Bump Go to 1.23.2 (#6718)

* Bump Go to 1.23.2 Signed-off-by: Tero Saarni <[email protected]> * Bump golangci-lint to v1.61.0 Signed-off-by: Tero Saarni <[email protected]> * Lint fixes Signed-off-by: Tero Saarni <[email protected]> * Added ignore for gosec G115 and fixed overflow in few places Signed-off-by: Tero Saarni <[email protected]> --------- Signed-off-by: Tero Saarni <[email protected]>
projectcontour · Nov 8, 2024 · 2659222 · 2659222
1 parent 0be3efa
commit 2659222
Show file tree

Hide file tree

Showing 34 changed files with 74 additions and 67 deletions.
diff --git a/.github/workflows/build_daily.yaml b/.github/workflows/build_daily.yaml
@@ -12,7 +12,7 @@ permissions:
 
 env:
   GOPROXY: https://proxy.golang.org/
-  GO_VERSION: 1.22.5
+  GO_VERSION: 1.23.2
 
 jobs:
   e2e-contour-xds:

diff --git a/.github/workflows/build_tag.yaml b/.github/workflows/build_tag.yaml
@@ -18,7 +18,7 @@ permissions:
 
 env:
   GOPROXY: https://proxy.golang.org/
-  GO_VERSION: 1.22.5
+  GO_VERSION: 1.23.2
 
 jobs:
   build:

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -14,7 +14,7 @@ permissions:
 
 env:
   GOPROXY: https://proxy.golang.org/
-  GO_VERSION: 1.22.5
+  GO_VERSION: 1.23.2
 
 jobs:
   CodeQL-Build:

diff --git a/.github/workflows/prbuild.yaml b/.github/workflows/prbuild.yaml
@@ -13,7 +13,7 @@ permissions:
 
 env:
   GOPROXY: https://proxy.golang.org/
-  GO_VERSION: 1.22.5
+  GO_VERSION: 1.23.2
 
 jobs:
   lint:
@@ -29,8 +29,8 @@ jobs:
     - name: golangci-lint
       uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
       with:
-        version: v1.56.2
-        args: --build-tags=e2e,conformance,tools,gcp,oidc,none --out-format=colored-line-number
+        version: v1.61.0
+        args: --build-tags=e2e,conformance,gcp,oidc,none --out-format=colored-line-number
   codespell:
     name: Codespell
     runs-on: ubuntu-latest

diff --git a/Makefile b/Makefile
@@ -40,7 +40,7 @@ endif
 IMAGE_PLATFORMS ?= linux/amd64,linux/arm64
 
 # Base build image to use.
-BUILD_BASE_IMAGE ?= golang:1.22.5@sha256:829eff99a4b2abffe68f6a3847337bf6455d69d17e49ec1a97dac78834754bd6
+BUILD_BASE_IMAGE ?= golang:1.23.2@sha256:858ab89651d8a3d637da5580e71fdec40b5aefbb148ba50b9a629bd079a14bcd
 
 # Enable build with CGO.
 BUILD_CGO_ENABLED ?= 0
@@ -194,7 +194,7 @@ lint-codespell:
 .PHONY: lint-golint
 lint-golint:
 	@echo Running Go linter ...
-	@./hack/golangci-lint run --build-tags=e2e,conformance,tools,gcp,oidc,none
+	@./hack/golangci-lint run --build-tags=e2e,conformance,gcp,oidc,none
 
 .PHONY: lint-yamllint
 lint-yamllint:

diff --git a/changelogs/unreleased/6718-tsaarni-small.md b/changelogs/unreleased/6718-tsaarni-small.md
@@ -0,0 +1 @@
+Updateds to Go 1.23.2. See the [Go release notes](https://go.dev/doc/devel/release#go1.23.0) for more information.
diff --git a/cmd/contour/contour.go b/cmd/contour/contour.go
@@ -161,7 +161,7 @@ func main() {
 		// Reinitialize with the target debug level.
 		k8s.InitLogging(
 			k8s.LogWriterOption(log.WithField("context", "kubernetes")),
-			k8s.LogLevelOption(int(serveCtx.KubernetesDebug)),
+			k8s.LogLevelOption(int(serveCtx.KubernetesDebug)), //nolint:gosec // disable G115
 		)
 
 		log.Infof("args: %v", args)

diff --git a/hack/golangci-lint b/hack/golangci-lint
@@ -1,3 +1,3 @@
 #! /usr/bin/env bash
 
