diff --git a/.gitattributes b/.gitattributes index eae8351..d6894d5 100644 --- a/.gitattributes +++ b/.gitattributes @@ -21,3 +21,9 @@ go.sum text eol=lf # generated keeps it out of GitHub language stats and collapses it # in PR diffs by default. pkg/generated/** linguist-generated + +# Golden render snapshots are regenerated mechanically via +# `TALM_UPDATE_GOLDEN=1 go test ./pkg/engine/ -run TestGoldenRender`, +# not hand-edited. Marking them generated keeps the rendered YAML dumps +# out of language stats and collapses them in PR diffs by default. +pkg/engine/testdata/golden/** linguist-generated diff --git a/docs/manual-test-plan.md b/docs/manual-test-plan.md index 032a54b..d2dd5b5 100644 --- a/docs/manual-test-plan.md +++ b/docs/manual-test-plan.md @@ -986,6 +986,28 @@ Expected (per node): `node 192.0.2.10: talm: drift verification unavailable on m Regression anchor: a refactor that always-prefixes (`node : talm: ...` on single-node) is a UX regression. The `nodePrefix("")` helper must collapse to empty for the bare-line single-node case. +### D4. TLS `--skip-verify` — native honored, wrapped passthrough warned + +`--skip-verify` skips server-certificate verification while preserving client-certificate authentication, for connecting to a node whose IP is absent from the server cert SANs. It is reimplemented in talm (`WithClientSkipVerify` in `pkg/commands/root.go`) now that the cozystack/talos fork is dropped, and its coverage differs by command kind. + +Native command (apply / template / upgrade / rotate-ca) — the flag is honored. Run against a node reachable by an IP that is NOT in the server cert SANs: + +```bash +talm apply --dry-run --skip-verify --nodes 192.0.2.10 -f nodes/node0.yaml +``` + +Expected: the connection succeeds (no `x509: certificate is valid for … not 192.0.2.10` TLS SAN error) and the dry-run render proceeds. + +Wrapped talosctl passthrough command (health / get / dashboard / …) — the flag is NOT supported, and the command says so instead of failing opaquely: + +```bash +talm health --skip-verify --nodes 192.0.2.10 +``` + +Expected (stderr): `Warning: --skip-verify is not supported for the wrapped talosctl command "health"; it applies only to talm-native commands (apply, template, upgrade, rotate-ca). Connecting with full TLS verification.` — the command then connects with full verification (and fails against an out-of-SAN IP, as it would without the flag). + +Regression anchor: `pkg/commands/skip_verify_test.go` pins the TLS config (skip server verify + client cert preserved), the native routing (`WithClientNoNodes` / `WithClient` reach `WithClientSkipVerify`), the `--cluster` and dial-option threading, and the passthrough warning. A change that silently no-ops `--skip-verify` on native commands, or drops the passthrough warning, is a regression. + ## E. Upgrade ### E1. Stage an upgrade to the same image diff --git a/go.mod b/go.mod index efabf74..dcfdcb3 100644 --- a/go.mod +++ b/go.mod @@ -1,89 +1,88 @@ module github.com/cozystack/talm -go 1.26.3 +go 1.26.5 // Kubernetes dependencies sharing the same version. require ( - k8s.io/api v0.35.3 - k8s.io/apimachinery v0.35.3 - k8s.io/client-go v0.35.3 - k8s.io/component-base v0.35.3 // indirect + k8s.io/api v0.36.2 + k8s.io/apimachinery v0.36.2 + k8s.io/client-go v0.36.2 + k8s.io/component-base v0.36.2 // indirect ) require ( cloud.google.com/go/compute/metadata v0.9.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 // indirect - github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.4.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 // indirect - github.com/aws/aws-sdk-go-v2/config v1.32.14 // indirect - github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21 // indirect - github.com/aws/aws-sdk-go-v2/service/kms v1.50.4 // indirect - github.com/aws/smithy-go v1.24.3 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.5.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 // indirect + github.com/aws/aws-sdk-go-v2/config v1.32.30 // indirect + github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30 // indirect + github.com/aws/aws-sdk-go-v2/service/kms v1.54.1 // indirect + github.com/aws/smithy-go v1.27.4 // indirect github.com/blang/semver/v4 v4.0.0 // indirect github.com/cenkalti/backoff/v4 v4.3.0 // indirect github.com/containernetworking/cni v1.3.0 // indirect - github.com/cosi-project/runtime v1.14.1 + github.com/cosi-project/runtime v1.16.2 github.com/distribution/reference v0.6.0 // indirect - github.com/docker/cli v29.4.0+incompatible // indirect + github.com/docker/cli v29.6.2+incompatible // indirect github.com/dustin/go-humanize v1.0.1 github.com/fatih/color v1.19.0 // indirect github.com/foxboron/go-uefi v0.0.0-20251010190908-d29549a44f29 // indirect - github.com/gdamore/tcell/v2 v2.13.8 // indirect + github.com/gdamore/tcell/v2 v2.13.10 // indirect github.com/gertd/go-pluralize v0.2.1 // indirect - github.com/gizak/termui/v3 v3.1.0 // indirect - github.com/google/cel-go v0.28.0 // indirect - github.com/google/go-containerregistry v0.21.4 // indirect + github.com/google/cel-go v0.29.2 // indirect + github.com/google/go-containerregistry v0.21.7 // indirect github.com/google/go-tpm v0.9.8 // indirect github.com/google/uuid v1.6.0 // indirect - github.com/gopacket/gopacket v1.5.0 // indirect + github.com/gopacket/gopacket v1.7.0 // indirect github.com/hashicorp/go-multierror v1.1.1 - github.com/jsimonetti/rtnetlink/v2 v2.2.0 // indirect - github.com/klauspost/compress v1.18.5 // indirect - github.com/mattn/go-isatty v0.0.21 // indirect - github.com/mdlayher/ethtool v0.6.0 // indirect + github.com/jsimonetti/rtnetlink/v2 v2.2.1-0.20260317095713-310581b9c6ac // indirect + github.com/klauspost/compress v1.19.1 // indirect + github.com/mattn/go-isatty v0.0.23 // indirect + github.com/mdlayher/ethtool v0.6.1 // indirect github.com/mdlayher/genetlink v1.4.0 // indirect - github.com/mdlayher/netlink v1.10.0 // indirect + github.com/mdlayher/netlink v1.11.2 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect github.com/opencontainers/image-spec v1.1.1 // indirect github.com/opencontainers/runtime-spec v1.3.0 // indirect - github.com/prometheus/procfs v0.20.1 // indirect + github.com/prometheus/procfs v0.21.1 // indirect github.com/rivo/tview v0.42.0 // indirect github.com/rs/xid v1.6.0 // indirect github.com/ryanuber/columnize v2.1.2+incompatible // indirect github.com/ryanuber/go-glob v1.0.0 // indirect github.com/siderolabs/crypto v0.6.5 - github.com/siderolabs/gen v0.8.6 // indirect - github.com/siderolabs/go-api-signature v0.3.12 // indirect + github.com/siderolabs/gen v0.8.7 // indirect + github.com/siderolabs/go-api-signature v0.3.13 // indirect github.com/siderolabs/go-circular v0.2.3 // indirect github.com/siderolabs/go-kubeconfig v0.1.2 // indirect - github.com/siderolabs/go-kubernetes v0.2.30 // indirect + github.com/siderolabs/go-kubernetes v0.2.41 // indirect github.com/siderolabs/go-pointer v1.0.1 // indirect github.com/siderolabs/go-procfs v0.1.2 // indirect github.com/siderolabs/go-retry v0.3.3 // indirect - github.com/siderolabs/go-talos-support v0.2.0 // indirect + github.com/siderolabs/go-talos-support v0.2.1 // indirect github.com/siderolabs/net v0.4.0 // indirect github.com/siderolabs/proto-codec v0.1.4 // indirect - github.com/siderolabs/talos/pkg/machinery v1.13.0-beta.1 + github.com/siderolabs/talos/pkg/machinery v1.13.7 github.com/sirupsen/logrus v1.9.4 // indirect github.com/spf13/cobra v1.10.2 github.com/spf13/pflag v1.0.10 github.com/stretchr/testify v1.11.1 - go.etcd.io/etcd/api/v3 v3.6.10 // indirect - go.etcd.io/etcd/client/pkg/v3 v3.6.10 // indirect - go.etcd.io/etcd/client/v3 v3.6.10 // indirect - go.etcd.io/etcd/etcdutl/v3 v3.6.10 // indirect - go.uber.org/zap v1.27.1 // indirect - golang.org/x/net v0.53.0 // indirect + go.etcd.io/etcd/api/v3 v3.7.0 // indirect + go.etcd.io/etcd/client/pkg/v3 v3.7.0 // indirect + go.etcd.io/etcd/client/v3 v3.7.0 // indirect + go.etcd.io/etcd/etcdutl/v3 v3.7.0 // indirect + go.uber.org/zap v1.28.0 // indirect + golang.org/x/net v0.57.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/sync v0.20.0 // indirect - golang.org/x/sys v0.43.0 - golang.org/x/term v0.42.0 - golang.org/x/text v0.36.0 // indirect + golang.org/x/sync v0.22.0 // indirect + golang.org/x/sys v0.47.0 + golang.org/x/term v0.45.0 + golang.org/x/text v0.40.0 // indirect golang.org/x/time v0.15.0 // indirect golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 // indirect - google.golang.org/grpc v1.80.0 - google.golang.org/protobuf v1.36.11 + google.golang.org/grpc v1.82.1 + google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af gopkg.in/yaml.v3 v3.0.1 k8s.io/klog/v2 v2.140.0 // indirect sigs.k8s.io/hydrophone v0.7.0 // indirect @@ -94,94 +93,86 @@ require ( filippo.io/age v1.3.1 github.com/BurntSushi/toml v1.6.0 github.com/Masterminds/sprig/v3 v3.3.0 - github.com/cockroachdb/errors v1.13.0 + github.com/cockroachdb/errors v1.14.0 github.com/gobwas/glob v0.2.3 - github.com/siderolabs/talos v1.12.6 - helm.sh/helm/v3 v3.20.2 + github.com/siderolabs/talos v1.13.7 + helm.sh/helm/v4 v4.2.3 ) require ( c2sp.org/CCTV/age v0.0.0-20260405221107-d5c22d3131c5 // indirect - cel.dev/expr v0.25.1 // indirect + cel.dev/expr v0.25.2 // indirect dario.cat/mergo v1.0.2 // indirect filippo.io/hpke v0.4.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect - github.com/AzureAD/microsoft-authentication-library-for-go v1.7.1 // indirect + github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect github.com/MakeNowJust/heredoc v1.0.0 // indirect github.com/Masterminds/goutils v1.1.1 // indirect - github.com/Masterminds/semver/v3 v3.4.0 // indirect + github.com/Masterminds/semver/v3 v3.5.0 // indirect github.com/ProtonMail/go-crypto v1.4.1 // indirect - github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f // indirect - github.com/ProtonMail/gopenpgp/v2 v2.10.0 // indirect + github.com/ProtonMail/gopenpgp/v3 v3.4.1 // indirect github.com/adrg/xdg v0.5.3 // indirect github.com/antlr4-go/antlr/v4 v4.13.1 // indirect github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2 // indirect - github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect - github.com/aws/aws-sdk-go-v2/credentials v1.19.14 // indirect - github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect - github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect - github.com/aws/aws-sdk-go-v2/service/signin v1.0.9 // indirect - github.com/aws/aws-sdk-go-v2/service/sso v1.30.15 // indirect - github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.19 // indirect - github.com/aws/aws-sdk-go-v2/service/sts v1.41.10 // indirect + github.com/aws/aws-sdk-go-v2 v1.42.1 // indirect + github.com/aws/aws-sdk-go-v2/credentials v1.19.29 // indirect + github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 // indirect + github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 // indirect + github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 // indirect + github.com/aws/aws-sdk-go-v2/service/acm v1.42.1 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 // indirect + github.com/aws/aws-sdk-go-v2/service/signin v1.4.1 // indirect + github.com/aws/aws-sdk-go-v2/service/sso v1.32.1 // indirect + github.com/aws/aws-sdk-go-v2/service/ssooidc v1.37.1 // indirect + github.com/aws/aws-sdk-go-v2/service/sts v1.44.1 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/brianvoe/gofakeit/v7 v7.14.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/chai2010/gettext-go v1.0.3 // indirect - github.com/cilium/ebpf v0.21.0 // indirect - github.com/clipperhouse/uax29/v2 v2.7.0 // indirect - github.com/cloudflare/circl v1.6.3 // indirect - github.com/cockroachdb/logtags v0.0.0-20230118201751-21c54148d20b // indirect - github.com/cockroachdb/redact v1.1.5 // indirect - github.com/containerd/containerd/v2 v2.2.2 // indirect + github.com/cloudflare/circl v1.6.4 // indirect + github.com/cockroachdb/logtags v0.0.0-20241215232642-bb51bb14a506 // indirect + github.com/cockroachdb/redact v1.1.8 // indirect + github.com/containerd/containerd/v2 v2.3.3 // indirect github.com/containerd/errdefs v1.0.0 // indirect github.com/containerd/go-cni v1.1.13 // indirect github.com/containerd/log v0.1.0 // indirect - github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect github.com/coreos/go-semver v0.3.1 // indirect github.com/coreos/go-systemd/v22 v22.7.0 // indirect github.com/creack/pty v1.1.24 // indirect - github.com/cyphar/filepath-securejoin v0.6.1 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/dlclark/regexp2 v1.11.5 // indirect - github.com/docker/docker-credential-helpers v0.9.5 // indirect + github.com/docker/docker-credential-helpers v0.9.8 // indirect github.com/emicklei/dot v1.11.0 // indirect github.com/emicklei/go-restful/v3 v3.13.0 // indirect github.com/evanphx/json-patch v5.9.11+incompatible // indirect github.com/evanphx/json-patch/v5 v5.9.11 // indirect github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect - github.com/fatih/camelcase v1.0.0 // indirect - github.com/fluxcd/cli-utils v1.0.0 // indirect - github.com/fluxcd/pkg/ssa v0.70.0 // indirect - github.com/fxamacker/cbor/v2 v2.9.1 // indirect + github.com/fluxcd/cli-utils v1.2.2 // indirect + github.com/fluxcd/pkg/ssa v0.77.0 // indirect + github.com/fxamacker/cbor/v2 v2.9.2 // indirect github.com/gdamore/encoding v1.0.1 // indirect - github.com/getsentry/sentry-go v0.46.0 // indirect + github.com/getsentry/sentry-go v0.48.0 // indirect github.com/ghodss/yaml v1.0.0 // indirect github.com/go-errors/errors v1.5.1 // indirect - github.com/go-logr/logr v1.4.3 // indirect + github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect - github.com/go-openapi/jsonpointer v0.22.5 // indirect - github.com/go-openapi/jsonreference v0.21.5 // indirect - github.com/go-openapi/swag v0.25.5 // indirect - github.com/go-openapi/swag/cmdutils v0.25.5 // indirect - github.com/go-openapi/swag/conv v0.25.5 // indirect - github.com/go-openapi/swag/fileutils v0.25.5 // indirect - github.com/go-openapi/swag/jsonname v0.25.5 // indirect - github.com/go-openapi/swag/jsonutils v0.25.5 // indirect - github.com/go-openapi/swag/loading v0.25.5 // indirect - github.com/go-openapi/swag/mangling v0.25.5 // indirect - github.com/go-openapi/swag/netutils v0.25.5 // indirect - github.com/go-openapi/swag/stringutils v0.25.5 // indirect - github.com/go-openapi/swag/typeutils v0.25.5 // indirect - github.com/go-openapi/swag/yamlutils v0.25.5 // indirect - github.com/go-openapi/testify/enable/yaml/v2 v2.4.2 // indirect - github.com/go-openapi/testify/v2 v2.4.2 // indirect + github.com/go-openapi/jsonpointer v1.0.0 // indirect + github.com/go-openapi/jsonreference v1.0.0 // indirect + github.com/go-openapi/swag v0.27.3 // indirect + github.com/go-openapi/swag/cmdutils v0.27.3 // indirect + github.com/go-openapi/swag/conv v0.27.3 // indirect + github.com/go-openapi/swag/fileutils v0.27.3 // indirect + github.com/go-openapi/swag/jsonutils v0.27.3 // indirect + github.com/go-openapi/swag/loading v0.27.3 // indirect + github.com/go-openapi/swag/mangling v0.27.3 // indirect + github.com/go-openapi/swag/netutils v0.27.3 // indirect + github.com/go-openapi/swag/pools v0.27.3 // indirect + github.com/go-openapi/swag/stringutils v0.27.3 // indirect + github.com/go-openapi/swag/typeutils v0.27.3 // indirect + github.com/go-openapi/swag/yamlutils v0.27.3 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang-jwt/jwt/v5 v5.3.1 // indirect github.com/golang/protobuf v1.5.4 // indirect @@ -189,14 +180,11 @@ require ( github.com/google/gnostic-models v0.7.1 // indirect github.com/google/go-cmp v0.7.0 // indirect github.com/google/go-tpm-tools v0.4.9-0.20260325175049-22911efba9e5 // indirect - github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 // indirect github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect github.com/gosuri/uilive v0.0.4 // indirect github.com/gosuri/uiprogress v0.0.1 // indirect - github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect - github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect + github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect - github.com/hexops/gotextdiff v1.0.3 // indirect github.com/huandu/xstrings v1.5.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/jonboulle/clockwork v0.5.0 // indirect @@ -205,94 +193,88 @@ require ( github.com/kr/text v0.2.0 // indirect github.com/kylelemons/godebug v1.1.0 // indirect github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect - github.com/lmittmann/tint v1.1.3 // indirect + github.com/lmittmann/tint v1.2.0 // indirect github.com/lucasb-eyer/go-colorful v1.4.0 // indirect - github.com/mattn/go-colorable v0.1.14 // indirect - github.com/mattn/go-runewidth v0.0.23 // indirect - github.com/mdlayher/socket v0.6.0 // indirect + github.com/mattn/go-colorable v0.1.15 // indirect + github.com/mdlayher/socket v0.6.1 // indirect github.com/mitchellh/copystructure v1.2.0 // indirect - github.com/mitchellh/go-homedir v1.1.0 // indirect github.com/mitchellh/go-wordwrap v1.0.1 // indirect github.com/mitchellh/reflectwalk v1.0.2 // indirect - github.com/moby/moby/api v1.54.1 // indirect + github.com/moby/moby/api v1.55.0 // indirect github.com/moby/spdystream v0.5.1 // indirect github.com/moby/term v0.5.2 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect - github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect - github.com/nsf/termbox-go v1.1.1 // indirect + github.com/navidys/tvxwidgets v0.14.0 // indirect + github.com/neticdk/go-stdlib v1.0.1 // indirect github.com/peterbourgon/diskv v2.0.1+incompatible // indirect - github.com/petermattis/goid v0.0.0-20260330135022-df67b199bc81 // indirect + github.com/petermattis/goid v0.0.0-20260716134002-a9b348f0a2b9 // indirect github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect github.com/pkg/errors v0.9.1 // indirect - github.com/pkg/xattr v0.4.12 // indirect github.com/planetscale/vtprotobuf v0.6.1-0.20250313105119-ba97887b0a25 // indirect github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect - github.com/prometheus/client_golang v1.23.2 // indirect + github.com/prometheus/client_golang v1.24.0 // indirect github.com/prometheus/client_model v0.6.2 // indirect - github.com/prometheus/common v0.67.5 // indirect + github.com/prometheus/common v0.70.0 // indirect github.com/rivo/uniseg v0.4.7 // indirect - github.com/rogpeppe/go-internal v1.14.1 // indirect + github.com/rogpeppe/go-internal v1.15.0 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect github.com/sasha-s/go-deadlock v0.3.9 // indirect github.com/shopspring/decimal v1.4.0 // indirect - github.com/siderolabs/go-cmd v0.2.0 // indirect + github.com/siderolabs/go-cmd v0.2.1 // indirect github.com/siderolabs/protoenc v0.2.4 // indirect github.com/spf13/afero v1.15.0 // indirect github.com/spf13/cast v1.10.0 // indirect - github.com/spyzhov/ajson v0.9.6 // indirect github.com/stretchr/objx v0.5.3 // indirect - github.com/vbatts/tar-split v0.12.2 // indirect + github.com/tidwall/gjson v1.19.0 // indirect + github.com/tidwall/match v1.2.0 // indirect + github.com/tidwall/pretty v1.2.1 // indirect + github.com/tidwall/sjson v1.2.5 // indirect + github.com/wI2L/jsondiff v0.7.1 // indirect github.com/x448/float16 v0.8.4 // indirect github.com/xiang90/probing v0.0.0-20221125231312-a49e3df8f510 // indirect github.com/xlab/treeprint v1.2.0 // indirect - go.etcd.io/bbolt v1.4.3 // indirect - go.etcd.io/etcd/pkg/v3 v3.6.10 // indirect - go.etcd.io/etcd/server/v3 v3.6.10 // indirect - go.etcd.io/raft/v3 v3.6.0 // indirect + go.etcd.io/bbolt v1.5.0 // indirect + go.etcd.io/etcd/pkg/v3 v3.7.0 // indirect + go.etcd.io/etcd/server/v3 v3.7.0 // indirect + go.etcd.io/raft/v3 v3.7.0 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 // indirect - go.opentelemetry.io/otel v1.43.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect - go.opentelemetry.io/otel/metric v1.43.0 // indirect - go.opentelemetry.io/otel/trace v1.43.0 // indirect + go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0 // indirect + go.opentelemetry.io/otel v1.44.0 // indirect + go.opentelemetry.io/otel/metric v1.44.0 // indirect + go.opentelemetry.io/otel/trace v1.44.0 // indirect go.uber.org/multierr v1.11.0 // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - go.yaml.in/yaml/v4 v4.0.0-rc.4 // indirect - golang.org/x/crypto v0.50.0 // indirect - golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect + go.yaml.in/yaml/v4 v4.0.0-rc.6 // indirect + golang.org/x/crypto v0.54.0 // indirect + golang.org/x/exp v0.0.0-20260718201538-764159d718ef // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260720211330-0afa2a65878a // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260720211330-0afa2a65878a // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect - k8s.io/apiextensions-apiserver v0.35.3 // indirect - k8s.io/cli-runtime v0.35.3 // indirect - k8s.io/component-helpers v0.35.3 // indirect - k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31 // indirect - k8s.io/kubectl v0.35.3 // indirect - k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 // indirect - sigs.k8s.io/cli-utils v0.37.3-0.20250918194211-77c836a69463 // indirect - sigs.k8s.io/controller-runtime v0.23.3 // indirect + k8s.io/apiextensions-apiserver v0.36.2 // indirect + k8s.io/cli-runtime v0.36.2 // indirect + k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect + k8s.io/kubectl v0.36.2 // indirect + k8s.io/streaming v0.36.2 // indirect + k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 // indirect + sigs.k8s.io/controller-runtime v0.24.1 // indirect sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect sigs.k8s.io/kustomize/api v0.21.1 // indirect sigs.k8s.io/kustomize/kyaml v0.21.1 // indirect sigs.k8s.io/randfill v1.0.0 // indirect - sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect + sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect ) exclude github.com/containerd/containerd v1.7.0 -// Replace Sidero Talos with Cozystack Talos fork to include the following fix: -// - https://github.com/siderolabs/talos/pull/12652 (--skip-verify) -// Upstream declined this flag citing a risk of leaking sensitive data to -// a malicious actor impersonating the Talos API, so the fork is required -// for as long as we need --skip-verify. -replace ( - github.com/siderolabs/talos => github.com/cozystack/talos v0.0.0-20260126122716-d18a185e3680 - github.com/siderolabs/talos/pkg/machinery => github.com/cozystack/talos/pkg/machinery v0.0.0-20260126122716-d18a185e3680 -) +// NOTE: talm previously replaced siderolabs/talos with the cozystack/talos fork +// solely for the --skip-verify flag (upstream declined it in siderolabs/talos#12652, +// citing a risk of leaking data to an actor impersonating the Talos API). The flag +// is now reimplemented in pkg/commands (talm-local SkipVerify + WithClientSkipVerify) +// against the stock upstream client, so the fork is no longer needed. diff --git a/go.sum b/go.sum index 0d40d32..e79cb7b 100644 --- a/go.sum +++ b/go.sum @@ -1,7 +1,7 @@ c2sp.org/CCTV/age v0.0.0-20260405221107-d5c22d3131c5 h1:cfA60MkD/UfyN00vKw80uybqDKiJ1colisyotVecLdk= c2sp.org/CCTV/age v0.0.0-20260405221107-d5c22d3131c5/go.mod h1:SrHC2C7r5GkDk8R+NFVzYy/sdj0Ypg9htaPXQq5Cqeo= -cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4= -cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4= +cel.dev/expr v0.25.2 h1:K6j46C81hXtZQfuX60cVWQFBJahKSE2gfRbNuvr5bFs= +cel.dev/expr v0.25.2/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4= cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs= cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8= @@ -12,42 +12,40 @@ filippo.io/hpke v0.4.0 h1:p575VVQ6ted4pL+it6M00V/f2qTZITO0zgmdKCkd5+A= filippo.io/hpke v0.4.0/go.mod h1:EmAN849/P3qdeK+PCMkDpDm83vRHM5cDipBJ8xbQLVY= github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk= github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0/go.mod h1:t76Ruy8AHvUAC8GfMWJMa0ElSbuIcO03NLpynfbgsPA= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 h1:aokoqcHvaGjiM3VpjKDfMMnF/8epJ+Q1HLJ7CudztqE= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0/go.mod h1:/WYEx9pcM9Y+Dd/APJaNlSvVSvzl54rrMdZT5+Oi2LM= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 h1:CU4+EJeJi3TKYWEcYuSdWsjzw0nVsK/H0MSQOiPcymU= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0/go.mod h1:q0+UTSRvShwUCrR/s5HtyInYphN7Wvxb7snFM3u+SLA= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0 h1:xFaZZ+IubdftrDHnGGwZ6QvQ3KHTtWl2MCK+GMt2vxs= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0/go.mod h1:mCBhUhlMjLLJKr5aqw2TNS/VqJOie8MzWq3DAMJeKso= github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4= github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0/go.mod h1:7dCRMLwisfRH3dBupKeNCioWYUZ4SS09Z14H+7i8ZoY= -github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.4.0 h1:mtvR5ZXH5Ew6PSONd5lO5OXovWP1E3oAlgC8fpxor2Q= -github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.4.0/go.mod h1:u560+RFVfG0CBPzkXlDW43slESbBAQjgDGi3r6z+wk8= -github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 h1:E4MgwLBGeVB5f2MdcIVD3ELVAWpr+WD6MUe1i+tM/PA= -github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0/go.mod h1:Y2b/1clN4zsAoUd/pgNAQHjLDnTis/6ROkUfyob6psM= +github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.5.0 h1:15MiSirdxWpIKFEHwfwfMWYieETCUnPTERPIlnytQeo= +github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.5.0/go.mod h1:0AAf/fHAqhIsvD6XGKlCsDO8u+cCiYBBuro+lWS6os4= +github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 h1:MaKvxE6D0KkjOg6Wd9M00iqP5PR0kUxCfiezes4JweM= +github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0/go.mod h1:i2h9fsTFKZorh8RdV2IcSUf/Qj98GlTkrTvUbX/s8as= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfgcSyHZXJI8J0IWE5MsCGlb2xp9fJiXyxWgmOFg4= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0/go.mod h1:ucUjca2JtSZboY8IoUqyQyuuXvwbMBVwFOm0vdQPNhA= github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg= github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE= -github.com/AzureAD/microsoft-authentication-library-for-go v1.7.1 h1:edShSHV3DV90+kt+CMaEXEzR9QF7wFrPJxVGz2blMIU= -github.com/AzureAD/microsoft-authentication-library-for-go v1.7.1/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= +github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 h1:RHK7bS+HQMslb1sZpAokUt+zTVmue0hKSs2C791hhzU= +github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk= github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho= github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ= github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE= github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI= github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU= -github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0= -github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= +github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE= +github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs= github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0= github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM= github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo= -github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f h1:tCbYj7/299ekTTXpdwKYF8eBlsYsDVoggDAuAjoK66k= -github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f/go.mod h1:gcr0kNtGBqin9zDW9GOHcVntrwnjrK+qdJ06mWYBybw= -github.com/ProtonMail/gopenpgp/v2 v2.10.0 h1:llCzLvntC9+iH+if/na4AgKTef/Zm4vpaRrR3+JdKvo= -github.com/ProtonMail/gopenpgp/v2 v2.10.0/go.mod h1:dc0h9Pg3ftfN0U4pfRzujilfh61A2R52wgMkZWcWm2I= +github.com/ProtonMail/gopenpgp/v3 v3.4.1 h1:K7uUhSHSJxORZ+RuHpilTT6S4MA2whCRlXNwLqd0+ys= +github.com/ProtonMail/gopenpgp/v3 v3.4.1/go.mod h1:bGdV9f6edhmd581wzXsQCTKdH8bXBbyhkgDKPjwPc6U= github.com/adrg/xdg v0.5.3 h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78= github.com/adrg/xdg v0.5.3/go.mod h1:nlTsY+NNiCBGCK2tpm09vRqfVzrc2fLmXGpBLF0zlTQ= github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ= @@ -56,36 +54,38 @@ github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2 h1:7Ip0wMmLHLRJdrloD github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= -github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY= -github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o= -github.com/aws/aws-sdk-go-v2/config v1.32.14 h1:opVIRo/ZbbI8OIqSOKmpFaY7IwfFUOCCXBsUpJOwDdI= -github.com/aws/aws-sdk-go-v2/config v1.32.14/go.mod h1:U4/V0uKxh0Tl5sxmCBZ3AecYny4UNlVmObYjKuuaiOo= -github.com/aws/aws-sdk-go-v2/credentials v1.19.14 h1:n+UcGWAIZHkXzYt87uMFBv/l8THYELoX6gVcUvgl6fI= -github.com/aws/aws-sdk-go-v2/credentials v1.19.14/go.mod h1:cJKuyWB59Mqi0jM3nFYQRmnHVQIcgoxjEMAbLkpr62w= -github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21 h1:NUS3K4BTDArQqNu2ih7yeDLaS3bmHD0YndtA6UP884g= -github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21/go.mod h1:YWNWJQNjKigKY1RHVJCuupeWDrrHjRqHm0N9rdrWzYI= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 h1:Rgg6wvjjtX8bNHcvi9OnXWwcE0a2vGpbwmtICOsvcf4= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21/go.mod h1:A/kJFst/nm//cyqonihbdpQZwiUhhzpqTsdbhDdRF9c= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgqSE5hE/o47Ij9qk/SEZFbUOe9A= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps= -github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 h1:qYQ4pzQ2Oz6WpQ8T3HvGHnZydA72MnLuFK9tJwmrbHw= -github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY= -github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY= -github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI= -github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3xgIJMSC8S6hEVq+38DcvUlgFY0FM6mSI5oto= -github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA= -github.com/aws/aws-sdk-go-v2/service/kms v1.50.4 h1:PgD1y0ZagPokGIZPmejCBUySBzOFDN+leZxCOfb1OEQ= -github.com/aws/aws-sdk-go-v2/service/kms v1.50.4/go.mod h1:FfXDb5nXrsoGgxsBFxwxr3vdHXheC2tV+6lmuLghhjQ= -github.com/aws/aws-sdk-go-v2/service/signin v1.0.9 h1:QKZH0S178gCmFEgst8hN0mCX1KxLgHBKKY/CLqwP8lg= -github.com/aws/aws-sdk-go-v2/service/signin v1.0.9/go.mod h1:7yuQJoT+OoH8aqIxw9vwF+8KpvLZ8AWmvmUWHsGQZvI= -github.com/aws/aws-sdk-go-v2/service/sso v1.30.15 h1:lFd1+ZSEYJZYvv9d6kXzhkZu07si3f+GQ1AaYwa2LUM= -github.com/aws/aws-sdk-go-v2/service/sso v1.30.15/go.mod h1:WSvS1NLr7JaPunCXqpJnWk1Bjo7IxzZXrZi1QQCkuqM= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.19 h1:dzztQ1YmfPrxdrOiuZRMF6fuOwWlWpD2StNLTceKpys= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.19/go.mod h1:YO8TrYtFdl5w/4vmjL8zaBSsiNp3w0L1FfKVKenZT7w= -github.com/aws/aws-sdk-go-v2/service/sts v1.41.10 h1:p8ogvvLugcR/zLBXTXrTkj0RYBUdErbMnAFFp12Lm/U= -github.com/aws/aws-sdk-go-v2/service/sts v1.41.10/go.mod h1:60dv0eZJfeVXfbT1tFJinbHrDfSJ2GZl4Q//OSSNAVw= -github.com/aws/smithy-go v1.24.3 h1:XgOAaUgx+HhVBoP4v8n6HCQoTRDhoMghKqw4LNHsDNg= -github.com/aws/smithy-go v1.24.3/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc= +github.com/aws/aws-sdk-go-v2 v1.42.1 h1:9eOTgu1z/dVtYpNZ3/8/XbbaX0x/BqE3HUzAzs6K0ek= +github.com/aws/aws-sdk-go-v2 v1.42.1/go.mod h1:5pKeft2eJj+gElQ38Jqg4ibCqh+/AK33/0X3hip7IjM= +github.com/aws/aws-sdk-go-v2/config v1.32.30 h1:XwsEzpTJfQYJbFicz/QMLwAZdyeNVVoOEkbF7R3gPJk= +github.com/aws/aws-sdk-go-v2/config v1.32.30/go.mod h1:Ud32SuMc+/9BGxfpSVld7HrE2o05JwKmXY4M3jOQNZU= +github.com/aws/aws-sdk-go-v2/credentials v1.19.29 h1:WHZGssHH887cO0ox07SIQZsFx3MKD4ps6w0xUEmnKYQ= +github.com/aws/aws-sdk-go-v2/credentials v1.19.29/go.mod h1:Mhl0xR6zjguiuj00XRx2wMx22sAltk7oya39sT7fdg8= +github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30 h1:/hi1JADLEW9YYryEz1w4GQu0EtP23pP553Cf9KgsDV4= +github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30/go.mod h1:/3AOgy4K17Dm4ucMZVC/MJkzy5kmfKUcINRHZyo0koQ= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 h1:xM/Is9cKMHa8Jj8zkvWhvrFkZsXJV9E+BB4g0HW0duQ= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30/go.mod h1:WueJeNDZvK1fMYEWJIkcivBfEzUkTpBhzlrUKKY8EuA= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 h1:jn46zC9LdsVR/ZpMIJqMqb8hHv31BlLx3ulVqNspUOk= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30/go.mod h1:1hTMsAgbdS/AtUi4bw8+gUuh1pceo+eXRLfpSuSQj3M= +github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 h1:3GUprIsfmGcC5SACIyB0e7E0BM1O1b3Erl5CePYIAeQ= +github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31/go.mod h1:7PuV1yl5e2xnUbm+RqvVg5i2iBM8EyijZNoI9wsOoOc= +github.com/aws/aws-sdk-go-v2/service/acm v1.42.1 h1:88uIv0OndPiipNtWnCOnm31ee0YLIFYq65hggm4AvZk= +github.com/aws/aws-sdk-go-v2/service/acm v1.42.1/go.mod h1:0HVmvx7Fvvqg+fXgDm66ye6/IF0NKccKS+UkuJyRjpI= +github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 h1:mbRIur/BiHK6SKPjoBIXSE/hJ6g6JGRLuxQy1jGjlN4= +github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13/go.mod h1:ITg9em2KbJx1s0y4aqRX5OYWG6HBZ5TVR//OdpEZ2CQ= +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 h1:/Z5jmNrKsSD7EmDjzAPsm/3L9IuOkzaynklJZ1qX7S4= +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30/go.mod h1:lEzEZnOosE7zi8Z6royW1cFJTD9fpab4Ul1SBrllewk= +github.com/aws/aws-sdk-go-v2/service/kms v1.54.1 h1:aeJAJyvWS3gQ679pJbz8ZdOh3MViD1zvEdoZMVEawbg= +github.com/aws/aws-sdk-go-v2/service/kms v1.54.1/go.mod h1:0RXNc6Yf3AvSMldGD6Lcch96Ojlw2TtGnHsqfD/L4u8= +github.com/aws/aws-sdk-go-v2/service/signin v1.4.1 h1:V7ZZ300WPXGjvkyore5DGe0ljVPOxCXie/thWdtSBXE= +github.com/aws/aws-sdk-go-v2/service/signin v1.4.1/go.mod h1:mxC0nT/C8wMMS97DemZPzvUZxvIt+2Iq+eS3JdFZGgg= +github.com/aws/aws-sdk-go-v2/service/sso v1.32.1 h1:gYFYh4iLLcAOJRLNPY2aD2g9DIhKn4eof8UkIrr1rTk= +github.com/aws/aws-sdk-go-v2/service/sso v1.32.1/go.mod h1:u8af9Nqkmqnr96f7v9nHqzZT9XBwbXEkTiqT4ROuJSE= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.37.1 h1:arjT9Cm3/WYbGmD5TUZHk4UQn4Lle1fUNZs5FC6CtF0= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.37.1/go.mod h1:DMPWJBjYs6+3+f/qhBFEFPPlQ6NlhWjai3dJNvipJ84= +github.com/aws/aws-sdk-go-v2/service/sts v1.44.1 h1:RvfHDg+xvAeZ+5741vUEjpOVtYSIm93W2zhx10Xtydw= +github.com/aws/aws-sdk-go-v2/service/sts v1.44.1/go.mod h1:9gdl4RrflIdpDb2TlXshWgR1F9TeCkvqDx77Vpr4Z/Q= +github.com/aws/smithy-go v1.27.4 h1:JQcphmBN4f0q/sPqXqROIItRNV/hy10cgu7CsFy616M= +github.com/aws/smithy-go v1.27.4/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM= @@ -102,46 +102,36 @@ github.com/chai2010/gettext-go v1.0.3 h1:9liNh8t+u26xl5ddmWLmsOsdNLwkdRTg5AG+JnT github.com/chai2010/gettext-go v1.0.3/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA= github.com/cilium/ebpf v0.21.0 h1:4dpx1J/B/1apeTmWBH5BkVLayHTkFrMovVPnHEk+l3k= github.com/cilium/ebpf v0.21.0/go.mod h1:1kHKv6Kvh5a6TePP5vvvoMa1bclRyzUXELSs272fmIQ= -github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk= -github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM= -github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8= -github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= +github.com/cloudflare/circl v1.6.4 h1:pOXuDTCEYyzydgUpQ0CQz3LsinKjiSk6nNP5Lt5K64U= +github.com/cloudflare/circl v1.6.4/go.mod h1:YxarevkLlbaHuWsxG6vmYNWBEsSp4pnp7j+4VljMavY= github.com/cockroachdb/datadriven v1.0.2 h1:H9MtNqVoVhvd9nCBwOyDjUEdZCREqbIdCJD93PBm/jA= github.com/cockroachdb/datadriven v1.0.2/go.mod h1:a9RdTaap04u637JoCzcUoIcDmvwSUtcUFtT/C3kJlTU= -github.com/cockroachdb/errors v1.13.0 h1:BoCcJeiP9hpBJDETkX19qi8Tb8So37srSsp3stTaDMQ= -github.com/cockroachdb/errors v1.13.0/go.mod h1:bjxt/4E5+OyuAnacpTIU9rn2mzPu1VlthvHP+xpROq0= -github.com/cockroachdb/logtags v0.0.0-20230118201751-21c54148d20b h1:r6VH0faHjZeQy818SGhaone5OnYfxFR/+AzdY3sf5aE= -github.com/cockroachdb/logtags v0.0.0-20230118201751-21c54148d20b/go.mod h1:Vz9DsVWQQhf3vs21MhPMZpMGSht7O/2vFW2xusFUVOs= -github.com/cockroachdb/redact v1.1.5 h1:u1PMllDkdFfPWaNGMyLD1+so+aq3uUItthCFqzwPJ30= -github.com/cockroachdb/redact v1.1.5/go.mod h1:BVNblN9mBWFyMyqK1k3AAiSxhvhfK2oOZZ2lK+dpvRg= -github.com/containerd/containerd/v2 v2.2.2 h1:mjVQdtfryzT7lOqs5EYUFZm8ioPVjOpkSoG1GJPxEMY= -github.com/containerd/containerd/v2 v2.2.2/go.mod h1:5Jhevmv6/2J+Iu/A2xXAdUIdI5Ah/hfyO7okJ4AFIdY= +github.com/cockroachdb/errors v1.14.0 h1:EfdVEJpN3z8rPMo43Yit59LxoiIa470fSXpZXuEs+ZI= +github.com/cockroachdb/errors v1.14.0/go.mod h1:xRa70jZ9sNBQmISt5KmJmAD++E4dQHm89oCRiZGEdq0= +github.com/cockroachdb/logtags v0.0.0-20241215232642-bb51bb14a506 h1:ASDL+UJcILMqgNeV5jiqR4j+sTuvQNHdf2chuKj1M5k= +github.com/cockroachdb/logtags v0.0.0-20241215232642-bb51bb14a506/go.mod h1:Mw7HqKr2kdtu6aYGn3tPmAftiP3QPX63LdK/zcariIo= +github.com/cockroachdb/redact v1.1.8 h1:8eVLLj6juKxiKrAEw2b8cJvNqWq++U8WOfQFuL7KTaA= +github.com/cockroachdb/redact v1.1.8/go.mod h1:GceHHpJ0rMDpYARL5In88Alq/xMBUtVlz7Qxix6ZVkw= +github.com/containerd/containerd/v2 v2.3.3 h1:MUNBVVBTBpPll7KPh5GTvkC3cfG03PQLAHVdsUoue9k= +github.com/containerd/containerd/v2 v2.3.3/go.mod h1:rHKGm3VW6wNrINb3x8mNT+w7qYXFVElTt/8HTuxVhD4= github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI= github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M= github.com/containerd/go-cni v1.1.13 h1:eFSGOKlhoYNxpJ51KRIMHZNlg5UgocXEIEBGkY7Hnis= github.com/containerd/go-cni v1.1.13/go.mod h1:nTieub0XDRmvCZ9VI/SBG6PyqT95N4FIhxsauF1vSBI= github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I= github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo= -github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw= -github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY= github.com/containernetworking/cni v1.3.0 h1:v6EpN8RznAZj9765HhXQrtXgX+ECGebEYEmnuFjskwo= github.com/containernetworking/cni v1.3.0/go.mod h1:Bs8glZjjFfGPHMw6hQu82RUgEPNGEaBb9KS5KtNMnJ4= github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4= github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec= github.com/coreos/go-systemd/v22 v22.7.0 h1:LAEzFkke61DFROc7zNLX/WA2i5J8gYqe0rSj9KI28KA= github.com/coreos/go-systemd/v22 v22.7.0/go.mod h1:xNUYtjHu2EDXbsxz1i41wouACIwT7Ybq9o0BQhMwD0w= -github.com/cosi-project/runtime v1.14.1 h1:1mxuH0zGXdJIy6762kaQsd+7C9MmzzuvIVIfWd867Os= -github.com/cosi-project/runtime v1.14.1/go.mod h1:SfzpfNx7YwK8byi1X6ytikDXVMmbC7UpiCWdzntRf8M= -github.com/cozystack/talos v0.0.0-20260126122716-d18a185e3680 h1:4SR6MxhhXvfczmyS4+JXyQhY3L8DvFwOsYDU2qKk/dQ= -github.com/cozystack/talos v0.0.0-20260126122716-d18a185e3680/go.mod h1:8ltdWw6w4fruILycZHvL91TlB7D6+P1vc2a0gbNC8sw= -github.com/cozystack/talos/pkg/machinery v0.0.0-20260126122716-d18a185e3680 h1:p8xt+lGJBmlv7YTeg9HyynlIgjd22o3zcCV4WGaJpwA= -github.com/cozystack/talos/pkg/machinery v0.0.0-20260126122716-d18a185e3680/go.mod h1:dNc4lG9yb2CzCwnJbfSUO9ZmkXE6P3BnVo1UsCITr/U= +github.com/cosi-project/runtime v1.16.2 h1:sgjOMrnaElrja93kkJJJIQYwd45PhpGl9cBci9yqn5c= +github.com/cosi-project/runtime v1.16.2/go.mod h1:+GrSnmJjMfWMe6NubevwwXQf/v7afddDLeCbLonvvps= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s= github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE= -github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE= -github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= @@ -150,10 +140,10 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ= github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8= -github.com/docker/cli v29.4.0+incompatible h1:+IjXULMetlvWJiuSI0Nbor36lcJ5BTcVpUmB21KBoVM= -github.com/docker/cli v29.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= -github.com/docker/docker-credential-helpers v0.9.5 h1:EFNN8DHvaiK8zVqFA2DT6BjXE0GzfLOZ38ggPTKePkY= -github.com/docker/docker-credential-helpers v0.9.5/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c= +github.com/docker/cli v29.6.2+incompatible h1:/bjePvcbbFTnRrMfWJBY7AjfICdsiLVgHn6LwTVOcqw= +github.com/docker/cli v29.6.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/docker-credential-helpers v0.9.8 h1:bIREROb7So6PRlq6KTtdS9MPEjC29OQRkFNlvK2OX8Q= +github.com/docker/docker-credential-helpers v0.9.8/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c= github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY= github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto= github.com/emicklei/dot v1.11.0 h1:zsrhCuFHAJge/aZIC4N4LdHy5tqYu4tWEaUzIwdYj4Y= @@ -166,75 +156,71 @@ github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjT github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM= github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2Wvf/TIe2xdyJxTlb6obmF18d8QdkxNDu4= github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc= -github.com/fatih/camelcase v1.0.0 h1:hxNvNX/xYBp0ovncs8WyWZrOrpBNub/JfaMvbURyft8= -github.com/fatih/camelcase v1.0.0/go.mod h1:yN2Sb0lFhZJUdVvtELVWefmrXpuZESvPmqwoZc+/fpc= github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w= github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE= -github.com/fluxcd/cli-utils v1.0.0 h1:+luz8igR6dM5f7uHwkkMTECsl+jp0kR69POuV5aOoDs= -github.com/fluxcd/cli-utils v1.0.0/go.mod h1:ANTIXWLLsNmn5bMNxbyoY22rtwRSR/fbu+IFy756fs0= -github.com/fluxcd/pkg/ssa v0.70.0 h1:IBylYPiTK1IEdCC2DvjKXIhwQcbd5VufXA9WS3zO+tE= -github.com/fluxcd/pkg/ssa v0.70.0/go.mod h1:6igtlt7/zF+nNFQpa5ZAkkvtpL6o36NRU39/PqqC+Bg= +github.com/fluxcd/cli-utils v1.2.2 h1:adDOmwE+LSwTzmYUaoEFPblruOuaQEKAg1ZNTmPJObE= +github.com/fluxcd/cli-utils v1.2.2/go.mod h1:FsghNGY+3Sr70c0FOB7I5So0kzoYVdvQ8GTid3XXVWM= +github.com/fluxcd/pkg/ssa v0.77.0 h1:HaDg7XDQGfVTFY379GrnnhrON1CQLjrLmyGbbTw5Ohc= +github.com/fluxcd/pkg/ssa v0.77.0/go.mod h1:bNImnO/GHtjjgp7BtGXVk181CoZbH9rEVEJfOwg1Xo8= github.com/foxboron/go-uefi v0.0.0-20251010190908-d29549a44f29 h1:2XQY2y+CZCLpFjK5p2EEMwDdP99c7AWP29WhCTkiQm8= github.com/foxboron/go-uefi v0.0.0-20251010190908-d29549a44f29/go.mod h1:sqQZKX1X86EAN4C07n6DcbGC/DCN36BNaX/uNvjzmfk= github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8= github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0= -github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ= -github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= +github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78= +github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= github.com/gdamore/encoding v1.0.1 h1:YzKZckdBL6jVt2Gc+5p82qhrGiqMdG/eNs6Wy0u3Uhw= github.com/gdamore/encoding v1.0.1/go.mod h1:0Z0cMFinngz9kS1QfMjCP8TY7em3bZYeeklsSDPivEo= -github.com/gdamore/tcell/v2 v2.13.8 h1:Mys/Kl5wfC/GcC5Cx4C2BIQH9dbnhnkPgS9/wF3RlfU= -github.com/gdamore/tcell/v2 v2.13.8/go.mod h1:+Wfe208WDdB7INEtCsNrAN6O2m+wsTPk1RAovjaILlo= +github.com/gdamore/tcell/v2 v2.13.10 h1:Afs3JKt83HnhuUKdZ3MnxUgOqQRWftj5JyDqv1LLynA= +github.com/gdamore/tcell/v2 v2.13.10/go.mod h1:+Wfe208WDdB7INEtCsNrAN6O2m+wsTPk1RAovjaILlo= github.com/gertd/go-pluralize v0.2.1 h1:M3uASbVjMnTsPb0PNqg+E/24Vwigyo/tvyMTtAlLgiA= github.com/gertd/go-pluralize v0.2.1/go.mod h1:rbYaKDbsXxmRfr8uygAEKhOWsjyrrqrkHVpZvoOp8zk= -github.com/getsentry/sentry-go v0.46.0 h1:mbdDaarbUdOt9X+dx6kDdntkShLEX3/+KyOsVDTPDj0= -github.com/getsentry/sentry-go v0.46.0/go.mod h1:evVbw2qotNUdYG8KxXbAdjOQWWvWIwKxpjdZZIvcIPw= +github.com/getsentry/sentry-go v0.48.0 h1:FRZNr7Uk1C86ev1bSJmYlUkL9oyivQA6YOcdYfaaMmY= +github.com/getsentry/sentry-go v0.48.0/go.mod h1:E5UkA5wp1qR2+MDydNYlVeUiNN2xEdjYMidkgf0Qoss= github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk= github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= -github.com/gizak/termui/v3 v3.1.0 h1:ZZmVDgwHl7gR7elfKf1xc4IudXZ5qqfDh4wExk4Iajc= -github.com/gizak/termui/v3 v3.1.0/go.mod h1:bXQEBkJpzxUAKf0+xq9MSWAvWZlE7c+aidmyFlkYTrY= github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk= github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ= github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg= -github.com/go-openapi/jsonpointer v0.22.5 h1:8on/0Yp4uTb9f4XvTrM2+1CPrV05QPZXu+rvu2o9jcA= -github.com/go-openapi/jsonpointer v0.22.5/go.mod h1:gyUR3sCvGSWchA2sUBJGluYMbe1zazrYWIkWPjjMUY0= -github.com/go-openapi/jsonreference v0.21.5 h1:6uCGVXU/aNF13AQNggxfysJ+5ZcU4nEAe+pJyVWRdiE= -github.com/go-openapi/jsonreference v0.21.5/go.mod h1:u25Bw85sX4E2jzFodh1FOKMTZLcfifd1Q+iKKOUxExw= -github.com/go-openapi/swag v0.25.5 h1:pNkwbUEeGwMtcgxDr+2GBPAk4kT+kJ+AaB+TMKAg+TU= -github.com/go-openapi/swag v0.25.5/go.mod h1:B3RT6l8q7X803JRxa2e59tHOiZlX1t8viplOcs9CwTA= -github.com/go-openapi/swag/cmdutils v0.25.5 h1:yh5hHrpgsw4NwM9KAEtaDTXILYzdXh/I8Whhx9hKj7c= -github.com/go-openapi/swag/cmdutils v0.25.5/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0= -github.com/go-openapi/swag/conv v0.25.5 h1:wAXBYEXJjoKwE5+vc9YHhpQOFj2JYBMF2DUi+tGu97g= -github.com/go-openapi/swag/conv v0.25.5/go.mod h1:CuJ1eWvh1c4ORKx7unQnFGyvBbNlRKbnRyAvDvzWA4k= -github.com/go-openapi/swag/fileutils v0.25.5 h1:B6JTdOcs2c0dBIs9HnkyTW+5gC+8NIhVBUwERkFhMWk= -github.com/go-openapi/swag/fileutils v0.25.5/go.mod h1:V3cT9UdMQIaH4WiTrUc9EPtVA4txS0TOmRURmhGF4kc= -github.com/go-openapi/swag/jsonname v0.25.5 h1:8p150i44rv/Drip4vWI3kGi9+4W9TdI3US3uUYSFhSo= -github.com/go-openapi/swag/jsonname v0.25.5/go.mod h1:jNqqikyiAK56uS7n8sLkdaNY/uq6+D2m2LANat09pKU= -github.com/go-openapi/swag/jsonutils v0.25.5 h1:XUZF8awQr75MXeC+/iaw5usY/iM7nXPDwdG3Jbl9vYo= -github.com/go-openapi/swag/jsonutils v0.25.5/go.mod h1:48FXUaz8YsDAA9s5AnaUvAmry1UcLcNVWUjY42XkrN4= -github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.5 h1:SX6sE4FrGb4sEnnxbFL/25yZBb5Hcg1inLeErd86Y1U= -github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.5/go.mod h1:/2KvOTrKWjVA5Xli3DZWdMCZDzz3uV/T7bXwrKWPquo= -github.com/go-openapi/swag/loading v0.25.5 h1:odQ/umlIZ1ZVRteI6ckSrvP6e2w9UTF5qgNdemJHjuU= -github.com/go-openapi/swag/loading v0.25.5/go.mod h1:I8A8RaaQ4DApxhPSWLNYWh9NvmX2YKMoB9nwvv6oW6g= -github.com/go-openapi/swag/mangling v0.25.5 h1:hyrnvbQRS7vKePQPHHDso+k6CGn5ZBs5232UqWZmJZw= -github.com/go-openapi/swag/mangling v0.25.5/go.mod h1:6hadXM/o312N/h98RwByLg088U61TPGiltQn71Iw0NY= -github.com/go-openapi/swag/netutils v0.25.5 h1:LZq2Xc2QI8+7838elRAaPCeqJnHODfSyOa7ZGfxDKlU= -github.com/go-openapi/swag/netutils v0.25.5/go.mod h1:lHbtmj4m57APG/8H7ZcMMSWzNqIQcu0RFiXrPUara14= -github.com/go-openapi/swag/stringutils v0.25.5 h1:NVkoDOA8YBgtAR/zvCx5rhJKtZF3IzXcDdwOsYzrB6M= -github.com/go-openapi/swag/stringutils v0.25.5/go.mod h1:PKK8EZdu4QJq8iezt17HM8RXnLAzY7gW0O1KKarrZII= -github.com/go-openapi/swag/typeutils v0.25.5 h1:EFJ+PCga2HfHGdo8s8VJXEVbeXRCYwzzr9u4rJk7L7E= -github.com/go-openapi/swag/typeutils v0.25.5/go.mod h1:itmFmScAYE1bSD8C4rS0W+0InZUBrB2xSPbWt6DLGuc= -github.com/go-openapi/swag/yamlutils v0.25.5 h1:kASCIS+oIeoc55j28T4o8KwlV2S4ZLPT6G0iq2SSbVQ= -github.com/go-openapi/swag/yamlutils v0.25.5/go.mod h1:Gek1/SjjfbYvM+Iq4QGwa/2lEXde9n2j4a3wI3pNuOQ= -github.com/go-openapi/testify/enable/yaml/v2 v2.4.2 h1:5zRca5jw7lzVREKCZVNBpysDNBjj74rBh0N2BGQbSR0= -github.com/go-openapi/testify/enable/yaml/v2 v2.4.2/go.mod h1:XVevPw5hUXuV+5AkI1u1PeAm27EQVrhXTTCPAF85LmE= -github.com/go-openapi/testify/v2 v2.4.2 h1:tiByHpvE9uHrrKjOszax7ZvKB7QOgizBWGBLuq0ePx4= -github.com/go-openapi/testify/v2 v2.4.2/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw= +github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s= +github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y= +github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY= +github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0= +github.com/go-openapi/swag v0.27.3 h1:i6oVKkGZeFgETHMiBHGtj9gIQ1aLtWDdJnT/SRZeets= +github.com/go-openapi/swag v0.27.3/go.mod h1:qEXs3GcyyQTDCFQ4ykqnLPDh8qT+zBcjbVWdxCAW0Us= +github.com/go-openapi/swag/cmdutils v0.27.3 h1:sjuL0TvW81i9R9GRMO/fy+c3mOW+7zxRYwy/7fobZt4= +github.com/go-openapi/swag/cmdutils v0.27.3/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM= +github.com/go-openapi/swag/conv v0.27.3 h1:iqJFmGEjmX3AY0lSszABFqRVqOSt99XS0LzNIMJYuhU= +github.com/go-openapi/swag/conv v0.27.3/go.mod h1:nPRmN6jgNme99hpf+nM0auDZGALWIqlwhisKPK/bQhQ= +github.com/go-openapi/swag/fileutils v0.27.3 h1:3UVoZ2RLaIs1lt+2jcKzL8RM3Yk0rmsDE9FLA/HGxFE= +github.com/go-openapi/swag/fileutils v0.27.3/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8= +github.com/go-openapi/swag/jsonutils v0.27.3 h1:1DEz+O82frtSMBcos/7XIn1GnpNTbsD4Bru4Dc/uhRc= +github.com/go-openapi/swag/jsonutils v0.27.3/go.mod h1:qiDCoQvzkMxrV3G8FLEdIU5L+EFYc0zcDOHWT3Yofvo= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.3 h1:h/eT9kmGCDdFLJF29lOhzLtF0FmP1AX2MhLJWVebsb8= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.3/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY= +github.com/go-openapi/swag/loading v0.27.3 h1:L9nQkEgzU7QgFQL+pLEMfGUKxeM4pWwGwbET9Z3weW0= +github.com/go-openapi/swag/loading v0.27.3/go.mod h1:rJ0NeaKsF4CVPnMGjPQl7JlSHzvD0bc2DKXLss1hiuE= +github.com/go-openapi/swag/mangling v0.27.3 h1:gRzzD1PAUoLTtGMgI3KpBmCSOlTuLTFWnviLxLcTnyg= +github.com/go-openapi/swag/mangling v0.27.3/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w= +github.com/go-openapi/swag/netutils v0.27.3 h1:IoBvfCoprsE6E87kAIm9basnISqDDqB79mJ8MN+f5PU= +github.com/go-openapi/swag/netutils v0.27.3/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ= +github.com/go-openapi/swag/pools v0.27.3 h1:gXjImP3F6/56wRRcFgEPld084Y6u2gs21ikPBt8NKBk= +github.com/go-openapi/swag/pools v0.27.3/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE= +github.com/go-openapi/swag/stringutils v0.27.3 h1:Ru28hnbAvN5wycALQYy8IobHvASq+FUFMlp1QzLM0JI= +github.com/go-openapi/swag/stringutils v0.27.3/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM= +github.com/go-openapi/swag/typeutils v0.27.3 h1:l6SSrx5eR5/WVwrGNzN6bQ9WqL04mrxNBl9YgQ3rcJ4= +github.com/go-openapi/swag/typeutils v0.27.3/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ= +github.com/go-openapi/swag/yamlutils v0.27.3 h1:cRFCAoYtslYn9L9T0xWryHy1t7c1MACC+DMj3CLvwvs= +github.com/go-openapi/swag/yamlutils v0.27.3/go.mod h1:6JYBGj8sw/NawMllyZY+cTA8Mzk2etS3ZBASdcyPsiU= +github.com/go-openapi/testify/enable/yaml/v2 v2.6.0 h1:gGHwAJ0R/5jU8BEGDbfRNR3hL68dAVi84WuOApp29B0= +github.com/go-openapi/testify/enable/yaml/v2 v2.6.0/go.mod h1:tY+St1SGq4NFl0QIqdTY4aEdbChAHxhyB77XQi9iJCo= +github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug= +github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw= github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI= github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8= github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y= @@ -247,14 +233,14 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg= github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4= -github.com/google/cel-go v0.28.0 h1:KjSWstCpz/MN5t4a8gnGJNIYUsJRpdi/r97xWDphIQc= -github.com/google/cel-go v0.28.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8= +github.com/google/cel-go v0.29.2 h1:ZtDxkeiMmz0mxbKDYiNkE5Lk7V5edMRcaaDf2jX002k= +github.com/google/cel-go v0.29.2/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8= github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c= github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.21.4 h1:VrhlIQtdhE6riZW//MjPrcJ1snAjPoCCpPHqGOygrv8= -github.com/google/go-containerregistry v0.21.4/go.mod h1:kxgc23zQ2qMY/hAKt0wCbB/7tkeovAP2mE2ienynJUw= +github.com/google/go-containerregistry v0.21.7 h1:/vPFuVXDjtFREsVArW+0h1CIl5urnOhzei4X2DMW9IU= +github.com/google/go-containerregistry v0.21.7/go.mod h1:kjSbt7/zMsKLWfnHrIvKvhXHUw91jbe9DNjPPJ32gXE= github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo= github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY= github.com/google/go-tpm-tools v0.4.9-0.20260325175049-22911efba9e5 h1:WKRLDs3+G0hJjP+3EdjQwUpqTVZ0E33qZs1lTiN1I1o= @@ -264,46 +250,41 @@ github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oX github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/gopacket/gopacket v1.5.0 h1:9s9fcSUVKFlRV97B77Bq9XNV3ly2gvvsneFMQUGjc+M= -github.com/gopacket/gopacket v1.5.0/go.mod h1:i3NaGaqfoWKAr1+g7qxEdWsmfT+MXuWkAe9+THv8LME= +github.com/gopacket/gopacket v1.7.0 h1:GdmF8ytGnjtSvyy30CTZhIwX1ybDWH3Q0MNK0blIKzA= +github.com/gopacket/gopacket v1.7.0/go.mod h1:QKowPlTLrQU2rqV5C5I14Aoaid3l8da3kbddibc/Wgk= github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo= github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA= github.com/gosuri/uilive v0.0.4 h1:hUEBpQDj8D8jXgtCdBu7sWsy5sbW/5GhuO8KBwJ2jyY= github.com/gosuri/uilive v0.0.4/go.mod h1:V/epo5LjjlDE5RJUcqx8dbw+zc93y5Ya3yg8tfZ74VI= github.com/gosuri/uiprogress v0.0.1 h1:0kpv/XY/qTmFWl/SkaJykZXrBBzwwadmW8fRb7RJSxw= github.com/gosuri/uiprogress v0.0.1/go.mod h1:C1RTYn4Sc7iEyf6j8ft5dyoZ4212h8G1ol9QQluh5+0= -github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA= -github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA= -github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 h1:+9834+KizmvFV7pXQGSXQTsaWhq2GjuNUt0aUU0YBYw= github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0 h1:QGLs/O40yoNK9vmy4rhUGBVyMf1lISBGtXRpsu/Qu/o= github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0/go.mod h1:hM2alZsMUni80N33RBe6J0e423LB+odMj7d3EMP9l20= github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 h1:B+8ClL/kCQkRiU82d9xajRPKYMrB7E0MbtzWVi1K4ns= github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3/go.mod h1:NbCUVmiS4foBGBHOYlCT25+YmGpJ32dZPi75pGEUpj4= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo= github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM= -github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM= -github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg= github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI= github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I= github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60= -github.com/jsimonetti/rtnetlink/v2 v2.2.0 h1:/KfZ310gOAFrXXol5VwnFEt+ucldD/0dsSRZwpHCP9w= -github.com/jsimonetti/rtnetlink/v2 v2.2.0/go.mod h1:lbjDHxC+5RJ08lzPeA90Ls2pEoId3F08MoEMlhfHxeI= +github.com/jsimonetti/rtnetlink/v2 v2.2.1-0.20260317095713-310581b9c6ac h1:UfziP9RaDM6D+f+yNdL3T/N1DztwltLDGBkpybF/fYs= +github.com/jsimonetti/rtnetlink/v2 v2.2.1-0.20260317095713-310581b9c6ac/go.mod h1:A/gqt1BEMJcvzGQJXQ3SnsDOQL7QRNhxTiC3eb++608= github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU= github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk= +github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= @@ -312,39 +293,30 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0= github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE= -github.com/lithammer/dedent v1.1.0 h1:VNzHMVCBNG1j0fh3OrsFRkVUwStdDArbgBWoPAffktY= -github.com/lithammer/dedent v1.1.0/go.mod h1:jrXYCQtgg0nJiN+StA2KgR7w6CiQNv9Fd/Z9BP0jIOc= -github.com/lmittmann/tint v1.1.3 h1:Hv4EaHWXQr+GTFnOU4VKf8UvAtZgn0VuKT+G0wFlO3I= -github.com/lmittmann/tint v1.1.3/go.mod h1:HIS3gSy7qNwGCj+5oRjAutErFBl4BzdQP6cJZ0NfMwE= +github.com/lmittmann/tint v1.2.0 h1:AogHRHy8HUJUnNJBHJlYa+fR4YY8mko2cnCp67xn9JY= +github.com/lmittmann/tint v1.2.0/go.mod h1:HIS3gSy7qNwGCj+5oRjAutErFBl4BzdQP6cJZ0NfMwE= github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4= github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0= -github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE= -github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= -github.com/mattn/go-isatty v0.0.21 h1:xYae+lCNBP7QuW4PUnNG61ffM4hVIfm+zUzDuSzYLGs= -github.com/mattn/go-isatty v0.0.21/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4= -github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU= -github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI= -github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw= -github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= -github.com/mdlayher/ethtool v0.6.0 h1:w2VJlyAxXajaLxIBOEviIlR+QcRjGO6onVIzrGt5ZsA= -github.com/mdlayher/ethtool v0.6.0/go.mod h1:AQayR0oe0+6wqogmFO7X9GmmbuXChIme2EF7dxvHy/A= +github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY= +github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= +github.com/mattn/go-isatty v0.0.23 h1:cYwCQTQf3HB6xUC+BtyCLZNr7IzbOmoZbmssVNzSyiQ= +github.com/mattn/go-isatty v0.0.23/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A= +github.com/mdlayher/ethtool v0.6.1 h1:fSfcX6EN3yBqcB+vsCnq8hpbIT4vEa7T+BKb0NjT894= +github.com/mdlayher/ethtool v0.6.1/go.mod h1:ezmdXM273WHGEt1OvaeqvKAkcjw28/dbYYeQuC2aIxQ= github.com/mdlayher/genetlink v1.4.0 h1:f/Xs7Y2T+GyX9b3dbiUhnLE9InGs5F9RxJ2JwBMl71o= github.com/mdlayher/genetlink v1.4.0/go.mod h1:d1hrKr8fwZU2JkcAtQUAzeTrI7nbgQSl+5k1cC0biSA= -github.com/mdlayher/netlink v1.10.0 h1:K7NHm0iQh2nOtfsj/YNNSN1s7T5JGtNCNwP66OKNiEw= -github.com/mdlayher/netlink v1.10.0/go.mod h1:YBnl5BXsCoRuwBjKKlZ+aYmEoq0r12FDA/3JC+94KDg= -github.com/mdlayher/socket v0.6.0 h1:ScZPaAGyO1icQnbFrhPM8mnXyMu9qukC1K4ZoM2IQKU= -github.com/mdlayher/socket v0.6.0/go.mod h1:q7vozUAnxSqnjHc12Fik5yUKIzfZ8ITCfMkhOtE9z18= +github.com/mdlayher/netlink v1.11.2 h1:HKh2jqe+omdSWcQ88nrT7INE61B0NXfiSPFdgL4YbNI= +github.com/mdlayher/netlink v1.11.2/go.mod h1:uT2Yc/QLaZubzDpZIBi9d4GoeLwtp3x1AMeqSRrK2sA= +github.com/mdlayher/socket v0.6.1 h1:M7uj2NtuujUY4mYr1C57NmfNiRHbkKpnBxO856lsc3A= +github.com/mdlayher/socket v0.6.1/go.mod h1:+/SGtqc9V+5dAuRgQsU0fGBI+oRDiW7O2Obx10OIWfg= github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw= github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s= -github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y= -github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= -github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo= github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0= github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0= github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ= github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw= -github.com/moby/moby/api v1.54.1 h1:TqVzuJkOLsgLDDwNLmYqACUuTehOHRGKiPhvH8V3Nn4= -github.com/moby/moby/api v1.54.1/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs= +github.com/moby/moby/api v1.55.0 h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc= +github.com/moby/moby/api v1.55.0/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs= github.com/moby/spdystream v0.5.1 h1:9sNYeYZUcci9R6/w7KDaFWEWeV4LStVG78Mpyq/Zm/Y= github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI= github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ= @@ -359,15 +331,14 @@ github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/ github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= -github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus= -github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw= -github.com/nsf/termbox-go v0.0.0-20190121233118-02980233997d/go.mod h1:IuKpRQcYE1Tfu+oAQqaLisqDeXgjyyltCfsaoYN18NQ= -github.com/nsf/termbox-go v1.1.1 h1:nksUPLCb73Q++DwbYUBEglYBRPZyoXJdrj5L+TkjyZY= -github.com/nsf/termbox-go v1.1.1/go.mod h1:T0cTdVuOwf7pHQNtfhnEbzHbcNyCEcVU4YPpouCbVxo= -github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI= -github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE= -github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28= -github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg= +github.com/navidys/tvxwidgets v0.14.0 h1:8UDKTDbbQeWwmOBcsTzKTrUYv7BpGYphpib7zWt6i6s= +github.com/navidys/tvxwidgets v0.14.0/go.mod h1:yILrJRJqf399gw7JyUM7UdT+e9PMMDXpk+CuIoqvEj8= +github.com/neticdk/go-stdlib v1.0.1 h1:3P6tJIICo8kvMMEFWSZCk+iRh+HoN8P/51WwMO+Ka2k= +github.com/neticdk/go-stdlib v1.0.1/go.mod h1:KP9nLuDoanLbM8Wturn+hage2FtcrJaF1+1Znu+MKEw= +github.com/onsi/ginkgo/v2 v2.30.0 h1:zxM/9XneXFIy64j6/wAmBIX4zRC7Hu6U8XFNZvDnCQc= +github.com/onsi/ginkgo/v2 v2.30.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44= +github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I= +github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= @@ -377,8 +348,8 @@ github.com/opencontainers/runtime-spec v1.3.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/ github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI= github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU= github.com/petermattis/goid v0.0.0-20250813065127-a731cc31b4fe/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4= -github.com/petermattis/goid v0.0.0-20260330135022-df67b199bc81 h1:WDsQxOJDy0N1VRAjXLpi8sCEZRSGarLWQevDxpTBRrM= -github.com/petermattis/goid v0.0.0-20260330135022-df67b199bc81/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4= +github.com/petermattis/goid v0.0.0-20260716134002-a9b348f0a2b9 h1:UyKlK0Ke63afxhHrgJAk8KlCt+kP9KYBRUsWG6lK2WM= +github.com/petermattis/goid v0.0.0-20260716134002-a9b348f0a2b9/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4= github.com/pingcap/errors v0.11.4 h1:lFuQV/oaUMGcD2tqt+01ROSmJs75VG1ToEOkZIZ4nE4= github.com/pingcap/errors v0.11.4/go.mod h1:Oi8TUi2kEtXXLMJk9l1cGmz20kV3TaQ0usTwv5KuLY8= github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ= @@ -386,28 +357,26 @@ github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjL github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= -github.com/pkg/xattr v0.4.12 h1:rRTkSyFNTRElv6pkA3zpjHpQ90p/OdHQC1GmGh1aTjM= -github.com/pkg/xattr v0.4.12/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6ktU= github.com/planetscale/vtprotobuf v0.6.1-0.20250313105119-ba97887b0a25 h1:S1hI5JiKP7883xBzZAr1ydcxrKNSVNm7+3+JwjxZEsg= github.com/planetscale/vtprotobuf v0.6.1-0.20250313105119-ba97887b0a25/go.mod h1:ZQntvDG8TkPgljxtA0R9frDoND4QORU1VXz015N5Ks4= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= -github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= +github.com/prometheus/client_golang v1.24.0 h1:5XStIklKuAtJSNpdD3s8XJj/Yv78IQmE1kbNk87JrAI= +github.com/prometheus/client_golang v1.24.0/go.mod h1:QcsNdotprC2nS4BTM2ucbcqxd2CeXTEa9jW7zHO9iDE= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE= -github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4= -github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw= -github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc= -github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo= +github.com/prometheus/common v0.70.0 h1:bcpru3tWPVnxGnETLgOV5jbp/JRXgYEyv65CuBLAMMI= +github.com/prometheus/common v0.70.0/go.mod h1:S/SFasQmgGiYH6C81LKCtYa8QACgthGg5zxL2udV7SY= +github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI= +github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY= github.com/rivo/tview v0.42.0 h1:b/ftp+RxtDsHSaynXTbJb+/n/BxDEi+W3UfF5jILK6c= github.com/rivo/tview v0.42.0/go.mod h1:cSfIYfhpSGCjp3r/ECJb+GKS7cGJnqV8vfjQPwoXyfY= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= -github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= -github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= +github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc= +github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs= github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU= github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0= github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk= @@ -416,8 +385,6 @@ github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts= github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk= github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc= -github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6NgVqpn3+iol9aGu4= -github.com/santhosh-tekuri/jsonschema/v5 v5.3.1/go.mod h1:uToXkOrWAZ6/Oc07xWQrPOhJotwFIyu2bBVN41fcDUY= github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ= github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= github.com/sasha-s/go-deadlock v0.3.9 h1:fiaT9rB7g5sr5ddNZvlwheclN9IP86eFW9WgqlEQV+w= @@ -428,32 +395,36 @@ github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME= github.com/siderolabs/crypto v0.6.5 h1:Elq5tpWP2ApZ4Y+Kg+eIDiiWbmriCPI1mjYIMwvsYkw= github.com/siderolabs/crypto v0.6.5/go.mod h1:QjVcrdJQE1sxhjHqieCgwGdlIYq/xCP2DL53Up8nbU4= -github.com/siderolabs/gen v0.8.6 h1:pE6shuqov3L+5rEcAUJ/kY6iJofimljQw5G95P8a5c4= -github.com/siderolabs/gen v0.8.6/go.mod h1:J9IbusbES2W6QWjtSHpDV9iPGZHc978h1+KJ4oQRspQ= -github.com/siderolabs/go-api-signature v0.3.12 h1:i1X+kPh9fzo+lEjtEplZSbtq1p21vKv4FCWJcB/ozvk= -github.com/siderolabs/go-api-signature v0.3.12/go.mod h1:dPLiXohup4qHX7KUgF/wwOE3lRU5uAr3ssEomNxiyxY= +github.com/siderolabs/gen v0.8.7 h1:Nu31kL0ln/facRHBfNX7zcB7w9VZ9tifXKsP4lUtWHw= +github.com/siderolabs/gen v0.8.7/go.mod h1:J9IbusbES2W6QWjtSHpDV9iPGZHc978h1+KJ4oQRspQ= +github.com/siderolabs/go-api-signature v0.3.13 h1:1u3vOWpn4PJJcQZCQXXXxeZk+HcoRdXCpvojE3q5Q9k= +github.com/siderolabs/go-api-signature v0.3.13/go.mod h1:gfAm/sYbkxAR6YAH+72dhK46nGwNM/O985y8btLjMhQ= github.com/siderolabs/go-circular v0.2.3 h1:GKkA1Tw79kEFGtWdl7WTxEUTbwtklITeiRT0V1McHrA= github.com/siderolabs/go-circular v0.2.3/go.mod h1:YBN/q9YpQphUYnBtBgPsngauSHj1TEZfgQZWZVjk1WE= -github.com/siderolabs/go-cmd v0.2.0 h1:fZ0jbQzZg4bFLmJzNEDZM/RlebZsfHOo2k+PCJ6g7y4= -github.com/siderolabs/go-cmd v0.2.0/go.mod h1:YA/UEDh8Av84RlI4LfQw7HN9+vgxUrQw/Byef1dgptY= +github.com/siderolabs/go-cmd v0.2.1 h1:499+nXoEKTtUnMvlXfiwMz2fudnunfB75dJR6AKYbAA= +github.com/siderolabs/go-cmd v0.2.1/go.mod h1:YA/UEDh8Av84RlI4LfQw7HN9+vgxUrQw/Byef1dgptY= github.com/siderolabs/go-kubeconfig v0.1.2 h1:0D0v3lXUKon+A2qRFwOnc9m4qSB+e+5WDmvGjiJPH8Y= github.com/siderolabs/go-kubeconfig v0.1.2/go.mod h1:FMl17PHjjAJjdeUTMN+gBzGH0lhsCbj2IX9/HNMpMh0= -github.com/siderolabs/go-kubernetes v0.2.30 h1:sqOulDpkdTRtqTIn7odFAe5tz8ea12kZgNz0BOnxUb0= -github.com/siderolabs/go-kubernetes v0.2.30/go.mod h1:D6b6O6oVFXPUBTN+euLTF3llSw5GmUqP749brODKF5s= +github.com/siderolabs/go-kubernetes v0.2.41 h1:la1y0C7QDBHlyfVTUGRjeS7ILSA1SvF/wPHDiVzzQ9g= +github.com/siderolabs/go-kubernetes v0.2.41/go.mod h1:YHFw+ud3F2y2tOu6ea2gnUmX4kVIu8RyF3zX27vakSE= github.com/siderolabs/go-pointer v1.0.1 h1:f7Yi4IK1jptS8yrT9GEbwhmGcVxvPQgBUG/weH3V3DM= github.com/siderolabs/go-pointer v1.0.1/go.mod h1:C8Q/3pNHT4RE9e4rYR9PHeS6KPMlStRBgYrJQJNy/vA= github.com/siderolabs/go-procfs v0.1.2 h1:bDs9hHyYGE2HO1frpmUsD60yg80VIEDrx31fkbi4C8M= github.com/siderolabs/go-procfs v0.1.2/go.mod h1:dBzQXobsM7+TWRRI3DS9X7vAuj8Nkfgu3Z/U9iY3ZTY= github.com/siderolabs/go-retry v0.3.3 h1:zKV+S1vumtO72E6sYsLlmIdV/G/GcYSBLiEx/c9oCEg= github.com/siderolabs/go-retry v0.3.3/go.mod h1:Ff/VGc7v7un4uQg3DybgrmOWHEmJ8BzZds/XNn/BqMI= -github.com/siderolabs/go-talos-support v0.2.0 h1:8/SsWBqV+gdqi5Bz9TbdetOE8Ygra5nWFh7W7B0PH/U= -github.com/siderolabs/go-talos-support v0.2.0/go.mod h1:tfwP9mpPdmqLU8DuCDgcAd0ficLlJuB/XMtrIV8g+20= +github.com/siderolabs/go-talos-support v0.2.1 h1:QVFhcmGw1ZTTXEtukBgrdjNxYbsPAOTMpopisV4EbgU= +github.com/siderolabs/go-talos-support v0.2.1/go.mod h1:tfwP9mpPdmqLU8DuCDgcAd0ficLlJuB/XMtrIV8g+20= github.com/siderolabs/net v0.4.0 h1:1bOgVay/ijPkJz4qct98nHsiB/ysLQU0KLoBC4qLm7I= github.com/siderolabs/net v0.4.0/go.mod h1:/ibG+Hm9HU27agp5r9Q3eZicEfjquzNzQNux5uEk0kM= github.com/siderolabs/proto-codec v0.1.4 h1:AcrLot/251qAa35GYhSqDeEKF3bygOlNaYJSrl7MPNQ= github.com/siderolabs/proto-codec v0.1.4/go.mod h1:frX2VEBSrZwzGxEdT+AMSjiWr6ySY/rCSXJxD0z9kxQ= github.com/siderolabs/protoenc v0.2.4 h1:D3Fpn2nQSQOhl8ZlAxijZAf7K6F8CM1uZq0afIGsr8Q= github.com/siderolabs/protoenc v0.2.4/go.mod h1:i5XLHjfv5vyi7LhQrSEo19HCA+lYtDd7CWxsoWp9XE8= +github.com/siderolabs/talos v1.13.7 h1:lxIkUajbneQMM/lIVS+JTOn1TwSLCgYwe4E4/M72FNM= +github.com/siderolabs/talos v1.13.7/go.mod h1:JLVfZ8e1wJ9lHcZtBwzljNcrw686505rdn0/UeCfE6g= +github.com/siderolabs/talos/pkg/machinery v1.13.7 h1:0cPB37GT83zDKYueh2saaet3wXy00mUdkQcdPqrbK60= +github.com/siderolabs/talos/pkg/machinery v1.13.7/go.mod h1:2PtzQFjql5bg9YNp8gv1vARJT5rhmBUtoj1+fYXbLk8= github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w= github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g= github.com/soheilhy/cmux v0.1.5 h1:jjzc5WVemNEDTLwv9tlmemhC73tI08BNOIGwBOo10Js= @@ -467,8 +438,6 @@ github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiT github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= -github.com/spyzhov/ajson v0.9.6 h1:iJRDaLa+GjhCDAt1yFtU/LKMtLtsNVKkxqlpvrHHlpQ= -github.com/spyzhov/ajson v0.9.6/go.mod h1:a6oSw0MMb7Z5aD2tPoPO+jq11ETKgXUr2XktHdT8Wt8= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= @@ -477,14 +446,25 @@ github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk= +github.com/tidwall/gjson v1.19.0 h1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU= +github.com/tidwall/gjson v1.19.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc= +github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM= +github.com/tidwall/match v1.2.0 h1:0pt8FlkOwjN2fPt4bIl4BoNxb98gGHN2ObFEDkrfZnM= +github.com/tidwall/match v1.2.0/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM= +github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU= +github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4= +github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU= +github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY= +github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28= github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75 h1:6fotK7otjonDflCTK0BCfls4SPy3NcCVb5dqqmbRknE= github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75/go.mod h1:KO6IkyS8Y3j8OdNO85qEYBsRPuteD+YciPomcXdrMnk= -github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4= -github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA= github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0= github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4= github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY= github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM= +github.com/wI2L/jsondiff v0.7.1 h1:Fg9+yj+1/x3UtPBJhR91TKEzRkrEEWcAcLbg9dzEaNM= +github.com/wI2L/jsondiff v0.7.1/go.mod h1:yAt2W7U6Jd4HK0RA8DGSGk0zDtfEtOUUJVnH/xICpjo= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= github.com/xiang90/probing v0.0.0-20221125231312-a49e3df8f510 h1:S2dVYn90KE98chqDkyE9Z4N61UnQd+KOfgp5Iu53llk= @@ -494,68 +474,68 @@ github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= -go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo= -go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E= -go.etcd.io/etcd/api/v3 v3.6.10 h1:jlwjtELjA8yi2VWpOFH+0w0lGr3K6mVDyn0RDB9aaAY= -go.etcd.io/etcd/api/v3 v3.6.10/go.mod h1:pdV4VeFmvhdNjB4LWRkC8ReLyRBAxUOze3GarMhE2sk= -go.etcd.io/etcd/client/pkg/v3 v3.6.10 h1:tBT7podcPhuVbCVkAEzx8bC5I+aqxfLwBN8/As1arrA= -go.etcd.io/etcd/client/pkg/v3 v3.6.10/go.mod h1:WEy3PpwbbEBVRdh1NVJYsuUe/8eyI21PNJRazeD8z/Y= -go.etcd.io/etcd/client/v3 v3.6.10 h1:J598zJ+C/ZPvImypmq5waj84+bovePrlZERHklf34y0= -go.etcd.io/etcd/client/v3 v3.6.10/go.mod h1:iHhUDUcEwaKs1YFq3MgmI9U4zhTVasp/vgdVbFf1RS8= -go.etcd.io/etcd/etcdutl/v3 v3.6.10 h1:znRywXhuqb2JqJLX1o37L9rLtwDFdrx5yPm6aZ+KF+c= -go.etcd.io/etcd/etcdutl/v3 v3.6.10/go.mod h1:uHd2aAwWFxF5O5yx/kQo2d0EG+PMlFp/o3CKXG0rzbk= -go.etcd.io/etcd/pkg/v3 v3.6.10 h1:17TwO17SkbgIBCloGRikqVy/HdPbeXX4zPAlzRZbzDw= -go.etcd.io/etcd/pkg/v3 v3.6.10/go.mod h1:UfjvwrKPZVnmpKD3UZKQpC7kMLsSIGlQjIVFGRXI6eo= -go.etcd.io/etcd/server/v3 v3.6.10 h1:MfnewdUHfYUr7ytYKuYQb2WWxTstGj70Vx7nM8e2rVs= -go.etcd.io/etcd/server/v3 v3.6.10/go.mod h1:dWedTPxlXqd9P4pxgqjSb2NwcqobmumsMWLOf4Z+OTY= -go.etcd.io/raft/v3 v3.6.0 h1:5NtvbDVYpnfZWcIHgGRk9DyzkBIXOi8j+DDp1IcnUWQ= -go.etcd.io/raft/v3 v3.6.0/go.mod h1:nLvLevg6+xrVtHUmVaTcTz603gQPHfh7kUAwV6YpfGo= +go.etcd.io/bbolt v1.5.0 h1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P/bD4lxU= +go.etcd.io/bbolt v1.5.0/go.mod h1:mkltfYE5aUHQxUct9N9V+Kp7aSjFqjgrhcXIS70Lrdk= +go.etcd.io/etcd/api/v3 v3.7.0 h1:WZlGK7pRtYGDB8ti8wkrQ5D2oWGMbtNL9VA5e+vF2Fg= +go.etcd.io/etcd/api/v3 v3.7.0/go.mod h1:EcTihnwAQ0BQNh5dfAdaFVFdchuo7EP0HlX7TV3jz/A= +go.etcd.io/etcd/client/pkg/v3 v3.7.0 h1:sW9njJzS3vXKcAJjjLQ4nk+avNUJ12Bcijcx8ehUskE= +go.etcd.io/etcd/client/pkg/v3 v3.7.0/go.mod h1:cnzZGIUzSfjEwLC6UBVsSXlEK1eepS/JUD7wE6PLRT0= +go.etcd.io/etcd/client/v3 v3.7.0 h1:5MHO37VbPB87VRPKUXEcicjeQWiTSjpPv3Ume8xPx20= +go.etcd.io/etcd/client/v3 v3.7.0/go.mod h1:DJ382WuwjmbowjPDyaaQ0idWXy4dh91XRhe4FOrb9vM= +go.etcd.io/etcd/etcdutl/v3 v3.7.0 h1:NWpz72HizSHVmOK+zDA6LwLpFBq5qAQiiJm3VV55rDY= +go.etcd.io/etcd/etcdutl/v3 v3.7.0/go.mod h1:4l1DPx/nyxKAC4unO7cfDQwC1Gxleb+2AjCD25gZDt4= +go.etcd.io/etcd/pkg/v3 v3.7.0 h1:aUBHGzXnYL2m3AlZfKp0ZhHQLVZIKfu9QsIlYdr+mxc= +go.etcd.io/etcd/pkg/v3 v3.7.0/go.mod h1:fDQYyc8rOC1Yl4EZLh0O1OjHzwJW7jAly80+BpD1M9o= +go.etcd.io/etcd/server/v3 v3.7.0 h1:ScdUdN8ljuimp0lZaNq0otLMrHcFSFT+dQyT1j7JSFo= +go.etcd.io/etcd/server/v3 v3.7.0/go.mod h1:v7N1dPdSW2vzyxGsbDwK4X0sCe3SYNlQ+9eNIMGzdxQ= +go.etcd.io/raft/v3 v3.7.0 h1:BGzlwx07bLv8PW6OU5HObuz1y4hlPZUXA07pM1mPUh4= +go.etcd.io/raft/v3 v3.7.0/go.mod h1:6gX6T2X907DjnjsFLODnTxba77stjs84W9gTTI0GUNA= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 h1:0Qx7VGBacMm9ZENQ7TnNObTYI4ShC+lHI16seduaxZo= -go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0/go.mod h1:Sje3i3MjSPKTSPvVWCaL8ugBzJwik3u4smCjUeuupqg= -go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= -go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0 h1:2yEATaop1/a1I4psnSLgWVPLWwCzkqWakgJy7xTDVy0= +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0/go.mod h1:D7J12YRapIekYyPWgGPlA/23pRmpSEZC5xJC/TTLI9U= +go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= +go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k= go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 h1:RAE+JPfvEmvy+0LzyUA25/SGawPwIUbZ6u0Wug54sLc= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0/go.mod h1:AGmbycVGEsRx9mXMZ75CsOyhSP6MFIcj/6dnG+vhVjk= -go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= -go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY= -go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= -go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg= -go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw= -go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A= -go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A= -go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= +go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= +go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= +go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= +go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= +go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= +go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= +go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= -go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc= -go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E= +go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo= +go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -go.yaml.in/yaml/v4 v4.0.0-rc.4 h1:UP4+v6fFrBIb1l934bDl//mmnoIZEDK0idg1+AIvX5U= -go.yaml.in/yaml/v4 v4.0.0-rc.4/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0= +go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4= +go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI= -golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q= -golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM= -golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80= +golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= +golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= +golang.org/x/exp v0.0.0-20260718201538-764159d718ef h1:LkZ48HFgy/TvhTI0bcWkjgFkgLyKUwcTbDjS0DUjw+A= +golang.org/x/exp v0.0.0-20260718201538-764159d718ef/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= -golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM= -golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU= +golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= +golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= @@ -563,8 +543,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= -golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA= -golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -572,34 +552,32 @@ golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= -golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= +golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220408201424-a24fb2fb8a0f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= -golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= -golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY= -golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY= +golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= +golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= -golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= -golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg= -golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -608,8 +586,8 @@ golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roY golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= -golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c= -golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI= +golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= +golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= @@ -618,14 +596,14 @@ golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 h1:3GDAcqdI golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10/go.mod h1:T97yPqesLiNrOYxkwmhMI0ZIlJDm+p0PMR8eRVeR5tQ= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d h1:/aDRtSZJjyLQzm75d+a1wOJaqyKBMvIAfeQmoa3ORiI= -google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:etfGUgejTiadZAUaEP14NP97xi1RGeawqkjDARA/UOs= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d h1:wT2n40TBqFY6wiwazVK9/iTWbsQrgk5ZfCSVFLO9LQA= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM= -google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4= -google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= -google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= +google.golang.org/genproto/googleapis/api v0.0.0-20260720211330-0afa2a65878a h1:97PfJ4tCxY5C7NzzgGqQEMZmXbISdvSArNNEOoUGKBg= +google.golang.org/genproto/googleapis/api v0.0.0-20260720211330-0afa2a65878a/go.mod h1:1brfde68Npq6+WA75c1EHWPijZEG1kMus61ygPZfn4A= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260720211330-0afa2a65878a h1:qI/YMH1ep2qQtqcp00gMQyoU7mjvbhg88GJKCvfoLj0= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260720211330-0afa2a65878a/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= +google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= +google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= +google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= @@ -642,34 +620,32 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q= gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA= -helm.sh/helm/v3 v3.20.2 h1:binM4rvPx5DcNsa1sIt7UZi55lRbu3pZUFmQkSoRh48= -helm.sh/helm/v3 v3.20.2/go.mod h1:Fl1kBaWCpkUrM6IYXPjQ3bdZQfFrogKArqptvueZ6Ww= -k8s.io/api v0.35.3 h1:pA2fiBc6+N9PDf7SAiluKGEBuScsTzd2uYBkA5RzNWQ= -k8s.io/api v0.35.3/go.mod h1:9Y9tkBcFwKNq2sxwZTQh1Njh9qHl81D0As56tu42GA4= -k8s.io/apiextensions-apiserver v0.35.3 h1:2fQUhEO7P17sijylbdwt0nBdXP0TvHrHj0KeqHD8FiU= -k8s.io/apiextensions-apiserver v0.35.3/go.mod h1:tK4Kz58ykRpwAEkXUb634HD1ZAegEElktz/B3jgETd8= -k8s.io/apimachinery v0.35.3 h1:MeaUwQCV3tjKP4bcwWGgZ/cp/vpsRnQzqO6J6tJyoF8= -k8s.io/apimachinery v0.35.3/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns= -k8s.io/cli-runtime v0.35.3 h1:UZq4ipNimtzBmhN7PPKbfAdqo8quK0H0UdGl6qAQnqI= -k8s.io/cli-runtime v0.35.3/go.mod h1:O7MUmCqcKSd5xI+O5X7/pRkB5l0O2NIhOdUVwbHLXu4= -k8s.io/client-go v0.35.3 h1:s1lZbpN4uI6IxeTM2cpdtrwHcSOBML1ODNTCCfsP1pg= -k8s.io/client-go v0.35.3/go.mod h1:RzoXkc0mzpWIDvBrRnD+VlfXP+lRzqQjCmKtiwZ8Q9c= -k8s.io/component-base v0.35.3 h1:mbKbzoIMy7JDWS/wqZobYW1JDVRn/RKRaoMQHP9c4P0= -k8s.io/component-base v0.35.3/go.mod h1:IZ8LEG30kPN4Et5NeC7vjNv5aU73ku5MS15iZyvyMYk= -k8s.io/component-helpers v0.35.3 h1:Rl2p3wNMC0YU21rziLkWXavr7MwkB5Td3lNZ/+gYGm8= -k8s.io/component-helpers v0.35.3/go.mod h1:8BkyfcBA6XsCtFYxDB+mCfZqM6P39Aco12AKigNn0C8= +helm.sh/helm/v4 v4.2.3 h1:JEejtPE04+SvyRomOfgRXVxyJ/lude7eShio30oQr0Y= +helm.sh/helm/v4 v4.2.3/go.mod h1:azI2XpxowOGXAgzeXcqyfskUmIfILqIcJxiFw1M6PuM= +k8s.io/api v0.36.2 h1:TF6YDLIzKfccK7cq9YpTcGX8TJmEkHVRv78DM51fRYY= +k8s.io/api v0.36.2/go.mod h1:F4LbMO4brjZYh7yFkXWhynSvtB7YauxV4c+HHkNRGNg= +k8s.io/apiextensions-apiserver v0.36.2 h1:3O5gqOj/dt2XWWbpMe+TXWpE9yU6pjM/tXxtHHJT/K4= +k8s.io/apiextensions-apiserver v0.36.2/go.mod h1:cL1tBWe8XSaP1H30iWKGo7hf6iAUUUJPEU70dskmAnA= +k8s.io/apimachinery v0.36.2 h1:0PE/W/WNy1UX61NLbXY5TMbJ6UwLL6E6lAPkYrKFxbQ= +k8s.io/apimachinery v0.36.2/go.mod h1:fvf/HOLXq9RId0rnDIbN1OEBvHXdQbLMM8nu0LcBUf4= +k8s.io/cli-runtime v0.36.2 h1:CconTvEeV4DJs4ZX3HQKCFbFRGsm6OtuBM9yjmMP2VM= +k8s.io/cli-runtime v0.36.2/go.mod h1:LddcjiMf4YlnHO7c1Y7rEtDqL84FyiYVLco7V679GUU= +k8s.io/client-go v0.36.2 h1:bfgxmFKc9CgqsgX4xKLAAdmTQlWee7Ob/HlDOrJ5TBI= +k8s.io/client-go v0.36.2/go.mod h1:1vgO4OAlfPnoLcb+Rze2GF5rAr14w8qjrYMoyXJzQj0= +k8s.io/component-base v0.36.2 h1:Z0VH80O7Ng0HDZnZj3WRR3urEGa0kTwmO8CwEwjVK1w= +k8s.io/component-base v0.36.2/go.mod h1:mGfFOA7Gwpdm1VW2cwSQYbiDIlz8GD2WGwH88QSeCyA= k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc= k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0= -k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31 h1:V+sn9a/1fEYDGwnllCmqXBk8x7obZ+hl869Q3Abumkg= -k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0= -k8s.io/kubectl v0.35.3 h1:1KqSYXk/sodU7VeDvK6atX2kAGUZd2QTeR5K7Hb9r9w= -k8s.io/kubectl v0.35.3/go.mod h1:GPHxZqRe+u/i3gTBoVQHeIyq2NilfNPj9hDWeuN3x5s= -k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 h1:kBawHLSnx/mYHmRnNUf9d4CpjREbeZuxoSGOX/J+aYM= -k8s.io/utils v0.0.0-20260319190234-28399d86e0b5/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= -sigs.k8s.io/cli-utils v0.37.3-0.20250918194211-77c836a69463 h1:cogPZ9yOTBY+1TxAXD7DnqQqTrN83iwNTdq08z3lFao= -sigs.k8s.io/cli-utils v0.37.3-0.20250918194211-77c836a69463/go.mod h1:u5LTcoijf7f18rMNL7PVNyJzoGEriT+tS57ZSVG3nc4= -sigs.k8s.io/controller-runtime v0.23.3 h1:VjB/vhoPoA9l1kEKZHBMnQF33tdCLQKJtydy4iqwZ80= -sigs.k8s.io/controller-runtime v0.23.3/go.mod h1:B6COOxKptp+YaUT5q4l6LqUJTRpizbgf9KSRNdQGns0= +k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A= +k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I= +k8s.io/kubectl v0.36.2 h1:rpUGGpeL09XVOLep2yle5jrtk//JA1L6ZHfkQQtVEwk= +k8s.io/kubectl v0.36.2/go.mod h1:gVbQ3B/yb4bSR2ggQ7rd0W6icUSWs7sduH4e16Vii+0= +k8s.io/streaming v0.36.2 h1:NSKthPPg9UFSKsRauVJUVGH2Dvn8fhKmY4qrMkw/p98= +k8s.io/streaming v0.36.2/go.mod h1:z6fV3D+NVkoeqRMtWwlUZK6U17SY/LqNzOxWL6GyR/s= +k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 h1:jVkFFVfXdXP74B/zbO3hM3hpSFD0xvhQ5U686DPurkE= +k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3/go.mod h1:M2s5JB1lIYP3jzZdorPLHXIPJzt9vv2muW5a6L9DtNM= +sigs.k8s.io/controller-runtime v0.24.1 h1:miPEwrmirImAvgME1L9qebGHrOnGJoVmVdtOU9fRfo4= +sigs.k8s.io/controller-runtime v0.24.1/go.mod h1:vFkfY5fGt5xAC/sKb8IBFKgWPNKG9OUG29dR8Y2wImw= sigs.k8s.io/hydrophone v0.7.0 h1:BKEb8m6mcVL6kFEZ4jUCk5VD81bqm2XPtNxFT52ifxc= sigs.k8s.io/hydrophone v0.7.0/go.mod h1:w22N+PiIfL6XrIAxEqnZ7HnoER3F447WvdDlQhURiro= sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg= @@ -680,7 +656,7 @@ sigs.k8s.io/kustomize/kyaml v0.21.1 h1:IVlbmhC076nf6foyL6Taw4BkrLuEsXUXNpsE+ScX7 sigs.k8s.io/kustomize/kyaml v0.21.1/go.mod h1:hmxADesM3yUN2vbA5z1/YTBnzLJ1dajdqpQonwBL1FQ= sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU= sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY= -sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8= -sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE= +sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q= +sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE= sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs= sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4= diff --git a/main.go b/main.go index 4f2ed92..bca54af 100644 --- a/main.go +++ b/main.go @@ -136,7 +136,7 @@ func registerRootFlags(cmd *cobra.Command) { cmd.PersistentFlags().StringSliceVar(&commands.GlobalArgs.Nodes, "nodes", []string{}, "target the specified nodes") cmd.PersistentFlags().StringSliceVarP(&commands.GlobalArgs.Endpoints, "endpoints", "e", []string{}, "override default endpoints in Talos configuration") cmd.PersistentFlags().StringVar(&commands.GlobalArgs.Cluster, "cluster", "", "Cluster to connect to if a proxy endpoint is used.") - cmd.PersistentFlags().BoolVar(&commands.GlobalArgs.SkipVerify, "skip-verify", false, "skip TLS certificate verification (keeps client authentication)") + cmd.PersistentFlags().BoolVar(&commands.SkipVerify, "skip-verify", false, "skip TLS certificate verification (keeps client authentication)") cmd.PersistentFlags().Bool("version", false, "Print the version number of the application") // No backticks in this usage string: pflag's UnquoteUsage treats the // first backtick-quoted word as the flag's value-placeholder name, which diff --git a/pkg/commands/apply.go b/pkg/commands/apply.go index fe88b51..a21ea84 100644 --- a/pkg/commands/apply.go +++ b/pkg/commands/apply.go @@ -797,7 +797,7 @@ func withApplyClientBare(action func(ctx context.Context, c *client.Client) erro return WithClientMaintenance(applyCmdFlags.certFingerprints, action) } - if GlobalArgs.SkipVerify { + if SkipVerify { return WithClientSkipVerify(action) } diff --git a/pkg/commands/root.go b/pkg/commands/root.go index f149e6c..d64fe79 100644 --- a/pkg/commands/root.go +++ b/pkg/commands/root.go @@ -16,8 +16,12 @@ package commands import ( "context" + "crypto/tls" + "encoding/base64" "os" + "os/signal" "path/filepath" + "syscall" "time" "github.com/cockroachdb/errors" @@ -27,6 +31,7 @@ import ( "github.com/siderolabs/talos/cmd/talosctl/pkg/talos/global" "github.com/siderolabs/talos/pkg/machinery/client" + clientconfig "github.com/siderolabs/talos/pkg/machinery/client/config" ) // GlobalArgs is the common arguments for the root command. @@ -34,6 +39,59 @@ import ( //nolint:gochecknoglobals // cobra CLI architecture: persistent flags bind to package-level state shared across all subcommands; refactoring out the global would require threading state through every command's RunE. var GlobalArgs global.Args +// SkipVerify, when set via --skip-verify, disables TLS certificate verification +// while preserving client-certificate authentication. Upstream global.Args has no +// such field (the cozystack/talos fork added it for siderolabs/talos#12652, which +// upstream declined); it is reimplemented here so talm can drop the fork and track +// stock upstream Talos. +// +//nolint:gochecknoglobals // cobra CLI architecture: persistent flag binds to package-level state. +var SkipVerify bool + +// errContextNotFound is returned when the requested context is absent from the +// talosconfig. +var errContextNotFound = errors.New("context not found in talosconfig") + +// signalContext returns a context cancelled on SIGINT/SIGTERM so a --skip-verify +// client connection can be interrupted cleanly, mirroring talosctl's own wrappers. +func signalContext() (context.Context, context.CancelFunc) { + return signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM) +} + +// skipVerifyTLSConfig builds a TLS config that skips server-certificate +// verification while preserving client-certificate authentication taken from the +// talosconfig context. +func skipVerifyTLSConfig(configContext *clientconfig.Context) (*tls.Config, error) { + // InsecureSkipVerify is the whole point of --skip-verify (connect to nodes + // whose IP is absent from the cert SANs); client-cert auth is preserved below. + tlsConfig := &tls.Config{ + InsecureSkipVerify: true, //nolint:gosec // intentional: --skip-verify + } + + if configContext.Crt == "" || configContext.Key == "" { + return tlsConfig, nil + } + + crtBytes, err := base64.StdEncoding.DecodeString(configContext.Crt) + if err != nil { + return nil, errors.Wrap(err, "decoding client certificate from talosconfig context") + } + + keyBytes, err := base64.StdEncoding.DecodeString(configContext.Key) + if err != nil { + return nil, errors.Wrap(err, "decoding client key from talosconfig context") + } + + cert, err := tls.X509KeyPair(crtBytes, keyBytes) + if err != nil { + return nil, errors.Wrap(err, "loading client key pair from talosconfig context") + } + + tlsConfig.Certificates = []tls.Certificate{cert} + + return tlsConfig, nil +} + // Config is the package-level configuration populated from Chart.yaml and // CLI persistent flags. Mirrors GlobalArgs for project-root-relative path // resolution across every subcommand. @@ -84,7 +142,18 @@ var Config struct { // WithClientNoNodes wraps common code to initialize Talos client and provide cancellable context. // // WithClientNoNodes doesn't set any node information on the request context. +// +// This is the single choke point every talm-native command funnels through +// (directly or via WithClient), so routing --skip-verify here restores the +// coverage the dropped cozystack/talos fork used to provide at the library +// level for the whole CLI. Wrapped talosctl passthrough commands run upstream +// RunE code that never reaches this function, so they are handled separately +// (and cannot honor --skip-verify without the fork — see talosctl_wrapper.go). func WithClientNoNodes(action func(context.Context, *client.Client) error, dialOptions ...grpc.DialOption) error { + if SkipVerify { + return WithClientSkipVerify(action, dialOptions...) + } + //nolint:wrapcheck // thin pass-through to talos global.Args; error already carries Talos context return GlobalArgs.WithClientNoNodes(action, dialOptions...) } @@ -119,22 +188,90 @@ func WithClientMaintenance(enforceFingerprints []string, action func(context.Con return GlobalArgs.WithClientMaintenance(enforceFingerprints, action) } +// skipVerifyClientOptions assembles the client options for a --skip-verify +// connection. It mirrors upstream global.Args.WithClientNoNodes so the skip +// path does not silently lose behavior the normal path has: it pins the +// already-resolved config context (so client.GetConfigContext honors +// --talosconfig / --context instead of falling back to the default config), +// forwards caller dial options, threads the --cluster proxy override when set, +// and selects endpoints from flags or the talosconfig context — all carrying +// the verification-skipping TLS config built from that context. +func skipVerifyClientOptions(configContext *clientconfig.Context, tlsConfig *tls.Config, dialOptions []grpc.DialOption) []client.OptionFunc { + opts := []client.OptionFunc{ + client.WithConfigContext(configContext), + client.WithTLSConfig(tlsConfig), + client.WithDefaultGRPCDialOptions(), + // Kept for structural parity with upstream WithClientNoNodes. It is + // inert on the skip-verify path — getConn short-circuits on the explicit + // TLS config before the SideroV1 interceptor — so it never actually + // consumes the keys dir here; skip-verify + Omni SaaS-key auth is not a + // real combination. + client.WithSideroV1KeysDir(clientconfig.CustomSideroV1KeysDirPath(GlobalArgs.SideroV1KeysDir)), + } + + if len(dialOptions) > 0 { + opts = append(opts, client.WithGRPCDialOptions(dialOptions...)) + } + + // Preserve the --cluster proxy header the non-skip path sets, so + // `--skip-verify --cluster X` still reaches nodes behind an Omni/Sidero proxy. + if GlobalArgs.Cluster != "" { + opts = append(opts, client.WithCluster(GlobalArgs.Cluster)) + } + + if len(GlobalArgs.Endpoints) > 0 { + opts = append(opts, client.WithEndpoints(GlobalArgs.Endpoints...)) + } else if len(configContext.Endpoints) > 0 { + opts = append(opts, client.WithEndpoints(configContext.Endpoints...)) + } + + return opts +} + // WithClientSkipVerify wraps common code to initialize Talos client with TLS verification disabled // but with client certificate authentication preserved. // This is useful when connecting to nodes via IP addresses not listed in the server certificate's SANs. -func WithClientSkipVerify(action func(context.Context, *client.Client) error) error { - //nolint:wrapcheck // thin pass-through to talos global.Args; error already carries Talos context - return GlobalArgs.WithClientSkipVerify(action) -} +func WithClientSkipVerify(action func(context.Context, *client.Client) error, dialOptions ...grpc.DialOption) error { + ctx, stop := signalContext() + defer stop() -// WithClientAuto automatically selects the appropriate client wrapper based on GlobalArgs.SkipVerify. -// If SkipVerify is true, uses WithClientSkipVerify, otherwise uses WithClientNoNodes. -func WithClientAuto(action func(context.Context, *client.Client) error) error { - if GlobalArgs.SkipVerify { - return WithClientSkipVerify(action) + cfg, err := clientconfig.Open(GlobalArgs.Talosconfig) + if err != nil { + return errors.Wrapf(err, "opening talosconfig %q", GlobalArgs.Talosconfig) + } + + contextName := GlobalArgs.CmdContext + if contextName == "" { + contextName = cfg.Context + } + + configContext, ok := cfg.Contexts[contextName] + if !ok { + //nolint:wrapcheck // cockroachdb/errors.WithHint at boundary. + return errors.WithHint( + errors.Wrapf(errContextNotFound, "%q", contextName), + "verify the context name against `talosctl config contexts`", + ) + } + + tlsConfig, err := skipVerifyTLSConfig(configContext) + if err != nil { + return err } - return WithClientNoNodes(action) + c, err := client.New(ctx, skipVerifyClientOptions(configContext, tlsConfig, dialOptions)...) + if err != nil { + return errors.Wrap(err, "constructing Talos client") + } + defer func() { _ = c.Close() }() + + // Deliberately no client.WithNodes here: this is the skip-verify backing + // for the no-nodes constructors (WithClientNoNodes, withApplyClientBare), + // mirroring upstream where WithClientNoNodes never sets node metadata. + // Callers that want nodes (WithClient, the per-node apply loop) inject + // them in their own wrapper layer. Injecting here would attach a plural + // `nodes` key that apid's director rejects for COSI reads (e.g. rotate-ca). + return action(ctx, c) } // Commands is a list of commands published by the package. diff --git a/pkg/commands/rotate_ca_handler.go b/pkg/commands/rotate_ca_handler.go index 4fb5a14..6ad0944 100644 --- a/pkg/commands/rotate_ca_handler.go +++ b/pkg/commands/rotate_ca_handler.go @@ -312,7 +312,7 @@ func discoverClusterNodes() (controlPlane, workers []string, err error) { func getKubeconfigFromTalos() ([]byte, error) { var kubeconfigData []byte - err := GlobalArgs.WithClient(func(ctx context.Context, c *client.Client) error { + err := WithClient(func(ctx context.Context, c *client.Client) error { var err error kubeconfigData, err = c.Kubeconfig(ctx) @@ -323,7 +323,6 @@ func getKubeconfigFromTalos() ([]byte, error) { return nil }) - //nolint:wrapcheck // forwarding talos/cobra error verbatim per the wrapper contract. return kubeconfigData, err } diff --git a/pkg/commands/skip_verify_test.go b/pkg/commands/skip_verify_test.go new file mode 100644 index 0000000..e7efb8c --- /dev/null +++ b/pkg/commands/skip_verify_test.go @@ -0,0 +1,464 @@ +// Copyright Cozystack Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package commands + +import ( + "bytes" + "context" + "crypto/ecdsa" + "crypto/elliptic" + "crypto/rand" + "crypto/tls" + "crypto/x509" + "crypto/x509/pkix" + "encoding/base64" + "encoding/pem" + "math/big" + "path/filepath" + "strings" + "testing" + "time" + + "github.com/cockroachdb/errors" + "google.golang.org/grpc" + "google.golang.org/grpc/metadata" + + "github.com/siderolabs/talos/pkg/machinery/client" + clientconfig "github.com/siderolabs/talos/pkg/machinery/client/config" +) + +// genTestCertKeyB64 generates an ephemeral self-signed ECDSA cert/key pair and +// returns each PEM block base64-encoded — the exact storage format a talosconfig +// context uses for its Crt and Key fields. +func genTestCertKeyB64(t *testing.T) (string, string) { + t.Helper() + + key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) + if err != nil { + t.Fatalf("generate key: %v", err) + } + + tmpl := &x509.Certificate{ + SerialNumber: big.NewInt(1), + Subject: pkix.Name{CommonName: "talm-test"}, + NotBefore: time.Now().Add(-time.Hour), + NotAfter: time.Now().Add(time.Hour), + } + + der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key) + if err != nil { + t.Fatalf("create certificate: %v", err) + } + + crtPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}) + + keyDER, err := x509.MarshalECPrivateKey(key) + if err != nil { + t.Fatalf("marshal key: %v", err) + } + + keyPEM := pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER}) + + return base64.StdEncoding.EncodeToString(crtPEM), base64.StdEncoding.EncodeToString(keyPEM) +} + +// TestSkipVerifyTLSConfig_NoCertKeyInsecureOnly documents that with an empty +// talosconfig context (no client cert/key) the config still skips server-cert +// verification but carries no client certificate. +func TestSkipVerifyTLSConfig_NoCertKeyInsecureOnly(t *testing.T) { + cfg, err := skipVerifyTLSConfig(&clientconfig.Context{}) + if err != nil { + t.Fatalf("unexpected error: %v", err) + } + + if !cfg.InsecureSkipVerify { + t.Error("InsecureSkipVerify must be true — skipping server-cert verification is the point of --skip-verify") + } + + if len(cfg.Certificates) != 0 { + t.Errorf("expected no client certificate when context has none, got %d", len(cfg.Certificates)) + } +} + +// TestSkipVerifyTLSConfig_WithCertKeyPreservesClientAuth is the core contract: +// server-cert verification is skipped WHILE client-certificate authentication is +// preserved from the talosconfig context. +func TestSkipVerifyTLSConfig_WithCertKeyPreservesClientAuth(t *testing.T) { + crtB64, keyB64 := genTestCertKeyB64(t) + + cfg, err := skipVerifyTLSConfig(&clientconfig.Context{Crt: crtB64, Key: keyB64}) + if err != nil { + t.Fatalf("unexpected error: %v", err) + } + + if !cfg.InsecureSkipVerify { + t.Error("InsecureSkipVerify must remain true even when a client cert is present") + } + + if len(cfg.Certificates) != 1 { + t.Fatalf("expected the client certificate to be preserved, got %d certificates", len(cfg.Certificates)) + } +} + +// TestSkipVerifyTLSConfig_InvalidBase64Cert asserts a malformed base64 crt is a +// hard error rather than a silently insecure connection. +func TestSkipVerifyTLSConfig_InvalidBase64Cert(t *testing.T) { + _, keyB64 := genTestCertKeyB64(t) + + if _, err := skipVerifyTLSConfig(&clientconfig.Context{Crt: "!!not-base64!!", Key: keyB64}); err == nil { + t.Fatal("expected an error for an invalid base64 certificate") + } +} + +// TestSkipVerifyTLSConfig_InvalidBase64Key asserts a malformed base64 key errors. +func TestSkipVerifyTLSConfig_InvalidBase64Key(t *testing.T) { + crtB64, _ := genTestCertKeyB64(t) + + if _, err := skipVerifyTLSConfig(&clientconfig.Context{Crt: crtB64, Key: "!!not-base64!!"}); err == nil { + t.Fatal("expected an error for an invalid base64 key") + } +} + +// TestSkipVerifyTLSConfig_MismatchedKeyPair asserts a cert paired with a +// different private key fails instead of producing a broken client cert. +func TestSkipVerifyTLSConfig_MismatchedKeyPair(t *testing.T) { + crtB64, _ := genTestCertKeyB64(t) + _, otherKeyB64 := genTestCertKeyB64(t) + + if _, err := skipVerifyTLSConfig(&clientconfig.Context{Crt: crtB64, Key: otherKeyB64}); err == nil { + t.Fatal("expected an error when the cert and key belong to different pairs") + } +} + +// stageMissingContextTalosconfig writes a talosconfig whose only context is +// "present", points GlobalArgs at it while requesting the absent context +// "absent", and toggles SkipVerify — restoring every mutated global on cleanup. +// +// It is a routing probe: a wrapper that reaches the local WithClientSkipVerify +// fails with errContextNotFound before dialing, whereas one that falls through +// to upstream global.Args surfaces a different error. That lets a test assert +// which path a client wrapper took without needing a live node. +func stageMissingContextTalosconfig(t *testing.T, skipVerify bool) { + t.Helper() + + cfg := &clientconfig.Config{ + Context: "present", + Contexts: map[string]*clientconfig.Context{ + "present": {Endpoints: []string{"127.0.0.1"}}, + }, + } + + cfgPath := filepath.Join(t.TempDir(), "talosconfig") + if err := cfg.Save(cfgPath); err != nil { + t.Fatalf("save talosconfig fixture: %v", err) + } + + origTalosconfig := GlobalArgs.Talosconfig + origCmdContext := GlobalArgs.CmdContext + origSkipVerify := SkipVerify + t.Cleanup(func() { + GlobalArgs.Talosconfig = origTalosconfig + GlobalArgs.CmdContext = origCmdContext + SkipVerify = origSkipVerify + }) + + GlobalArgs.Talosconfig = cfgPath + GlobalArgs.CmdContext = "absent" + SkipVerify = skipVerify +} + +// TestWithClientSkipVerify_ContextNotFound covers the early-return branch: when +// the requested context is absent from the talosconfig, the wrapper fails with +// errContextNotFound before ever dialing a node. +func TestWithClientSkipVerify_ContextNotFound(t *testing.T) { + stageMissingContextTalosconfig(t, true) + + err := WithClientSkipVerify(func(context.Context, *client.Client) error { + t.Fatal("action must not run when the context is not found") + + return nil + }) + + if !errors.Is(err, errContextNotFound) { + t.Fatalf("expected errContextNotFound, got %v", err) + } +} + +// TestWithClientNoNodes_SkipVerifyRoutes proves that with SkipVerify set the +// shared talm choke point reroutes through WithClientSkipVerify. This is the +// coverage the dropped cozystack/talos fork used to provide at the library +// level for every talm-native command; errContextNotFound is emitted only by +// the local WithClientSkipVerify, so seeing it proves the route was taken. +func TestWithClientNoNodes_SkipVerifyRoutes(t *testing.T) { + stageMissingContextTalosconfig(t, true) + + err := WithClientNoNodes(func(context.Context, *client.Client) error { + t.Fatal("action must not run — routing should hit WithClientSkipVerify's missing-context guard") + + return nil + }) + + if !errors.Is(err, errContextNotFound) { + t.Fatalf("expected WithClientNoNodes to route through WithClientSkipVerify (errContextNotFound), got %v", err) + } +} + +// TestWithClient_SkipVerifyRoutes proves the same for WithClient — the wrapper +// every talm-native command (upgrade, rotate-ca, ...) funnels through — so +// --skip-verify is honored for them, not just apply/template. +func TestWithClient_SkipVerifyRoutes(t *testing.T) { + stageMissingContextTalosconfig(t, true) + + err := WithClient(func(context.Context, *client.Client) error { + t.Fatal("action must not run — routing should hit WithClientSkipVerify's missing-context guard") + + return nil + }) + + if !errors.Is(err, errContextNotFound) { + t.Fatalf("expected WithClient to route through WithClientSkipVerify (errContextNotFound), got %v", err) + } +} + +// withGlobalArgsReset saves and restores the GlobalArgs fields the option-builder +// tests mutate, so they don't leak into other tests sharing the package global. +func withGlobalArgsReset(t *testing.T) { + t.Helper() + + origCluster := GlobalArgs.Cluster + origEndpoints := GlobalArgs.Endpoints + t.Cleanup(func() { + GlobalArgs.Cluster = origCluster + GlobalArgs.Endpoints = origEndpoints + }) + + GlobalArgs.Cluster = "" + GlobalArgs.Endpoints = nil +} + +// TestSkipVerifyClientOptions_ClusterThreaded pins that --cluster is not lost on +// the skip-verify path: setting GlobalArgs.Cluster adds exactly one option +// (client.WithCluster), matching upstream global.Args.WithClientNoNodes. The +// option slice is the only observable surface — client.Options fields are +// unexported — so coverage is by option count. +func TestSkipVerifyClientOptions_ClusterThreaded(t *testing.T) { + withGlobalArgsReset(t) + + base := skipVerifyClientOptions(&clientconfig.Context{}, &tls.Config{}, nil) + if len(base) != 4 { + t.Fatalf("baseline expected 4 options (config context + TLS + default gRPC + SideroV1 keys dir), got %d", len(base)) + } + + GlobalArgs.Cluster = "proxy-cluster" + + withCluster := skipVerifyClientOptions(&clientconfig.Context{}, &tls.Config{}, nil) + if len(withCluster) != len(base)+1 { + t.Errorf("--cluster must add one option: baseline %d, with cluster %d", len(base), len(withCluster)) + } +} + +// TestSkipVerifyClientOptions_DialOptionsThreaded pins that caller dial options +// reach the skip-verify client instead of being silently dropped. +func TestSkipVerifyClientOptions_DialOptionsThreaded(t *testing.T) { + withGlobalArgsReset(t) + + base := skipVerifyClientOptions(&clientconfig.Context{}, &tls.Config{}, nil) + withDial := skipVerifyClientOptions(&clientconfig.Context{}, &tls.Config{}, []grpc.DialOption{grpc.WithUserAgent("talm-test")}) + + if len(withDial) != len(base)+1 { + t.Errorf("caller dial options must add one option: baseline %d, with dial %d", len(base), len(withDial)) + } +} + +// TestSkipVerifyClientOptions_Endpoints pins endpoint selection: flag endpoints +// or, failing that, context endpoints add exactly one option; neither adds none. +func TestSkipVerifyClientOptions_Endpoints(t *testing.T) { + withGlobalArgsReset(t) + + none := skipVerifyClientOptions(&clientconfig.Context{}, &tls.Config{}, nil) + + GlobalArgs.Endpoints = []string{"192.0.2.1"} + fromFlag := skipVerifyClientOptions(&clientconfig.Context{Endpoints: []string{"192.0.2.2"}}, &tls.Config{}, nil) + + GlobalArgs.Endpoints = nil + fromContext := skipVerifyClientOptions(&clientconfig.Context{Endpoints: []string{"192.0.2.2"}}, &tls.Config{}, nil) + + if len(fromFlag) != len(none)+1 || len(fromContext) != len(none)+1 { + t.Errorf("endpoints must add exactly one option: none=%d flag=%d context=%d", len(none), len(fromFlag), len(fromContext)) + } +} + +// TestWarnSkipVerifyUnsupported pins the passthrough scope-reduction warning: +// silent when the flag is off, and naming both the flag and the command when on. +func TestWarnSkipVerifyUnsupported(t *testing.T) { + origSkipVerify := SkipVerify + t.Cleanup(func() { SkipVerify = origSkipVerify }) + + SkipVerify = false + + var offBuf bytes.Buffer + + warnSkipVerifyUnsupported(&offBuf, "health") + + if offBuf.Len() != 0 { + t.Errorf("no warning expected when --skip-verify is off, got %q", offBuf.String()) + } + + SkipVerify = true + + var onBuf bytes.Buffer + + warnSkipVerifyUnsupported(&onBuf, "health") + + out := onBuf.String() + if !strings.Contains(out, "--skip-verify") || !strings.Contains(out, "health") { + t.Errorf("warning must name both --skip-verify and the command, got %q", out) + } + // Pin the full native-command list as one substring so the warning + // text and the manual-test-plan D4 expected string cannot drift apart + // (rotate-ca was dropped from the doc once already). + if !strings.Contains(out, "apply, template, upgrade, rotate-ca") { + t.Errorf("warning must list the full native command set, got %q", out) + } +} + +// stageValidSkipVerifyContext writes a talosconfig with a single reachable +// context "present" (carrying the given nodes), points GlobalArgs at it with +// SkipVerify on and no explicit --nodes / --endpoints, and restores every +// mutated global on cleanup. Unlike stageMissingContextTalosconfig, the context +// resolves — so client construction succeeds and the action closure runs, +// letting a test inspect the context the wrapper actually built. +func stageValidSkipVerifyContext(t *testing.T, nodes []string) { + t.Helper() + + cfg := &clientconfig.Config{ + Context: "present", + Contexts: map[string]*clientconfig.Context{ + "present": { + Endpoints: []string{"127.0.0.1"}, + Nodes: nodes, + }, + }, + } + + cfgPath := filepath.Join(t.TempDir(), "talosconfig") + if err := cfg.Save(cfgPath); err != nil { + t.Fatalf("save talosconfig fixture: %v", err) + } + + origTalosconfig := GlobalArgs.Talosconfig + origCmdContext := GlobalArgs.CmdContext + origNodes := GlobalArgs.Nodes + origEndpoints := GlobalArgs.Endpoints + origSkipVerify := SkipVerify + t.Cleanup(func() { + GlobalArgs.Talosconfig = origTalosconfig + GlobalArgs.CmdContext = origCmdContext + GlobalArgs.Nodes = origNodes + GlobalArgs.Endpoints = origEndpoints + SkipVerify = origSkipVerify + }) + + GlobalArgs.Talosconfig = cfgPath + GlobalArgs.CmdContext = "" + GlobalArgs.Nodes = nil + GlobalArgs.Endpoints = nil + SkipVerify = true +} + +// outgoingNodes returns the plural "nodes" gRPC metadata talos sets via +// client.WithNodes, or nil when none is present. +func outgoingNodes(ctx context.Context) []string { + md, ok := metadata.FromOutgoingContext(ctx) + if !ok { + return nil + } + + return md.Get("nodes") +} + +// TestWithClient_SkipVerifyPreservesConfigContext pins that the skip-verify +// client carries the resolved talosconfig context, so downstream +// client.GetConfigContext() honors --talosconfig / --context instead of falling +// back to the default ~/.talos/config. Without WithConfigContext, WithClient's +// node-resolution closure (and upgrade/rotate-ca's own GetConfigContext calls) +// silently read the wrong config when no explicit --nodes is given. +func TestWithClient_SkipVerifyPreservesConfigContext(t *testing.T) { + stageValidSkipVerifyContext(t, []string{"192.0.2.50"}) + + var gotContext *clientconfig.Context + + err := WithClient(func(_ context.Context, c *client.Client) error { + gotContext = c.GetConfigContext() + + return nil + }) + if err != nil { + t.Fatalf("WithClient returned error (config context likely fell back to default): %v", err) + } + + if gotContext == nil { + t.Fatal("GetConfigContext returned nil — the resolved config context was not threaded onto the skip-verify client") + } + + if len(gotContext.Nodes) != 1 || gotContext.Nodes[0] != "192.0.2.50" { + t.Errorf("expected the specified talosconfig context nodes [192.0.2.50], got %v", gotContext.Nodes) + } +} + +// TestWithClientNoNodes_SkipVerifyOmitsNodeMetadata pins the no-nodes contract: +// WithClientNoNodes (the skip-verify backing for COSI reads like rotate-ca's +// updateSecretsFromCluster) must NOT attach the plural `nodes` metadata that +// apid's director rejects — even when the talosconfig context carries nodes. +func TestWithClientNoNodes_SkipVerifyOmitsNodeMetadata(t *testing.T) { + stageValidSkipVerifyContext(t, []string{"192.0.2.50"}) + + var gotNodes []string + + err := WithClientNoNodes(func(ctx context.Context, _ *client.Client) error { + gotNodes = outgoingNodes(ctx) + + return nil + }) + if err != nil { + t.Fatalf("WithClientNoNodes returned error: %v", err) + } + + if len(gotNodes) != 0 { + t.Errorf("WithClientNoNodes under --skip-verify must not set node metadata (no-nodes contract), got nodes=%v", gotNodes) + } +} + +// TestWithClient_SkipVerifySetsResolvedNodes is the complement: WithClient (the +// with-nodes layer) MUST inject the resolved context nodes so commands that +// need node targeting still work under --skip-verify without explicit --nodes. +func TestWithClient_SkipVerifySetsResolvedNodes(t *testing.T) { + stageValidSkipVerifyContext(t, []string{"192.0.2.50"}) + + var gotNodes []string + + err := WithClient(func(ctx context.Context, _ *client.Client) error { + gotNodes = outgoingNodes(ctx) + + return nil + }) + if err != nil { + t.Fatalf("WithClient returned error: %v", err) + } + + if len(gotNodes) != 1 || gotNodes[0] != "192.0.2.50" { + t.Errorf("WithClient under --skip-verify must set the resolved context nodes [192.0.2.50], got %v", gotNodes) + } +} diff --git a/pkg/commands/talosctl_wrapper.go b/pkg/commands/talosctl_wrapper.go index 665afd1..a3f7e95 100644 --- a/pkg/commands/talosctl_wrapper.go +++ b/pkg/commands/talosctl_wrapper.go @@ -16,6 +16,7 @@ package commands import ( "fmt" + "io" "net" "os" "path/filepath" @@ -140,6 +141,25 @@ func propagatePersistentFlags(cmd, wrappedCmd *cobra.Command) { }) } +// warnSkipVerifyUnsupported writes a warning to w when --skip-verify is set for +// a wrapped talosctl passthrough command. Those commands run upstream RunE code +// that builds its own client through upstream global.Args, which has no +// skip-verify concept — only the dropped cozystack/talos fork could inject it +// at the library level. So --skip-verify is a no-op for them; the warning keeps +// the user from chasing an opaque TLS SAN failure. talm-native commands (apply, +// template, upgrade, rotate-ca) honor the flag via WithClientNoNodes. +func warnSkipVerifyUnsupported(w io.Writer, cmdName string) { + if !SkipVerify { + return + } + + fmt.Fprintf(w, + "Warning: --skip-verify is not supported for the wrapped talosctl command %q; "+ + "it applies only to talm-native commands (apply, template, upgrade, rotate-ca). "+ + "Connecting with full TLS verification.\n", + cmdName) +} + // wrapTalosCommand wraps a talosctl command to add --file flag support. // //nolint:gocognit,gocyclo,cyclop,funlen // cobra wrapper for talosctl forward; branching over (--insecure, --talosconfig override, file/template flags, modeline) is each one short branch. @@ -259,7 +279,7 @@ func wrapTalosCommand(cmd *cobra.Command, cmdName string) *cobra.Command { // Sync GlobalArgs to talosctl commands taloscommands.GlobalArgs = GlobalArgs - // Note: --skip-verify is now supported for all commands via GlobalArgs.SkipVerify + warnSkipVerifyUnsupported(os.Stderr, cmdName) if originalPreRunE != nil { return originalPreRunE(cmd, args) diff --git a/pkg/commands/template.go b/pkg/commands/template.go index 16ccf15..f858c55 100644 --- a/pkg/commands/template.go +++ b/pkg/commands/template.go @@ -129,10 +129,10 @@ single MachineConfig and apply it once".`, return WithClientMaintenance(nil, templateFunc(args)) } - if GlobalArgs.SkipVerify { - return WithClientSkipVerify(templateFunc(args)) - } - + // WithClient routes through WithClientSkipVerify when --skip-verify is + // set, and also injects node metadata that template `lookup` needs — + // so the skip-verify path must go through it, not the bare no-nodes + // WithClientSkipVerify directly. return WithClient(templateFunc(args)) }, } @@ -291,9 +291,11 @@ func runTemplate(ctx context.Context, tmpl func(ctx context.Context, c *client.C return tmpl(ctx, nil) case templateCmdFlags.insecure: return WithClientMaintenance(nil, tmpl) - case GlobalArgs.SkipVerify: - return WithClientSkipVerify(tmpl) default: + // WithClient handles --skip-verify (via WithClientNoNodes routing) and + // injects the node metadata template `lookup` needs; the bare no-nodes + // WithClientSkipVerify must not be used directly here. + //nolint:contextcheck // WithClient may route through WithClientSkipVerify, which owns its signal-rooted context return WithClient(tmpl) } } diff --git a/pkg/engine/contract_errors_test.go b/pkg/engine/contract_errors_test.go index bd434f5..cd83574 100644 --- a/pkg/engine/contract_errors_test.go +++ b/pkg/engine/contract_errors_test.go @@ -41,8 +41,8 @@ import ( "testing" helmEngine "github.com/cozystack/talm/pkg/engine/helm" - "helm.sh/helm/v3/pkg/chart/loader" - "helm.sh/helm/v3/pkg/chartutil" + "helm.sh/helm/v4/pkg/chart/common" + "helm.sh/helm/v4/pkg/chart/v2/loader" ) // renderExpectingError calls the Helm engine directly with the given @@ -71,7 +71,7 @@ func renderExpectingError(t *testing.T, chartPath, talosVersion string, lookup f maps.Copy(merged, values) eng := helmEngine.Engine{} - _, err = eng.Render(chrt, chartutil.Values{ + _, err = eng.Render(chrt, common.Values{ "Values": merged, "TalosVersion": talosVersion, }) diff --git a/pkg/engine/engine.go b/pkg/engine/engine.go index f396710..31f113c 100644 --- a/pkg/engine/engine.go +++ b/pkg/engine/engine.go @@ -26,8 +26,8 @@ import ( helmEngine "github.com/cozystack/talm/pkg/engine/helm" "github.com/cozystack/talm/pkg/yamltools" "github.com/hashicorp/go-multierror" - "helm.sh/helm/v3/pkg/chart/loader" - "helm.sh/helm/v3/pkg/strvals" + "helm.sh/helm/v4/pkg/chart/v2/loader" + "helm.sh/helm/v4/pkg/strvals" "github.com/siderolabs/talos/cmd/talosctl/pkg/talos/helpers" diff --git a/pkg/engine/golden_test.go b/pkg/engine/golden_test.go new file mode 100644 index 0000000..0eb2cf8 --- /dev/null +++ b/pkg/engine/golden_test.go @@ -0,0 +1,135 @@ +// Copyright Cozystack Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package engine + +import ( + "os" + "path/filepath" + "strconv" + "strings" + "testing" +) + +// updateGolden reports whether to regenerate the committed golden +// snapshots instead of comparing against them. Set TALM_UPDATE_GOLDEN=1 +// to regenerate (an env toggle avoids a package-level flag global): +// +// TALM_UPDATE_GOLDEN=1 go test ./pkg/engine/ -run TestGoldenRender +func updateGolden() bool { + return os.Getenv("TALM_UPDATE_GOLDEN") != "" +} + +// TestGoldenRender pins the full, byte-for-byte rendered output of the +// shipped charts across the whole schema matrix. Unlike the substring +// contract tests elsewhere in this package — which assert only the +// specific fields each one names — this catches any change that alters +// whitespace, key ordering, number/bool formatting, document count, +// `---` separator placement, the trailing newline, or any field no +// other test happens to check. +// +// The matrix is charts/cozystack + charts/generic × controlplane + +// worker × multi-doc (v1.12+) + legacy single-doc (pre-v1.12) schemas. +// Discovery is driven by the deterministic simpleNicLookup fixture so +// the output depends on nothing outside the repo. +// +// It exists as a safety net for library upgrades (e.g. the Helm v3→v4 +// swap): regenerate the golden files on the old version, then run this +// test unchanged on the new one — any diff is a behavioral regression +// to investigate, not something to regenerate away. +func TestGoldenRender(t *testing.T) { + cases := []struct { + name string + chartPath string + templateFile string + talosVersion string + }{ + {"cozystack-controlplane-multidoc", cozystackChartPath, "templates/controlplane.yaml", "v1.12"}, + {"cozystack-worker-multidoc", cozystackChartPath, "templates/worker.yaml", "v1.12"}, + {"cozystack-controlplane-legacy", cozystackChartPath, "templates/controlplane.yaml", "v1.11"}, + {"cozystack-worker-legacy", cozystackChartPath, "templates/worker.yaml", "v1.11"}, + {"generic-controlplane-multidoc", genericChartPath, "templates/controlplane.yaml", "v1.12"}, + {"generic-worker-multidoc", genericChartPath, "templates/worker.yaml", "v1.12"}, + {"generic-controlplane-legacy", genericChartPath, "templates/controlplane.yaml", "v1.11"}, + {"generic-worker-legacy", genericChartPath, "templates/worker.yaml", "v1.11"}, + } + + for _, tc := range cases { + t.Run(tc.name, func(t *testing.T) { + got := renderChartTemplateWithLookup(t, tc.chartPath, tc.templateFile, simpleNicLookup(), tc.talosVersion) + goldenPath := filepath.Join("testdata", "golden", tc.name+".golden.yaml") + + if updateGolden() { + if err := os.MkdirAll(filepath.Dir(goldenPath), 0o755); err != nil { + t.Fatalf("mkdir golden dir: %v", err) + } + if err := os.WriteFile(goldenPath, []byte(got), 0o644); err != nil { + t.Fatalf("write golden %s: %v", goldenPath, err) + } + return + } + + wantBytes, err := os.ReadFile(goldenPath) + if err != nil { + t.Fatalf("read golden %s: %v (regenerate with TALM_UPDATE_GOLDEN=1)", goldenPath, err) + } + + if got != string(wantBytes) { + t.Errorf("rendered output for %s differs from golden %s.\n"+ + "A byte-level diff here means rendering behavior changed — investigate before regenerating.\n%s", + tc.name, goldenPath, firstLineDiff(string(wantBytes), got)) + } + }) + } +} + +// firstLineDiff returns a compact description of the first line where +// want and got differ, with a little surrounding context, so a golden +// mismatch points at the exact drift instead of dumping both full files. +func firstLineDiff(want, got string) string { + wantLines := strings.Split(want, "\n") + gotLines := strings.Split(got, "\n") + + maxLen := max(len(wantLines), len(gotLines)) + + for i := range maxLen { + var wl, gl string + if i < len(wantLines) { + wl = wantLines[i] + } + if i < len(gotLines) { + gl = gotLines[i] + } + if wl != gl { + return "first difference at line " + itoa(i+1) + ":\n" + + " want: " + quote(wl) + "\n" + + " got: " + quote(gl) + } + } + + return "files differ only in trailing content (line count: want " + + itoa(len(wantLines)) + ", got " + itoa(len(gotLines)) + ")" +} + +// itoa is a tiny strconv.Itoa alias kept local so the diff helper reads +// without an extra import at the call sites. +func itoa(n int) string { + return strconv.Itoa(n) +} + +// quote renders a line with visible quotes so trailing-whitespace drift +// is legible in the failure message. +func quote(s string) string { + return "\"" + s + "\"" +} diff --git a/pkg/engine/helm/doc.go b/pkg/engine/helm/doc.go index 6b3443a..e764a82 100644 --- a/pkg/engine/helm/doc.go +++ b/pkg/engine/helm/doc.go @@ -21,4 +21,4 @@ When Helm renders templates it does so with additional functions and different modes (e.g., strict, lint mode). This package handles the helm specific implementation. */ -package engine // import "helm.sh/helm/v3/pkg/engine" +package engine // import "helm.sh/helm/v4/pkg/engine" diff --git a/pkg/engine/helm/engine.go b/pkg/engine/helm/engine.go index c83fee5..0bf1135 100644 --- a/pkg/engine/helm/engine.go +++ b/pkg/engine/helm/engine.go @@ -29,8 +29,8 @@ import ( "github.com/cockroachdb/errors" - "helm.sh/helm/v3/pkg/chart" - "helm.sh/helm/v3/pkg/chartutil" + "helm.sh/helm/v4/pkg/chart/common" + chart "helm.sh/helm/v4/pkg/chart/v2" ) // Disks is a package-level lookup table consulted by chart templates that @@ -71,7 +71,7 @@ type Engine struct { // access to the values set for its parent. If chart "foo" includes chart "bar", // "bar" will not have access to the values for "foo". // -// Values should be prepared with something like `chartutils.ReadValues`. +// Values should be prepared with something like `common.ReadValues`. // // Values are passed through the templates according to scope. If the top layer // chart includes the chart foo, which includes the chart bar, the values map @@ -79,7 +79,7 @@ type Engine struct { // that section of the values will be passed into the "foo" chart. And if that // section contains a value named "bar", that value will be passed on to the // bar chart during render time. -func (e Engine) Render(chrt *chart.Chart, values chartutil.Values) (map[string]string, error) { +func (e Engine) Render(chrt *chart.Chart, values common.Values) (map[string]string, error) { tmap := allTemplates(chrt, values) return e.render(tmap) @@ -87,7 +87,7 @@ func (e Engine) Render(chrt *chart.Chart, values chartutil.Values) (map[string]s // Render takes a chart, optional values, and value overrides, and attempts to // render the Go templates using the default options. -func Render(chrt *chart.Chart, values chartutil.Values) (map[string]string, error) { +func Render(chrt *chart.Chart, values common.Values) (map[string]string, error) { return new(Engine).Render(chrt, values) } @@ -96,7 +96,7 @@ type renderable struct { // tpl is the current template. tpl string // vals are the values to be supplied to the template. - vals chartutil.Values + vals common.Values // namespace prefix to the templates of the current chart basePath string } @@ -394,7 +394,7 @@ func (e Engine) render(tpls map[string]renderable) (_ map[string]string, err err } // At render time, add information about the template that is being rendered. vals := tpls[filename].vals - vals["Template"] = chartutil.Values{"Name": filename, "BasePath": tpls[filename].basePath} + vals["Template"] = common.Values{"Name": filename, "BasePath": tpls[filename].basePath} var buf strings.Builder @@ -498,7 +498,7 @@ func (p byPathLen) Less(i, j int) bool { // allTemplates returns all templates for a chart and its dependencies. // // As it goes, it also prepares the values in a scope-sensitive manner. -func allTemplates(c *chart.Chart, vals chartutil.Values) map[string]renderable { +func allTemplates(c *chart.Chart, vals common.Values) map[string]renderable { templates := make(map[string]renderable) recAllTpls(c, templates, vals) @@ -509,7 +509,7 @@ func allTemplates(c *chart.Chart, vals chartutil.Values) map[string]renderable { // // As it recurses, it also sets the values to be appropriate for the template // scope. -func recAllTpls(c *chart.Chart, templates map[string]renderable, vals chartutil.Values) map[string]any { +func recAllTpls(c *chart.Chart, templates map[string]renderable, vals common.Values) map[string]any { subCharts := make(map[string]any) chartMetaData := struct { chart.Metadata @@ -522,7 +522,7 @@ func recAllTpls(c *chart.Chart, templates map[string]renderable, vals chartutil. "Files": newFiles(c.Files), "Release": vals["Release"], "Capabilities": vals["Capabilities"], - "Values": make(chartutil.Values), + "Values": make(common.Values), "Subcharts": subCharts, "Disks": Disks, helmKeyTalosVersion: vals[helmKeyTalosVersion], diff --git a/pkg/engine/helm/engine_test.go b/pkg/engine/helm/engine_test.go index ba59c47..13eb82a 100644 --- a/pkg/engine/helm/engine_test.go +++ b/pkg/engine/helm/engine_test.go @@ -26,8 +26,9 @@ import ( "github.com/cockroachdb/errors" - "helm.sh/helm/v3/pkg/chart" - "helm.sh/helm/v3/pkg/chartutil" + "helm.sh/helm/v4/pkg/chart/common" + "helm.sh/helm/v4/pkg/chart/common/util" + chart "helm.sh/helm/v4/pkg/chart/v2" ) func TestSortTemplates(t *testing.T) { @@ -88,7 +89,7 @@ func TestRender(t *testing.T) { Name: "moby", Version: helmTestVersion, }, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/test1", Data: []byte("{{.Values.outer | title }} {{.Values.inner | title}}")}, {Name: "templates/test2", Data: []byte("{{.Values.global.callme | lower }}")}, {Name: "templates/test3", Data: []byte("{{.noValue}}")}, @@ -108,7 +109,7 @@ func TestRender(t *testing.T) { }, } - v, err := chartutil.CoalesceValues(c, vals) + v, err := util.CoalesceValues(c, vals) if err != nil { t.Fatalf("Failed to coalesce values: %s", err) } @@ -138,7 +139,7 @@ func TestRenderRefsOrdering(t *testing.T) { Name: "parent", Version: helmTestVersion, }, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/_helpers.tpl", Data: []byte(`{{- define "test" -}}parent value{{- end -}}`)}, {Name: "templates/test.yaml", Data: []byte(`{{ tpl "{{ include \"test\" . }}" . }}`)}, }, @@ -148,7 +149,7 @@ func TestRenderRefsOrdering(t *testing.T) { Name: helmKeyChartChild, Version: helmTestVersion, }, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/_helpers.tpl", Data: []byte(`{{- define "test" -}}child value{{- end -}}`)}, }, } @@ -159,7 +160,7 @@ func TestRenderRefsOrdering(t *testing.T) { } for i := range 100 { - out, err := Render(parentChart, chartutil.Values{}) + out, err := Render(parentChart, common.Values{}) if err != nil { t.Fatalf("Failed to render templates: %s", err) } @@ -175,7 +176,7 @@ func TestRenderRefsOrdering(t *testing.T) { func TestRenderInternals(t *testing.T) { // Test the internals of the rendering tool. - vals := chartutil.Values{helmKeyName: "one", "Value": "two"} + vals := common.Values{helmKeyName: "one", "Value": "two"} tpls := map[string]renderable{ "one": {tpl: `Hello {{title .Name}}`, vals: vals}, "two": {tpl: `Goodbye {{upper .Value}}`, vals: vals}, @@ -212,7 +213,7 @@ func TestRenderWithDNS(t *testing.T) { Name: "moby", Version: helmTestVersion, }, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/test1", Data: []byte("{{getHostByName \"helm.sh\"}}")}, }, Values: map[string]any{}, @@ -222,7 +223,7 @@ func TestRenderWithDNS(t *testing.T) { helmKeyValues: map[string]any{}, } - v, err := chartutil.CoalesceValues(c, vals) + v, err := util.CoalesceValues(c, vals) if err != nil { t.Fatalf("Failed to coalesce values: %s", err) } @@ -270,7 +271,7 @@ func TestParallelRenderInternals(t *testing.T) { } func TestParseErrors(t *testing.T) { - vals := chartutil.Values{helmKeyValues: map[string]any{}} + vals := common.Values{helmKeyValues: map[string]any{}} tplsUndefinedFunction := map[string]renderable{ "undefined_function": {tpl: `{{foo}}`, vals: vals}, @@ -286,7 +287,7 @@ func TestParseErrors(t *testing.T) { } func TestExecErrors(t *testing.T) { - vals := chartutil.Values{helmKeyValues: map[string]any{}} + vals := common.Values{helmKeyValues: map[string]any{}} cases := []struct { name string tpls map[string]renderable @@ -350,7 +351,7 @@ linebreak`, } func TestFailErrors(t *testing.T) { - vals := chartutil.Values{helmKeyValues: map[string]any{}} + vals := common.Values{helmKeyValues: map[string]any{}} failtpl := `All your base are belong to us{{ fail "This is an error" }}` tplsFailed := map[string]renderable{ @@ -381,14 +382,14 @@ func TestFailErrors(t *testing.T) { func TestAllTemplates(t *testing.T) { ch1 := &chart.Chart{ Metadata: &chart.Metadata{Name: "ch1"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/foo", Data: []byte("foo")}, {Name: "templates/bar", Data: []byte("bar")}, }, } dep1 := &chart.Chart{ Metadata: &chart.Metadata{Name: "laboratory mice"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/pinky", Data: []byte("pinky")}, {Name: "templates/brain", Data: []byte("brain")}, }, @@ -397,13 +398,13 @@ func TestAllTemplates(t *testing.T) { dep2 := &chart.Chart{ Metadata: &chart.Metadata{Name: "same thing we do every night"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/innermost", Data: []byte("innermost")}, }, } dep1.AddDependency(dep2) - tpls := allTemplates(ch1, chartutil.Values{}) + tpls := allTemplates(ch1, common.Values{}) if len(tpls) != 5 { t.Errorf("Expected 5 charts, got %d", len(tpls)) } @@ -412,19 +413,19 @@ func TestAllTemplates(t *testing.T) { func TestChartValuesContainsIsRoot(t *testing.T) { ch1 := &chart.Chart{ Metadata: &chart.Metadata{Name: "parent"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/isroot", Data: []byte("{{.Chart.IsRoot}}")}, }, } dep1 := &chart.Chart{ Metadata: &chart.Metadata{Name: helmKeyChartChild}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/isroot", Data: []byte("{{.Chart.IsRoot}}")}, }, } ch1.AddDependency(dep1) - out, err := Render(ch1, chartutil.Values{}) + out, err := Render(ch1, common.Values{}) if err != nil { t.Fatalf("failed to render templates: %s", err) } @@ -444,13 +445,13 @@ func TestRenderDependency(t *testing.T) { toptpl := `Hello {{template "myblock"}}` ch := &chart.Chart{ Metadata: &chart.Metadata{Name: "outerchart"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/outer", Data: []byte(toptpl)}, }, } ch.AddDependency(&chart.Chart{ Metadata: &chart.Metadata{Name: "innerchart"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/inner", Data: []byte(deptpl)}, }, }) @@ -481,7 +482,7 @@ func TestRenderNestedValues(t *testing.T) { deepest := &chart.Chart{ Metadata: &chart.Metadata{Name: helmFixtureDeepest}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: deepestpath, Data: []byte(`And this same {{.Values.what}} that smiles {{.Values.global.when}}`)}, {Name: checkrelease, Data: []byte(`Tomorrow will be {{default "happy" .Release.Name }}`)}, }, @@ -490,7 +491,7 @@ func TestRenderNestedValues(t *testing.T) { inner := &chart.Chart{ Metadata: &chart.Metadata{Name: helmFixtureHerrick}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: innerpath, Data: []byte(`Old {{.Values.who}} is still a-flyin'`)}, }, Values: map[string]any{"who": "Robert", "what": "glasses"}, @@ -499,7 +500,7 @@ func TestRenderNestedValues(t *testing.T) { outer := &chart.Chart{ Metadata: &chart.Metadata{Name: "top"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: outerpath, Data: []byte(`Gather ye {{.Values.what}} while ye may`)}, {Name: subchartspath, Data: []byte(`The glorious Lamp of {{.Subcharts.herrick.Subcharts.deepest.Values.where}}, the {{.Subcharts.herrick.Values.what}}`)}, }, @@ -527,15 +528,15 @@ func TestRenderNestedValues(t *testing.T) { }, } - tmp, err := chartutil.CoalesceValues(outer, injValues) + tmp, err := util.CoalesceValues(outer, injValues) if err != nil { t.Fatalf("Failed to coalesce values: %s", err) } - inject := chartutil.Values{ + inject := common.Values{ helmKeyValues: tmp, helmKeyChart: outer.Metadata, - helmKeyRelease: chartutil.Values{ + helmKeyRelease: common.Values{ helmKeyName: "dyin", }, } @@ -576,11 +577,11 @@ func TestRenderNestedValues(t *testing.T) { func TestRenderBuiltinValues(t *testing.T) { inner := &chart.Chart{ Metadata: &chart.Metadata{Name: "Latium"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/Lavinia", Data: []byte(`{{.Template.Name}}{{.Chart.Name}}{{.Release.Name}}`)}, {Name: "templates/From", Data: []byte(`{{.Files.author | printf "%s"}} {{.Files.Get "book/title.txt"}}`)}, }, - Files: []*chart.File{ + Files: []*common.File{ {Name: "author", Data: []byte("Virgil")}, {Name: "book/title.txt", Data: []byte("Aeneid")}, }, @@ -588,17 +589,17 @@ func TestRenderBuiltinValues(t *testing.T) { outer := &chart.Chart{ Metadata: &chart.Metadata{Name: "Troy"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/Aeneas", Data: []byte(`{{.Template.Name}}{{.Chart.Name}}{{.Release.Name}}`)}, {Name: "templates/Amata", Data: []byte(`{{.Subcharts.Latium.Chart.Name}} {{.Subcharts.Latium.Files.author | printf "%s"}}`)}, }, } outer.AddDependency(inner) - inject := chartutil.Values{ + inject := common.Values{ helmKeyValues: "", helmKeyChart: outer.Metadata, - helmKeyRelease: chartutil.Values{ + helmKeyRelease: common.Values{ helmKeyName: "Aeneid", }, } @@ -626,7 +627,7 @@ func TestRenderBuiltinValues(t *testing.T) { func TestAlterFuncMap_include(t *testing.T) { c := &chart.Chart{ Metadata: &chart.Metadata{Name: "conrad"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/quote", Data: []byte(`{{include "conrad/templates/_partial" . | indent 2}} dead.`)}, {Name: "templates/_partial", Data: []byte(`{{.Release.Name}} - he`)}, }, @@ -635,16 +636,16 @@ func TestAlterFuncMap_include(t *testing.T) { // Check nested reference in include FuncMap d := &chart.Chart{ Metadata: &chart.Metadata{Name: "nested"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/quote", Data: []byte(`{{include "nested/templates/quote" . | indent 2}} dead.`)}, {Name: "templates/_partial", Data: []byte(`{{.Release.Name}} - he`)}, }, } - v := chartutil.Values{ + v := common.Values{ helmKeyValues: "", helmKeyChart: c.Metadata, - helmKeyRelease: chartutil.Values{ + helmKeyRelease: common.Values{ helmKeyName: "Mistah Kurtz", }, } @@ -669,19 +670,19 @@ func TestAlterFuncMap_include(t *testing.T) { func TestAlterFuncMap_require(t *testing.T) { c := &chart.Chart{ Metadata: &chart.Metadata{Name: "conan"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/quote", Data: []byte(`All your base are belong to {{ required "A valid 'who' is required" .Values.who }}`)}, {Name: "templates/bases", Data: []byte(`All {{ required "A valid 'bases' is required" .Values.bases }} of them!`)}, }, } - v := chartutil.Values{ - helmKeyValues: chartutil.Values{ + v := common.Values{ + helmKeyValues: common.Values{ "who": "us", "bases": 2, }, helmKeyChart: c.Metadata, - helmKeyRelease: chartutil.Values{ + helmKeyRelease: common.Values{ helmKeyName: helmFixture90sMeme, }, } @@ -702,12 +703,12 @@ func TestAlterFuncMap_require(t *testing.T) { // test required without passing in needed values with lint mode on // verifies lint replaces required with an empty string (should not fail) - lintValues := chartutil.Values{ - helmKeyValues: chartutil.Values{ + lintValues := common.Values{ + helmKeyValues: common.Values{ "who": "us", }, helmKeyChart: c.Metadata, - helmKeyRelease: chartutil.Values{ + helmKeyRelease: common.Values{ helmKeyName: helmFixture90sMeme, }, } @@ -731,17 +732,17 @@ func TestAlterFuncMap_require(t *testing.T) { func TestAlterFuncMap_tpl(t *testing.T) { c := &chart.Chart{ Metadata: &chart.Metadata{Name: helmFixtureTplFunction}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/base", Data: []byte(`Evaluate tpl {{tpl "Value: {{ .Values.value}}" .}}`)}, }, } - v := chartutil.Values{ - helmKeyValues: chartutil.Values{ + v := common.Values{ + helmKeyValues: common.Values{ "value": "myvalue", }, helmKeyChart: c.Metadata, - helmKeyRelease: chartutil.Values{ + helmKeyRelease: common.Values{ helmKeyName: helmFixtureTestRelease, }, } @@ -760,17 +761,17 @@ func TestAlterFuncMap_tpl(t *testing.T) { func TestAlterFuncMap_tplfunc(t *testing.T) { c := &chart.Chart{ Metadata: &chart.Metadata{Name: helmFixtureTplFunction}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/base", Data: []byte(`Evaluate tpl {{tpl "Value: {{ .Values.value | quote}}" .}}`)}, }, } - v := chartutil.Values{ - helmKeyValues: chartutil.Values{ + v := common.Values{ + helmKeyValues: common.Values{ "value": "myvalue", }, helmKeyChart: c.Metadata, - helmKeyRelease: chartutil.Values{ + helmKeyRelease: common.Values{ helmKeyName: helmFixtureTestRelease, }, } @@ -789,17 +790,17 @@ func TestAlterFuncMap_tplfunc(t *testing.T) { func TestAlterFuncMap_tplinclude(t *testing.T) { c := &chart.Chart{ Metadata: &chart.Metadata{Name: helmFixtureTplFunction}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/base", Data: []byte(`{{ tpl "{{include ` + "`" + `TplFunction/templates/_partial` + "`" + ` . | quote }}" .}}`)}, {Name: "templates/_partial", Data: []byte(`{{.Template.Name}}`)}, }, } - v := chartutil.Values{ - helmKeyValues: chartutil.Values{ + v := common.Values{ + helmKeyValues: common.Values{ "value": "myvalue", }, helmKeyChart: c.Metadata, - helmKeyRelease: chartutil.Values{ + helmKeyRelease: common.Values{ helmKeyName: helmFixtureTestRelease, }, } @@ -819,15 +820,15 @@ func TestRenderRecursionLimit(t *testing.T) { // endless recursion should produce an error c := &chart.Chart{ Metadata: &chart.Metadata{Name: "bad"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/base", Data: []byte(`{{include "recursion" . }}`)}, {Name: "templates/recursion", Data: []byte(`{{define "recursion"}}{{include "recursion" . }}{{end}}`)}, }, } - v := chartutil.Values{ + v := common.Values{ helmKeyValues: "", helmKeyChart: c.Metadata, - helmKeyRelease: chartutil.Values{ + helmKeyRelease: common.Values{ helmKeyName: helmFixtureTestRelease, }, } @@ -846,7 +847,7 @@ func TestRenderRecursionLimit(t *testing.T) { d := &chart.Chart{ Metadata: &chart.Metadata{Name: "overlook"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/quote", Data: []byte(repeatedIncl)}, {Name: "templates/_function", Data: []byte(printFunc)}, }, @@ -866,23 +867,23 @@ func TestRenderRecursionLimit(t *testing.T) { func TestRenderLoadTemplateForTplFromFile(t *testing.T) { c := &chart.Chart{ Metadata: &chart.Metadata{Name: "TplLoadFromFile"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/base", Data: []byte(`{{ tpl (.Files.Get .Values.filename) . }}`)}, {Name: "templates/_function", Data: []byte(`{{define "test-function"}}test-function{{end}}`)}, }, - Files: []*chart.File{ + Files: []*common.File{ {Name: "test", Data: []byte(`{{ tpl (.Files.Get .Values.filename2) .}}`)}, {Name: "test2", Data: []byte(`{{include "test-function" .}}{{define "nested-define"}}nested-define-content{{end}} {{include "nested-define" .}}`)}, }, } - v := chartutil.Values{ - helmKeyValues: chartutil.Values{ + v := common.Values{ + helmKeyValues: common.Values{ "filename": "test", "filename2": "test2", }, helmKeyChart: c.Metadata, - helmKeyRelease: chartutil.Values{ + helmKeyRelease: common.Values{ helmKeyName: helmFixtureTestRelease, }, } @@ -901,15 +902,15 @@ func TestRenderLoadTemplateForTplFromFile(t *testing.T) { func TestRenderTplEmpty(t *testing.T) { c := &chart.Chart{ Metadata: &chart.Metadata{Name: "TplEmpty"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/empty-string", Data: []byte(`{{tpl "" .}}`)}, {Name: "templates/empty-action", Data: []byte(`{{tpl "{{ \"\"}}" .}}`)}, {Name: "templates/only-defines", Data: []byte(`{{tpl "{{define \"not-invoked\"}}not-rendered{{end}}" .}}`)}, }, } - v := chartutil.Values{ + v := common.Values{ helmKeyChart: c.Metadata, - helmKeyRelease: chartutil.Values{ + helmKeyRelease: common.Values{ helmKeyName: helmFixtureTestRelease, }, } @@ -935,7 +936,7 @@ func TestRenderTplTemplateNames(t *testing.T) { // .Template.BasePath and .Name make it through c := &chart.Chart{ Metadata: &chart.Metadata{Name: "TplTemplateNames"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/default-basepath", Data: []byte(`{{tpl "{{ .Template.BasePath }}" .}}`)}, {Name: "templates/default-name", Data: []byte(`{{tpl "{{ .Template.Name }}" .}}`)}, {Name: "templates/modified-basepath", Data: []byte(`{{tpl "{{ .Template.BasePath }}" .Values.dot}}`)}, @@ -943,10 +944,10 @@ func TestRenderTplTemplateNames(t *testing.T) { {Name: "templates/modified-field", Data: []byte(`{{tpl "{{ .Template.Field }}" .Values.dot}}`)}, }, } - v := chartutil.Values{ - helmKeyValues: chartutil.Values{ - "dot": chartutil.Values{ - "Template": chartutil.Values{ + v := common.Values{ + helmKeyValues: common.Values{ + "dot": common.Values{ + "Template": common.Values{ helmKeyBasePath: "path/to/template", helmKeyName: "name-of-template", "Field": helmFixtureExtraField, @@ -954,7 +955,7 @@ func TestRenderTplTemplateNames(t *testing.T) { }, }, helmKeyChart: c.Metadata, - helmKeyRelease: chartutil.Values{ + helmKeyRelease: common.Values{ helmKeyName: helmFixtureTestRelease, }, } @@ -982,7 +983,7 @@ func TestRenderTplRedefines(t *testing.T) { // Redefining a template inside 'tpl' does not affect the outer definition c := &chart.Chart{ Metadata: &chart.Metadata{Name: "TplRedefines"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/_partials", Data: []byte(`{{define "partial"}}original-in-partial{{end}}`)}, {Name: "templates/partial", Data: []byte( `before: {{include "partial" .}}\n{{tpl .Values.partialText .}}\nafter: {{include "partial" .}}`, @@ -1004,8 +1005,8 @@ func TestRenderTplRedefines(t *testing.T) { )}, }, } - v := chartutil.Values{ - helmKeyValues: chartutil.Values{ + v := common.Values{ + helmKeyValues: common.Values{ "partialText": `{{define "partial"}}redefined-in-tpl{{end}}tpl: {{include "partial" .}}`, "manifestText": `{{define "manifest"}}redefined-in-tpl{{end}}tpl: {{include "manifest" .}}`, "manifestOnlyText": `tpl: {{include "manifest-only" .}}`, @@ -1017,7 +1018,7 @@ func TestRenderTplRedefines(t *testing.T) { "innerText": `{{define "nested"}}redefined-in-inner-tpl{{end}}inner-tpl: {{include "nested" .}} {{include "nested-outer" . }}`, }, helmKeyChart: c.Metadata, - helmKeyRelease: chartutil.Values{ + helmKeyRelease: common.Values{ helmKeyName: helmFixtureTestRelease, }, } @@ -1048,16 +1049,16 @@ func TestRenderTplMissingKey(t *testing.T) { // Rendering a missing key results in empty/zero output. c := &chart.Chart{ Metadata: &chart.Metadata{Name: "TplMissingKey"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/manifest", Data: []byte( `missingValue: {{tpl "{{.Values.noSuchKey}}" .}}`, )}, }, } - v := chartutil.Values{ - helmKeyValues: chartutil.Values{}, + v := common.Values{ + helmKeyValues: common.Values{}, helmKeyChart: c.Metadata, - helmKeyRelease: chartutil.Values{ + helmKeyRelease: common.Values{ helmKeyName: helmFixtureTestRelease, }, } @@ -1081,16 +1082,16 @@ func TestRenderTplMissingKeyString(t *testing.T) { // Rendering a missing key results in error c := &chart.Chart{ Metadata: &chart.Metadata{Name: "TplMissingKeyStrict"}, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/manifest", Data: []byte( `missingValue: {{tpl "{{.Values.noSuchKey}}" .}}`, )}, }, } - v := chartutil.Values{ - helmKeyValues: chartutil.Values{}, + v := common.Values{ + helmKeyValues: common.Values{}, helmKeyChart: c.Metadata, - helmKeyRelease: chartutil.Values{ + helmKeyRelease: common.Values{ helmKeyName: helmFixtureTestRelease, }, } @@ -1122,13 +1123,13 @@ func TestTalosVersionInTemplateContext(t *testing.T) { Name: "testchart", Version: "0.1.0", }, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/test.yaml", Data: []byte("talosVersion: {{ .TalosVersion }}")}, }, } - vals := chartutil.Values{ - helmKeyValues: chartutil.Values{}, + vals := common.Values{ + helmKeyValues: common.Values{}, "TalosVersion": "v1.12", } @@ -1152,13 +1153,13 @@ func TestTalosVersionEmpty(t *testing.T) { Name: "testchart", Version: "0.1.0", }, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/test.yaml", Data: []byte("talosVersion: {{ .TalosVersion }}")}, }, } - vals := chartutil.Values{ - helmKeyValues: chartutil.Values{}, + vals := common.Values{ + helmKeyValues: common.Values{}, } out, err := Render(c, vals) @@ -1182,12 +1183,12 @@ func TestTalosVersionConcurrentRender(t *testing.T) { Name: "testchart", Version: "0.1.0", }, - Templates: []*chart.File{ + Templates: []*common.File{ {Name: "templates/test.yaml", Data: []byte("talosVersion: {{ .TalosVersion }}")}, }, } - vals := chartutil.Values{ - helmKeyValues: chartutil.Values{}, + vals := common.Values{ + helmKeyValues: common.Values{}, "TalosVersion": version, } out, err := Render(c, vals) @@ -1224,11 +1225,11 @@ func TestCidrNetworkTemplateFunc(t *testing.T) { renderExpr := func(expr string) (string, error) { chrt := &chart.Chart{ Metadata: &chart.Metadata{Name: "cidrtest"}, - Templates: []*chart.File{{Name: "templates/out.yaml", Data: []byte(expr)}}, + Templates: []*common.File{{Name: "templates/out.yaml", Data: []byte(expr)}}, Values: map[string]any{}, } var eng Engine - out, err := eng.Render(chrt, chartutil.Values{helmKeyValues: map[string]any{}}) + out, err := eng.Render(chrt, common.Values{helmKeyValues: map[string]any{}}) if err != nil { return "", err } @@ -1278,11 +1279,11 @@ func TestCidrContainsTemplateFunc(t *testing.T) { renderExpr := func(expr string) (string, error) { chrt := &chart.Chart{ Metadata: &chart.Metadata{Name: "cidrtest"}, - Templates: []*chart.File{{Name: "templates/out.yaml", Data: []byte(expr)}}, + Templates: []*common.File{{Name: "templates/out.yaml", Data: []byte(expr)}}, Values: map[string]any{}, } var eng Engine - out, err := eng.Render(chrt, chartutil.Values{helmKeyValues: map[string]any{}}) + out, err := eng.Render(chrt, common.Values{helmKeyValues: map[string]any{}}) if err != nil { return "", err } @@ -1353,11 +1354,11 @@ func TestCidrPrefixLenTemplateFunc(t *testing.T) { renderExpr := func(expr string) (string, error) { chrt := &chart.Chart{ Metadata: &chart.Metadata{Name: "cidrtest"}, - Templates: []*chart.File{{Name: "templates/out.yaml", Data: []byte(expr)}}, + Templates: []*common.File{{Name: "templates/out.yaml", Data: []byte(expr)}}, Values: map[string]any{}, } var eng Engine - out, err := eng.Render(chrt, chartutil.Values{helmKeyValues: map[string]any{}}) + out, err := eng.Render(chrt, common.Values{helmKeyValues: map[string]any{}}) if err != nil { return "", err } @@ -1403,11 +1404,11 @@ func TestIPIsValidTemplateFunc(t *testing.T) { renderExpr := func(expr string) (string, error) { chrt := &chart.Chart{ Metadata: &chart.Metadata{Name: "iptest"}, - Templates: []*chart.File{{Name: "templates/out.yaml", Data: []byte(expr)}}, + Templates: []*common.File{{Name: "templates/out.yaml", Data: []byte(expr)}}, Values: map[string]any{}, } var eng Engine - out, err := eng.Render(chrt, chartutil.Values{helmKeyValues: map[string]any{}}) + out, err := eng.Render(chrt, common.Values{helmKeyValues: map[string]any{}}) if err != nil { return "", err } diff --git a/pkg/engine/helm/files.go b/pkg/engine/helm/files.go index 84825f8..1c72617 100644 --- a/pkg/engine/helm/files.go +++ b/pkg/engine/helm/files.go @@ -23,15 +23,15 @@ import ( "github.com/gobwas/glob" - "helm.sh/helm/v3/pkg/chart" + "helm.sh/helm/v4/pkg/chart/common" ) // files is a map of files in a chart that can be accessed from a template. type files map[string][]byte // NewFiles creates a new files from chart files. -// Given an []*chart.File (the format for files in a chart.Chart), extract a map of files. -func newFiles(from []*chart.File) files { +// Given an []*common.File (the format for files in a chart), extract a map of files. +func newFiles(from []*common.File) files { files := make(map[string][]byte) for _, f := range from { files[f.Name] = f.Data diff --git a/pkg/engine/render_test.go b/pkg/engine/render_test.go index 19d4ccc..81d2eb0 100644 --- a/pkg/engine/render_test.go +++ b/pkg/engine/render_test.go @@ -25,8 +25,8 @@ import ( helmEngine "github.com/cozystack/talm/pkg/engine/helm" "github.com/siderolabs/talos/pkg/machinery/client" - "helm.sh/helm/v3/pkg/chart/loader" - "helm.sh/helm/v3/pkg/chartutil" + "helm.sh/helm/v4/pkg/chart/common" + "helm.sh/helm/v4/pkg/chart/v2/loader" ) // testEndpoint is the cluster endpoint injected by tests that do not @@ -111,7 +111,7 @@ func renderChartTemplate(t *testing.T, chartPath string, templateFile string, ta values["advertisedSubnets"] = []any{testAdvertisedSubnet} } - rootValues := chartutil.Values{ + rootValues := common.Values{ "Values": values, "TalosVersion": tv, } @@ -171,7 +171,7 @@ func renderChartTemplateWithLookup(t *testing.T, chartPath string, templateFile values["advertisedSubnets"] = []any{testAdvertisedSubnet} } - rootValues := chartutil.Values{ + rootValues := common.Values{ "Values": values, "TalosVersion": tv, } @@ -455,7 +455,7 @@ func TestLegacyCozystack_NrHugepages(t *testing.T) { values["advertisedSubnets"] = []any{testAdvertisedSubnet} eng := helmEngine.Engine{} - out, err := eng.Render(chrt, chartutil.Values{ + out, err := eng.Render(chrt, common.Values{ "Values": values, }) if err != nil { @@ -486,7 +486,7 @@ func TestMultiDocCozystack_NrHugepages(t *testing.T) { values["advertisedSubnets"] = []any{testAdvertisedSubnet} eng := helmEngine.Engine{} - out, err := eng.Render(chrt, chartutil.Values{ + out, err := eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": "v1.12", }) @@ -1076,7 +1076,7 @@ func TestMultiDocCozystack_BondTopology(t *testing.T) { values["endpoint"] = testEndpoint eng := helmEngine.Engine{} - out, err := eng.Render(chrt, chartutil.Values{ + out, err := eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": "v1.12", }) @@ -1113,7 +1113,7 @@ func TestMultiDocCozystack_VlanOnBondTopology(t *testing.T) { values["endpoint"] = testEndpoint eng := helmEngine.Engine{} - out, err := eng.Render(chrt, chartutil.Values{ + out, err := eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": "v1.12", }) @@ -1147,7 +1147,7 @@ func TestMultiDocGeneric_BondTopology(t *testing.T) { values["endpoint"] = testEndpoint eng := helmEngine.Engine{} - out, err := eng.Render(chrt, chartutil.Values{ + out, err := eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": "v1.12", }) @@ -1180,7 +1180,7 @@ func TestMultiDocGeneric_VlanOnBondTopology(t *testing.T) { values["endpoint"] = testEndpoint eng := helmEngine.Engine{} - out, err := eng.Render(chrt, chartutil.Values{ + out, err := eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": "v1.12", }) @@ -1944,7 +1944,7 @@ func TestMultiDocFailsWhenVLANHasNoVlanID(t *testing.T) { } eng := helmEngine.Engine{} - _, err = eng.Render(chrt, chartutil.Values{ + _, err = eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": "v1.12", }) @@ -1998,7 +1998,7 @@ func TestMultiDocFailsWhenVLANHasNoParent(t *testing.T) { } eng := helmEngine.Engine{} - _, err = eng.Render(chrt, chartutil.Values{ + _, err = eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": "v1.12", }) @@ -2142,7 +2142,7 @@ func TestMultiDocFailsOnLegacyInterfacesInRunningConfig(t *testing.T) { } eng := helmEngine.Engine{} - _, err = eng.Render(chrt, chartutil.Values{ + _, err = eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": "v1.12", }) @@ -6853,7 +6853,7 @@ func renderCozystackWith(t *testing.T, lookup func(string, string, string) (map[ maps.Copy(values, overrides) eng := helmEngine.Engine{} - out, err := eng.Render(chrt, chartutil.Values{ + out, err := eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": "v1.12", }) @@ -6902,7 +6902,7 @@ func renderCozystackExpectError(t *testing.T, lookup func(string, string, string } eng := helmEngine.Engine{} - _, err = eng.Render(chrt, chartutil.Values{ + _, err = eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": version, }) @@ -6938,7 +6938,7 @@ func renderGenericExpectError(t *testing.T, lookup func(string, string, string) } eng := helmEngine.Engine{} - _, err = eng.Render(chrt, chartutil.Values{ + _, err = eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": version, }) @@ -6966,7 +6966,7 @@ func renderGenericWith(t *testing.T, lookup func(string, string, string) (map[st maps.Copy(values, overrides) eng := helmEngine.Engine{} - out, err := eng.Render(chrt, chartutil.Values{ + out, err := eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": "v1.12", }) @@ -7062,7 +7062,7 @@ func TestMultiDocCozystack_EndpointRequired(t *testing.T) { values["endpoint"] = "" eng := helmEngine.Engine{} - _, err = eng.Render(chrt, chartutil.Values{ + _, err = eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": "v1.12", }) @@ -7090,7 +7090,7 @@ func TestMultiDocCozystack_InvalidClusterNameOverride(t *testing.T) { values["clusterName"] = "InvalidClusterName" eng := helmEngine.Engine{} - _, err = eng.Render(chrt, chartutil.Values{ + _, err = eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": "v1.12", }) @@ -7129,7 +7129,7 @@ func TestMultiDocGeneric_InvalidClusterNameOverride(t *testing.T) { values["clusterName"] = "InvalidClusterName" eng := helmEngine.Engine{} - _, err = eng.Render(chrt, chartutil.Values{ + _, err = eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": "v1.12", }) @@ -7204,7 +7204,7 @@ func TestMultiDocCozystack_ShippedDefaultsFailFresh(t *testing.T) { eng := helmEngine.Engine{} // Render with chrt.Values exactly as shipped — no test injection. - _, err = eng.Render(chrt, chartutil.Values{ + _, err = eng.Render(chrt, common.Values{ "Values": chrt.Values, "TalosVersion": "v1.12", }) @@ -7319,7 +7319,7 @@ func renderLegacyChart(t *testing.T, chartDir, templateName string, lookup func( maps.Copy(values, overrides) eng := helmEngine.Engine{} - out, err := eng.Render(chrt, chartutil.Values{ + out, err := eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": "", }) @@ -7592,7 +7592,7 @@ func TestMultiDocCozystack_EmptyDiscoveryErrors(t *testing.T) { values["advertisedSubnets"] = []any{} eng := helmEngine.Engine{} - _, err = eng.Render(chrt, chartutil.Values{ + _, err = eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": "v1.12", }) @@ -7631,7 +7631,7 @@ func TestMultiDocCozystack_WorkerValidSubnetsFallsBackToDiscovery(t *testing.T) values["advertisedSubnets"] = []any{} eng := helmEngine.Engine{} - out, err := eng.Render(chrt, chartutil.Values{ + out, err := eng.Render(chrt, common.Values{ "Values": values, "TalosVersion": "v1.12", }) diff --git a/pkg/engine/testdata/golden/cozystack-controlplane-legacy.golden.yaml b/pkg/engine/testdata/golden/cozystack-controlplane-legacy.golden.yaml new file mode 100644 index 0000000..0cb9a3e --- /dev/null +++ b/pkg/engine/testdata/golden/cozystack-controlplane-legacy.golden.yaml @@ -0,0 +1,114 @@ + +machine: + nodeLabels: + node.kubernetes.io/exclude-from-external-load-balancers: + $patch: delete + type: controlplane + kubelet: + nodeIP: + validSubnets: + - 192.168.1.0/24 + extraConfig: + cpuManagerPolicy: static + maxPods: 512 + sysctls: + net.ipv4.neigh.default.gc_thresh1: "4096" + net.ipv4.neigh.default.gc_thresh2: "8192" + net.ipv4.neigh.default.gc_thresh3: "16384" + net.ipv4.tcp_orphan_retries: "3" + net.ipv4.tcp_fin_timeout: "30" + net.core.netdev_max_backlog: "5000" + net.core.netdev_budget: "600" + net.core.netdev_budget_usecs: "8000" + kernel: + modules: + - name: openvswitch + - name: drbd + parameters: + - usermode_helper=disabled + - name: zfs + - name: spl + - name: vfio_pci + - name: vfio_iommu_type1 + certSANs: + - 127.0.0.1 + files: + - content: | + [plugins] + [plugins."io.containerd.grpc.v1.cri"] + device_ownership_from_security_context = true + [plugins."io.containerd.cri.v1.runtime"] + device_ownership_from_security_context = true + path: /etc/cri/conf.d/20-customization.part + op: create + - op: overwrite + path: /etc/lvm/lvm.conf + permissions: 0o644 + content: | + backup { + backup = 0 + archive = 0 + } + devices { + global_filter = [ "r|^/dev/drbd.*|", "r|^/dev/dm-.*|", "r|^/dev/zd.*|", "r|^/dev/loop.*|" ] + } + install: + image: ghcr.io/cozystack/cozystack/talos:v1.12.6 + + # -- Discovered disks: + disk: "/dev/sda" + registries: + mirrors: + docker.io: + endpoints: + - https://mirror.gcr.io + network: + hostname: "talos-23c56" + nameservers: ["8.8.8.8"] + + # -- Discovered interfaces: + # eth0: + # hardwareAddr:aa:bb:cc:00:00:01 + # busPath: pci-0000:00:1f.0 + # driver: + # vendor: + # product: ) + interfaces: + - interface: eth0 + addresses: ["192.168.201.10/24"] + routes: + - network: 0.0.0.0/0 + gateway: 192.168.201.1 +cluster: + network: + cni: + name: none + dnsDomain: "cozy.local" + podSubnets: + - 10.244.0.0/16 + serviceSubnets: + - 10.96.0.0/16 + clusterName: "cozystack" + controlPlane: + endpoint: "https://talm-test.invalid:6443" + allowSchedulingOnControlPlanes: true + controllerManager: + extraArgs: + bind-address: 0.0.0.0 + allocate-node-cidrs: true + cluster-cidr: "10.244.0.0/16" + scheduler: + extraArgs: + bind-address: 0.0.0.0 + apiServer: + certSANs: + - 127.0.0.1 + proxy: + disabled: true + discovery: + enabled: false + etcd: + advertisedSubnets: + - 192.168.1.0/24 + extraArgs: + quota-backend-bytes: "8589934592" diff --git a/pkg/engine/testdata/golden/cozystack-controlplane-multidoc.golden.yaml b/pkg/engine/testdata/golden/cozystack-controlplane-multidoc.golden.yaml new file mode 100644 index 0000000..fd03b73 --- /dev/null +++ b/pkg/engine/testdata/golden/cozystack-controlplane-multidoc.golden.yaml @@ -0,0 +1,122 @@ + +machine: + nodeLabels: + node.kubernetes.io/exclude-from-external-load-balancers: + $patch: delete + type: controlplane + kubelet: + nodeIP: + validSubnets: + - 192.168.1.0/24 + extraConfig: + cpuManagerPolicy: static + maxPods: 512 + sysctls: + net.ipv4.neigh.default.gc_thresh1: "4096" + net.ipv4.neigh.default.gc_thresh2: "8192" + net.ipv4.neigh.default.gc_thresh3: "16384" + net.ipv4.tcp_orphan_retries: "3" + net.ipv4.tcp_fin_timeout: "30" + net.core.netdev_max_backlog: "5000" + net.core.netdev_budget: "600" + net.core.netdev_budget_usecs: "8000" + kernel: + modules: + - name: openvswitch + - name: drbd + parameters: + - usermode_helper=disabled + - name: zfs + - name: spl + - name: vfio_pci + - name: vfio_iommu_type1 + certSANs: + - 127.0.0.1 + files: + - content: | + [plugins] + [plugins."io.containerd.grpc.v1.cri"] + device_ownership_from_security_context = true + [plugins."io.containerd.cri.v1.runtime"] + device_ownership_from_security_context = true + path: /etc/cri/conf.d/20-customization.part + op: create + - op: overwrite + path: /etc/lvm/lvm.conf + permissions: 0o644 + content: | + backup { + backup = 0 + archive = 0 + } + devices { + global_filter = [ "r|^/dev/drbd.*|", "r|^/dev/dm-.*|", "r|^/dev/zd.*|", "r|^/dev/loop.*|" ] + } + install: + image: ghcr.io/cozystack/cozystack/talos:v1.12.6 + + # -- Discovered disks: + disk: "/dev/sda" +cluster: + network: + cni: + name: none + dnsDomain: "cozy.local" + podSubnets: + - 10.244.0.0/16 + serviceSubnets: + - 10.96.0.0/16 + clusterName: "cozystack" + controlPlane: + endpoint: "https://talm-test.invalid:6443" + allowSchedulingOnControlPlanes: true + controllerManager: + extraArgs: + bind-address: 0.0.0.0 + allocate-node-cidrs: true + cluster-cidr: "10.244.0.0/16" + scheduler: + extraArgs: + bind-address: 0.0.0.0 + apiServer: + certSANs: + - 127.0.0.1 + proxy: + disabled: true + discovery: + enabled: false + etcd: + advertisedSubnets: + - 192.168.1.0/24 + extraArgs: + quota-backend-bytes: "8589934592" +--- +apiVersion: v1alpha1 +kind: RegistryMirrorConfig +name: docker.io +endpoints: + - url: https://mirror.gcr.io +# -- Discovered interfaces: +# eth0: +# hardwareAddr:aa:bb:cc:00:00:01 +# busPath: pci-0000:00:1f.0 +# driver: +# vendor: +# product: ) +--- +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: "talos-23c56" +--- +apiVersion: v1alpha1 +kind: ResolverConfig +nameservers: + - address: "8.8.8.8" +--- +apiVersion: v1alpha1 +kind: LinkConfig +name: eth0 +addresses: + - address: 192.168.201.10/24 +routes: + - gateway: 192.168.201.1 diff --git a/pkg/engine/testdata/golden/cozystack-worker-legacy.golden.yaml b/pkg/engine/testdata/golden/cozystack-worker-legacy.golden.yaml new file mode 100644 index 0000000..9f88403 --- /dev/null +++ b/pkg/engine/testdata/golden/cozystack-worker-legacy.golden.yaml @@ -0,0 +1,90 @@ + +machine: + type: worker + kubelet: + nodeIP: + validSubnets: + - 192.168.1.0/24 + extraConfig: + cpuManagerPolicy: static + maxPods: 512 + sysctls: + net.ipv4.neigh.default.gc_thresh1: "4096" + net.ipv4.neigh.default.gc_thresh2: "8192" + net.ipv4.neigh.default.gc_thresh3: "16384" + net.ipv4.tcp_orphan_retries: "3" + net.ipv4.tcp_fin_timeout: "30" + net.core.netdev_max_backlog: "5000" + net.core.netdev_budget: "600" + net.core.netdev_budget_usecs: "8000" + kernel: + modules: + - name: openvswitch + - name: drbd + parameters: + - usermode_helper=disabled + - name: zfs + - name: spl + - name: vfio_pci + - name: vfio_iommu_type1 + certSANs: + - 127.0.0.1 + files: + - content: | + [plugins] + [plugins."io.containerd.grpc.v1.cri"] + device_ownership_from_security_context = true + [plugins."io.containerd.cri.v1.runtime"] + device_ownership_from_security_context = true + path: /etc/cri/conf.d/20-customization.part + op: create + - op: overwrite + path: /etc/lvm/lvm.conf + permissions: 0o644 + content: | + backup { + backup = 0 + archive = 0 + } + devices { + global_filter = [ "r|^/dev/drbd.*|", "r|^/dev/dm-.*|", "r|^/dev/zd.*|", "r|^/dev/loop.*|" ] + } + install: + image: ghcr.io/cozystack/cozystack/talos:v1.12.6 + + # -- Discovered disks: + disk: "/dev/sda" + registries: + mirrors: + docker.io: + endpoints: + - https://mirror.gcr.io + network: + hostname: "talos-23c56" + nameservers: ["8.8.8.8"] + + # -- Discovered interfaces: + # eth0: + # hardwareAddr:aa:bb:cc:00:00:01 + # busPath: pci-0000:00:1f.0 + # driver: + # vendor: + # product: ) + interfaces: + - interface: eth0 + addresses: ["192.168.201.10/24"] + routes: + - network: 0.0.0.0/0 + gateway: 192.168.201.1 +cluster: + network: + cni: + name: none + dnsDomain: "cozy.local" + podSubnets: + - 10.244.0.0/16 + serviceSubnets: + - 10.96.0.0/16 + clusterName: "cozystack" + controlPlane: + endpoint: "https://talm-test.invalid:6443" diff --git a/pkg/engine/testdata/golden/cozystack-worker-multidoc.golden.yaml b/pkg/engine/testdata/golden/cozystack-worker-multidoc.golden.yaml new file mode 100644 index 0000000..6a52db2 --- /dev/null +++ b/pkg/engine/testdata/golden/cozystack-worker-multidoc.golden.yaml @@ -0,0 +1,98 @@ + +machine: + type: worker + kubelet: + nodeIP: + validSubnets: + - 192.168.1.0/24 + extraConfig: + cpuManagerPolicy: static + maxPods: 512 + sysctls: + net.ipv4.neigh.default.gc_thresh1: "4096" + net.ipv4.neigh.default.gc_thresh2: "8192" + net.ipv4.neigh.default.gc_thresh3: "16384" + net.ipv4.tcp_orphan_retries: "3" + net.ipv4.tcp_fin_timeout: "30" + net.core.netdev_max_backlog: "5000" + net.core.netdev_budget: "600" + net.core.netdev_budget_usecs: "8000" + kernel: + modules: + - name: openvswitch + - name: drbd + parameters: + - usermode_helper=disabled + - name: zfs + - name: spl + - name: vfio_pci + - name: vfio_iommu_type1 + certSANs: + - 127.0.0.1 + files: + - content: | + [plugins] + [plugins."io.containerd.grpc.v1.cri"] + device_ownership_from_security_context = true + [plugins."io.containerd.cri.v1.runtime"] + device_ownership_from_security_context = true + path: /etc/cri/conf.d/20-customization.part + op: create + - op: overwrite + path: /etc/lvm/lvm.conf + permissions: 0o644 + content: | + backup { + backup = 0 + archive = 0 + } + devices { + global_filter = [ "r|^/dev/drbd.*|", "r|^/dev/dm-.*|", "r|^/dev/zd.*|", "r|^/dev/loop.*|" ] + } + install: + image: ghcr.io/cozystack/cozystack/talos:v1.12.6 + + # -- Discovered disks: + disk: "/dev/sda" +cluster: + network: + cni: + name: none + dnsDomain: "cozy.local" + podSubnets: + - 10.244.0.0/16 + serviceSubnets: + - 10.96.0.0/16 + clusterName: "cozystack" + controlPlane: + endpoint: "https://talm-test.invalid:6443" +--- +apiVersion: v1alpha1 +kind: RegistryMirrorConfig +name: docker.io +endpoints: + - url: https://mirror.gcr.io +# -- Discovered interfaces: +# eth0: +# hardwareAddr:aa:bb:cc:00:00:01 +# busPath: pci-0000:00:1f.0 +# driver: +# vendor: +# product: ) +--- +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: "talos-23c56" +--- +apiVersion: v1alpha1 +kind: ResolverConfig +nameservers: + - address: "8.8.8.8" +--- +apiVersion: v1alpha1 +kind: LinkConfig +name: eth0 +addresses: + - address: 192.168.201.10/24 +routes: + - gateway: 192.168.201.1 diff --git a/pkg/engine/testdata/golden/generic-controlplane-legacy.golden.yaml b/pkg/engine/testdata/golden/generic-controlplane-legacy.golden.yaml new file mode 100644 index 0000000..6bca4d3 --- /dev/null +++ b/pkg/engine/testdata/golden/generic-controlplane-legacy.golden.yaml @@ -0,0 +1,42 @@ + +machine: + type: controlplane + kubelet: + nodeIP: + validSubnets: + - 192.168.1.0/24 + install: + + # -- Discovered disks: + disk: "/dev/sda" + network: + hostname: "talos-23c56" + nameservers: ["8.8.8.8"] + + # -- Discovered interfaces: + # eth0: + # hardwareAddr:aa:bb:cc:00:00:01 + # busPath: pci-0000:00:1f.0 + # driver: + # vendor: + # product: ) + interfaces: + - interface: eth0 + addresses: ["192.168.201.10/24"] + routes: + - network: 0.0.0.0/0 + gateway: 192.168.201.1 + +cluster: + network: + podSubnets: + - 10.244.0.0/16 + serviceSubnets: + - 10.96.0.0/16 + clusterName: "generic" + controlPlane: + endpoint: "https://talm-test.invalid:6443" + apiServer: + etcd: + advertisedSubnets: + - 192.168.1.0/24 diff --git a/pkg/engine/testdata/golden/generic-controlplane-multidoc.golden.yaml b/pkg/engine/testdata/golden/generic-controlplane-multidoc.golden.yaml new file mode 100644 index 0000000..7804e87 --- /dev/null +++ b/pkg/engine/testdata/golden/generic-controlplane-multidoc.golden.yaml @@ -0,0 +1,49 @@ + +machine: + type: controlplane + kubelet: + nodeIP: + validSubnets: + - 192.168.1.0/24 + install: + + # -- Discovered disks: + disk: "/dev/sda" + +cluster: + network: + podSubnets: + - 10.244.0.0/16 + serviceSubnets: + - 10.96.0.0/16 + clusterName: "generic" + controlPlane: + endpoint: "https://talm-test.invalid:6443" + apiServer: + etcd: + advertisedSubnets: + - 192.168.1.0/24 +# -- Discovered interfaces: +# eth0: +# hardwareAddr:aa:bb:cc:00:00:01 +# busPath: pci-0000:00:1f.0 +# driver: +# vendor: +# product: ) +--- +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: "talos-23c56" +--- +apiVersion: v1alpha1 +kind: ResolverConfig +nameservers: + - address: "8.8.8.8" +--- +apiVersion: v1alpha1 +kind: LinkConfig +name: eth0 +addresses: + - address: 192.168.201.10/24 +routes: + - gateway: 192.168.201.1 diff --git a/pkg/engine/testdata/golden/generic-worker-legacy.golden.yaml b/pkg/engine/testdata/golden/generic-worker-legacy.golden.yaml new file mode 100644 index 0000000..38594f3 --- /dev/null +++ b/pkg/engine/testdata/golden/generic-worker-legacy.golden.yaml @@ -0,0 +1,38 @@ + +machine: + type: worker + kubelet: + nodeIP: + validSubnets: + - 192.168.1.0/24 + install: + + # -- Discovered disks: + disk: "/dev/sda" + network: + hostname: "talos-23c56" + nameservers: ["8.8.8.8"] + + # -- Discovered interfaces: + # eth0: + # hardwareAddr:aa:bb:cc:00:00:01 + # busPath: pci-0000:00:1f.0 + # driver: + # vendor: + # product: ) + interfaces: + - interface: eth0 + addresses: ["192.168.201.10/24"] + routes: + - network: 0.0.0.0/0 + gateway: 192.168.201.1 + +cluster: + network: + podSubnets: + - 10.244.0.0/16 + serviceSubnets: + - 10.96.0.0/16 + clusterName: "generic" + controlPlane: + endpoint: "https://talm-test.invalid:6443" diff --git a/pkg/engine/testdata/golden/generic-worker-multidoc.golden.yaml b/pkg/engine/testdata/golden/generic-worker-multidoc.golden.yaml new file mode 100644 index 0000000..5c34308 --- /dev/null +++ b/pkg/engine/testdata/golden/generic-worker-multidoc.golden.yaml @@ -0,0 +1,45 @@ + +machine: + type: worker + kubelet: + nodeIP: + validSubnets: + - 192.168.1.0/24 + install: + + # -- Discovered disks: + disk: "/dev/sda" + +cluster: + network: + podSubnets: + - 10.244.0.0/16 + serviceSubnets: + - 10.96.0.0/16 + clusterName: "generic" + controlPlane: + endpoint: "https://talm-test.invalid:6443" +# -- Discovered interfaces: +# eth0: +# hardwareAddr:aa:bb:cc:00:00:01 +# busPath: pci-0000:00:1f.0 +# driver: +# vendor: +# product: ) +--- +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: "talos-23c56" +--- +apiVersion: v1alpha1 +kind: ResolverConfig +nameservers: + - address: "8.8.8.8" +--- +apiVersion: v1alpha1 +kind: LinkConfig +name: eth0 +addresses: + - address: 192.168.201.10/24 +routes: + - gateway: 192.168.201.1