[ws-manager-mk2] update to support k8s 0.30 API (#20580)

* [go components] Fixed "go test ./..." in various components

Tool: gitpod/catfood.gitpod.cloud

* [go components] Update k8s 0.29.3 -> 0.30.9 API

 - update the go-update-wc-deps.sh script to handle the brunt of that transition
 - fixes Maintenance- + Subscriber-Controller
 - document steps

Tool: gitpod/catfood.gitpod.cloud

* [ws-manager-mk2] Decide how to apply appamor config based on serverversion to support k8s 1.30+

Tool: gitpod/catfood.gitpod.cloud

* [gpctl] Missing go mod tidy

Tool: gitpod/catfood.gitpod.cloud

* Replace vulnerable outcaste-io/badger/v3 with original dgraph-io/badger/v3

Tool: gitpod/catfood.gitpod.cloud

* more go mod tidy

Tool: gitpod/catfood.gitpod.cloud

* [image-builder-bob, installer] Select the correct version of containerd....

Tool: gitpod/catfood.gitpod.cloud

---------

Co-authored-by: Gero Posmyk-Leinemann <[email protected]>

Author: kylos101

WORKSPACE.yaml

@@ -38,6 +38,7 @@ defaultVariant:
     - GOARCH=amd64
     - DOCKER_DEFAULT_PLATFORM=linux/amd64
     - NODE_OPTIONS=--max_old_space_size=8192
+    - LEEWAY_BUILD=true
   srcs:
     exclude:
       # Make sure we don't include node_modules/**/*.ts by accident

components/blobserve/go.mod

@@ -1,6 +1,8 @@
 module github.com/gitpod-io/gitpod/blobserve
 
-go 1.22
+go 1.22.0
+
+toolchain go1.23.3
 
 require (
 	github.com/containerd/containerd v1.6.36
@@ -13,7 +15,7 @@ require (
 	github.com/heptiolabs/healthcheck v0.0.0-20211123025425-613501dd5deb
 	github.com/opencontainers/image-spec v1.1.0
 	github.com/prometheus/client_golang v1.18.0
-	github.com/spf13/cobra v1.6.0
+	github.com/spf13/cobra v1.7.0
 	golang.org/x/sync v0.6.0
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028
 )
@@ -33,7 +35,7 @@ require (
 	github.com/docker/docker-credential-helpers v0.8.0 // indirect
 	github.com/facebookgo/atomicfile v0.0.0-20151019160806-2de1f203e7d5 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fsnotify/fsnotify v1.6.0 // indirect
+	github.com/fsnotify/fsnotify v1.7.0 // indirect
 	github.com/gitpod-io/gitpod/components/scrubber v0.0.0-00010101000000-000000000000 // indirect
 	github.com/gitpod-io/gitpod/registry-facade/api v0.0.0-00010101000000-000000000000 // indirect
 	github.com/go-logr/logr v1.4.1 // indirect
@@ -52,7 +54,7 @@ require (
 	github.com/hashicorp/go-retryablehttp v0.7.5 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
-	github.com/inconshreveable/mousetrap v1.0.1 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/ipfs/bbloom v0.0.4 // indirect
 	github.com/ipfs/boxo v0.18.0 // indirect
 	github.com/ipfs/go-bitfield v1.1.0 // indirect
@@ -149,9 +151,9 @@ require (
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	k8s.io/api v0.29.3 // indirect
-	k8s.io/apimachinery v0.29.3 // indirect
-	k8s.io/klog/v2 v2.110.1 // indirect
+	k8s.io/api v0.30.9 // indirect
+	k8s.io/apimachinery v0.30.9 // indirect
+	k8s.io/klog/v2 v2.120.1 // indirect
 	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
 	lukechampine.com/blake3 v1.2.1 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
@@ -166,52 +168,52 @@ replace github.com/gitpod-io/gitpod/registry-facade => ../registry-facade // lee
 
 replace github.com/gitpod-io/gitpod/registry-facade/api => ../registry-facade-api/go // leeway
 
-replace k8s.io/api => k8s.io/api v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/api => k8s.io/api v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/apimachinery => k8s.io/apimachinery v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/apimachinery => k8s.io/apimachinery v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/apiserver => k8s.io/apiserver v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/apiserver => k8s.io/apiserver v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/cli-runtime => k8s.io/cli-runtime v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/cli-runtime => k8s.io/cli-runtime v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/client-go => k8s.io/client-go v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/client-go => k8s.io/client-go v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/cloud-provider => k8s.io/cloud-provider v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/cloud-provider => k8s.io/cloud-provider v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/code-generator => k8s.io/code-generator v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/code-generator => k8s.io/code-generator v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/component-base => k8s.io/component-base v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/component-base => k8s.io/component-base v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/cri-api => k8s.io/cri-api v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/cri-api => k8s.io/cri-api v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/kube-proxy => k8s.io/kube-proxy v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/kube-proxy => k8s.io/kube-proxy v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/kubelet => k8s.io/kubelet v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/kubelet => k8s.io/kubelet v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/metrics => k8s.io/metrics v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/metrics => k8s.io/metrics v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/component-helpers => k8s.io/component-helpers v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/component-helpers => k8s.io/component-helpers v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/controller-manager => k8s.io/controller-manager v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/controller-manager => k8s.io/controller-manager v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/kubectl => k8s.io/kubectl v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/kubectl => k8s.io/kubectl v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/mount-utils => k8s.io/mount-utils v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/mount-utils => k8s.io/mount-utils v0.30.9 // leeway indirect from components/common-go:lib
 
-replace k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.29.3 // leeway indirect from components/common-go:lib
+replace k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.30.9 // leeway indirect from components/common-go:lib

components/blobserve/go.sum

@@ -0,0 +1,13 @@
+# How to upgrade Kubernetes dependencies
+
+General steps:
+ 1. modify target versions in `go-update-wc-deps.sh`
+ 1. run `./go-update-wc-deps.sh`
+   1. if it fails, fix the test/code, and run it again until all tests are good - except `install/installer`
+ 1. take care of `install/installer`
+   1. manually verify that the `go.mod` has the target versions set, and if not, adjust manually (not sure why these get overriden there)
+   1. make sure `helm.sh/helm/v3` is set to a compatible version (refer to https://github.com/helm/helm/releases/ to see which release bumps "k8s-io" to which version)
+   1. test with `go mod tidy && go test ./...` until it succeeds
+
+
+gpl: I just noticed that probably `go-get-kubernetes.sh` was meant for bumping kubernetes versions in `common-go` - which I did manually. So probably that should be the very first step.

components/common-go/README.md

@@ -17,6 +17,10 @@ declare -A WORKSPACE_CLUSTER_DEPENDENCIES
 WORKSPACE_CLUSTER_DEPENDENCIES["github.com/containerd/containerd"]="1.6.36"
 WORKSPACE_CLUSTER_DEPENDENCIES["github.com/moby/buildkit"]="0.12.5"
 WORKSPACE_CLUSTER_DEPENDENCIES["github.com/opencontainers/runc"]="1.1.14"
+# Reasoning for this version: https://pkg.go.dev/sigs.k8s.io/controller-runtime#section-readme
+WORKSPACE_CLUSTER_DEPENDENCIES["sigs.k8s.io/controller-runtime"]="0.18.7"
+# Prefix matches
+WORKSPACE_CLUSTER_DEPENDENCIES["k8s.io/"]="0.30.9"
 
 # loop through keys of each associative array
 for key in "${!WORKSPACE_CLUSTER_DEPENDENCIES[@]}"
@@ -33,24 +37,63 @@ do
         FOLDER="$(dirname "${c}")"
         pushd "${FOLDER}"
 
-        if  grep -q "${key}" go.mod && ! grep -q "${key} v${WORKSPACE_CLUSTER_DEPENDENCIES[${key}]}" go.mod; then
-            go get "${key}"@v"${WORKSPACE_CLUSTER_DEPENDENCIES[${key}]}"
-            # shellcheck disable=SC2076
-            if [[ ! " ${COMPONENTS_TO_TEST[*]} " =~ " ${FOLDER} " ]]; then
-                COMPONENTS_TO_TEST+=("${FOLDER}")
+        # list all package to update, in case "key" is a prefix
+        PACKAGES=$(grep -o "[[:space:]]${key}[^ ]*" go.mod | tr -d "[:blank:]" | sort | uniq)
+        for p in ${PACKAGES}; do
+            if [[ "$p" == k8s.io/klog* ]] || [[ "$p" == k8s.io/utils* ]] || [[ "$p" == k8s.io/kube-openapi* ]]  || [[ "$p" == k8s.io/gengo* ]]; then
+                # special case imported indirectly, we don't want to update these. Also, they have different versions.
+                echo "Ignoring ${p}..."
+                continue
             fi
-        fi
+
+            if  grep -q "${p}" go.mod && ! grep -q "${p} v${WORKSPACE_CLUSTER_DEPENDENCIES[${key}]}" go.mod; then
+                go get "${p}"@v"${WORKSPACE_CLUSTER_DEPENDENCIES[${key}]}"
+                # shellcheck disable=SC2076
+                if [[ ! " ${COMPONENTS_TO_TEST[*]} " =~ " ${FOLDER} " ]]; then
+                    COMPONENTS_TO_TEST+=("${FOLDER}")
+                fi
+            fi
+        done
 
         popd
     done
 done
 
+echo ""
+echo "========== Done updating, doing tidy and testing now =========="
+echo ""
+
+# Cleanup installer separately because it depends on all other packages
+# Doing "go mod tidy" in this order avoids package resolution confusion
+INSTALLER_PACKAGE=""
+
 for t in "${COMPONENTS_TO_TEST[@]}"
 do
+    if [[ "${t}" == "*install/installer" ]]; then
+        # do after all others, as it's depending on all other packages
+        INSTALLER_PACKAGE="${t}"
+        continue
+    fi
+
     pushd "${t}"
     # clean it up
     go mod tidy
     # assert that build and tests pass
-    go test ./...
+
+
+    if [[ "${t}" == "test" ]]; then
+        echo "Skipping tests for ${t}"
+    else
+        go test ./...
+    fi
     popd
 done
+
+if [[ -n "${INSTALLER_PACKAGE}" ]]; then
+    pushd "${INSTALLER_PACKAGE}"
+    # clean it up
+    go mod tidy
+    # assert that build and tests pass
+    go test ./...
+    popd
+fi