Merge branch 'main' into docs/experimental-features-guide

Author: ADubhlaoich

.github/workflows/ci.yml

@@ -170,7 +170,7 @@ jobs:
       - name: Build binary
         uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
         with:
-          version: v2.3.1 # renovate: datasource=github-tags depName=goreleaser/goreleaser
+          version: v2.3.2 # renovate: datasource=github-tags depName=goreleaser/goreleaser
           args: ${{ github.ref_type == 'tag' && 'release' || 'build --snapshot' }} --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/conformance.yml

@@ -82,7 +82,7 @@ jobs:
       - name: Build binary
         uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
         with:
-          version: v2.3.1 # renovate: datasource=github-tags depName=goreleaser/goreleaser
+          version: v2.3.2 # renovate: datasource=github-tags depName=goreleaser/goreleaser
           args: build --single-target --snapshot --clean
         env:
           TELEMETRY_ENDPOINT: "" # disables sending telemetry

.github/workflows/functional.yml

@@ -69,7 +69,7 @@ jobs:
       - name: Build binary
         uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
         with:
-          version: v2.3.1 # renovate: datasource=github-tags depName=goreleaser/goreleaser
+          version: v2.3.2 # renovate: datasource=github-tags depName=goreleaser/goreleaser
           args: build --single-target --snapshot --clean
         env:
           TELEMETRY_ENDPOINT: otel-collector-opentelemetry-collector.collector.svc.cluster.local:4317

.github/workflows/nfr.yml

@@ -160,7 +160,7 @@ jobs:
           merge-multiple: true
 
       - name: Open a PR with the results
-        uses: peter-evans/create-pull-request@6cd32fd93684475c31847837f87bb135d40a2b79 # v7.0.3
+        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
         with:
           token: ${{ secrets.NGINX_PAT }}
           commit-message: NFR Test Results for NGF version ${{ needs.vars.outputs.version }}

.github/workflows/release-pr.yml

@@ -89,7 +89,7 @@ jobs:
           make generate-all
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@6cd32fd93684475c31847837f87bb135d40a2b79 # v7.0.3
+        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
         with:
           token: ${{ secrets.NGINX_PAT }}
           commit-message: Release ${{ inputs.version }}

.golangci.yml

@@ -9,28 +9,36 @@ linters-settings:
     ignore-generated-header: true
     rules:
       - name: blank-imports
+      - name: constant-logical-expr
       - name: context-as-argument
       - name: context-keys-type
+      - name: defer
       - name: dot-imports
         arguments:
           - allowedPackages:
               - github.com/onsi/gomega
               - github.com/onsi/ginkgo/v2
+      - name: duplicated-imports
       - name: empty-block
       - name: error-naming
       - name: error-return
       - name: error-strings
       - name: errorf
       - name: exported
+      - name: import-shadowing
       - name: increment-decrement
       - name: indent-error-flow
       - name: package-comments
       - name: range
+      - name: range-val-address
+      - name: range-val-in-closure
       - name: receiver-naming
       - name: redefines-builtin-id
+      - name: string-of-int
       - name: superfluous-else
       - name: time-naming
       - name: unexported-return
+      - name: unnecessary-stmt
       - name: unreachable-code
       - name: unused-parameter
       - name: var-declaration
@@ -80,9 +88,11 @@ linters:
     - lll
     - loggercheck
     - makezero
+    - mirror
     - misspell
     - musttag
     - nilerr
+    - nilnil
     - noctx
     - nolintlint
     - predeclared

internal/framework/controller/reconciler_test.go

@@ -66,8 +66,11 @@ var _ = Describe("Reconciler", func() {
 		) error {
 			Expect(object).To(BeAssignableToTypeOf(&v1.HTTPRoute{}))
 			Expect(nsname).To(Equal(client.ObjectKeyFromObject(hr)))
+			Expect(hr).ToNot(BeNil())
 
