Skip to content

Conversation

@wallrj-cyberark
Copy link
Member

@wallrj-cyberark wallrj-cyberark commented Sep 17, 2025

Supplants #635

Upgrade makefile modules to the latest version. Why? Because I want to build venafi-kubernetes-agent and cyberark-disco-agent with the latest version of Go and with up to date versions of all the build tools.
All the other changes around dependabot / renovate are side effects of the make upgrade-klone command.

  • Ran make upgrade-klone
  • Removed the boilerplate module because none of the files currently have the header
  • Ran make generate-base
  • Fixed a new golangci-lint noctx warning in the logging tests

There's so much new stuff in makefile-modules, related to renovate and the use of chainguard STS....I have no idea whether it's going to work in this repo....and I can't think of an easy way to test it before merging this....so I propose merging it and fixing any problems as they arise.

Testing

I ran make ark-test-e2e because it is not run by GitHub Actions. It invokes the new make ark-release and uses some of the new versions of the tools to build and test the agent in a local dev environment. Output elided for brevity.

richard@localhost:~/projects/jetstack/jetstack-secure$ make ark-test-e2e
PATH="_bin/tools:..." ./hack/ark/test-e2e.sh
...
make oci-push-ark helm-chart-oci-push \
    oci_ark_image_name="ttl.sh/<redacted>/images/cyberark-disco-agent" \
    ...
echo '{}' | .../yq '.defaultBaseImage = "quay.io/jetstack/base-static@sha256:<redacted>"' | ... > .../oci-layout-ark.ko_config.yaml
...
/home/richard/projects/jetstack/jetstack-secure/_bin/tools/ko build ././cmd/ark \
    --platform=linux/amd64 \
    --image-annotation="org.opencontainers.image.source"="https://github.com/jetstack/jetstack-secure" \
    --image-annotation="org.opencontainers.image.vendor"="CyberArk Software Ltd." \
    --image-annotation="org.opencontainers.image.licenses"="EULA - https://www.cyberark.com/contract-terms/" \
    --image-annotation="org.opencontainers.image.authors"="TODO" \
    --image-annotation="org.opencontainers.image.title"="CyberArk Discovery and Context Agent" \
    --image-annotation="org.opencontainers.image.description"="Gathers machine identity data from Kubernetes clusters." \
    --image-annotation="org.opencontainers.image.version"="v1.6.0-73-<redacted>" \
    --image-annotation="org.opencontainers.image.revision"="<redacted>" \
    --oci-layout-path=_bin/scratch/image/oci-layout-ark \
    --sbom-dir=.../oci-layout-ark.sbom \
    --sbom=spdx \
    --push=false \
    --bare
...
2025/09/17 12:31:33 Using base quay.io/jetstack/base-static@sha256:<redacted> for github.com/jetstack/preflight/cmd/ark
2025/09/17 12:31:33 Building github.com/jetstack/preflight/cmd/ark for linux/amd64
2025/09/17 12:31:43 Writing SBOM to .../oci-layout-ark.sbom/ark-linux-amd64.spdx.json
2025/09/17 12:31:45 Saved ko://github.com/jetstack/preflight/cmd/ark
...
/home/richard/projects/jetstack/jetstack-secure/_bin/tools/crane  push "_bin/scratch/image/oci-layout-ark" "ttl.sh/<redacted>/images/cyberark-disco-agent:v1.6.0-73-<redacted>"
2025/09/17 12:32:26 ttl.sh/<redacted>/images/cyberark-disco-agent:v1.6.0-73-<redacted>: digest: sha256:<redacted> size: 1864
...
/home/richard/projects/jetstack/jetstack-secure/_bin/tools/helm push "_bin/scratch/helm/cyberark-disco-agent-v1.6.0-73-<redacted>.tgz" "oci://ttl.sh/<redacted>/charts/" ...
Pushed: ttl.sh/<redacted>/charts/cyberark-disco-agent:v1.6.0-73-<redacted>
Digest: sha256:<redacted>
...
Release complete!
RELEASE_OCI_IMAGE=ttl.sh/<redacted>/images/cyberark-disco-agent
RELEASE_OCI_IMAGE_TAG=v1.6.0-73-<redacted>
RELEASE_OCI_IMAGE_DIGEST=sha256:<redacted>
RELEASE_OCI_CHART=ttl.sh/<redacted>/charts/cyberark-disco-agent
RELEASE_OCI_CHART_TAG=v1.6.0-73-<redacted>
RELEASE_OCI_CHART_DIGEST=sha256:<redacted>
...
ERROR: failed to create cluster: node(s) already exist for a cluster with the name "kind"
Error from server (AlreadyExists): namespaces "cyberark" already exists
secret "agent-credentials" deleted from cyberark namespace
secret/agent-credentials created
Pulled: ttl.sh/<redacted>/charts/cyberark-disco-agent@sha256:<redacted>
Digest: sha256:<redacted>
Release "agent" has been upgraded. Happy Helming!
NAME: agent
LAST DEPLOYED: Wed Sep 17 12:32:35 2025
NAMESPACE: cyberark
STATUS: deployed
REVISION: 3
...
deployment "disco-agent" successfully rolled out
{
  "ts": ...,
  "caller": "agent/run.go:58",
  "msg": "Starting",
  "version": "v1.6.0-73-<redacted>",
  "commit": "<redacted>"
}
{
  "ts": ...,
  "caller": "identity/identity.go:402",
  "msg": "successfully completed AdvanceAuthentication request to CyberArk Identity; login complete",
  "username": "<redacted>@cyberark.cloud.<redacted>"
}
{"ts":...,"caller":"agent/run.go:417","msg":"Data sent successfully"}