-go run github.com/golangci/golangci-lint/cmd/golangci-lint@v1.56.2 "$@"
+go run github.com/golangci/golangci-lint/cmd/golangci-lint@v1.61.0 "$@"
diff --git a/internal/annotation/annotations.go b/internal/annotation/annotations.go
@@ -188,6 +188,11 @@ func NumRetries(i *networking_v1.Ingress) uint32 {
 		return 1
 	}
 
+	// If set to other negative value than 1, then fall back to Envoy default.
+	if val < 0 {
+		return 1
+	}
+
 	return uint32(val)
 }
 

diff --git a/internal/dag/builder_test.go b/internal/dag/builder_test.go
@@ -16164,7 +16164,7 @@ func makeHTTPRoute(name, namespace, hostname string, firstRule gatewayapi_v1.HTT
 	}
 }
 
-func makeHTTPRouteRule(pathType gatewayapi_v1.PathMatchType, pathValue, serviceName string, port int, weight int32) gatewayapi_v1.HTTPRouteRule {
+func makeHTTPRouteRule(pathType gatewayapi_v1.PathMatchType, pathValue, serviceName string, port uint16, weight int32) gatewayapi_v1.HTTPRouteRule {
 	return gatewayapi_v1.HTTPRouteRule{
 		Matches:     gatewayapi.HTTPRouteMatch(pathType, pathValue),
 		BackendRefs: gatewayapi.HTTPBackendRef(serviceName, port, weight),

diff --git a/internal/dag/dag.go b/internal/dag/dag.go
@@ -579,7 +579,7 @@ type HeaderValueMatchDescriptorEntry struct {
 	Value       string
 }
 
-type VhRateLimitsType int
+type VhRateLimitsType int32
 
 const (
 	// VhRateLimitsOverride (Default) will use the virtual host rate limits unless the route has a rate limit policy.

diff --git a/internal/dag/gatewayapi_processor.go b/internal/dag/gatewayapi_processor.go
@@ -175,7 +175,7 @@ func (p *GatewayAPIProcessor) Run(dag *DAG, source *KubernetesCache) {
 	}
 
 	for listenerName, attachedRoutes := range listenerAttachedRoutes {
-		gwAccessor.SetListenerAttachedRoutes(listenerName, attachedRoutes)
+		gwAccessor.SetListenerAttachedRoutes(listenerName, int32(attachedRoutes)) //nolint:gosec // disable G115
 	}
 
 	p.computeGatewayConditions(gwAccessor, gatewayNotProgrammedCondition)
@@ -1034,7 +1034,7 @@ func (p *GatewayAPIProcessor) computeTLSRouteForListener(route *gatewayapi_v1alp
 			// Route defaults to a weight of "1" unless otherwise specified.
 			routeWeight := uint32(1)
 			if backendRef.Weight != nil {
-				routeWeight = uint32(*backendRef.Weight)
+				routeWeight = uint32(*backendRef.Weight) //nolint:gosec // disable G115
 			}
 
 			// Keep track of all the weights for this set of backendRefs. This will be
@@ -1299,7 +1299,7 @@ func (p *GatewayAPIProcessor) computeHTTPRouteForListener(
 
 				var portNumber uint32
 				if filter.RequestRedirect.Port != nil {
-					portNumber = uint32(*filter.RequestRedirect.Port)
+					portNumber = uint32(*filter.RequestRedirect.Port) //nolint:gosec // disable G115
 				}
 
 				var scheme string
@@ -1440,7 +1440,7 @@ func (p *GatewayAPIProcessor) computeHTTPRouteForListener(
 		// index of the rule to ensure rules that come first have a higher
 		// priority. All dag.Routes generated from a single HTTPRoute rule have
 		// the same priority.
-		priority := uint8(ruleIndex)
+		priority := uint8(ruleIndex) //nolint:gosec // disable G115
 
 		// Get our list of routes based on whether it's a redirect or a cluster-backed route.
 		// Note that we can end up with multiple routes here since the match conditions are
@@ -1632,7 +1632,7 @@ func (p *GatewayAPIProcessor) computeGRPCRouteForListener(route *gatewayapi_v1.G
 		// index of the rule to ensure rules that come first have a higher
 		// priority. All dag.Routes generated from a single GRPCRoute rule have
 		// the same priority.
-		priority := uint8(ruleIndex)
+		priority := uint8(ruleIndex) //nolint:gosec // disable G115
 