-			hr.DeepCopyInto(object.(*v1.HTTPRoute))
+			hrObj, ok := object.(*v1.HTTPRoute)
+			Expect(ok).To(BeTrue(), "object is not *v1.HTTPRoute")
+			hr.DeepCopyInto(hrObj)
 
 			return nil
 		}

internal/framework/events/first_eventbatch_preparer_test.go

@@ -108,7 +108,8 @@ var _ = Describe("FirstEventBatchPreparer", func() {
 				fakeReader.ListCalls(
 					func(_ context.Context, list client.ObjectList, _ ...client.ListOption) error {
 						httpRoute := v1.HTTPRoute{ObjectMeta: metav1.ObjectMeta{Name: "test"}}
-						typedList := list.(*v1.HTTPRouteList)
+						typedList, ok := list.(*v1.HTTPRouteList)
+						Expect(ok).To(BeTrue(), "expected list to be of type *v1.HTTPRouteList")
 						typedList.Items = append(typedList.Items, httpRoute)
 
 						return nil

internal/framework/helpers/helpers.go

@@ -33,12 +33,12 @@ func GetPointer[T any](v T) *T {
 // making it is possible to use it in tests when comparing against values returned by the fake client.
 // It panics if it fails to process the time.
 func PrepareTimeForFakeClient(t metav1.Time) metav1.Time {
-	bytes, err := t.Marshal()
+	b, err := t.Marshal()
 	if err != nil {
 		panic(fmt.Errorf("failed to marshal time: %w", err))
 	}
 
-	if err = t.Unmarshal(bytes); err != nil {
+	if err = t.Unmarshal(b); err != nil {
 		panic(fmt.Errorf("failed to unmarshal time: %w", err))
 	}
 
@@ -78,10 +78,10 @@ func EqualPointers[T comparable](p1, p2 *T) bool {
 }
 
 // MustExecuteTemplate executes the template with the given data.
-func MustExecuteTemplate(template *template.Template, data interface{}) []byte {
+func MustExecuteTemplate(templ *template.Template, data interface{}) []byte {
 	var buf bytes.Buffer
 
-	if err := template.Execute(&buf, data); err != nil {
+	if err := templ.Execute(&buf, data); err != nil {
 		panic(err)
 	}
 

internal/framework/status/leader_aware_group_updater_test.go

@@ -59,7 +59,8 @@ var _ = Describe("LeaderAwareGroupUpdater", func() {
 
 			if updateNeeded {
 				setter = func(obj client.Object) bool {
-					gc := obj.(*v1.GatewayClass)
+					gc, ok := obj.(*v1.GatewayClass)
+					Expect(ok).To(BeTrue(), "obj is not a *v1.GatewayClass")
 					gc.Status = createGCStatus(condType)
 					return true
 				}

internal/framework/status/updater.go

@@ -54,9 +54,9 @@ type Updater struct {
 }
 
 // NewUpdater creates a new Updater.
-func NewUpdater(client client.Client, logger logr.Logger) *Updater {
+func NewUpdater(c client.Client, logger logr.Logger) *Updater {
 	return &Updater{
-		client: client,
+		client: c,
 		logger: logger,
 	}
 }

internal/framework/status/updater_test.go

@@ -69,7 +69,8 @@ func prepareReq(name string, condType string, updateNeeded bool) UpdateRequest {
 	var setter Setter
 	if updateNeeded {
 		setter = func(obj client.Object) bool {
-			gc := obj.(*v1.GatewayClass)
+			gc, ok := obj.(*v1.GatewayClass)
+			Expect(ok).To(BeTrue(), "obj is not a *v1.GatewayClass")
 			gc.Status = createGCStatus(condType)
 			return true
 		}

internal/mode/static/config_updater_test.go

@@ -16,6 +16,7 @@ import (
 )
 
 func TestUpdateControlPlane(t *testing.T) {
+	t.Parallel()
 	debugLogCfg := &ngfAPI.NginxGateway{
 		Spec: ngfAPI.NginxGatewaySpec{
 			Logging: &ngfAPI.Logging{
@@ -72,6 +73,7 @@ func TestUpdateControlPlane(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
 			g := NewWithT(t)
 
 			fakeLogSetter := &staticfakes.FakeLogLevelSetter{
@@ -118,6 +120,7 @@ func TestValidateLogLevel(t *testing.T) {
 
 	for _, level := range validLevels {
 		t.Run(fmt.Sprintf("valid level %q", level), func(t *testing.T) {
+			t.Parallel()
 			g := NewWithT(t)
 
 			g.Expect(validateLogLevel(level)).To(Succeed())

internal/mode/static/handler.go

@@ -181,7 +181,7 @@ func (h *eventHandlerImpl) HandleEventBatch(ctx context.Context, logger logr.Log
 		h.parseAndCaptureEvent(ctx, logger, event)
 	}
 
