mirror of
https://github.com/hanzokms/kubernetes-operator.git
synced 2026-10-30 20:30:51 +00:00
zeekayandHanzo Dev
b8f260c3f2
The official golang images set GOTOOLCHAIN=local. A floating golang:<minor> tag
that resolves behind the `go` directive in go.mod therefore kills the container
build outright:
go: go.mod requires go >= 1.26.5 (running go 1.26.4; GOTOOLCHAIN=local)
This already shipped as a live failure in hanzoai/visor v1.108.16.
Why this repo and not its sibling KMS forks: this is de-branded first-party code
(module github.com/hanzokms/kubernetes-operator, June 2026 relicense to
BSD-3-Clause and CRD group move to kms.hanzo.ai), so it is maintained and worth
hardening. The three still-upstream Infisical forks alongside it
(agent-injector, cert-issuer, k8s-kms-plugin) are deliberately left untouched.
Two orthogonal changes:
- pin the base to golang:1.26.5 -> hermetic; the image and the directive
always agree, nothing to download.
- ENV GOTOOLCHAIN=auto -> resilient; if go.mod later moves past the
pin, the toolchain is fetched (checksum-verified via sum.golang.org) instead
of hard-failing. This is what stops the class recurring.
Note this moves the builder two minor versions (golang:1.24 -> golang:1.26.5)
to put the repo on the same toolchain as the rest of the fleet. The `go`
directive in go.mod stays at 1.24.0 on purpose: a newer toolchain building an
older directive is always valid, and raising the directive would propagate a
floor to every consumer. If that jump is unwanted, the same fix holds with
golang:1.24.<latest> — only the tag changes, GOTOOLCHAIN=auto still applies.
Verified on go1.26.5 against the 1.24.0 directive:
go build ./... EXIT=0
go vet ./... EXIT=0
go test $(go list ./... | grep -v /e2e) -- with KUBEBUILDER_ASSETS from
setup-envtest, exactly as the Makefile `test` target runs it:
internal/services/kmssecret ok; internal/controller 2 passed / 1 failed.
That one failure is PRE-EXISTING and is not fixed here: the scaffolded spec
"KMSSecret Controller ... should successfully reconcile the resource" creates a
KMSSecret with no managedKubeSecretReferences, which the controller now rejects
("KMSSecret CRD must have at least one managed secret reference set"). The test
has not kept up with the validation. Reproduced identically on the pristine
pre-change tree, which has zero modified files, so it is not caused by the
builder pin.
Co-authored-by: Hanzo Dev <[email protected]>
37 lines
1.4 KiB
Docker
37 lines
1.4 KiB
Docker
# Build the manager binary
|
|
FROM golang:1.26.5 AS builder
|
|
# Pinned to an exact patch, and GOTOOLCHAIN=auto so a future go.mod bump downloads
|
|
# its toolchain instead of hard-failing under the official image's GOTOOLCHAIN=local.
|
|
ENV GOTOOLCHAIN=auto
|
|
ARG TARGETOS
|
|
ARG TARGETARCH
|
|
|
|
WORKDIR /workspace
|
|
# Copy the Go Modules manifests
|
|
COPY go.mod go.mod
|
|
COPY go.sum go.sum
|
|
# cache deps before building and copying source so that we don't need to re-download as much
|
|
# and so that source changes don't invalidate our downloaded layer
|
|
RUN go mod download
|
|
|
|
# Copy the go source
|
|
COPY cmd/main.go cmd/main.go
|
|
COPY api/ api/
|
|
COPY internal/ internal/
|
|
|
|
# Build
|
|
# the GOARCH has not a default value to allow the binary be built according to the host where the command
|
|
# was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
|
|
# the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
|
|
# by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
|
|
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager cmd/main.go
|
|
|
|
# Use distroless as minimal base image to package the manager binary
|
|
# Refer to https://github.com/GoogleContainerTools/distroless for more details
|
|
FROM gcr.io/distroless/static:nonroot
|
|
WORKDIR /
|
|
COPY --from=builder /workspace/manager .
|
|
USER 65532:65532
|
|
|
|
ENTRYPOINT ["/manager"]
|