Upgrade to Go 1.26 and Operator SDK v1.39.1

.ci/minikube_integration.sh

@@ -62,8 +62,6 @@ kubectl wait deploy/registry-operator-controller-manager --namespace registry-op
 if [ $? -ne 0 ]; then
     echo "manager container logs:"
     kubectl logs -l app=devfileregistry-operator --namespace registry-operator-system --container manager
-    echo "kube-rbac-proxy container logs:"
-    kubectl logs -l app=devfileregistry-operator --namespace registry-operator-system --container kube-rbac-proxy
 
     # Return the description of every pod
     kubectl describe pods --namespace registry-operator-system

.github/workflows/ci.yaml

@@ -50,11 +50,8 @@ jobs:
           fi
       - name: Check format
         run: |
-          go get github.com/google/addlicense@v1.1.1
           go install github.com/google/addlicense@v1.1.1
-          go get golang.org/x/tools/cmd/goimports@v0.24.0
-          go install golang.org/x/tools/cmd/goimports@v0.24.0
-          git reset HEAD --hard
+          go install golang.org/x/tools/cmd/goimports@v0.52.0
 
           make fmt
           if [[ ! -z $(git status -s) ]]
@@ -80,7 +77,7 @@ jobs:
 
       - name: Run Gosec Security Scanner
         run: |
-          go install github.com/securego/gosec/v2/cmd/gosec@e0cca6fe95306b7e7790d6f1bf6a7bec6d622459 # v2.22.0
+          go install github.com/securego/gosec/v2/cmd/gosec@v2.29.0
           make gosec
           if [[ $? != 0 ]]
           then
@@ -105,6 +102,11 @@ jobs:
       - name: Set up QEMU # Enables arm64 image building
         uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
+      - name: Set up Go 1.x
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version-file: "go.mod"
+
       - name: Check if operator docker build is working
         run: make docker-buildx-build
 

.github/workflows/release-pr.yaml

@@ -73,7 +73,7 @@ jobs:
       - gosec
     runs-on: ubuntu-latest
     env:
-      OPERATOR_SDK_DL_URL: https://github.com/operator-framework/operator-sdk/releases/download/v1.28.0
+      OPERATOR_SDK_DL_URL: https://github.com/operator-framework/operator-sdk/releases/download/v1.39.1
       OPERATOR_SDK_CLI: ./operator-sdk
     steps:
       - name: Checkout registry-operator source code

.gitignore

@@ -25,3 +25,6 @@ bin
 
 # cache directory
 .cache/
+
+# Consolidated installation manifests
+dist/

CLUSTER_SUPPORT.md

@@ -5,11 +5,11 @@ systems based on which Operator SDK version the registry operator
 is using as well as the API overlap between OpenShift and 
 Kubernetes. 
 
-Operator currently targets [Kubernetes 1.29 API](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md) and is tested on [OpenShift 4.18](https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes).
+Operator currently targets [Kubernetes 1.31 API](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.31.md) and is tested on [OpenShift 4.18](https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes).
 
 ## Operator SDK
 
-Current version in use by the Registry Operator is [Operator SDK v1.28.0](https://sdk.operatorframework.io/docs/upgrading-sdk-version/v1.28.0/), planned to use [Operator SDK v1.39.1](https://sdk.operatorframework.io/docs/upgrading-sdk-version/v1.39.1/) ([devfile/api#1626](https://github.com/devfile/api/issues/1626)) to be in sync with target OpenShift 4.18 version.
+The Registry Operator uses [Operator SDK v1.39.1](https://sdk.operatorframework.io/docs/upgrading-sdk-version/v1.39.1/) and Kubernetes 1.31 APIs, completing the planned SDK alignment for OpenShift 4.18 ([devfile/api#1626](https://github.com/devfile/api/issues/1626)).
 
 To update the Operator SDK, refer to [Upgrade SDK Version](https://sdk.operatorframework.io/docs/upgrading-sdk-version/) 
 and change the following

Dockerfile

@@ -14,8 +14,9 @@
 # limitations under the License.
 
