chore: bump go to 1.25.8

salasberryfin · salasberryfin · commit 692a8f5e9e62 · 2026-03-11T11:03:54.000+01:00
This version of Go includes the latest CVE fixes. Some extra changes are
applied to address new linter errors.

Signed-off-by: Carlos Salas &lt;carlos.salas@suse.com&gt;
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
@@ -24,7 +24,7 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9.2.0
         with:
-          version: v2.1.0
+          version: v2.11.2
           working-directory: ${{matrix.working-directory}}
           args: --timeout=5m0s
           skip-cache: true
diff --git a/.golangci.yml b/.golangci.yml
@@ -1,6 +1,6 @@
 version: "2"
 run:
-  go: "1.24"
+  go: "1.25"
   allow-parallel-runners: true
 linters:
   default: all
@@ -19,15 +19,18 @@ linters:
     - ireturn
     - maintidx
     - nestif
+    - noinlineerr
     - nolintlint
     - nonamedreturns
     - paralleltest
+    - prealloc
     - rowserrcheck
     - sqlclosecheck
     - tagliatelle
     - varnamelen
     - wastedassign
     - wrapcheck
+    - wsl # use the new wsl_v5 instead
   settings:
     funlen:
       lines: 110
@@ -107,6 +110,9 @@ linters:
       - linters:
           - revive
         text: "package-comments: should have a package comment"
+      - linters:
+          - modernize
+        text: "any: interface{}"
     paths:
       - zz_generated.*\.go$
       - conversion\.go
diff --git a/bootstrap/api/v1beta1/groupversion_info.go b/bootstrap/api/v1beta1/groupversion_info.go
@@ -14,10 +14,10 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Package v1beta1 contains API Schema definitions for the bootstrap v1beta1 API group
+package v1beta1
+
 // +kubebuilder:object:generate=true
 // +groupName=bootstrap.cluster.x-k8s.io
-package v1beta1
 
 import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
diff --git a/bootstrap/internal/cloudinit/controlplane_join.go b/bootstrap/internal/cloudinit/controlplane_join.go
@@ -40,8 +40,8 @@ func NewJoinControlPlane(input *ControlPlaneInput) ([]byte, error) {
 	}
 
 	controlPlaneCloudJoinWithVersion := fmt.Sprintf(controlPlaneCloudInit, input.RKE2Version)
-	userData, err := generate("JoinControlplane", controlPlaneCloudJoinWithVersion, input)
 
+	userData, err := generate("JoinControlplane", controlPlaneCloudJoinWithVersion, input)
 	if err != nil {
 		return nil, err
 	}
diff --git a/bootstrap/internal/cloudinit/worker_join.go b/bootstrap/internal/cloudinit/worker_join.go
@@ -63,8 +63,8 @@ func NewJoinWorker(input *BaseUserData) ([]byte, error) {
 	}
 
 	workerCloudJoinWithVersion := fmt.Sprintf(workerCloudInit, input.RKE2Version)
-	userData, err := generate("JoinWorker", workerCloudJoinWithVersion, input)
 
+	userData, err := generate("JoinWorker", workerCloudJoinWithVersion, input)
 	if err != nil {
 		return nil, err
 	}
diff --git a/bootstrap/internal/controllers/rke2config_controller.go b/bootstrap/internal/controllers/rke2config_controller.go
@@ -485,7 +485,7 @@ func (r *RKE2ConfigReconciler) handleClusterNotInitialized(ctx context.Context,
 	yamlEncoder := yaml.NewEncoder(&buf)
 	yamlEncoder.SetIndent(2)
 
-	err = yamlEncoder.Encode(&configStruct)
+	err = yamlEncoder.Encode(&configStruct) //nolint:gosec // G117: we intentionally serialize EtcdS3AccessKey in ServerConfig
 	if err != nil {
 		return ctrl.Result{}, fmt.Errorf("unable to marshal config.yaml: %w", err)
 	}
@@ -732,7 +732,7 @@ func (r *RKE2ConfigReconciler) joinControlplane(ctx context.Context, scope *Scop
 	yamlEncoder := yaml.NewEncoder(&buf)
 	yamlEncoder.SetIndent(2)
 
-	err = yamlEncoder.Encode(&configStruct)
+	err = yamlEncoder.Encode(&configStruct) //nolint:gosec // G117: we intentionally serialize EtcdS3AccessKey in ServerConfig
 	if err != nil {
 		return ctrl.Result{}, fmt.Errorf("unable to marshal config.yaml: %w", err)
 	}
diff --git a/controlplane/api/v1beta1/groupversion_info.go b/controlplane/api/v1beta1/groupversion_info.go
@@ -14,10 +14,10 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Package v1beta1 contains API Schema definitions for the controlplane v1beta1 API group
+package v1beta1
+
 // +kubebuilder:object:generate=true
 // +groupName=controlplane.cluster.x-k8s.io
-package v1beta1
 
 import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
diff --git a/controlplane/api/v1beta1/rke2controlplanetemplate_types.go b/controlplane/api/v1beta1/rke2controlplanetemplate_types.go
@@ -51,7 +51,8 @@ type RKE2ControlPlaneTemplate struct {
 type RKE2ControlPlaneTemplateList struct {
 	metav1.TypeMeta `json:",inline"`
 	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []RKE2ControlPlaneTemplate `json:"items"`
+
+	Items []RKE2ControlPlaneTemplate `json:"items"`
 }
 
 func init() { //nolint:gochecknoinits
diff --git a/controlplane/api/v1beta2/condition_consts.go b/controlplane/api/v1beta2/condition_consts.go
@@ -347,7 +347,7 @@ const (
 	// RKE2ControlPlaneCertificatesAvailableCondition documents the overall status of the certificates generated by the RKE2ControlPlane.
 	RKE2ControlPlaneCertificatesAvailableCondition = "CertificatesAvailable"
 
-	// RKE2ControlPlaneCertificatesAvailableInternalErrorReason documents a failure in generating the certificates.
+	// RKE2ControlPlaneCertificatesInternalErrorReason documents a failure in generating the certificates.
 	RKE2ControlPlaneCertificatesInternalErrorReason = clusterv1.InternalErrorReason
 
 	// RKE2ControlPlaneCertificatesAvailableReason surfaces when cluster certificates are available,
diff --git a/controlplane/internal/controllers/scale.go b/controlplane/internal/controllers/scale.go
@@ -598,11 +598,11 @@ func (r *RKE2ControlPlaneReconciler) computeDesiredMachine(
 	// Add the annotations from the MachineTemplate.
 	// Note: we intentionally don't use the map directly to ensure we don't modify the map in RKE2ControlPlane.
 	for k, v := range rcp.Spec.MachineTemplate.ObjectMeta.Annotations {
-		desiredMachine.Annotations[k] = v
+		desiredMachine.Annotations[k] = v //nolint:modernize
 	}
 
 	for k, v := range annotations {
-		desiredMachine.Annotations[k] = v
+		desiredMachine.Annotations[k] = v //nolint:modernize
 	}
 
 	// Set other in-place mutable fields
@@ -622,7 +622,7 @@ func ControlPlaneMachineLabelsForCluster(rcp *controlplanev1.RKE2ControlPlane, c
 	// Add the labels from the MachineTemplate.
 	// Note: we intentionally don't use the map directly to ensure we don't modify the map in RKE2ControlPlane.
 	for k, v := range rcp.Spec.MachineTemplate.ObjectMeta.Labels {
-		labels[k] = v
+		labels[k] = v //nolint:modernize
 	}
 
 	// Always force these labels over the ones coming from the spec.
diff --git a/controlplane/internal/util/ssa/cache.go b/controlplane/internal/util/ssa/cache.go
@@ -100,6 +100,7 @@ func NewCache(controllerName string) Cache {
 
 type ssaCache struct {
 	cache.Store
+
 	controllerName string
 }
 
diff --git a/controlplane/internal/util/ssa/filterintent.go b/controlplane/internal/util/ssa/filterintent.go
@@ -119,7 +119,7 @@ type FilterIntentInput struct {
 // IsPathAllowed returns true when the Path is one of the AllowedPaths.
 func IsPathAllowed(allowedPaths []contract.Path) func(path contract.Path) bool {
 	return func(path contract.Path) bool {
-		for _, p := range allowedPaths {
+		for _, p := range allowedPaths { //nolint:modernize
 			// NOTE: we allow everything Equal or one IsParentOf one of the allowed paths.
 			// e.g. if allowed Path is metadata.labels, we allow both metadata and metadata.labels;
 			// this is required because allowed Path is called recursively.
@@ -144,7 +144,7 @@ func IsPathNotAllowed(allowedPaths []contract.Path) func(path contract.Path) boo
 // IsPathIgnored returns true when the Path is one of the IgnorePaths.
 func IsPathIgnored(ignorePaths []contract.Path) func(path contract.Path) bool {
 	return func(path contract.Path) bool {
-		for _, p := range ignorePaths {
+		for _, p := range ignorePaths { //nolint:modernize
 			if path.Equal(p) {
 				return true
 			}
diff --git a/controlplane/internal/util/ssa/managedfields.go b/controlplane/internal/util/ssa/managedfields.go
@@ -157,6 +157,7 @@ func CleanUpManagedFieldsForSSAAdoption(ctx context.Context, c client.Client, ob
 			"f:name": map[string]interface{}{},
 		},
 	}
+
 	fieldV1, err := json.Marshal(fieldV1Map)
 	if err != nil { //nolint:wsl
 		return fmt.Errorf("failed to create seeding fieldV1Map for cleaning up legacy managed fields: %w", err)
diff --git a/go.mod b/go.mod
@@ -1,6 +1,6 @@
 module github.com/rancher/cluster-api-provider-rke2
 
-go 1.24.13
+go 1.25.8
 
 require (
 	github.com/coreos/butane v0.27.0
diff --git a/hack/tools/go.mod b/hack/tools/go.mod
@@ -1,6 +1,6 @@
 module github.com/rancher/cluster-api-provider-rke2/hack/tools
 
-go 1.24.13
+go 1.25.8
 
 require sigs.k8s.io/cluster-api/hack/tools v0.0.0-20240820112706-3abe3058a6a8
 
diff --git a/pkg/proxy/addr.go b/pkg/proxy/addr.go
@@ -30,6 +30,7 @@ const scheme string = "proxy"
 // Addr defines a proxy net/addr format.
 type Addr struct {
 	net.Addr
+
 	port       string
 	identifier uint32
 }
diff --git a/pkg/rke2/config.go b/pkg/rke2/config.go
@@ -93,6 +93,8 @@ sysctl -p /etc/sysctl.d/90-rke2-cis.conf
 
 // ServerConfig is a struct that contains the information needed to generate a RKE2 server config.
 type ServerConfig struct {
+	rke2AgentConfig `yaml:",inline"`
+
 	AdvertiseAddress                  string   `yaml:"advertise-address,omitempty"`
 	AuditPolicyFile                   string   `yaml:"audit-policy-file,omitempty"`
 	BindAddress                       string   `yaml:"bind-address,omitempty"`
@@ -160,8 +162,6 @@ type ServerConfig struct {
 	EtcdS3Timeout             string `yaml:"etcd-s3-timeout,omitempty"`
 	EtcdSnapshotCompress      string `yaml:"etcd-snapshot-compress,omitempty"`
 	ServicelbNamespace        string `yaml:"servicelb-namespace,omitempty"`
-
-	rke2AgentConfig `yaml:",inline"`
 }
 
 // ServerConfigOpts is a struct that contains the information needed to generate a RKE2 server config.
@@ -286,6 +286,7 @@ func newRKE2ServerConfig(opts ServerConfigOpts) (*ServerConfig, []bootstrapv1.Fi
 			}
 
 			var ok bool
+
 			accessKeyID, ok = awsCredentialsSecret.Data["aws_access_key_id"]
 
 			if !ok {
diff --git a/test/helpers/envtest.go b/test/helpers/envtest.go
@@ -183,7 +183,7 @@ func getFilePathToCAPICRDs(root string) string {
 
 	var clusterAPIVersion string
 
-	for _, line := range strings.Split(string(modBits), "\n") {
+	for line := range strings.SplitSeq(string(modBits), "\n") {
 		matches := clusterAPIVersionRegex.FindStringSubmatch(line)
 		if len(matches) == 3 {
 			clusterAPIVersion = matches[2]

Original file line number	Diff line number	Diff line change
`@@ -40,8 +40,8 @@ func NewJoinControlPlane(input *ControlPlaneInput) ([]byte, error) {`
`40`	`40`	`}`
`41`	`41`
`42`	`42`	`controlPlaneCloudJoinWithVersion := fmt.Sprintf(controlPlaneCloudInit, input.RKE2Version)`
`43`		`- userData, err := generate("JoinControlplane", controlPlaneCloudJoinWithVersion, input)`
`44`	`43`
	`44`	`+ userData, err := generate("JoinControlplane", controlPlaneCloudJoinWithVersion, input)`
`45`	`45`	`if err != nil {`
`46`	`46`	`return nil, err`
`47`	`47`	`}`
Original file line number	Diff line number	Diff line change
`@@ -63,8 +63,8 @@ func NewJoinWorker(input *BaseUserData) ([]byte, error) {`
`63`	`63`	`}`
`64`	`64`
`65`	`65`	`workerCloudJoinWithVersion := fmt.Sprintf(workerCloudInit, input.RKE2Version)`
`66`		`- userData, err := generate("JoinWorker", workerCloudJoinWithVersion, input)`
`67`	`66`
	`67`	`+ userData, err := generate("JoinWorker", workerCloudJoinWithVersion, input)`
`68`	`68`	`if err != nil {`
`69`	`69`	`return nil, err`
`70`	`70`	`}`
Original file line number	Diff line number	Diff line change
`@@ -51,7 +51,8 @@ type RKE2ControlPlaneTemplate struct {`
`51`	`51`	`type RKE2ControlPlaneTemplateList struct {`
`52`	`52`	metav1.TypeMeta `json:",inline"`
`53`	`53`	metav1.ListMeta `json:"metadata,omitempty"`
`54`		- Items []RKE2ControlPlaneTemplate `json:"items"`
	`54`	`+`
	`55`	+ Items []RKE2ControlPlaneTemplate `json:"items"`
`55`	`56`	`}`
`56`	`57`
`57`	`58`	`func init() { //nolint:gochecknoinits`
Original file line number	Diff line number	Diff line change
`@@ -598,11 +598,11 @@ func (r *RKE2ControlPlaneReconciler) computeDesiredMachine(`
`598`	`598`	`// Add the annotations from the MachineTemplate.`
`599`	`599`	`// Note: we intentionally don't use the map directly to ensure we don't modify the map in RKE2ControlPlane.`
`600`	`600`	`for k, v := range rcp.Spec.MachineTemplate.ObjectMeta.Annotations {`
`601`		`- desiredMachine.Annotations[k] = v`
	`601`	`+ desiredMachine.Annotations[k] = v //nolint:modernize`
`602`	`602`	`}`
`603`	`603`
`604`	`604`	`for k, v := range annotations {`
`605`		`- desiredMachine.Annotations[k] = v`
	`605`	`+ desiredMachine.Annotations[k] = v //nolint:modernize`
`606`	`606`	`}`
`607`	`607`
`608`	`608`	`// Set other in-place mutable fields`
`@@ -622,7 +622,7 @@ func ControlPlaneMachineLabelsForCluster(rcp *controlplanev1.RKE2ControlPlane, c`
`622`	`622`	`// Add the labels from the MachineTemplate.`
`623`	`623`	`// Note: we intentionally don't use the map directly to ensure we don't modify the map in RKE2ControlPlane.`
`624`	`624`	`for k, v := range rcp.Spec.MachineTemplate.ObjectMeta.Labels {`
`625`		`- labels[k] = v`
	`625`	`+ labels[k] = v //nolint:modernize`
`626`	`626`	`}`
`627`	`627`
`628`	`628`	`// Always force these labels over the ones coming from the spec.`