Drop containerd by moving to helm v3.21.3 - #5172
Merged
dimitri-nicolo merged 1 commit intoAug 14, 2026
Merged
Conversation
dimitri-nicolo
added
dependencies
marvin-tigera
removed
release-note-not-required
docs-not-required
dependencies
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the module dependency graph to remove github.com/containerd/containerd from the operator binary by bumping Helm to a release that no longer links containerd (switching to oras-go/v2 internally). This fits into the operator codebase as a supply-chain/security hardening change without touching runtime/operator logic.
Changes:
- Bump
helm.sh/helm/v3fromv3.20.2tov3.21.3. - Bump
oras.land/oras-go/v2tov2.6.2and refresh related transitive versions viago mod tidy. - Remove
github.com/containerd/containerdfrom the module graph (no remainingcontainerd/containerdentries ingo.mod/go.sum).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| go.mod | Bumps Helm/oras-go and updates indirect requirements; removes github.com/containerd/containerd from requirements. |
| go.sum | Updates checksums to match the new Helm/oras-go dependency graph and removes github.com/containerd/containerd sums. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
dimitri-nicolo
added
dependencies
dimitri-nicolo
force-pushed
the
dimitri-helm-3.21.3-drop-containerd-v1.42
branch
from
August 13, 2026 21:15
431b133 to
e13e6ca
Compare
…rable containerd (#5100) containerd is not used by the operator. It arrives through one chain: pkg/render/istio -> helm.sh/helm/v3/pkg/action -> helm.sh/helm/v3/pkg/registry (helm's OCI client) -> github.com/containerd/containerd/remotes pkg/render/istio only uses helm as a local template renderer, so it never contacts a registry, but pkg/action imports pkg/registry unconditionally and containerd is linked in regardless. helm v3.21.3 replaced containerd's remotes with oras-go/v2, so moving to it removes containerd outright. (cherry picked from commit 3fce8ac) Conflicts: go.mod, go.sum Resolved by keeping this branch's own dependency versions and taking only the upgrade itself, then re-tidying: - helm.sh/helm/v3 v3.20.2 -> v3.21.3 - oras.land/oras-go v2.6.0 -> v2.6.2 k8s.io/* stays at v0.36.3 here; master was on v0.36.2 when it made this change, and helm v3.21.3 only requires v0.36.2. Everything else in the diff is what `go mod tidy` recomputed once containerd left the graph: Masterminds/semver and lib/pq move because helm requires newer ones. No controller-runtime change is needed on this branch: it is already on v0.24.1 / client-go v0.36.3, which is what helm v3.21.3 wants. Verified: - go build ./... passes; containerd drops from 8 linked packages to 0 and leaves go.mod entirely. - go test ./pkg/render/istio/... (the only helm consumer on this branch) passes.
dimitri-nicolo
force-pushed
the
dimitri-helm-3.21.3-drop-containerd-v1.42
branch
from
August 13, 2026 21:17
e13e6ca to
16c0343
Compare
This was referenced Aug 13, 2026
rene-dekker
pushed a commit
that referenced
this pull request
Aug 14, 2026
…5177) This branch tracks calico-private release-calient-v3.23 (see config/enterprise_versions.yml libcalico-go), which is bumping its third-party pins in tigera/calico-private#13239. The operator deploys those images, so its own pins have to move with them. | component | before | after | |---|---|---| | eck-kibana | 8.19.16 | 8.19.20 | | eck-elasticsearch | 8.19.16 | 8.19.20 | | coreos-prometheus | v3.9.1 | v3.13.2 | | coreos-alertmanager | v0.30.1 | v0.33.1 | | eck-elasticsearch-operator | 3.4.0 | 3.4.1 | | ISTIO_VERSION (Makefile) | 1.29.4 | 1.29.6 | pkg/components/enterprise.go is regenerated from the yaml by gen-versions, not hand-edited. The eck-elasticsearch-operator move also repairs an inconsistency on this branch: pkg/imports/crds/enterprise/01-crd-eck-bundle.yaml was already synced to ECK 3.4.1 (#5173) while this pin still claimed 3.4.0. Not changed, deliberately: GO_VERSION stays 1.26.5 and K8S_VERSION stays v1.36.3. calico-private#13254 moves v3.23 to Go 1.25.13, but this branch is on the Go 1.26 line and k8s 1.36, and #5172 (helm v3.21.3) requires Go 1.26 here. Those two pins are not meant to track calico-private. Not changed: the version literals in hack/release/prep_test.go. They are inputs to a round-trip test asserting that updateConfigVersions leaves third-party pins alone; the values are arbitrary and match nothing real. Verified: - go build ./... passes. - Istio charts re-fetched at 1.29.6; pkg/render/istio passes. - pkg/render/logstorage/... (elasticsearch, kibana, eck), pkg/components and hack/release all pass.
rene-dekker
approved these changes
Aug 14, 2026
This was referenced Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Cherry-pick of master's
3fce8aca0("chore(deps): bump helm to v3.21.3 and oras-go to v2.6.2 to drop vulnerable containerd", #5100), to remove containerd from the operator on this branch instead of bumping it again.containerd isn't used here. It arrives via
pkg/render/istio→ helm'spkg/action→ helm's OCIpkg/registry→containerd/remotes. That render code only uses helm as a local template renderer — it loads four embedded chart tarballs withDryRun/ClientOnlyset and never contacts a registry — butpkg/actionimportspkg/registryunconditionally, so containerd gets linked into the binary on a path nothing can reach.helm v3.21.3 swapped containerd for
oras-go/v2, so moving to it drops containerd entirely.This branch takes the pick cheaply. It's already on controller-runtime v0.24.1 / client-go v0.36.3, which is what helm v3.21.3 wants, so nothing else has to move:
k8s.io/*stays at v0.36.3 — master was on v0.36.2 when it made this change, and helm v3.21.3 only requires v0.36.2, so there's no reason to move backwards. The rest of the diff is whatgo mod tidyrecomputed once containerd left the graph:Masterminds/semverandlib/pqmove because helm requires newer ones.Verified
go build ./...passes; containerd drops from 8 linked packages to 0 and leavesgo.modentirely.go test ./pkg/render/istio/...(the only helm consumer on this branch) passes.CI
The earlier
dirty-checkfailure on this PR was unrelated pre-existing drift inpkg/imports/crds/enterprise/01-crd-eck-bundle.yaml, which broke every PR on this branch. That's fixed and merged (#5173); this PR is now rebased on top of it and contains only the go.mod/go.sum change.Companion PRs
Release Note