build(deps): update linkerd/dev to v47

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
     "name": "linkerd2",
-    "image": "ghcr.io/linkerd/dev:v46",
+    "image": "ghcr.io/linkerd/dev:v47",
     "extensions": [
         "DavidAnson.vscode-markdownlint",
         "golang.go",

.github/workflows/actions.yml

@@ -12,16 +12,16 @@ permissions:
 
 jobs:
   actionlint:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v46
+      - uses: linkerd/dev/actions/setup-tools@v47
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - run: just action-lint
 
   devcontainer-versions:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v46
+      - uses: linkerd/dev/actions/setup-tools@v47
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - run: just action-dev-check

.github/workflows/cni-plugin-integration.yml

@@ -19,9 +19,9 @@ jobs:
         cni: [flannel, calico, cilium]
         iptables-mode: [legacy, nft]
     timeout-minutes: 15
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v46
+      - uses: linkerd/dev/actions/setup-tools@v47
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Run CNI integration tests
         env:
@@ -30,17 +30,17 @@ jobs:
   ordering-test:
     continue-on-error: true
     timeout-minutes: 15
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v46
+      - uses: linkerd/dev/actions/setup-tools@v47
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Run CNI ordering tests
         run: just cni-plugin-test-ordering
   repair-controller:
     timeout-minutes: 15
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v46
+      - uses: linkerd/dev/actions/setup-tools@v47
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Run repair-controller tests
         run: just cni-repair-controller-integration

.github/workflows/go.yml

@@ -13,24 +13,24 @@ permissions:
 
 jobs:
   lint:
-    runs-on: ubuntu-22.04
-    container: ghcr.io/linkerd/dev:v46-go
+    runs-on: ubuntu-24.04
+    container: ghcr.io/linkerd/dev:v47-go
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
       - run: just go-lint --verbose --timeout=10m
 
   fmt:
-    runs-on: ubuntu-22.04
-    container: ghcr.io/linkerd/dev:v46-go
+    runs-on: ubuntu-24.04
+    container: ghcr.io/linkerd/dev:v47-go
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
       - run: just go-fmt-check
 
   unit-test:
-    runs-on: ubuntu-22.04
-    container: ghcr.io/linkerd/dev:v46-go
+    runs-on: ubuntu-24.04
+    container: ghcr.io/linkerd/dev:v47-go
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033

.github/workflows/integration.yml

@@ -13,9 +13,9 @@ on:
 jobs:
   proxy-init-integration:
     timeout-minutes: 15
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v46
+      - uses: linkerd/dev/actions/setup-tools@v47
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Run proxy-init integration tests
         run: just proxy-init-test-integration

.github/workflows/markdown.yml

@@ -12,7 +12,7 @@ on:
 jobs:
   md-lint:
     timeout-minutes: 5
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - uses: DavidAnson/markdownlint-cli2-action@992badcdf24e3b8eb7e87ff9287fe931bcb00c6e

.github/workflows/release-cni-plugin.yml

@@ -13,7 +13,7 @@ permissions:
 jobs:
   meta:
     timeout-minutes: 3
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - id: meta
@@ -27,7 +27,7 @@ jobs:
 
   docker-publish:
     needs: meta
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 25
     permissions:
       id-token: write # needed for signing the images with GitHub OIDC token
@@ -40,14 +40,14 @@ jobs:
           restore-keys: cni-plugin-${{ needs.meta.outputs.mode }}-
 
       - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
-      - uses: linkerd/dev/actions/setup-tools@v46
+      - uses: linkerd/dev/actions/setup-tools@v47
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - run: |
           just cni-plugin-image='${{ needs.meta.outputs.repo }}:${{ needs.meta.outputs.version }}' \
                 build-cni-plugin-image \
                   --cache-from type=local,src="$RUNNER_TEMP/.buildx-cache" \
                   --cache-to type=local,dest="$RUNNER_TEMP/.buildx-cache",mode=max \
-                  --platform linux/amd64,linux/arm64,linux/arm/v7
+                  --platform linux/amd64,linux/arm64
       - run: just-dev prune-action-cache "$RUNNER_TEMP/.buildx-cache"
 
       # Only publish images on release
@@ -63,7 +63,7 @@ jobs:
                 build-cni-plugin-image \
                   --cache-from type=local,src="$RUNNER_TEMP/.buildx-cache" \
                   --cache-to type=local,dest="$RUNNER_TEMP/.buildx-cache",mode=max \
-                  --platform linux/amd64,linux/arm64,linux/arm/v7 \
+                  --platform linux/amd64,linux/arm64 \
                   --output type=registry
       - if: needs.meta.outputs.mode == 'release'
         uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159
@@ -77,7 +77,7 @@ jobs:
     timeout-minutes: 5
     permissions:
       contents: write
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - if: needs.meta.outputs.mode == 'release'

