dev: v42

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
     "name": "linkerd2",
-    "image": "ghcr.io/linkerd/dev:v40",
+    "image": "ghcr.io/linkerd/dev:v42",
     // "dockerFile": "./Dockerfile",
     // "context": "..",
     "customizations": {

.github/workflows/actions.yml

@@ -14,13 +14,13 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 10
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v41
+      - uses: linkerd/dev/actions/setup-tools@v42
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: just-dev lint-actions
 
   devcontainer-versions:
     runs-on: ubuntu-latest
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v41
+      - uses: linkerd/dev/actions/setup-tools@v42
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: just-dev check-action-images

.github/workflows/codecov.yml

@@ -14,7 +14,7 @@ jobs:
     timeout-minutes: 30
     runs-on: ubuntu-20.04
     container:
-      image: golang:1.19
+      image: golang:1.21
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: go install gotest.tools/gotestsum@v0.4.2
@@ -51,7 +51,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     container:
-      image: docker://rust:1.69.0
+      image: docker://rust:1.73.0
       options: --security-opt seccomp=unconfined
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11

.github/workflows/devcontainer.yml

@@ -15,7 +15,7 @@ permissions:
 jobs:
   rust-version:
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - shell: bash
@@ -39,6 +39,6 @@ jobs:
   devcontainer-image:
     runs-on: ubuntu-latest
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v41
+      - uses: linkerd/dev/actions/setup-tools@v42
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: just-dev pull-dev-image

.github/workflows/go.yml

@@ -16,7 +16,7 @@ jobs:
   go-lint:
     timeout-minutes: 10
     runs-on: ubuntu-20.04
-    container: ghcr.io/linkerd/dev:v40-go
+    container: ghcr.io/linkerd/dev:v42-go
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
@@ -25,7 +25,7 @@ jobs:
   go-format:
     timeout-minutes: 10
     runs-on: ubuntu-20.04
-    container: ghcr.io/linkerd/dev:v40-go
+    container: ghcr.io/linkerd/dev:v42-go
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
@@ -34,7 +34,7 @@ jobs:
   go-test:
     timeout-minutes: 10
     runs-on: ubuntu-20.04
-    container: ghcr.io/linkerd/dev:v40-go
+    container: ghcr.io/linkerd/dev:v42-go
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033

.github/workflows/helm.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 5
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v41
+      - uses: linkerd/dev/actions/setup-tools@v42
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: helm-docs
       - run: git diff --exit-code -- **/charts/**/README.md

.github/workflows/integration.yml

@@ -126,7 +126,7 @@ jobs:
     steps:
       - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe
         with:
-          go-version: '1.19'
+          go-version: '1.21'
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
         with:
@@ -173,7 +173,7 @@ jobs:
       matrix:
         k8s:
           - v1.21
-          - v1.26
+          - v1.28
     steps:
       - uses: extractions/setup-just@69d82fb0233557aec017ef13706851d0694e0f1d
         env:
@@ -267,7 +267,7 @@ jobs:
     steps:
       - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe
         with:
-          go-version: '1.19'
+          go-version: '1.21'
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
         with:
@@ -310,7 +310,7 @@ jobs:
     steps:
       - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe
         with:
-          go-version: '1.19'
+          go-version: '1.21'
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
         with:
@@ -354,14 +354,14 @@ jobs:
       matrix:
         k8s:
           - v1.21
-          - v1.26
+          - v1.28
     steps:
       - uses: extractions/setup-just@69d82fb0233557aec017ef13706851d0694e0f1d
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe
         with:
-          go-version: '1.19'
+          go-version: '1.21'
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
         with:

.github/workflows/proto.yml

@@ -15,7 +15,7 @@ jobs:
   proto-diff:
     timeout-minutes: 10
     runs-on: ubuntu-20.04
-    container: ghcr.io/linkerd/dev:v40-go
+    container: ghcr.io/linkerd/dev:v42-go
     steps:
       - run: apt update && apt install -y unzip
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11

.github/workflows/release.yml

@@ -97,7 +97,7 @@ jobs:
       uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
     - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe
       with:
-        go-version: '1.19'
+        go-version: '1.21'
     - name: Download image archives
       uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
       with:
@@ -131,7 +131,7 @@ jobs:
       uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
     - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe
       with:
-        go-version: '1.19'
+        go-version: '1.21'
     - name: Set environment variables from scripts
       run: |
         TAG='${{ needs.tag.outputs.tag }}'
@@ -155,7 +155,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe
         with:
-          go-version: '1.19'
+          go-version: '1.21'
       - uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226
       - name: Pull linkerd binary
         run: |

.github/workflows/rust.yml

@@ -43,7 +43,7 @@ jobs:
   fmt:
     timeout-minutes: 5
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
@@ -52,7 +52,7 @@ jobs:
   clippy:
     timeout-minutes: 20
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
@@ -63,19 +63,21 @@ jobs:
   check:
     timeout-minutes: 20
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
+      - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
       - run: just rs-fetch
       - run: just rs-check-dirs
 
   test:
     name: test
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
+      - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
       - run: just rs-fetch
       - run: just rs-test-build
       - run: just rs-test

