Go 1.27

.github/workflows/build.yaml

@@ -30,7 +30,7 @@ jobs:
         password: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
 
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - uses: google-github-actions/auth@v3
       with:
@@ -40,7 +40,7 @@ jobs:
       uses: google-github-actions/setup-gcloud@v3
 
     - name: Set up Go
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
         cache: false
@@ -105,10 +105,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Set up Go
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
         cache: false

Makefile

@@ -3,7 +3,7 @@ GITVERSION := $(shell git describe --long --all)
 BUILDDATE := $(shell date -Iseconds)
 VERSION := $(or ${VERSION},$(shell git describe --tags --exact-match 2> /dev/null || git symbolic-ref -q --short HEAD || git rev-parse --short HEAD))
 
-CONTROLLER_TOOLS_VERSION ?= v0.18.0
+CONTROLLER_TOOLS_VERSION ?= v0.21.0
 LOCALBIN ?= $(shell pwd)/bin
 CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
 MOCKERY ?= $(LOCALBIN)/mockery
@@ -89,4 +89,4 @@ go-mocks:
 		--tmpfs /.cache:uid=$$(id -u),gid=$$(id -g) \
 		-w /work \
 		-v ${PWD}:/work \
-		vektra/mockery:v3.6.4
+		vektra/mockery:v3.8.0

config/crd/bases/metal-stack.io_clusterwidenetworkpolicies.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.21.0
   name: clusterwidenetworkpolicies.metal-stack.io
 spec:
   group: metal-stack.io

controllers/clusterwidenetworkpolicy_controller.go

@@ -14,7 +14,6 @@ import (
 	"github.com/go-logr/logr"
 
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/tools/record"
 
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -79,10 +78,8 @@ func (r *ClusterwideNetworkPolicyReconciler) Reconcile(ctx context.Context, _ ct
 	}
 
 	f := &firewallv2.Firewall{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      r.FirewallName,
-			Namespace: r.SeedNamespace,
-		},
+		Name:      r.FirewallName,
+		Namespace: r.SeedNamespace,
 	}
 	if err := r.SeedClient.Get(ctx, client.ObjectKeyFromObject(f), f); err != nil {
 		return ctrl.Result{}, client.IgnoreNotFound(err)

controllers/droptailer_controller.go

@@ -19,8 +19,6 @@ import (
 	"github.com/txn2/txeh"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -116,7 +114,7 @@ func (r *DroptailerReconciler) SetupWithManager(mgr ctrl.Manager) error {
 
 			r.Log.Info("triggering reconcile because droptailer secret was changed and droptailer pod is present")
 
-			return []reconcile.Request{ctrl.Request{NamespacedName: types.NamespacedName{Name: pod.Name, Namespace: pod.Namespace}}}
+			return []reconcile.Request{ctrl.Request{Name: pod.Name, Namespace: pod.Namespace}}
 		}), builder.WithPredicates(droptailerSecretPredicate)).
 		Complete(r)
 }
@@ -141,10 +139,8 @@ func (r *DroptailerReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 	}
 
 	secret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      secretName,
-			Namespace: firewallv1.ClusterwideNetworkPolicyNamespace,
-		},
+		Name:      secretName,
+		Namespace: firewallv1.ClusterwideNetworkPolicyNamespace,
 	}
 	if err := r.ShootClient.Get(ctx, client.ObjectKeyFromObject(secret), secret); err != nil {
 		return ctrl.Result{}, err

controllers/firewall_controller_test.go

@@ -31,9 +31,7 @@ func TestConvert(t *testing.T) {
 		{
 			"np should yield proper cnwp",
 			networking.NetworkPolicy{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-np",
-				},
+				Name: "test-np",
 				Spec: networking.NetworkPolicySpec{
 					Egress: []networking.NetworkPolicyEgressRule{
 						{
@@ -55,10 +53,8 @@ func TestConvert(t *testing.T) {
 				},
 			},
 			&firewallv1.ClusterwideNetworkPolicy{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-np",
-					Namespace: firewallv1.ClusterwideNetworkPolicyNamespace,
-				},
+				Name:      "test-np",
+				Namespace: firewallv1.ClusterwideNetworkPolicyNamespace,
 				Spec: firewallv1.PolicySpec{
 					Egress: []firewallv1.EgressRule{
 						{
@@ -82,9 +78,7 @@ func TestConvert(t *testing.T) {
 		{
 			"np with pod selector are ignored",
 			networking.NetworkPolicy{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-np",
-				},
+				Name: "test-np",
 				Spec: networking.NetworkPolicySpec{
 					PodSelector: metav1.LabelSelector{
 						MatchLabels: map[string]string{"test": "test"},
@@ -97,9 +91,7 @@ func TestConvert(t *testing.T) {
 		{
 			"np with blacklisted name are ignored",
 			networking.NetworkPolicy{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "egress-allow-http",
-				},
+				Name: "egress-allow-http",
 				Spec: networking.NetworkPolicySpec{
 					Egress: []networking.NetworkPolicyEgressRule{
 						{
@@ -143,10 +135,8 @@ func TestConvert(t *testing.T) {
 // converts a network-policy object that was used before in a cluster-wide manner to the new CRD
 func convert(np networking.NetworkPolicy) (*firewallv1.ClusterwideNetworkPolicy, error) {
 	cwnp := firewallv1.ClusterwideNetworkPolicy{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      np.Name,
-			Namespace: firewallv1.ClusterwideNetworkPolicyNamespace,
-		},
+		Name:      np.Name,
+		Namespace: firewallv1.ClusterwideNetworkPolicyNamespace,
 	}
 	newEgresses := []firewallv1.EgressRule{}
 	for _, egress := range np.Spec.Egress {

controllers/firewall_monitor_annotation_controller.go

@@ -11,7 +11,6 @@ import (
 	"github.com/metal-stack/firewall-controller/v2/pkg/updater"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/tools/record"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
@@ -64,10 +63,8 @@ func (r *FirewallMonitorAnnotationController) SetupWithManager(mgr ctrl.Manager)
 func (r *FirewallMonitorAnnotationController) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	var (
 		fw = &firewallv2.Firewall{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      r.FirewallName,
-				Namespace: r.SeedNamespace,
-			},
+			Name:      r.FirewallName,
+			Namespace: r.SeedNamespace,
 		}
 		fwmon = &firewallv2.FirewallMonitor{}
 	)

controllers/firewall_monitor_controller.go

@@ -88,10 +88,8 @@ func (r *FirewallMonitorReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 
 	err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
 		mon := &firewallv2.FirewallMonitor{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      r.FirewallName,
-				Namespace: firewallv1.ClusterwideNetworkPolicyNamespace,
-			},
+			Name:      r.FirewallName,
+			Namespace: firewallv1.ClusterwideNetworkPolicyNamespace,
 		}
 
 		if err := r.ShootClient.Get(ctx, client.ObjectKeyFromObject(mon), mon); err != nil {

go.mod

@@ -1,6 +1,6 @@
 module github.com/metal-stack/firewall-controller/v2
 
-go 1.26
+go 1.27
 
 require (
 	github.com/Masterminds/semver/v3 v3.5.0
@@ -12,14 +12,14 @@ require (
 	github.com/ks2211/go-suricata v0.0.0-20200823200910-986ce1470707
 	github.com/metal-stack/firewall-controller-manager v0.6.1
 	github.com/metal-stack/metal-go v0.45.0
-	github.com/metal-stack/metal-lib v0.26.1
+	github.com/metal-stack/metal-lib v0.26.3
 	github.com/metal-stack/metal-networker v0.47.0
 	github.com/metal-stack/v v1.0.3
-	github.com/miekg/dns v1.1.72
-	github.com/stretchr/testify v1.11.1
+	github.com/miekg/dns v1.1.73
+	github.com/stretchr/testify v1.12.1
 	github.com/txn2/txeh v1.8.1
 	github.com/vishvananda/netlink v1.3.1
-	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
+	go4.org/netipx v0.0.0-20260823151212-3075585bcbeb
 	k8s.io/api v0.35.0
 	k8s.io/apiextensions-apiserver v0.35.0
 	k8s.io/apimachinery v0.35.0
@@ -37,65 +37,63 @@ require (
 	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/fsnotify/fsnotify v1.10.1 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
-	github.com/go-openapi/analysis v0.25.5 // indirect
-	github.com/go-openapi/errors v0.22.8 // indirect
-	github.com/go-openapi/jsonpointer v1.0.0 // indirect
-	github.com/go-openapi/jsonreference v1.0.0 // indirect
-	github.com/go-openapi/loads v0.25.0 // indirect
-	github.com/go-openapi/spec v0.22.9 // indirect
-	github.com/go-openapi/strfmt v0.27.0 // indirect
-	github.com/go-openapi/swag v0.28.0 // indirect
-	github.com/go-openapi/swag/cmdutils v0.28.0 // indirect
-	github.com/go-openapi/swag/conv v0.28.0 // indirect
-	github.com/go-openapi/swag/fileutils v0.28.0 // indirect
-	github.com/go-openapi/swag/jsonutils v0.28.0 // indirect
-	github.com/go-openapi/swag/loading v0.28.0 // indirect
-	github.com/go-openapi/swag/mangling v0.28.0 // indirect
-	github.com/go-openapi/swag/netutils v0.28.0 // indirect
-	github.com/go-openapi/swag/pools v0.28.0 // indirect
-	github.com/go-openapi/swag/stringutils v0.28.0 // indirect
-	github.com/go-openapi/swag/typeutils v0.28.0 // indirect
-	github.com/go-openapi/swag/yamlutils v0.28.0 // indirect
-	github.com/go-openapi/validate v0.26.1 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.6 // indirect
+	github.com/go-openapi/analysis v1.0.1 // indirect
+	github.com/go-openapi/errors v0.22.9 // indirect
+	github.com/go-openapi/jsonpointer v1.0.2 // indirect
+	github.com/go-openapi/jsonreference v1.0.3 // indirect
+	github.com/go-openapi/loads v0.25.3 // indirect
+	github.com/go-openapi/spec v1.0.1 // indirect
+	github.com/go-openapi/strfmt v0.27.3 // indirect
+	github.com/go-openapi/swag v0.29.2 // indirect
+	github.com/go-openapi/swag/cmdutils v0.29.2 // indirect
+	github.com/go-openapi/swag/conv v0.29.2 // indirect
+	github.com/go-openapi/swag/fileutils v0.29.2 // indirect
+	github.com/go-openapi/swag/jsonutils v0.29.2 // indirect
+	github.com/go-openapi/swag/loading v0.29.2 // indirect
+	github.com/go-openapi/swag/mangling v0.29.2 // indirect
+	github.com/go-openapi/swag/netutils v0.29.2 // indirect
+	github.com/go-openapi/swag/pools v0.29.2 // indirect
+	github.com/go-openapi/swag/stringutils v0.29.2 // indirect
+	github.com/go-openapi/swag/typeutils v0.29.2 // indirect
+	github.com/go-openapi/swag/yamlutils v0.29.2 // indirect
+	github.com/go-openapi/validate v1.0.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/gnostic-models v0.7.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kr/text v0.2.0 // indirect
-	github.com/mattn/go-colorable v0.1.15 // indirect
+	github.com/mattn/go-colorable v0.1.16 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mdlayher/netlink v1.11.2 // indirect
-	github.com/mdlayher/socket v0.6.1 // indirect
+	github.com/mdlayher/socket v0.7.0 // indirect
 	github.com/metal-stack/metal-hammer v0.13.17 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/oklog/ulid/v2 v2.1.2 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_golang v1.24.1 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.70.1 // indirect
-	github.com/prometheus/procfs v0.21.1 // indirect
+	github.com/prometheus/client_model v0.6.3 // indirect
+	github.com/prometheus/common v0.72.0 // indirect
+	github.com/prometheus/procfs v0.22.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/stretchr/objx v0.5.3 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/mod v0.38.0 // indirect
-	golang.org/x/net v0.57.0 // indirect
-	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/term v0.45.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
-	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.48.0 // indirect
+	golang.org/x/net v0.59.0 // indirect
+	golang.org/x/oauth2 v0.37.0 // indirect
+	golang.org/x/sync v0.23.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/term v0.46.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	golang.org/x/time v0.16.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect