[VC-45002] Upgrade makefile modules to the latest version by wallrj-cyberark · Pull Request #717 · jetstack/jetstack-secure

wallrj-cyberark · 2025-09-17T11:24:20Z

Supplants #635

Upgrade makefile modules to the latest version. Why? Because I want to build venafi-kubernetes-agent and cyberark-disco-agent with the latest version of Go and with up to date versions of all the build tools.
All the other changes around dependabot / renovate are side effects of the make upgrade-klone command.

Ran make upgrade-klone
Removed the boilerplate module because none of the files currently have the header
Ran make generate-base
Fixed a new golangci-lint noctx warning in the logging tests

There's so much new stuff in makefile-modules, related to renovate and the use of chainguard STS....I have no idea whether it's going to work in this repo....and I can't think of an easy way to test it before merging this....so I propose merging it and fixing any problems as they arise.

Testing

I ran make ark-test-e2e because it is not run by GitHub Actions. It invokes the new make ark-release and uses some of the new versions of the tools to build and test the agent in a local dev environment. Output elided for brevity.

richard@localhost:~/projects/jetstack/jetstack-secure$ make ark-test-e2e
PATH="_bin/tools:..." ./hack/ark/test-e2e.sh
...
make oci-push-ark helm-chart-oci-push \
    oci_ark_image_name="ttl.sh/<redacted>/images/cyberark-disco-agent" \
    ...
echo '{}' | .../yq '.defaultBaseImage = "quay.io/jetstack/base-static@sha256:<redacted>"' | ... > .../oci-layout-ark.ko_config.yaml
...
/home/richard/projects/jetstack/jetstack-secure/_bin/tools/ko build ././cmd/ark \
    --platform=linux/amd64 \
    --image-annotation="org.opencontainers.image.source"="https://github.com/jetstack/jetstack-secure" \
    --image-annotation="org.opencontainers.image.vendor"="CyberArk Software Ltd." \
    --image-annotation="org.opencontainers.image.licenses"="EULA - https://www.cyberark.com/contract-terms/" \
    --image-annotation="org.opencontainers.image.authors"="TODO" \
    --image-annotation="org.opencontainers.image.title"="CyberArk Discovery and Context Agent" \
    --image-annotation="org.opencontainers.image.description"="Gathers machine identity data from Kubernetes clusters." \
    --image-annotation="org.opencontainers.image.version"="v1.6.0-73-<redacted>" \
    --image-annotation="org.opencontainers.image.revision"="<redacted>" \
    --oci-layout-path=_bin/scratch/image/oci-layout-ark \
    --sbom-dir=.../oci-layout-ark.sbom \
    --sbom=spdx \
    --push=false \
    --bare
...
2025/09/17 12:31:33 Using base quay.io/jetstack/base-static@sha256:<redacted> for github.com/jetstack/preflight/cmd/ark
2025/09/17 12:31:33 Building github.com/jetstack/preflight/cmd/ark for linux/amd64
2025/09/17 12:31:43 Writing SBOM to .../oci-layout-ark.sbom/ark-linux-amd64.spdx.json
2025/09/17 12:31:45 Saved ko://github.com/jetstack/preflight/cmd/ark
...
/home/richard/projects/jetstack/jetstack-secure/_bin/tools/crane  push "_bin/scratch/image/oci-layout-ark" "ttl.sh/<redacted>/images/cyberark-disco-agent:v1.6.0-73-<redacted>"
2025/09/17 12:32:26 ttl.sh/<redacted>/images/cyberark-disco-agent:v1.6.0-73-<redacted>: digest: sha256:<redacted> size: 1864
...
/home/richard/projects/jetstack/jetstack-secure/_bin/tools/helm push "_bin/scratch/helm/cyberark-disco-agent-v1.6.0-73-<redacted>.tgz" "oci://ttl.sh/<redacted>/charts/" ...
Pushed: ttl.sh/<redacted>/charts/cyberark-disco-agent:v1.6.0-73-<redacted>
Digest: sha256:<redacted>
...
Release complete!
RELEASE_OCI_IMAGE=ttl.sh/<redacted>/images/cyberark-disco-agent
RELEASE_OCI_IMAGE_TAG=v1.6.0-73-<redacted>
RELEASE_OCI_IMAGE_DIGEST=sha256:<redacted>
RELEASE_OCI_CHART=ttl.sh/<redacted>/charts/cyberark-disco-agent
RELEASE_OCI_CHART_TAG=v1.6.0-73-<redacted>
RELEASE_OCI_CHART_DIGEST=sha256:<redacted>
...
ERROR: failed to create cluster: node(s) already exist for a cluster with the name "kind"
Error from server (AlreadyExists): namespaces "cyberark" already exists
secret "agent-credentials" deleted from cyberark namespace
secret/agent-credentials created
Pulled: ttl.sh/<redacted>/charts/cyberark-disco-agent@sha256:<redacted>
Digest: sha256:<redacted>
Release "agent" has been upgraded. Happy Helming!
NAME: agent
LAST DEPLOYED: Wed Sep 17 12:32:35 2025
NAMESPACE: cyberark
STATUS: deployed
REVISION: 3
...
deployment "disco-agent" successfully rolled out

{
  "ts": ...,
  "caller": "agent/run.go:58",
  "msg": "Starting",
  "version": "v1.6.0-73-<redacted>",
  "commit": "<redacted>"
}
{
  "ts": ...,
  "caller": "identity/identity.go:402",
  "msg": "successfully completed AdvanceAuthentication request to CyberArk Identity; login complete",
  "username": "<redacted>@cyberark.cloud.<redacted>"
}
{"ts":...,"caller":"agent/run.go:417","msg":"Data sent successfully"}

wallrj-cyberark · 2025-09-17T11:46:52Z

.github/workflows/govulncheck.yaml

    runs-on: ubuntu-latest

-    if: github.repository_owner == 'jetstack'
+    if: github.repository == 'jetstack/preflight'


This is the old name of this repo. It was renamed some years ago and GitHub provide a redirect....but I don't think this check is going to work.

