INS-2025: Bump libs and fix vulnerabilities for pluto

.circleci/config.yml

@@ -31,10 +31,28 @@ references:
       command: |
         apk --update add curl yq
         cd /tmp
-        curl -LO https://releases.hashicorp.com/vault/1.12.2/vault_1.12.2_linux_amd64.zip
-        sha256sum vault_1.12.2_linux_amd64.zip | grep 116c143de377a77a7ea455a367d5e9fe5290458e8a941a6e2dd85d92aaedba67
-        unzip vault_1.12.2_linux_amd64.zip
+        curl -LO https://releases.hashicorp.com/vault/1.21.4/vault_1.21.4_linux_amd64.zip
+        sha256sum vault_1.21.4_linux_amd64.zip | grep 889b681990fe221b884b7932fa9c9dd0ee9811b9349554f1aa287ab63c9f3dae
+        unzip vault_1.21.4_linux_amd64.zip
         mv vault /usr/bin/vault
+  install_vault_machine: &install_vault_machine
+    run:
+      name: install hashicorp vault
+      command: |
+        sudo apt-get update -y && sudo apt-get install -y curl unzip
+        cd /tmp
+        curl -LO https://releases.hashicorp.com/vault/1.21.4/vault_1.21.4_linux_amd64.zip
+        echo '889b681990fe221b884b7932fa9c9dd0ee9811b9349554f1aa287ab63c9f3dae  vault_1.21.4_linux_amd64.zip' | sha256sum -c
+        unzip -o vault_1.21.4_linux_amd64.zip
+        sudo mv vault /usr/bin/vault
+  setup_qemu_binfmt: &setup_qemu_binfmt
+    run:
+      name: Setup QEMU for multi-arch Docker builds
+      command: |
+        sudo apt-get update -y
+        sudo apt-get install -y qemu-user-static binfmt-support
+        docker buildx create --use || true
+        docker buildx inspect --bootstrap
   install_circleci: &install_circleci
     run:
       name: Install CircleCI CLI
@@ -54,17 +72,13 @@ jobs:
       - run: go mod download && go mod verify
       - run: go test -v ./... -coverprofile=coverage.txt -covermode=atomic
   release:
-    working_directory: /home/circleci/go/src/github.com/fairwindsops/pluto
+    machine:
+      image: ubuntu-2204:current
     resource_class: large
     shell: /bin/bash
-    docker:
-      - image: goreleaser/goreleaser:v2.14.0
-        environment:
-          GO111MODULE: "on"
     steps:
       - checkout
-      - setup_remote_docker
-      - *install_vault_alpine
+      - *install_vault_machine
       - rok8s/get_vault_env:
           vault_path: repo/global/env
       - rok8s/get_vault_env:
@@ -73,17 +87,32 @@ jobs:
           name: docker login
           command: |
             docker login -u _json_key -p "$(echo $GCP_ARTIFACTREADWRITE_JSON_KEY | base64 -d)" us-docker.pkg.dev
-      - run: echo 'export GORELEASER_CURRENT_TAG="${CIRCLE_TAG}"' >> $BASH_ENV
-      - run: goreleaser
+      - *setup_qemu_binfmt
+      - run:
+          name: Run GoReleaser release
+          command: |
+            export GORELEASER_CURRENT_TAG="${CIRCLE_TAG}"
+            docker run --rm \
+              -v /var/run/docker.sock:/var/run/docker.sock \
+              -v "$(pwd):/workspace" -w /workspace \
+              -e GORELEASER_CURRENT_TAG -e CIRCLE_TAG -e CIRCLE_SHA1 \
+              -e GO111MODULE=on \
+              goreleaser/goreleaser:v2.14.2
   snapshot:
-    working_directory: /home/circleci/go/src/github.com/fairwindsops/pluto
+    machine:
+      image: ubuntu-2204:current
     resource_class: large
-    docker:
-      - image: goreleaser/goreleaser:v2.14.0
     steps:
       - checkout
-      - setup_remote_docker
-      - run: goreleaser --snapshot --skip=sign
+      - *setup_qemu_binfmt
+      - run:
+          name: Run GoReleaser snapshot
+          command: |
+            docker run --rm \
+              -v /var/run/docker.sock:/var/run/docker.sock \
+              -v "$(pwd):/workspace" -w /workspace \
+              -e CIRCLE_SHA1 -e CIRCLE_BRANCH -e CIRCLE_TAG \
+              goreleaser/goreleaser:v2.14.2 --snapshot --skip=sign
       - store_artifacts:
           path: dist
           destination: snapshot
@@ -141,6 +170,7 @@ workflows:
   release:
     jobs:
       - release:
+          context: org-global
           filters:
             branches:
               ignore: /.*/

.goreleaser.yml

@@ -85,13 +85,15 @@ dockers:
   goarch: arm64
   dockerfile: Dockerfile
   build_flag_templates:
-  - "--platform=linux/arm64/v8"
+  - "--platform=linux/arm64"
 - image_templates:
   - "us-docker.pkg.dev/fairwinds-ops/oss/pluto:{{ .FullCommit }}-armv7"
   - "us-docker.pkg.dev/fairwinds-ops/oss/pluto:v{{ .Major }}-armv7"
   - "us-docker.pkg.dev/fairwinds-ops/oss/pluto:v{{ .Major }}.{{ .Minor }}-armv7"
   use: buildx
-  goarch: arm64
+  goarch: arm
+  goarm: 7
+  goos: linux
   dockerfile: Dockerfile
   build_flag_templates:
   - "--platform=linux/arm/v7"

Dockerfile

@@ -1,5 +1,7 @@
 FROM alpine:3.23.3
 
+RUN apk update && apk -U upgrade --no-cache
+
 LABEL org.opencontainers.image.authors="FairwindsOps, Inc." \
       org.opencontainers.image.vendor="FairwindsOps, Inc." \
       org.opencontainers.image.title="pluto" \