 # Build the manager binary
-FROM registry.access.redhat.com/ubi9/go-toolset:1.24.4-1754467841@sha256:3f552f246b4bd5bdfb4da0812085d381d00d3625769baecaed58c2667d344e5c as builder
-ARG TARGETARCH=amd64
+FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:1.26.7-1792425967@sha256:68d6b72cc3eb4c7975b2aca2451f6601c048c095d6b5fc2a310ce3df5ef2ada6 AS builder
+ARG TARGETOS=linux
+ARG TARGETARCH
 USER root
 
 WORKDIR /workspace
@@ -27,13 +28,13 @@ COPY go.sum go.sum
 RUN go mod download
 
 # Copy the go source
-COPY main.go main.go
+COPY cmd/ cmd/
 COPY api/ api/
-COPY controllers/ controllers/
+COPY internal/ internal/
 COPY pkg/ pkg/
 
 # Build
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -a -o manager main.go
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} GO111MODULE=on go build -a -o manager cmd/main.go
 
 ARG ENABLE_WEBHOOKS=true
 ENV ENABLE_WEBHOOKS=${ENABLE_WEBHOOKS}

Makefile

@@ -33,13 +33,13 @@ BUNDLE_METADATA_OPTS ?= $(BUNDLE_CHANNELS) $(BUNDLE_DEFAULT_CHANNEL)
 # Image URL to use all building/pushing image targets
 IMG ?= quay.io/devfile/registry-operator:next
 # ENVTEST_VERSION refers to the version of the setup-envtest binary to use
-ENVTEST_VERSION=v0.0.0-20240405143037-c25fe2f5ca0f
+ENVTEST_VERSION ?= release-0.19
 # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
-ENVTEST_K8S_VERSION = 1.26
+ENVTEST_K8S_VERSION ?= 1.31.0
 # Controller tools version number
-CONTROLLER_TOOLS_VERSION ?= v0.14.0
+CONTROLLER_TOOLS_VERSION ?= v0.23.0
 # Kustomize version number
-KUSTOMIZE_VERSION ?= v3.8.7
+KUSTOMIZE_VERSION ?= v5.4.3
 
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))
@@ -110,7 +110,9 @@ TARGET_ARCH ?= amd64
 
 .PHONY: test
 test: manifests generate fmt vet envtest ## Run tests.
-	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" go test -timeout=1h `go list ./... | grep -v /tests/` -coverprofile cover.out -v
+	KUBEBUILDER_ASSETS="$$( $(ENVTEST) use $(ENVTEST_K8S_VERSION) --use-deprecated-gcs=false -p path )"; \
+	export KUBEBUILDER_ASSETS; \
+	go test -timeout=1h `go list ./... | grep -v /tests/` -coverprofile cover.out -v
 
 ### test-integration: runs integration tests on the cluster set in context.
 .PHONY: test-integration
@@ -123,12 +125,13 @@ test-integration:
 ##@ Build
 
 .PHONY: build manager
+build: manager
 manager: manifests generate fmt vet ## Build manager binary.
-	GOOS=${TARGET_OS} GOARCH=${TARGET_ARCH} go build -o $(LOCALBIN)/manager ./main.go
+	GOOS=${TARGET_OS} GOARCH=${TARGET_ARCH} go build -o $(LOCALBIN)/manager ./cmd/main.go
 
 .PHONY: run
 run: manifests generate fmt vet ## Run a controller from your host.
-	$(LOCALBIN)/manager
+	go run ./cmd/main.go
 
 .PHONY: manifests
 manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
@@ -197,39 +200,37 @@ PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
 .PHONY: docker-buildx-build
 docker-buildx-build: test
 	$(MAKE) docker-buildx-setup
-	- docker buildx build --platform=$(PLATFORMS) --tag ${IMG} --provenance=false -f Dockerfile.cross $(shell pwd)
+	docker buildx build --platform=$(PLATFORMS) --tag ${IMG} --provenance=false -f Dockerfile $(shell pwd)
 	$(MAKE) docker-buildx-cleanup
 
 .PHONY: docker-buildx-push
 docker-buildx-push: test 
 	$(MAKE) docker-buildx-setup
-	- docker buildx build --push --platform=$(PLATFORMS) --tag ${IMG} --provenance=false -f Dockerfile.cross $(shell pwd)
+	docker buildx build --push --platform=$(PLATFORMS) --tag ${IMG} --provenance=false -f Dockerfile $(shell pwd)
 	$(MAKE) docker-buildx-cleanup
 