 		// Note that we can end up with multiple routes here since the match conditions are
 		// logically "OR"-ed, which we express as multiple routes, each with one of the
@@ -1799,7 +1799,7 @@ func (p *GatewayAPIProcessor) computeTCPRouteForListener(route *gatewayapi_v1alp
 		// Route defaults to a weight of "1" unless otherwise specified.
 		routeWeight := uint32(1)
 		if backendRef.Weight != nil {
-			routeWeight = uint32(*backendRef.Weight)
+			routeWeight = uint32(*backendRef.Weight) //nolint:gosec // disable G115
 		}
 
 		// Keep track of all the weights for this set of backendRefs. This will be
@@ -2133,7 +2133,7 @@ func (p *GatewayAPIProcessor) httpClusters(routeNamespace string, backendRefs []
 		// Route defaults to a weight of "1" unless otherwise specified.
 		routeWeight := uint32(1)
 		if backendRef.Weight != nil {
-			routeWeight = uint32(*backendRef.Weight)
+			routeWeight = uint32(*backendRef.Weight) //nolint:gosec // disable G115
 		}
 
 		// Keep track of all the weights for this set of backend refs. This will be
@@ -2332,7 +2332,7 @@ func (p *GatewayAPIProcessor) grpcClusters(routeNamespace string, backendRefs []
 		// Route defaults to a weight of "1" unless otherwise specified.
 		routeWeight := uint32(1)
 		if backendRef.Weight != nil {
-			routeWeight = uint32(*backendRef.Weight)
+			routeWeight = uint32(*backendRef.Weight) //nolint:gosec // disable G115
 		}
 
 		// Keep track of all the weights for this set of backend refs. This will be

diff --git a/internal/dag/httpproxy_processor.go b/internal/dag/httpproxy_processor.go
@@ -918,7 +918,7 @@ func (p *HTTPProxyProcessor) computeRoutes(
 
 		healthPolicy, err := httpHealthCheckPolicy(route.HealthCheckPolicy)
 		if err != nil {
-			validCond.AddErrorf(contour_v1.ConditionTypeRouteError, "HealthCheckPolicyInvalid", err.Error())
+			validCond.AddError(contour_v1.ConditionTypeRouteError, "HealthCheckPolicyInvalid", err.Error())
 			return nil
 		}
 
@@ -1023,7 +1023,7 @@ func (p *HTTPProxyProcessor) computeRoutes(
 			c := &Cluster{
 				Upstream:                      s,
 				LoadBalancerPolicy:            lbPolicy,
-				Weight:                        uint32(service.Weight),
+				Weight:                        uint32(service.Weight), //nolint:gosec // disable G115
 				HTTPHealthCheckPolicy:         healthPolicy,
 				UpstreamValidation:            uv,
 				RequestHeadersPolicy:          reqHP,
@@ -1236,7 +1236,7 @@ func (p *HTTPProxyProcessor) processHTTPProxyTCPProxy(validCond *contour_v1.Deta
 
 			proxy.Clusters = append(proxy.Clusters, &Cluster{
 				Upstream:             s,
-				Weight:               uint32(service.Weight),
+				Weight:               uint32(service.Weight), //nolint:gosec // disable G115
 				Protocol:             protocol,
 				LoadBalancerPolicy:   lbPolicy,
 				TCPHealthCheckPolicy: healthPolicy,
@@ -1926,7 +1926,7 @@ func redirectRoutePolicy(redirect *contour_v1.HTTPRequestRedirectPolicy) (*Redir
 
 	var portNumber uint32
 	if redirect.Port != nil {
-		portNumber = uint32(*redirect.Port)
+		portNumber = uint32(*redirect.Port) //nolint:gosec // disable G115
 	}
 
 	var scheme string
@@ -1971,7 +1971,7 @@ func directResponsePolicy(direct *contour_v1.HTTPDirectResponsePolicy) *DirectRe
 		return nil
 	}
 