.github/workflows/release-proxy-init.yml

@@ -13,7 +13,7 @@ permissions:
 jobs:
   meta:
     timeout-minutes: 3
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - uses: ./.github/actions/version-mode
@@ -27,7 +27,7 @@ jobs:
 
   docker-publish:
     needs: meta
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
       id-token: write # needed for signing the images with GitHub OIDC token
@@ -40,7 +40,7 @@ jobs:
           restore-keys: proxy-init-${{ needs.meta.outputs.mode }}-
 
       - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
-      - uses: linkerd/dev/actions/setup-tools@v46
+      - uses: linkerd/dev/actions/setup-tools@v47
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - run: |
           just proxy-init-image='${{ needs.meta.outputs.repo }}:${{ needs.meta.outputs.version }}' \
@@ -77,7 +77,7 @@ jobs:
     timeout-minutes: 5
     permissions:
       contents: write
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - if: needs.meta.outputs.mode == 'release'

.github/workflows/release-validator.yml

@@ -13,8 +13,8 @@ permissions:
 jobs:
   meta:
     timeout-minutes: 15
-    runs-on: ubuntu-22.04
-    container: ghcr.io/linkerd/dev:v46-rust
+    runs-on: ubuntu-24.04
+    container: ghcr.io/linkerd/dev:v47-rust
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - uses: ./.github/actions/version-mode
@@ -39,14 +39,16 @@ jobs:
           - os: windows
             arch: arm  
     timeout-minutes: 10
-    runs-on: ubuntu-22.04
-    container: ghcr.io/linkerd/dev:v46-rust-musl
+    runs-on: ubuntu-24.04
+    container: ghcr.io/linkerd/dev:v47-rust-musl
     steps:
       - name: Install MinGW
         if: matrix.os == 'windows'
         run: apt-get update && apt-get install mingw-w64 -y
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - run: just validator arch=${{ matrix.arch }} os=${{ matrix.os }} profile=release version=${{ needs.meta.outputs.version }} package
+        env:
+          CARGO: "cargo auditable"
       - uses: actions/upload-artifact@v4
         with:
           name: ${{ matrix.arch }}-${{ matrix.os }}-artifacts
@@ -57,7 +59,7 @@ jobs:
     timeout-minutes: 5
     permissions:
       contents: write
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:

.github/workflows/rust.yml

@@ -13,8 +13,8 @@ on:
 jobs:
   check:
     timeout-minutes: 5
-    runs-on: ubuntu-22.04
-    container: ghcr.io/linkerd/dev:v46-rust
+    runs-on: ubuntu-24.04
+    container: ghcr.io/linkerd/dev:v47-rust
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - run: just rs-fetch

.github/workflows/shell.yml

@@ -13,8 +13,8 @@ on:
 jobs:
   sh-lint:
     timeout-minutes: 5
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v46
+      - uses: linkerd/dev/actions/setup-tools@v47
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - run: just sh-lint

Dockerfile-cni-plugin

@@ -12,14 +12,15 @@ ARG TARGETARCH
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH GO111MODULE=on \
     go build -o /go/bin/linkerd-cni -mod=readonly -ldflags "-s -w" -v ./cni-plugin/
 
-FROM --platform=$BUILDPLATFORM ghcr.io/linkerd/dev:v46-rust-musl as cni-repair-controller
+FROM --platform=$BUILDPLATFORM ghcr.io/linkerd/dev:v47-rust-musl as cni-repair-controller
 WORKDIR /build
 COPY --link justfile justfile-rust .
 COPY --link Cargo.toml Cargo.lock .
 COPY --link validator validator
 COPY --link cni-repair-controller cni-repair-controller
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     cargo fetch
+env CARGO="cargo auditable"
 ARG TARGETARCH
 # Enable tokio runtime metrics
 ENV RUSTFLAGS="--cfg tokio_unstable"
@@ -28,10 +29,14 @@ RUN --mount=type=cache,target=target \
     target=$(case "$TARGETARCH" in \
         amd64) echo x86_64-unknown-linux-musl ;; \
         arm64) echo aarch64-unknown-linux-musl ;; \
-        arm) echo armv7-unknown-linux-musleabihf ;; \
         *) echo "unsupported architecture: $TARGETARCH" >&2; exit 1 ;; \
     esac) && \
-    just cni-repair-controller arch="$TARGETARCH" profile=release build && \
+    cflags=$(case "$TARGETARCH" in \
+        amd64) echo '' ;; \
+        arm64) echo '-fuse-ld=/usr/aarch64-linux-gnu/bin/ld' ;; \
+        *) echo "unsupported architecture: $TARGETARCH" >&2; exit 1 ;; \
+    esac) && \
+    AWS_LC_SYS_CFLAGS=$cflags just cni-repair-controller arch="$TARGETARCH" profile=release build && \
     mv "target/$target/release/linkerd-cni-repair-controller" .
 
 FROM --platform=$TARGETPLATFORM alpine:3.22.1 as runtime