-	changeType, graph := h.cfg.processor.Process()
+	changeType, gr := h.cfg.processor.Process()
 
 	var err error
 	switch changeType {
@@ -193,7 +193,7 @@ func (h *eventHandlerImpl) HandleEventBatch(ctx context.Context, logger logr.Log
 		return
 	case state.EndpointsOnlyChange:
 		h.version++
-		cfg := dataplane.BuildConfiguration(ctx, graph, h.cfg.serviceResolver, h.version)
+		cfg := dataplane.BuildConfiguration(ctx, gr, h.cfg.serviceResolver, h.version)
 
 		h.setLatestConfiguration(&cfg)
 
@@ -204,7 +204,7 @@ func (h *eventHandlerImpl) HandleEventBatch(ctx context.Context, logger logr.Log
 		)
 	case state.ClusterStateChange:
 		h.version++
-		cfg := dataplane.BuildConfiguration(ctx, graph, h.cfg.serviceResolver, h.version)
+		cfg := dataplane.BuildConfiguration(ctx, gr, h.cfg.serviceResolver, h.version)
 
 		h.setLatestConfiguration(&cfg)
 
@@ -230,10 +230,10 @@ func (h *eventHandlerImpl) HandleEventBatch(ctx context.Context, logger logr.Log
 
 	h.latestReloadResult = nginxReloadRes
 
-	h.updateStatuses(ctx, logger, graph)
+	h.updateStatuses(ctx, logger, gr)
 }
 
-func (h *eventHandlerImpl) updateStatuses(ctx context.Context, logger logr.Logger, graph *graph.Graph) {
+func (h *eventHandlerImpl) updateStatuses(ctx context.Context, logger logr.Logger, gr *graph.Graph) {
 	gwAddresses, err := getGatewayAddresses(ctx, h.cfg.k8sClient, nil, h.cfg.gatewayPodConfig)
 	if err != nil {
 		logger.Error(err, "Setting GatewayStatusAddress to Pod IP Address")
@@ -243,18 +243,18 @@ func (h *eventHandlerImpl) updateStatuses(ctx context.Context, logger logr.Logge
 
 	var gcReqs []frameworkStatus.UpdateRequest
 	if h.cfg.updateGatewayClassStatus {
-		gcReqs = status.PrepareGatewayClassRequests(graph.GatewayClass, graph.IgnoredGatewayClasses, transitionTime)
+		gcReqs = status.PrepareGatewayClassRequests(gr.GatewayClass, gr.IgnoredGatewayClasses, transitionTime)
 	}
 	routeReqs := status.PrepareRouteRequests(
-		graph.L4Routes,
-		graph.Routes,
+		gr.L4Routes,
+		gr.Routes,
 		transitionTime,
 		h.latestReloadResult,
 		h.cfg.gatewayCtlrName,
 	)
 
-	polReqs := status.PrepareBackendTLSPolicyRequests(graph.BackendTLSPolicies, transitionTime, h.cfg.gatewayCtlrName)
-	ngfPolReqs := status.PrepareNGFPolicyRequests(graph.NGFPolicies, transitionTime, h.cfg.gatewayCtlrName)
+	polReqs := status.PrepareBackendTLSPolicyRequests(gr.BackendTLSPolicies, transitionTime, h.cfg.gatewayCtlrName)
+	ngfPolReqs := status.PrepareNGFPolicyRequests(gr.NGFPolicies, transitionTime, h.cfg.gatewayCtlrName)
 