-	return directResponse(uint32(direct.StatusCode), direct.Body)
+	return directResponse(uint32(direct.StatusCode), direct.Body) //nolint:gosec // disable G115
 }
 
 func internalRedirectPolicy(internal *contour_v1.HTTPInternalRedirectPolicy) *InternalRedirectPolicy {

diff --git a/internal/dag/policy.go b/internal/dag/policy.go
@@ -93,6 +93,7 @@ func retryPolicy(rp *contour_v1.RetryPolicy) *RetryPolicy {
 	// If set to -1, then retries set to 0. If set to 0 or
 	// not supplied, the value is set to the Envoy default of 1.
 	// Otherwise the value supplied is returned.
+	// CRD validation guarantees -1 is the minimum value.
 	switch rp.NumRetries {
 	case -1:
 		numRetries = 0
@@ -103,7 +104,7 @@ func retryPolicy(rp *contour_v1.RetryPolicy) *RetryPolicy {
 	return &RetryPolicy{
 		RetryOn:              retryOn(rp.RetryOn),
 		RetriableStatusCodes: rp.RetriableStatusCodes,
-		NumRetries:           uint32(numRetries),
+		NumRetries:           uint32(numRetries), //nolint:gosec // disable G115
 		PerTryTimeout:        perTryTimeout,
 	}
 }
@@ -512,8 +513,8 @@ func httpHealthCheckPolicy(hc *contour_v1.HTTPHealthCheckPolicy) (*HTTPHealthChe
 		Host:               hc.Host,
 		Interval:           time.Duration(hc.IntervalSeconds) * time.Second,
 		Timeout:            time.Duration(hc.TimeoutSeconds) * time.Second,
-		UnhealthyThreshold: uint32(hc.UnhealthyThresholdCount),
-		HealthyThreshold:   uint32(hc.HealthyThresholdCount),
+		UnhealthyThreshold: uint32(hc.UnhealthyThresholdCount), //nolint:gosec // disable G115
+		HealthyThreshold:   uint32(hc.HealthyThresholdCount),   //nolint:gosec // disable G115
 		ExpectedStatuses:   expectedStatuses,
 	}, nil
 }

diff --git a/internal/dag/status_test.go b/internal/dag/status_test.go
@@ -5168,7 +5168,7 @@ func TestDAGStatus(t *testing.T) {
 	})
 }
 
-func validGatewayStatusUpdate(listenerName string, listenerProtocol gatewayapi_v1.ProtocolType, attachedRoutes int) []*status.GatewayStatusUpdate {
+func validGatewayStatusUpdate(listenerName string, listenerProtocol gatewayapi_v1.ProtocolType, attachedRoutes int32) []*status.GatewayStatusUpdate {
 	var supportedKinds []gatewayapi_v1.RouteGroupKind
 
 	switch listenerProtocol {
@@ -5218,7 +5218,7 @@ func validGatewayStatusUpdate(listenerName string, listenerProtocol gatewayapi_v
 			ListenerStatus: map[string]*gatewayapi_v1.ListenerStatus{
 				listenerName: {
 					Name:           gatewayapi_v1.SectionName(listenerName),
-					AttachedRoutes: int32(attachedRoutes),
+					AttachedRoutes: attachedRoutes,
 					SupportedKinds: supportedKinds,
 					Conditions:     listenerValidConditions(),
 				},

diff --git a/internal/envoy/v3/endpoint.go b/internal/envoy/v3/endpoint.go
@@ -40,7 +40,7 @@ func HealthCheckConfig(healthCheckPort int32) *envoy_config_endpoint_v3.Endpoint
 		return nil
 	}
 	return &envoy_config_endpoint_v3.Endpoint_HealthCheckConfig{
-		PortValue: uint32(healthCheckPort),
+		PortValue: uint32(healthCheckPort), //nolint:gosec // disable G115
 	}
 }
 

diff --git a/internal/envoy/v3/listener.go b/internal/envoy/v3/listener.go
@@ -685,6 +685,7 @@ func UnixSocketAddress(address string) *envoy_config_core_v3.Address {
 
 // SocketAddress creates a new TCP envoy_config_core_v3.Address.
 func SocketAddress(address string, port int) *envoy_config_core_v3.Address {
+	portValue := uint32(port) //nolint:gosec // disable G115
 	if address == "::" {
 		return &envoy_config_core_v3.Address{
 			Address: &envoy_config_core_v3.Address_SocketAddress{
@@ -693,7 +694,7 @@ func SocketAddress(address string, port int) *envoy_config_core_v3.Address {
 					Address:    address,
 					Ipv4Compat: true,
 					PortSpecifier: &envoy_config_core_v3.SocketAddress_PortValue{
-						PortValue: uint32(port),
+						PortValue: portValue,
 					},
 				},
 			},
@@ -705,7 +706,7 @@ func SocketAddress(address string, port int) *envoy_config_core_v3.Address {
 				Protocol: envoy_config_core_v3.SocketAddress_TCP,
 				Address:  address,
 				PortSpecifier: &envoy_config_core_v3.SocketAddress_PortValue{
-					PortValue: uint32(port),
+					PortValue: portValue,
 				},
 			},
 		},

diff --git a/internal/envoy/v3/ratelimit.go b/internal/envoy/v3/ratelimit.go
@@ -64,7 +64,7 @@ func LocalRateLimitConfig(config *dag.LocalRateLimitPolicy, statPrefix string) *
 
