Dependency update - Golang 1.20.1/1.19.6

[cpanato]

Tracking info

Link to any previous tracking issue: #2851 / #2815

Golang mailing list announcement: https://groups.google.com/g/golang-announce/c/2zqu2BOnpP8/m/3ECQJP56AwAJ

SIG Release Slack thread:

Work items

• kube-cross image update: Build Go 1.20.1 and 1.19.6 based images #2914

  • image promotion: Image promotion for build-image v1.27.0-go1.20.1-bullseye.0 / v1.25.0-go1.19.6-bullseye.0 / v1.26.0-go1.19.6-bullseye.0 / v1.23.0-go1.19.6-bullseye.0 / v1.24.0-go1.19.6-bullseye.0 k8s.io#4785

• go-runner image update: Build Go 1.20.1 and 1.19.6 based images #2914

  • image promotion: Image promotion for build-image v2.3.1-go1.20.1-bullseye.0 / v2.3.1-go1.19.6-bullseye.0 k8s.io#4783

• releng-ci image update: Build Go 1.20.1 and 1.19.6 based images #2914

  • image promotion: Image promotion for releng 1.21.1-bullseye-0 / 1.19.6-bullseye-0 k8s.io#4784

After kube-cross image promotion

• kubernetes/kubernetes update (master): [go] Bump images, dependencies and versions to go 1.20.1 kubernetes#115828

  Ensure the following have been updated within the PR:

  • kube-cross image
  • go-runner image
  • publishing bot rules
  • test image
  • .go-version file

After kubernetes/kubernetes (master) has been updated

• k8s-cloud-builder image update: Bump k8s-cloud-builder and k8s-ci-builder to Go 1.20.1 and 1.19.6 #2921

• k8s-ci-builder image variants update: Bump k8s-cloud-builder and k8s-ci-builder to Go 1.20.1 and 1.19.6 #2921

Cherry picks

• Kubernetes 1.23: [release-1.23] releng: Update images, dependencies and version to Go 1.19.6 kubernetes#115830
• Kubernetes 1.24: [release-1.24] releng: Update images, dependencies and version to Go 1.19.6 kubernetes#115831
• Kubernetes 1.25: [release-1.25] releng: Update images, dependencies and version to Go 1.19.6 kubernetes#115832
• Kubernetes 1.26: [release-1.26] releng: Update images, dependencies and version to Go 1.19.6 kubernetes#115833

• publishing bot rule updates for active Golang versions: update go to 1.19.6 in publishing bot rules for active release branches kubernetes#115855

After kubernetes/kubernetes (release branches) has been updated

• k8s-cloud-builder image update: Bump k8s-cloud-builder and k8s-ci-builder to Go 1.20.1 and 1.19.6 #2921

• k8s-ci-builder image variants update: Bump k8s-cloud-builder and k8s-ci-builder to Go 1.20.1 and 1.19.6 #2921

• kubekins/krte image variants update: Update kubekins/krte to Go 1.20.1/1.19.5 test-infra#28781

Follow-up items

• Ensure the Golang issue template is updated with any new requirements

/assign
cc: @kubernetes/release-engineering

[liggitt]

We also need to update to v0.7.0 of https://github.com/golang/net/releases/tag/v0.7.0 to pick up the CVE-2022-41723 fix

• master: Update golang.org/x/net to v0.7.0 kubernetes#115786
• 1.26: [1.26] Update golang.org/x/net to v0.7.0 kubernetes#115787
• 1.25: [1.25] Update golang.org/x/net to v0.7.0 kubernetes#115788
• 1.24: [1.24] Update golang.org/x/net to v0.7.0 kubernetes#115789
• 1.23: [1.23] Update golang.org/x/net to v0.7.0 kubernetes#115790

[cpanato]

all work is done for now
/close

[k8s-ci-robot]

@cpanato: Closing this issue.

In response to this:

all work is done for now
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[cici37]

Should we add distroless-iptable and debian-iptable update together in the issue template and get those updated done together in the future?

[jingyuanliang]

As a note, these two images contain gorunner which will be affected by a Golang stdlib CVE / version bump.

[cpanato]

@cici37 @jingyuanliang let me take a look, we have too many images 😅

[cpanato]

@cici37 @jingyuanliang yes makes sense, can you please open a PR to update the template?