.github/workflows/shell.yml

@@ -16,7 +16,7 @@ jobs:
     timeout-minutes: 10
     runs-on: ubuntu-20.04
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v41
+      - uses: linkerd/dev/actions/setup-tools@v42
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: just sh-lint
 

.golangci.yml

@@ -13,12 +13,9 @@ run:
 linters:
   enable:
   - bodyclose
-  - deadcode
-  - depguard
   - errcheck
   - errorlint
   - exportloopref
-  - goconst
   - gocritic
   - gosec
   - gosimple
@@ -33,8 +30,8 @@ linters:
   - unconvert
   - unparam
   - unused
-  - varcheck
   # TODO: enable more linters!
+  # - depguard
   # - dupl
   # - gochecknoglobals
   # - gochecknoinits
@@ -136,18 +133,10 @@ issues:
     - gocritic
     text: "ifElseChain: rewrite if-else to switch statement"
 
-  # Test files do not need to be linted by gosec since all OS operations are
-  # not dynamic.
-  - linters:
-    - gosec
-    path: .*test.*
-    text: "G204: Subprocess launched with .*"
-
-  # Test/fuzzing do not need to be checked for file handle cleanup.
+  # Test/fuzzing do not need to be tested for security issues.
   - linters:
     - gosec
     path: .*(test|fuzzer).*\.go
-    text: Deferring unsafe method \"Close\" on type \"\*os\.File\"
 
   # In tests/fuzzing we are usually mocking components or have a good idea
   # about the errors that we expect. For this reason, we ignore unchecked

CHANGES.md

@@ -1759,7 +1759,7 @@ it, such as recent versions of Flux.
   `linkerd-multicluster-link` chart for enhanced control on the service mirror
   deployment (thanks @utay!)
 * Fixed formatting of the `helm.sh/chart` label in CRDs
-* Updated container base images from buster to bullseye
+* Updated container base images from buster to bookworm
 * Added support for spaces in the `config.linkerd.io/opaque-ports` annotation
 
 ## edge-22.3.5

Cargo.toml

@@ -1,4 +1,5 @@
 [workspace]
+resolver = "2"
 members = [
     "policy-controller",
     "policy-controller/core",

Dockerfile-debug

@@ -1,4 +1,4 @@
-FROM debian:bullseye-slim
+FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     dnsutils \

Dockerfile-proxy

@@ -43,7 +43,7 @@ COPY --from=fetch /build/linkerd2-proxy /usr/lib/linkerd/linkerd2-proxy
 COPY --from=fetch /build/linkerd-await /usr/lib/linkerd/linkerd-await
 COPY --from=fetch /build/linkerd-network-validator /usr/lib/linkerd/linkerd2-network-validator
 COPY --from=golang /out/proxy-identity /usr/lib/linkerd/linkerd2-proxy-identity
-COPY --from=debian:bullseye-slim /bin/sleep /bin/sleep
+COPY --from=debian:bookworm-slim /bin/sleep /bin/sleep
 ARG LINKERD_VERSION
 ENV LINKERD_CONTAINER_VERSION_OVERRIDE=${LINKERD_VERSION}
 ENV LINKERD2_PROXY_LOG=warn,linkerd=info

cli/Dockerfile

@@ -1,7 +1,7 @@
 ARG BUILDPLATFORM=linux/amd64
 
 # Precompile key slow-to-build dependencies
-FROM --platform=$BUILDPLATFORM golang:1.19-alpine as go-deps
+FROM --platform=$BUILDPLATFORM golang:1.21-alpine as go-deps
 WORKDIR /linkerd-build
 COPY go.mod go.sum ./
 COPY bin/install-deps bin/

cni-plugin/Dockerfile

@@ -1,7 +1,7 @@
 ARG BUILDPLATFORM=linux/amd64
 
 # Precompile key slow-to-build dependencies
-FROM --platform=$BUILDPLATFORM golang:1.19-alpine as go-deps
+FROM --platform=$BUILDPLATFORM golang:1.21-alpine as go-deps
 WORKDIR /linkerd-build
 COPY go.mod go.sum ./
 COPY bin/install-deps bin/
@@ -18,7 +18,7 @@ COPY cni-plugin cni-plugin
 ARG TARGETARCH
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build -o /go/bin/linkerd-cni -v -mod=readonly ./cni-plugin/
 
-FROM debian:bullseye-slim
+FROM debian:bookworm-slim
 WORKDIR /linkerd
 RUN apt-get update && apt-get install -y --no-install-recommends \
     iptables \

controller/Dockerfile

@@ -1,7 +1,7 @@
 ARG BUILDPLATFORM=linux/amd64
 
 # Precompile key slow-to-build dependencies
-FROM --platform=$BUILDPLATFORM golang:1.19-alpine as go-deps
+FROM --platform=$BUILDPLATFORM golang:1.21-alpine as go-deps
 WORKDIR /linkerd-build
 COPY go.mod go.sum ./
 COPY bin/install-deps bin/