 # INTERNAL: Used to setup the docker-buildx command, not to be called by users
 .PHONY: docker-buildx-setup
 docker-buildx-setup:
-	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross
 	- docker buildx create --name registry-operator-builder
 	docker buildx use registry-operator-builder
 
 # INTERNAL: Used to cleanup the docker-buildx command, not to be called by users
 .PHONY: docker-buildx-cleanup
 docker-buildx-cleanup:
 	- docker buildx rm registry-operator-builder
-	rm Dockerfile.cross
 
 # Build the bundle image.
 .PHONY: docker-bundle-buildx-build
 docker-bundle-buildx-build:
 	$(MAKE) docker-bundle-buildx-setup
-	- docker buildx build --platform=${PLATFORMS} --tag ${BUNDLE_IMG} --provenance=false -f bundle.Dockerfile $(shell pwd)
+	docker buildx build --platform=${PLATFORMS} --tag ${BUNDLE_IMG} --provenance=false -f bundle.Dockerfile $(shell pwd)
 	$(MAKE) docker-bundle-buildx-cleanup
 
 .PHONY: docker-bundle-buildx-push
 docker-bundle-buildx-push:
 	$(MAKE) docker-bundle-buildx-setup
-	- docker buildx build --push --platform=${PLATFORMS} --tag ${BUNDLE_IMG} --provenance=false -f bundle.Dockerfile $(shell pwd)
+	docker buildx build --push --platform=${PLATFORMS} --tag ${BUNDLE_IMG} --provenance=false -f bundle.Dockerfile $(shell pwd)
 	$(MAKE) docker-bundle-buildx-cleanup
 
 # INTERNAL: Used to setup the docker-bundle-buildx command, not to be called by users
@@ -245,19 +246,17 @@ docker-bundle-buildx-cleanup:
 
 # Clone of docker-buildx command but redesigned to work with podman's workflow
 # Designed to build and push multi architecture images of the registry operator
-# This utilizes a new Dockerfile to insert platform args to preserve the original Dockerfile
+# The Dockerfile uses BUILDPLATFORM and TARGETARCH for cross-compilation.
 .PHONY: podman-buildx-build
 podman-buildx-build: test
-	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross
 	- podman manifest create ${IMG}
-	- podman build --platform=$(PLATFORMS) --manifest ${IMG} -f Dockerfile.cross $(shell pwd)
+	- podman build --platform=$(PLATFORMS) --manifest ${IMG} -f Dockerfile $(shell pwd)
 
 # Contains cleanup steps to remove files and manifests created during build
 .PHONY: podman-buildx-push
 podman-buildx-push:
 	- podman manifest push ${IMG}
 	- podman manifest rm ${IMG}
-	rm Dockerfile.cross
 
 # Build the podman image
 .PHONY: podman-build
@@ -283,10 +282,8 @@ uninstall-cert:
 # find or download controller-gen
 # download controller-gen if necessary
 .PHONY: controller-gen
-controller-gen: $(CONTROLLER_GEN)
-$(CONTROLLER_GEN): $(LOCALBIN)
-	test -s $(LOCALBIN)/controller-gen && $(LOCALBIN)/controller-gen --version | grep -q $(CONTROLLER_TOOLS_VERSION) || \
-GOBIN=$(LOCALBIN) GOFLAGS="" go install sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_TOOLS_VERSION)
+controller-gen: $(LOCALBIN)
+	$(call go-install-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen,$(CONTROLLER_TOOLS_VERSION))
 
 ##@ Deployment
 
@@ -307,20 +304,38 @@ deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in
 undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
 	$(KUSTOMIZE) build config/default | $(K8S_CLI) delete -f -
 
-KUSTOMIZE_INSTALL_SCRIPT ?= "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"
 .PHONY: kustomize
-kustomize: $(KUSTOMIZE)
-$(KUSTOMIZE): $(LOCALBIN)
-	test -s $(LOCALBIN)/kustomize || { curl -s $(KUSTOMIZE_INSTALL_SCRIPT) | bash -s -- $(subst v,,$(KUSTOMIZE_VERSION)) $(LOCALBIN); }
+kustomize: $(LOCALBIN) ## Download the configured kustomize version.
+	$(call go-install-tool,$(KUSTOMIZE),sigs.k8s.io/kustomize/kustomize/v5,$(KUSTOMIZE_VERSION))
 
 .PHONY: envtest
-envtest: $(ENVTEST) ## Download envtest-setup locally if necessary.
-$(ENVTEST): $(LOCALBIN)
-	test -s $(LOCALBIN)/setup-envtest || GOBIN=$(LOCALBIN) GOFLAGS="" go install sigs.k8s.io/controller-runtime/tools/setup-envtest@$(ENVTEST_VERSION)
+envtest: $(LOCALBIN) ## Download the configured setup-envtest version.
+	$(call go-install-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest,$(ENVTEST_VERSION))
+
+# Keep versioned binaries and refresh the stable symlink on every invocation.
+# Install into a temporary directory so an existing symlink cannot overwrite another version.
+define go-install-tool
+	@set -e; \
+	if [ ! -f "$(1)-$(3)" ]; then \
+		tool_dir=$$(mktemp -d); \
+		trap 'rm -rf "$$tool_dir"' EXIT; \
+		GOBIN=$$tool_dir GOFLAGS="" go install $(2)@$(3); \
+		tool_name=$$(basename $(2)); \
+		case "$$tool_name" in v[0-9]*) tool_name=$$(basename $$(dirname $(2)));; esac; \
+		mv "$$tool_dir/$$tool_name" "$(1)-$(3)"; \
+	fi; \
+	ln -sf "$(abspath $(1)-$(3))" "$(1)"
+endef
+
+.PHONY: build-installer
+build-installer: manifests generate kustomize ## Generate dist/install.yaml with CRDs and deployment.
+	mkdir -p dist
+	cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG)
+	$(KUSTOMIZE) build config/default > dist/install.yaml
 
 # Generate bundle manifests and metadata, then validate generated files.
 .PHONY: bundle
-bundle: manifests
+bundle: manifests kustomize
 	$(OPERATOR_SDK_CLI) generate kustomize manifests -q
 	cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG)
 	$(KUSTOMIZE) build config/manifests | $(OPERATOR_SDK_CLI) generate bundle -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS)
@@ -340,5 +355,5 @@ bundle-push:
 .PHONY: gosec
 gosec:
 	# Run this command to install gosec, if not installed:
-	# go install github.com/securego/gosec/v2/cmd/gosec@v2.22.0
+	# go install github.com/securego/gosec/v2/cmd/gosec@v2.29.0
 	gosec -no-fail -fmt=sarif -out=gosec.sarif -exclude-dir pkg/test -exclude-dir tests ./...

PROJECT

@@ -1,8 +1,7 @@
 domain: devfile.io
 layout:
-- go.kubebuilder.io/v3
+- go.kubebuilder.io/v4
 plugins:
-  go.sdk.operatorframework.io/v2: {}
   manifests.sdk.operatorframework.io/v2: {}
   scorecard.sdk.operatorframework.io/v2: {}
 projectName: registry-operator

README.md

@@ -3,7 +3,7 @@
 
 <div id="header">
 
-[![Go 1.24](https://img.shields.io/badge/1.24-blue?logo=go&labelColor=gray)](https://go.dev/doc/go1.24)
+[![Go 1.26](https://img.shields.io/badge/1.26-blue?logo=go&labelColor=gray)](https://go.dev/doc/go1.26)
 [![Apache2.0 License](https://img.shields.io/badge/license-Apache2.0-brightgreen.svg)](LICENSE)
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/8256/badge)](https://www.bestpractices.dev/projects/8256)
 [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/devfile/registry-operator/badge)](https://securityscorecards.dev/viewer/?uri=github.com/devfile/registry-operator)
@@ -39,17 +39,19 @@ Deployment cluster must meet one of the following criteria:
 - OpenShift Container Platform (OCP) 4.15.x-4.18.x
 - Kubernetes 1.29.x-1.31.x
 
-More on the support of container orchestration systems can be 
+More on the support of container orchestration systems can be
 found [here](CLUSTER_SUPPORT.md).
 
-Deployments made by the devfile registry operator must *never* target the default namespace due to incompatibility with 
+Deployments made by the devfile registry operator must *never* target the default namespace due to incompatibility with
 security setups.
 
 ### Development
 
-- Go 1.24.x
+See [the SDK 1.39.1 migration notes](SDK_MIGRATION.md) for layout and metrics changes.
+
+- Go 1.26.x
 - Docker / Podman
-- Operator SDK 1.28.x
+- Operator SDK 1.39.1
 
 See [Upgrade SDK Version](https://sdk.operatorframework.io/docs/upgrading-sdk-version/) for a guide on updating the Operator SDK. Ensure the Operator SDK version and the version of Kubernetes APIs match each other when updating by checking [CLUSTER_SUPPORT.md](CLUSTER_SUPPORT.md).
 
@@ -85,9 +87,10 @@ The repository contains a Makefile; building and deploying can be configured via
 | `ENABLE_WEBHOOK_HTTP2` | Overrides webhook HTTP server deployment to use http/2 if set to `true`, **not recommended** | `false` |
 | `BUNDLE_CHANNELS` | Sets the list channel(s) include bundle build under | `alpha` |
 | `BUNDLE_DEFAULT_CHANNEL` | Sets the default channel to use when installing the bundle | |
-| `ENVTEST_K8S_VERSION` | Version of k8s to use for the test environment | `1.26` (current) |
-| `CONTROLLER_TOOLS_VERSION` | Version of the controller tools | `v0.14.0` |
-| `KUSTOMIZE_VERSION` | Version of kustomize | `v3.8.7` | 
+| `ENVTEST_VERSION` | Version of setup-envtest | `release-0.19` |
+| `ENVTEST_K8S_VERSION` | Version of k8s to use for the test environment | `1.31.0` (current) |
+| `CONTROLLER_TOOLS_VERSION` | Version of the controller tools | `v0.23.0` |
+| `KUSTOMIZE_VERSION` | Version of kustomize | `v5.4.3` |
 | `GOBIN` | Path to install Go binaries to | `${GOPATH}/bin` |
 | `K8S_CLI` | Path to CLI tool to use with the target cluster environment, `kubectl` or `oc` | Either `oc` or `kubectl` if installed in that order |
 | `OPERATOR_SDK_CLI` | CLI path to `operator-sdk` tool | `operator-sdk` |
@@ -99,13 +102,13 @@ The repository contains a Makefile; building and deploying can be configured via
 | `TARGET_ARCH` | Target architecture for operator manager builds, possible values: `amd64`, `arm64`, `s390x`, `ppc64le` | `amd64` |
 | `TARGET_OS` | Target operating system for operator manager build, **only for `make manager`** | `linux` |
 | `PLATFORMS` | Target architecture(s) for `make docker-buildx` | All supported: `linux/arm64,linux/amd64,linux/s390x,linux/ppc64le` |
-| `KUSTOMIZE_INSTALL_SCRIPT` | URL of kustomize installation script, see [kustomize installation instructions](https://kubectl.docs.kubernetes.io/installation/kustomize/binaries/) | `https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh` |
 
 
 Some of the rules supported by the makefile:
 
 |rule|purpose|
 |---|---|
+| build-installer | generate `dist/install.yaml` with CRDs and deployment |
 | controller-gen | install the controller-gen tool, used by other commands |
 | kustomize | install the kustomize tool, used by other commands |
 | docker-build | build registry operator container image using docker |
@@ -145,7 +148,7 @@ Further information for the devfile organization security policy can be found [h
 Detailed instructions on how to run tests for the Devfile Registry Operator are found in [CONTRIBUTING.md](CONTRIBUTING.md#testing-your-changes).
 
 ### Run operator locally
-It's possible to run an instance of the operator locally while communicating with a cluster. 
+It's possible to run an instance of the operator locally while communicating with a cluster.
 
 1. You may need to install the `controller-gen` tool before, used when building the binary:
 
@@ -179,4 +182,3 @@ Please see our [CONTRIBUTING.md](./CONTRIBUTING.md).
 - [`make test-integration` times out when running in Minikube](https://github.com/devfile/api/issues/1313)
 - [Headless mode field does not update devfile registry state during reconcile](https://github.com/devfile/api/issues/1258)
 - [`make bundle` removes `alm-examples` for `DevfileRegistriesList` and `ClusterDevfileRegistriesList` CRDs due to bug with Kustomize](https://github.com/kubernetes-sigs/kustomize/issues/5042)
-- [Operator SDK is out of sync, should be upgraded to v1.39.1](https://github.com/devfile/api/issues/1626)