 	// Envoy defaults to 429 (Too Many Requests) if this is not specified.
 	if config.ResponseStatusCode > 0 {
-		c.Status = &envoy_type_v3.HttpStatus{Code: envoy_type_v3.StatusCode(config.ResponseStatusCode)}
+		c.Status = &envoy_type_v3.HttpStatus{Code: envoy_type_v3.StatusCode(config.ResponseStatusCode)} //nolint:gosec // disable G115
 	}
 
 	return protobuf.MustMarshalAny(c)

diff --git a/internal/envoy/v3/route.go b/internal/envoy/v3/route.go
@@ -229,7 +229,7 @@ func ipFilterConfig(allow bool, rules []dag.IPFilterRule) *envoy_filter_http_rba
 		prefixLen, _ := f.CIDR.Mask.Size()
 		cidr := &envoy_config_core_v3.CidrRange{
 			AddressPrefix: f.CIDR.IP.String(),
-			PrefixLen:     wrapperspb.UInt32(uint32(prefixLen)),
+			PrefixLen:     wrapperspb.UInt32(uint32(prefixLen)), //nolint:gosec // disable G115
 		}
 
 		if f.Remote {
@@ -518,7 +518,7 @@ func mirrorPolicy(r *dag.Route) []*envoy_config_route_v3.RouteAction_RequestMirr
 			Cluster: envoy.Clustername(mp.Cluster),
 			RuntimeFraction: &envoy_config_core_v3.RuntimeFractionalPercent{
 				DefaultValue: &envoy_type_v3.FractionalPercent{
-					Numerator:   uint32(mp.Weight),
+					Numerator:   uint32(mp.Weight), //nolint:gosec // disable G115
 					Denominator: envoy_type_v3.FractionalPercent_HUNDRED,
 				},
 			},

diff --git a/internal/featuretests/v3/envoy.go b/internal/featuretests/v3/envoy.go
@@ -286,12 +286,12 @@ func withIdleTimeout(route *envoy_config_route_v3.Route_Route, timeout time.Dura
 	return route
 }
 
-func withMirrorPolicy(route *envoy_config_route_v3.Route_Route, mirror string, weight int64) *envoy_config_route_v3.Route_Route {
+func withMirrorPolicy(route *envoy_config_route_v3.Route_Route, mirror string, weight uint32) *envoy_config_route_v3.Route_Route {
 	route.Route.RequestMirrorPolicies = []*envoy_config_route_v3.RouteAction_RequestMirrorPolicy{{
 		Cluster: mirror,
 		RuntimeFraction: &envoy_config_core_v3.RuntimeFractionalPercent{
 			DefaultValue: &envoy_type_v3.FractionalPercent{
-				Numerator:   uint32(weight),
+				Numerator:   weight,
 				Denominator: envoy_type_v3.FractionalPercent_HUNDRED,
 			},
 		},

diff --git a/internal/featuretests/v3/featuretests.go b/internal/featuretests/v3/featuretests.go
@@ -321,7 +321,7 @@ func (s *StatusResult) Equals(want contour_v1.HTTPProxyStatus) *Contour {
 	// We should never get an error fetching the status for an
 	// object, so make it fatal if we do.
 	if s.Err != nil {
-		s.T.Fatalf(s.Err.Error())
+		s.T.Fatal(s.Err.Error())
 	}
 
 	assert.Equal(s.T, want, *s.Have)
@@ -336,7 +336,7 @@ func (s *StatusResult) Like(want contour_v1.HTTPProxyStatus) *Contour {
 	// We should never get an error fetching the status for an
 	// object, so make it fatal if we do.
 	if s.Err != nil {
-		s.T.Fatalf(s.Err.Error())
+		s.T.Fatal(s.Err.Error())
 	}
 
 	if len(want.CurrentStatus) > 0 {