runs-on: ubuntu-latest

if: github.repository_owner == 'jetstack'
if: github.repository == 'jetstack/preflight'
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the old name of this repo. It was renamed some years ago and GitHub provide a redirect....but I don't think this check is going to work.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I updated the repo_name variable in 00_make file and ran make generate to change this.

# Without this hack, golangci-lint will complain that the
# github.com/jetstack/preflight imports should be grouped with all the other
# third-party modules.
generate-golangci-lint-config: repo_name := github.com/jetstack/preflight
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The change to the repo_name should help the new github actions workflows to run, but caused a problem with the golangci-lint (gci) import grouping which also relies on that variable.
The hack above uses the old value for generating the golangci-lint config.

@wallrj-cyberark wallrj-cyberark marked this pull request as ready for review September 17, 2025 12:58
echo "This workflow should not be run on a non-branch-head."
exit 1
- name: Octo STS Token Exchange
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wallrj-cyberark will we enable Octo STS in the jetstack repo too?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't know 😬 would it work? Is it easy to do?

Copy link
Contributor

@inteon inteon Sep 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We just have to add it as a github app afaik.
But you need to be admin in the jetstack org to do that...
I asked on teams.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. Then I'll merge it and pick your brains about the Octo STS app in teams.

- Ran make upgrade-klone
- Removed the boilerplate module because none of the files currently have the header
- Ran make generate-base

Signed-off-by: Richard Wall <richard.wall@cyberark.com>
 pkg/logs/logs_test.go:270:23: os/exec.Command must not be called. use os/exec.CommandContext (noctx)
   cmd := exec.Command(os.Args[0], "-test.run=^TestLogs$", "-test.v")

Signed-off-by: Richard Wall <richard.wall@cyberark.com>
Signed-off-by: Richard Wall <richard.wall@cyberark.com>
Signed-off-by: Richard Wall <richard.wall@cyberark.com>
…flow

Signed-off-by: Richard Wall <richard.wall@cyberark.com>
…nfig

- Change gci import prefix to github.com/jetstack/preflight in .golangci.yaml
- Add makefile hack to set repo_name for golangci-lint config generation
- Document workaround until go module can be renamed

Signed-off-by: Richard Wall <richard.wall@cyberark.com>
@wallrj-cyberark wallrj-cyberark added the test-e2e To signal e2e test job to be run label Sep 17, 2025
@wallrj-cyberark wallrj-cyberark merged commit 32d6bf1 into master Sep 17, 2025
6 checks passed
@wallrj-cyberark wallrj-cyberark deleted the klone_upgrade_2 branch September 17, 2025 14:17
@wallrj-cyberark wallrj-cyberark changed the title upgrade makefile modules to the latest version [VC-45002] Upgrade makefile modules to the latest version Sep 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

test-e2e To signal e2e test job to be run

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants