append(d.Spec.Template.Spec.Containers[0].Args, "--delay-shutdown=80")
 
 		// force the image to use the "normal" global mapping.
 		originalAgnhost := k8simage.GetOriginalImageConfigs()[k8simage.Agnhost]
-		rc.Spec.Template.Spec.Containers[0].Image = image.LocationFor(originalAgnhost.GetE2EImage())
+		d.Spec.Template.Spec.Containers[0].Image = image.LocationFor(originalAgnhost.GetE2EImage())
 
 		// ensure the pod is not forcibly deleted at 30s, but waits longer than the graceful sleep
 		minuteAndAHalf := int64(90)
-		rc.Spec.Template.Spec.TerminationGracePeriodSeconds = &minuteAndAHalf
+		d.Spec.Template.Spec.TerminationGracePeriodSeconds = &minuteAndAHalf
 
-		jig.AddRCAntiAffinity(rc)
+		jig.AddDeploymentAntiAffinity(d)
 	})
 	if err != nil {
 		return fmt.Errorf("error waiting for replicaset: %w", err)

pkg/riskanalysis/cmd.go

@@ -5,7 +5,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"github.com/openshift/origin/pkg/dataloader"
 	"io"
 	"net/http"
 	"os"
@@ -14,6 +13,8 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/openshift/origin/pkg/dataloader"
+
 	"github.com/openshift/origin/pkg/monitortestlibrary/allowedbackenddisruption"
 	"github.com/openshift/origin/pkg/monitortestlibrary/historicaldata"
 	"github.com/openshift/origin/pkg/monitortestlibrary/platformidentification"
@@ -216,7 +217,7 @@ func (opt *Options) requestRiskAnalysis(inputBytes []byte, client *http.Client,
 		failure := "unable to obtain risk analysis from sippy after retries"
 		logrus.WithError(err).Error(failure)
 		if err == nil { // no error, but no success either
-			err = fmt.Errorf(failure)
+			err = fmt.Errorf("%s", failure)
 		}
 		return nil, err
 	}

pkg/testsuites/filters.go

@@ -14,7 +14,7 @@ import (
 // printed at the beginning of the output.
 func SuitesString(suites []*ginkgo.TestSuite, prefix string) string {
 	buf := &bytes.Buffer{}
-	fmt.Fprintf(buf, prefix)
+	fmt.Fprint(buf, prefix)
 	for _, suite := range suites {
 		fmt.Fprintf(buf, "%s\n  %s\n\n", suite.Name, suite.Description)
 	}

test/e2e/upgrade/monitor.go

@@ -34,7 +34,7 @@ func (m *versionMonitor) Check(initialGeneration int64, desired configv1.Update)
 	cv, err := m.client.ConfigV1().ClusterVersions().Get(context.Background(), "version", metav1.GetOptions{})
 	if err != nil {
 		msg := fmt.Sprintf("unable to retrieve cluster version during upgrade: %v", err)
-		framework.Logf(msg)
+		framework.Logf("%s", msg)
 		return nil, msg, nil
 	}
 	m.lastCV = cv

test/e2e/upgrade/upgrade.go

@@ -162,7 +162,7 @@ var _ = g.Describe("[sig-arch][Feature:ClusterUpgrade]", func() {
 		}
 
 		if len(errMsgs) > 0 {
-			combinedErr := fmt.Errorf(strings.Join(errMsgs, "; "))
+			combinedErr := fmt.Errorf("%s", strings.Join(errMsgs, "; "))
 			o.Expect(combinedErr).NotTo(o.HaveOccurred())
 		}
 	})

test/extended/apiserver/api_requests.go

@@ -117,7 +117,7 @@ var _ = g.Describe("[sig-arch][Late]", func() {
 			for resource, requestCount := range resourceToRequestCount {
 				details := fmt.Sprintf("user/%v accessed %v %d times", user, resource, requestCount.count)
 				failureOutput = append(failureOutput, details)
-				framework.Logf(details)
+				framework.Logf("%s", details)
 			}
 		}
 
@@ -126,10 +126,10 @@ var _ = g.Describe("[sig-arch][Late]", func() {
 		if len(failureOutput) > 0 {
 			if cluster414OrNewer {
 				// for clusters 4.14+ this job needs to pass
-				framework.Failf(strings.Join(failureOutput, "\n"))
+				framework.Fail(strings.Join(failureOutput, "\n"))
 			} else {
 				// for olders - only flake
-				result.Flakef(strings.Join(failureOutput, "\n"))
+				result.Flakef("%s", strings.Join(failureOutput, "\n"))
 			}
 		}
 	})

test/extended/apiserver/kubeconfigs.go

@@ -98,9 +98,9 @@ func testNode(oc *exutil.CLI, kubeconfig, masterName string) error {
 	framework.Logf("Verifying kubeconfig %q on master %q", kubeconfig, masterName)
 	out, err := oc.AsAdmin().Run("debug").Args("node/"+masterName, "--", "chroot", "/host", "/bin/bash", "-euxo", "pipefail", "-c",
 		fmt.Sprintf(`oc --kubeconfig "%s" get namespace kube-system`, kubeconfigPath)).Output()
-	framework.Logf(out)
+	framework.Logf("%s", out)
 	if err != nil {
-		return fmt.Errorf(out)
+		return fmt.Errorf("%s", out)
 	}
 	return nil
 }
@@ -115,17 +115,17 @@ func testKubeApiserverContainer(oc *exutil.CLI, kubeconfig, masterName string) e
 	framework.Logf("Copying oc binary from host to kube-apiserver container in master %q", masterName)
 	out, err := oc.AsAdmin().Run("debug").Args("node/"+masterName, "--", "chroot", "/host", "/bin/bash", "-euxo", "pipefail", "-c",
 		fmt.Sprintf(`oc --kubeconfig /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/localhost.kubeconfig -n openshift-kube-apiserver cp /usr/bin/oc kube-apiserver-%s:/tmp`, masterName)).Output()
-	framework.Logf(out)
+	framework.Logf("%s", out)
 	if err != nil {
-		return fmt.Errorf(out)
+		return fmt.Errorf("%s", out)
 	}
 
 	framework.Logf("Verifying kubeconfig %q in kube-apiserver container in master %q", kubeconfig, masterName)
 	out, err = oc.AsAdmin().Run("exec").Args("-n", "openshift-kube-apiserver", "kube-apiserver-"+masterName, "--", "/bin/bash", "-euxo", "pipefail", "-c",
 		fmt.Sprintf(`/tmp/oc --kubeconfig "%s" get nodes`, kubeconfigPath)).Output()
-	framework.Logf(out)
+	framework.Logf("%s", out)
 	if err != nil {
-		return fmt.Errorf(out)
+		return fmt.Errorf("%s", out)
 	}
 	return nil
 }

test/extended/authorization/authorization.go

@@ -204,7 +204,7 @@ func prettyPrintReviewResponse(resp *authorizationv1.ResourceAccessReviewRespons
 		groupsStr = fmt.Sprintf("  groups:\n%s", strings.Join(groupStrList, ""))
 	}
 
-	return fmt.Sprintf(nsStr + usersStr + groupsStr)
+	return fmt.Sprintf("%s", nsStr+usersStr+groupsStr)
 }
 
 // This list includes the admins from above, plus users or groups known to have global view access

test/extended/authorization/rolebinding_restrictions.go

@@ -127,7 +127,7 @@ var _ = g.Describe("[sig-auth][Feature:RoleBindingRestrictions] RoleBindingRestr
 func generateAllowUserRolebindingRestriction(ns string, users []string) *authorizationv1.RoleBindingRestriction {
 	var userstr string
 	for _, s := range users {
-		userstr = fmt.Sprintf(userstr + strings.Replace(s, ":", "", -1))
+		userstr = fmt.Sprint(userstr + strings.Replace(s, ":", "", -1))
 	}
 	return &authorizationv1.RoleBindingRestriction{
 		ObjectMeta: metav1.ObjectMeta{

test/extended/ci/job_names.go

@@ -111,7 +111,7 @@ var _ = g.Describe("[sig-ci] [Early] prow job name", func() {
 				if isPeriodic {
 					e2e.Fail(failMessage)
 				} else {
-					result.Flakef(failMessage)
+					result.Flakef("%s", failMessage)
 				}
 			}
 		case "OVNKubernetes":
@@ -122,7 +122,7 @@ var _ = g.Describe("[sig-ci] [Early] prow job name", func() {
 				if isPeriodic {
 					e2e.Fail(failMessage)
 				} else {
-					result.Flakef(failMessage)
+					result.Flakef("%s", failMessage)
 				}
 			}
 		default:

test/extended/etcd/etcd_storage_path.go

@@ -435,7 +435,7 @@ func testEtcd3StoragePath(t g.GinkgoTInterface, oc *exutil.CLI, etcdClient3Fn fu
 				}
 				output, err = getFromEtcd(etcdClient3, testData.ExpectedEtcdPath)
 				if err != nil {
-					framework.Logf(err.Error())
+					framework.Logf("%s", err.Error())
 					lastErr = err
 					continue
 				}

test/extended/image_ecosystem/sample_repos.go

@@ -53,10 +53,10 @@ func NewSampleRepoTest(c sampleRepoConfig) func() {
 			})
 
 			g.Describe("Building "+c.repoName+" app from new-app", func() {
-				g.It(fmt.Sprintf("should build a "+c.repoName+" image and run it in a pod [apigroup:build.openshift.io]"), func() {
+				g.It(fmt.Sprintf("should build a %s image and run it in a pod [apigroup:build.openshift.io]", c.repoName), func() {
 					err := exutil.WaitForOpenShiftNamespaceImageStreams(oc)
 					o.Expect(err).NotTo(o.HaveOccurred())
-					g.By(fmt.Sprintf("calling oc new-app with the " + c.repoName + " example template"))
+					g.By(fmt.Sprintf("calling oc new-app with the %s example template", c.repoName))
 					newAppArgs := []string{c.templateURL}
 					if len(c.newAppParams) > 0 {
 						newAppArgs = append(newAppArgs, "-p")

test/extended/images/oc_copy.go

@@ -328,7 +328,7 @@ func (e *hookExecutor) executeExecNewPod(hook *appsv1.LifecycleHook, rc *corev1.
 	wg.Wait()
 	if updatedPod.Status.Phase == corev1.PodFailed {
 		fmt.Fprintf(e.out, "--> %s: Failed\n", label)
-		return fmt.Errorf(updatedPod.Status.Message)
+		return fmt.Errorf("%s", updatedPod.Status.Message)
 	}
 	// Only show this message if we created the pod ourselves, or we saw
 	// the pod in a running or pending state.

test/extended/images/signatures.go

@@ -118,7 +118,7 @@ var _ = g.Describe("[sig-imageregistry][Serial] Image signature workflow", func(
 		g.By("expecting the image to have unverified signature")
 		out, err = oc.Run("describe").Args("istag", "signed:latest").Output()
 		o.Expect(err).NotTo(o.HaveOccurred())
-		e2e.Logf(out)
+		e2e.Logf("%s", out)
 		o.Expect(out).To(o.ContainSubstring("Unverified"))
 
 		out, err = pod.Exec(strings.Join([]string{

test/extended/networking/cnimigration.go

@@ -293,7 +293,7 @@ var _ = g.Describe("[sig-network][Feature:CNIMigration]", g.Ordered, func() {
 			}
 		}
 		if len(errMsgs) > 0 {
-			combinedErr := fmt.Errorf(strings.Join(errMsgs, "; "))
+			combinedErr := fmt.Errorf("%s", strings.Join(errMsgs, "; "))
 			framework.ExpectNoError(combinedErr)
 		}
 	})

test/extended/networking/egressip.go

@@ -744,7 +744,7 @@ func applyEgressIPObject(oc *exutil.CLI, cloudNetworkClientset cloudnetwork.Inte
 	o.Expect(err).NotTo(o.HaveOccurred())
 
 	if cloudNetworkClientset != nil {
-		framework.Logf(fmt.Sprintf("Waiting for CloudPrivateIPConfig creation for a maximum of %d seconds", timeout))
+		framework.Logf("Waiting for CloudPrivateIPConfig creation for a maximum of %d seconds", timeout)
 		var exists bool
 		var isAssigned bool
 		o.Eventually(func() bool {
@@ -765,7 +765,7 @@ func applyEgressIPObject(oc *exutil.CLI, cloudNetworkClientset cloudnetwork.Inte
 		}, time.Duration(timeout)*time.Second, 5*time.Second).Should(o.BeTrue())
 	}
 
-	framework.Logf(fmt.Sprintf("Waiting for EgressIP addresses inside status of EgressIP CR %s for a maximum of %d seconds", egressIPObjectName, timeout))
+	framework.Logf("Waiting for EgressIP addresses inside status of EgressIP CR %s for a maximum of %d seconds", egressIPObjectName, timeout)
 	var hasIP bool
 	var nodeName string
 	o.Eventually(func() bool {
@@ -816,7 +816,7 @@ func openshiftSDNAssignEgressIPsManually(oc *exutil.CLI, cloudNetworkClientset c
 		o.Expect(err).NotTo(o.HaveOccurred())
 	}
 
-	framework.Logf(fmt.Sprintf("Waiting for CloudPrivateIPConfig creation for a maximum of %d seconds", timeout))
+	framework.Logf("Waiting for CloudPrivateIPConfig creation for a maximum of %d seconds", timeout)
 	var exists bool
 	var isAssigned bool
 	o.Eventually(func() bool {

test/extended/networking/egressip_helpers.go

@@ -1289,7 +1289,7 @@ func sendProbesToHostPort(oc *exutil.CLI, proberPod *v1.Pod, url, targetProtocol
 		for e := range errChan {
 			errList = fmt.Sprintf("%s {%s}", errList, e.Error())
 		}
-		return "", fmt.Errorf(errList)
+		return "", fmt.Errorf("%s", errList)
 	}
 
 	return randomID.String(), nil

test/extended/networking/ipsec.go

@@ -642,5 +642,5 @@ func dumpPodCommand(namespace, name, cmd string) {
 	g.GinkgoHelper()
 	stdout, err := e2eoutput.RunHostCmdWithRetries(namespace, name, cmd, statefulset.StatefulSetPoll, statefulset.StatefulPodTimeout)
 	o.Expect(err).NotTo(o.HaveOccurred())
-	framework.Logf(name + ": " + strings.Join(strings.Split(stdout, "\n"), fmt.Sprintf("\n%s: ", name)))
+	framework.Logf("%s: %s", name, strings.Join(strings.Split(stdout, "\n"), fmt.Sprintf("\n%s: ", name)))
 }

test/extended/olm/olm.go

@@ -169,7 +169,7 @@ var _ = g.Describe("[sig-arch] ocp payload should be based on existing source",
 			gitCommitID := strings.TrimSpace(idSlice[len(idSlice)-1])
 			e2e.Logf("olm source git commit ID:%s", gitCommitID)
 			if len(gitCommitID) != 40 {
-				e2e.Failf(fmt.Sprintf("the length of the git commit id is %d, != 40", len(gitCommitID)))
+				e2e.Failf("the length of the git commit id is %d, != 40", len(gitCommitID))
 			}
 
 			if sameCommit == "" {