I updated the repo_name variable in 00_make file and ran make generate to change this.

wallrj-cyberark · 2025-09-17T12:57:29Z

make/00_mod.mk

+# Without this hack, golangci-lint will complain that the
+# github.com/jetstack/preflight imports should be grouped with all the other
+# third-party modules.
+generate-golangci-lint-config: repo_name := github.com/jetstack/preflight


The change to the repo_name should help the new github actions workflows to run, but caused a problem with the golangci-lint (gci) import grouping which also relies on that variable.
The hack above uses the old value for generating the golangci-lint config.

inteon · 2025-09-17T13:08:38Z

.github/workflows/renovate.yaml

+          echo "This workflow should not be run on a non-branch-head."
+          exit 1
+
+      - name: Octo STS Token Exchange


@wallrj-cyberark will we enable Octo STS in the jetstack repo too?

I don't know 😬 would it work? Is it easy to do?

We just have to add it as a github app afaik.
But you need to be admin in the jetstack org to do that...
I asked on teams.

Thanks. Then I'll merge it and pick your brains about the Octo STS app in teams.

- Ran make upgrade-klone - Removed the boilerplate module because none of the files currently have the header - Ran make generate-base Signed-off-by: Richard Wall <richard.wall@cyberark.com>

pkg/logs/logs_test.go:270:23: os/exec.Command must not be called. use os/exec.CommandContext (noctx) cmd := exec.Command(os.Args[0], "-test.run=^TestLogs$", "-test.v") Signed-off-by: Richard Wall <richard.wall@cyberark.com>

Signed-off-by: Richard Wall <richard.wall@cyberark.com>

…flow Signed-off-by: Richard Wall <richard.wall@cyberark.com>

…nfig - Change gci import prefix to github.com/jetstack/preflight in .golangci.yaml - Add makefile hack to set repo_name for golangci-lint config generation - Document workaround until go module can be renamed Signed-off-by: Richard Wall <richard.wall@cyberark.com>

wallrj-cyberark mentioned this pull request Sep 17, 2025

Upgrade Makefile modules to their latest versions #697

Closed

wallrj-cyberark commented Sep 17, 2025

View reviewed changes

wallrj-cyberark marked this pull request as ready for review September 17, 2025 12:58

wallrj-cyberark requested review from inteon and mladen-rusev-cyberark September 17, 2025 13:03

inteon reviewed Sep 17, 2025

View reviewed changes

wallrj-cyberark added 6 commits September 17, 2025 14:21

upgrade makefile modules to the latest version

f56afe2

- Ran make upgrade-klone - Removed the boilerplate module because none of the files currently have the header - Ran make generate-base Signed-off-by: Richard Wall <richard.wall@cyberark.com>

Fix golangci-lint noctx error

3fc7c1f

pkg/logs/logs_test.go:270:23: os/exec.Command must not be called. use os/exec.CommandContext (noctx) cmd := exec.Command(os.Args[0], "-test.run=^TestLogs$", "-test.v") Signed-off-by: Richard Wall <richard.wall@cyberark.com>

Update the repo name

4199e14

Signed-off-by: Richard Wall <richard.wall@cyberark.com>

make generate

a20f72d

Signed-off-by: Richard Wall <richard.wall@cyberark.com>

Manually update the repo name in the manually edited govulncheck work…

950537c

…flow Signed-off-by: Richard Wall <richard.wall@cyberark.com>

wallrj-cyberark force-pushed the klone_upgrade_2 branch from ea6975b to 71c9cbc Compare September 17, 2025 13:21

wallrj-cyberark added the test-e2e To signal e2e test job to be run label Sep 17, 2025

inteon approved these changes Sep 17, 2025

View reviewed changes

wallrj-cyberark merged commit 32d6bf1 into master Sep 17, 2025
6 checks passed

wallrj-cyberark deleted the klone_upgrade_2 branch September 17, 2025 14:17

wallrj-cyberark changed the title ~~upgrade makefile modules to the latest version~~ [VC-45002] Upgrade makefile modules to the latest version Sep 17, 2025

This was referenced Sep 18, 2025

[VC-45029] Upgrade all the Go dependencies in preparation for a release #722

Merged

Upgrade dependencies #679

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[VC-45002] Upgrade makefile modules to the latest version#717

[VC-45002] Upgrade makefile modules to the latest version#717
wallrj-cyberark merged 6 commits intomasterfrom
klone_upgrade_2

wallrj-cyberark commented Sep 17, 2025 •

edited

Loading

Uh oh!

wallrj-cyberark Sep 17, 2025

Uh oh!

wallrj-cyberark Sep 17, 2025

Uh oh!

wallrj-cyberark Sep 17, 2025

Uh oh!

inteon Sep 17, 2025

Uh oh!

wallrj-cyberark Sep 17, 2025

Uh oh!

inteon Sep 17, 2025 •

edited

Loading

Uh oh!

wallrj-cyberark Sep 17, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

wallrj-cyberark commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing

Uh oh!

wallrj-cyberark Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

wallrj-cyberark Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

wallrj-cyberark Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

inteon Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

wallrj-cyberark Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

inteon Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wallrj-cyberark Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

wallrj-cyberark commented Sep 17, 2025 •

edited

Loading

inteon Sep 17, 2025 •

edited

Loading