 	reqs := make([]frameworkStatus.UpdateRequest, 0, len(gcReqs)+len(routeReqs)+len(polReqs)+len(ngfPolReqs))
 	reqs = append(reqs, gcReqs...)
@@ -267,8 +267,8 @@ func (h *eventHandlerImpl) updateStatuses(ctx context.Context, logger logr.Logge
 	// We put Gateway status updates separately from the rest of the statuses because we want to be able
 	// to update them separately from the rest of the graph whenever the public IP of NGF changes.
 	gwReqs := status.PrepareGatewayRequests(
-		graph.Gateway,
-		graph.IgnoredGateways,
+		gr.Gateway,
+		gr.IgnoredGateways,
 		transitionTime,
 		gwAddresses,
 		h.latestReloadResult,
@@ -558,15 +558,15 @@ func (h *eventHandlerImpl) nginxGatewayServiceUpsert(ctx context.Context, logger
 		logger.Error(err, "Setting GatewayStatusAddress to Pod IP Address")
 	}
 
-	graph := h.cfg.processor.GetLatestGraph()
-	if graph == nil {
+	gr := h.cfg.processor.GetLatestGraph()
+	if gr == nil {
 		return
 	}
 
 	transitionTime := metav1.Now()
 	gatewayStatuses := status.PrepareGatewayRequests(
-		graph.Gateway,
-		graph.IgnoredGateways,
+		gr.Gateway,
+		gr.IgnoredGateways,
 		transitionTime,
 		gwAddresses,
 		h.latestReloadResult,
@@ -584,15 +584,15 @@ func (h *eventHandlerImpl) nginxGatewayServiceDelete(
 		logger.Error(err, "Setting GatewayStatusAddress to Pod IP Address")
 	}
 
-	graph := h.cfg.processor.GetLatestGraph()
-	if graph == nil {
+	gr := h.cfg.processor.GetLatestGraph()
+	if gr == nil {
 		return
 	}
 
 	transitionTime := metav1.Now()
 	gatewayStatuses := status.PrepareGatewayRequests(
-		graph.Gateway,
-		graph.IgnoredGateways,
+		gr.Gateway,
+		gr.IgnoredGateways,
 		transitionTime,
 		gwAddresses,
 		h.latestReloadResult,

internal/mode/static/manager.go

@@ -715,14 +715,14 @@ func setInitialConfig(
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
-	var config ngfAPI.NginxGateway
+	var conf ngfAPI.NginxGateway
 	// Polling to wait for CRD to exist if the Deployment is created first.
 	if err := wait.PollUntilContextCancel(
 		ctx,
 		500*time.Millisecond,
 		true, /* poll immediately */
 		func(ctx context.Context) (bool, error) {
-			if err := reader.Get(ctx, configName, &config); err != nil {
+			if err := reader.Get(ctx, configName, &conf); err != nil {
 				if !apierrors.IsNotFound(err) {
 					return false, err
 				}
@@ -736,7 +736,7 @@ func setInitialConfig(
 
 	// status is not updated until the status updater's cache is started and the
 	// resource is processed by the controller
-	return updateControlPlane(&config, logger, eventRecorder, configName, logLevelSetter)
+	return updateControlPlane(&conf, logger, eventRecorder, configName, logLevelSetter)
 }
 
 func getMetricsOptions(cfg config.MetricsConfig) metricsserver.Options {

internal/mode/static/nginx/modules/package-lock.json

@@ -607,7 +607,7 @@ func (hpr *hostPathRules) maxServerCount() int {
 func buildUpstreams(
 	ctx context.Context,
 	listeners []*graph.Listener,
-	resolver resolver.ServiceResolver,
+	svcResolver resolver.ServiceResolver,
 	ipFamily IPFamilyType,
 ) []Upstream {
 	// There can be duplicate upstreams if multiple routes reference the same upstream.
@@ -643,7 +643,7 @@ func buildUpstreams(
 
 						var errMsg string
 
-						eps, err := resolver.Resolve(ctx, br.SvcNsName, br.ServicePort, allowedAddressType)
+						eps, err := svcResolver.Resolve(ctx, br.SvcNsName, br.ServicePort, allowedAddressType)
 						if err != nil {
 							errMsg = err.Error()
 						}