Upgrade: Go v1.20 and packages

ref: https://issues.redhat.com/browse/ACM-5042
Signed-off-by: Dale Haiducek <[email protected]>

Author: dhaiducek

Makefile

@@ -107,8 +107,8 @@ clean:
 
 .PHONY: fmt-dependencies
 fmt-dependencies:
-	$(call go-get-tool,github.com/daixiang0/gci@v0.2.9)
-	$(call go-get-tool,mvdan.cc/gofumpt@v0.2.0)
+	$(call go-get-tool,github.com/daixiang0/gci@v0.10.1)
+	$(call go-get-tool,mvdan.cc/gofumpt@v0.5.0)
 
 # All available format: format-go format-protos format-python
 # Default value will run all formats, override these make target with your requirements:
@@ -117,7 +117,7 @@ fmt-dependencies:
 fmt: fmt-dependencies
 	find . -not \( -path "./.go" -prune \) -name "*.go" | xargs gofmt -s -w
 	find . -not \( -path "./.go" -prune \) -name "*.go" | xargs gofumpt -l -w
-	find . -not \( -path "./.go" -prune \) -name "*.go" | xargs gci -w -local "$(shell cat go.mod | head -1 | cut -d " " -f 2)"
+	find . -not \( -path "./.go" -prune \) -name "*.go" | xargs gci write -s standard -s default -s "prefix($(shell cat go.mod | head -1 | cut -d " " -f 2))"
 
 ############################################################
 # check section
@@ -128,7 +128,7 @@ check: lint
 
 .PHONY: lint-dependencies
 lint-dependencies:
-	$(call go-get-tool,github.com/golangci/golangci-lint/cmd/golangci-lint@v1.46.2)
+	$(call go-get-tool,github.com/golangci/golangci-lint/cmd/golangci-lint@v1.52.2)
 
 # All available linters: lint-dockerfiles lint-scripts lint-yaml lint-copyright-banner lint-go lint-python lint-helm lint-markdown lint-sass lint-typescript lint-protos
 # Default value will run all linters, override these make target with your requirements:
@@ -141,19 +141,20 @@ lint: lint-dependencies lint-all
 ############################################################
 GOSEC = $(LOCAL_BIN)/gosec
 KUBEBUILDER = $(LOCAL_BIN)/kubebuilder
-KBVERSION = 3.2.0
-K8S_VERSION = 1.21.2
+ENVTEST = $(LOCAL_BIN)/setup-envtest
+KBVERSION = 3.12.0
+ENVTEST_K8S_VERSION = 1.26.x
 
 .PHONY: test
 test: test-dependencies
-	KUBEBUILDER_ASSETS=$(LOCAL_BIN) go test $(TESTARGS) `go list ./... | grep -v test/e2e`
+	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" go test $(TESTARGS) `go list ./... | grep -v test/e2e`
 
 .PHONY: test-coverage
 test-coverage: TESTARGS = -json -cover -covermode=atomic -coverprofile=coverage_unit.out
 test-coverage: test
 
 .PHONY: test-dependencies
-test-dependencies: kubebuilder-dependencies kubebuilder
+test-dependencies: envtest kubebuilder
 
 .PHONY: kubebuilder
 kubebuilder:
@@ -163,17 +164,13 @@ kubebuilder:
 		chmod +x $(KUBEBUILDER); \
 	fi
 
-.PHONY: kubebuilder-dependencies
-kubebuilder-dependencies: $(LOCAL_BIN)
-	@if [ ! -f $(LOCAL_BIN)/etcd ] || [ ! -f $(LOCAL_BIN)/kube-apiserver ] || [ ! -f $(LOCAL_BIN)/kubectl ] || \
-	[ "$$($(KUBEBUILDER) version 2>/dev/null | grep -o KubeBuilderVersion:\"[0-9]*\.[0-9]\.[0-9]*\")" != "KubeBuilderVersion:\"$(KBVERSION)\"" ]; then \
-		echo "Installing envtest Kubebuilder assets"; \
-		curl -L "https://go.kubebuilder.io/test-tools/$(K8S_VERSION)/$(GOOS)/$(GOARCH)" | tar xz --strip-components=2 -C $(LOCAL_BIN); \
-	fi
+.PHONY: envtest
+envtest:
+	$(call go-get-tool,sigs.k8s.io/controller-runtime/tools/setup-envtest@latest)
 
 .PHONY: gosec
 gosec:
-	$(call go-get-tool,github.com/securego/gosec/v2/cmd/gosec@v2.9.6)
+	$(call go-get-tool,github.com/securego/gosec/v2/cmd/gosec@v2.15.0)
 
 .PHONY: gosec-scan
 gosec-scan: gosec
@@ -228,7 +225,7 @@ controller-gen: ## Download controller-gen locally if necessary.
 
 .PHONY: kustomize
 kustomize: ## Download kustomize locally if necessary.
-	$(call go-get-tool,sigs.k8s.io/kustomize/kustomize/[email protected])
+	$(call go-get-tool,sigs.k8s.io/kustomize/kustomize/[email protected])
 
 ############################################################
 # e2e test section

build/Dockerfile

@@ -1,7 +1,7 @@
 # Stage 1: Use image builder to build the target binaries
 # Copyright Contributors to the Open Cluster Management project
 
-FROM golang:1.19 AS builder
+FROM golang:1.20 AS builder
 
 ENV COMPONENT=governance-policy-framework-addon
 ENV REPO_PATH=/go/src/github.com/open-cluster-management-io/${COMPONENT}

build/common/config/.golangci.yml

@@ -1,10 +1,6 @@
-service:
-  # When updating this, also update the version stored in docker/build-tools/Dockerfile in the multicloudlab/tools repo.
-  golangci-lint-version: 1.41.x # use the fixed version to not introduce new linters unexpectedly
 run:
   # timeout for analysis, e.g. 30s, 5m, default is 1m
   deadline: 20m
-  go: '1.17'
   timeout: 20m
 
   # which dirs to skip: they won't be analyzed;

controllers/gatekeepersync/gatekeeper_constraint_sync.go

@@ -4,7 +4,6 @@ package gatekeepersync
 
 import (
 	"context"
-
 	// #nosec G505
 	"crypto/sha1"
 	"encoding/json"

controllers/secretsync/secret_sync_test.go

@@ -28,7 +28,7 @@ func getTestSecret() *corev1.Secret {
 	// Generate an AES-256 key and stored it as a Secret on the Hub.
 	key := make([]byte, keySize/8)
 	_, err := rand.Read(key)
-	Expect(err).To(BeNil())
+	Expect(err).ToNot(HaveOccurred())
 
 	return &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
@@ -41,7 +41,7 @@ func getTestSecret() *corev1.Secret {
 	}
 }
 
-func TestReconcileSecretHubOnly(t *testing.T) {
+func TestReconcileSecretHubOnly(_ *testing.T) {
 	RegisterFailHandler(Fail)
 
 	encryptionSecret := getTestSecret()
@@ -55,16 +55,16 @@ func TestReconcileSecretHubOnly(t *testing.T) {
 		NamespacedName: types.NamespacedName{Name: SecretName, Namespace: clusterName},
 	}
 	_, err := r.Reconcile(context.TODO(), request)
-	Expect(err).To(BeNil())
+	Expect(err).ToNot(HaveOccurred())
 
 	// Verify that the Secret was synced to the managed cluster by the Reconciler.
 	managedEncryptionSecret := &corev1.Secret{}
 	err = managedClient.Get(context.TODO(), request.NamespacedName, managedEncryptionSecret)
-	Expect(err).To(BeNil())
-	Expect(len(managedEncryptionSecret.Data["key"])).To(Equal(keySize / 8))
+	Expect(err).ToNot(HaveOccurred())
+	Expect(managedEncryptionSecret.Data["key"]).To(HaveLen(keySize / 8))
 }
 
-func TestReconcileSecretHubOnlyDiffTargetNS(t *testing.T) {
+func TestReconcileSecretHubOnlyDiffTargetNS(_ *testing.T) {
 	RegisterFailHandler(Fail)
 
 	encryptionSecret := getTestSecret()
@@ -79,18 +79,18 @@ func TestReconcileSecretHubOnlyDiffTargetNS(t *testing.T) {
 		NamespacedName: types.NamespacedName{Name: SecretName, Namespace: clusterName},
 	}
 	_, err := r.Reconcile(context.TODO(), request)
-	Expect(err).To(BeNil())
+	Expect(err).ToNot(HaveOccurred())
 
 	// Verify that the Secret was synced to the managed cluster by the Reconciler.
 	managedEncryptionSecret := &corev1.Secret{}
 	err = managedClient.Get(
 		context.TODO(), types.NamespacedName{Name: SecretName, Namespace: "other-ns"}, managedEncryptionSecret,
 	)
-	Expect(err).To(BeNil())
-	Expect(len(managedEncryptionSecret.Data["key"])).To(Equal(keySize / 8))
+	Expect(err).ToNot(HaveOccurred())
+	Expect(managedEncryptionSecret.Data["key"]).To(HaveLen(keySize / 8))
 }
 
-func TestReconcileSecretAlreadySynced(t *testing.T) {
+func TestReconcileSecretAlreadySynced(_ *testing.T) {
 	RegisterFailHandler(Fail)
 
 	encryptionSecret := getTestSecret()
@@ -102,24 +102,24 @@ func TestReconcileSecretAlreadySynced(t *testing.T) {
 		NamespacedName: types.NamespacedName{Name: SecretName, Namespace: clusterName},
 	}
 	err := managedClient.Get(context.TODO(), request.NamespacedName, managedEncryptionSecret)
-	Expect(err).To(BeNil())
+	Expect(err).ToNot(HaveOccurred())
 
 	version := managedEncryptionSecret.ObjectMeta.ResourceVersion
 
 	r := SecretReconciler{
 		Client: hubClient, ManagedClient: managedClient, Scheme: scheme.Scheme, TargetNamespace: clusterName,
 	}
 	_, err = r.Reconcile(context.TODO(), request)
-	Expect(err).To(BeNil())
+	Expect(err).ToNot(HaveOccurred())
 
 	// Verify that the Secret was not modified by the Reconciler.
 	managedEncryptionSecret = &corev1.Secret{}
 	err = managedClient.Get(context.TODO(), request.NamespacedName, managedEncryptionSecret)
-	Expect(err).To(BeNil())
+	Expect(err).ToNot(HaveOccurred())
 	Expect(managedEncryptionSecret.ResourceVersion).To(Equal(version))
 }
 
-func TestReconcileSecretMismatch(t *testing.T) {
+func TestReconcileSecretMismatch(_ *testing.T) {
 	RegisterFailHandler(Fail)
 
 	hubEncryptionSecret := getTestSecret()
@@ -135,16 +135,16 @@ func TestReconcileSecretMismatch(t *testing.T) {
 		Client: hubClient, ManagedClient: managedClient, Scheme: scheme.Scheme, TargetNamespace: clusterName,
 	}
 	_, err := r.Reconcile(context.TODO(), request)
-	Expect(err).To(BeNil())
+	Expect(err).ToNot(HaveOccurred())
 
 	// Verify that the Secret was updated by the Reconciler.
 	managedEncryptionSecret = &corev1.Secret{}
 	err = managedClient.Get(context.TODO(), request.NamespacedName, managedEncryptionSecret)
-	Expect(err).To(BeNil())
-	Expect(len(managedEncryptionSecret.Data["key"])).To(Equal(keySize / 8))
+	Expect(err).ToNot(HaveOccurred())
+	Expect(managedEncryptionSecret.Data["key"]).To(HaveLen(keySize / 8))
 }
 
-func TestReconcileSecretDeletedOnHub(t *testing.T) {
+func TestReconcileSecretDeletedOnHub(_ *testing.T) {
 	RegisterFailHandler(Fail)
 
 	encryptionSecret := getTestSecret()
@@ -158,7 +158,7 @@ func TestReconcileSecretDeletedOnHub(t *testing.T) {
 		NamespacedName: types.NamespacedName{Name: SecretName, Namespace: clusterName},
 	}
 	_, err := r.Reconcile(context.TODO(), request)
-	Expect(err).To(BeNil())
+	Expect(err).ToNot(HaveOccurred())
 
 	// Verify that the Secret was deleted on the managed cluster by the Reconciler.
 	managedEncryptionSecret := &corev1.Secret{}
@@ -168,7 +168,7 @@ func TestReconcileSecretDeletedOnHub(t *testing.T) {
 
 // The tested code should occur in production because of the field selector set on the watch, but
 // the code should still account for it.
-func TestReconcileInvalidSecretName(t *testing.T) {
+func TestReconcileInvalidSecretName(_ *testing.T) {
 	RegisterFailHandler(Fail)
 
 	encryptionSecret := getTestSecret()
@@ -183,7 +183,7 @@ func TestReconcileInvalidSecretName(t *testing.T) {
 		NamespacedName: types.NamespacedName{Name: "not-the-secret", Namespace: clusterName},
 	}
 	_, err := r.Reconcile(context.TODO(), request)
-	Expect(err).To(BeNil())
+	Expect(err).ToNot(HaveOccurred())
 
 	// Verify that the Secret was not synced to the managed cluster by the Reconciler.
 	managedEncryptionSecret := &corev1.Secret{}

controllers/statussync/policy_status_sync.go

@@ -318,10 +318,9 @@ func (r *PolicyReconciler) Reconcile(ctx context.Context, request reconcile.Requ
 			newHistory = append(newHistory, history[historyIndex].ComplianceHistory)
 
 			for j := historyIndex; j < len(history); j++ {
-				if history[historyIndex].EventName == history[j].EventName &&
-					history[historyIndex].Message == history[j].Message {
-					// same event, filter it
-				} else {
+				// Skip over duplicate statuses where the event name and message match the current status
+				if history[historyIndex].EventName != history[j].EventName ||
+					history[historyIndex].Message != history[j].Message {
 					historyIndex = j - 1
 
 					break

controllers/templatesync/template_sync.go

@@ -591,22 +591,22 @@ func (r *PolicyReconciler) Reconcile(ctx context.Context, request reconcile.Requ
 				}
 
 				continue
-			} else {
-				// a different error getting template object from cluster
-				resultError = err
-				errMsg := fmt.Sprintf("Failed to get the object in the policy template: %s", err)
+			}
 
-				_ = r.emitTemplateError(ctx, instance, tIndex, tName, isClusterScoped, errMsg)
+			// a different error getting template object from cluster
+			resultError = err
+			errMsg := fmt.Sprintf("Failed to get the object in the policy template: %s", err)
 
-				tLogger.Error(err, "Failed to get the object in the policy template",
-					"namespace", instance.GetNamespace(),
-					"kind", gvk.Kind,
-				)
+			_ = r.emitTemplateError(ctx, instance, tIndex, tName, isClusterScoped, errMsg)
+
+			tLogger.Error(err, "Failed to get the object in the policy template",
+				"namespace", instance.GetNamespace(),
+				"kind", gvk.Kind,
+			)
 
-				policySystemErrorsCounter.WithLabelValues(instance.Name, tName, "get-error").Inc()
+			policySystemErrorsCounter.WithLabelValues(instance.Name, tName, "get-error").Inc()
 
-				continue
-			}
+			continue
 		}
 
 		if len(dependencyFailures) > 0 {