Honor stderrthreshold when logtostderr is enabled (#2109)

* Honor stderrthreshold when logtostderr is enabled

After calling klog.InitFlags, opt into the fixed stderrthreshold
behavior added in klog v2.140.0 so that severe-enough messages are
still mirrored to stderr when logtostderr is set.

Reference: kubernetes/klog#212
Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>

* fix: add error handling for flag.Set calls

Address review feedback by wrapping flag.Set() calls with proper
error checking instead of silently discarding errors.

Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>

* chore: re-trigger CLA check

Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>

* refactor: consolidate klog stderrthreshold flag init into ConfigureKlog helper

Move the repeated legacy_stderr_threshold_behavior and stderrthreshold
flag.Set calls into a single ConfigureKlog(fs *flag.FlagSet) helper in
pkg/util/log/setup.go. All call sites now delegate to this helper,
keeping the logic in one place and handling both the global
flag.CommandLine and custom FlagSet cases.

Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>

---------

Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>

Author: pierluigilenoci

cmd/junit-report/main.go

@@ -19,6 +19,7 @@ import (
 	"os"
 
 	"github.com/GoogleContainerTools/config-sync/cmd/junit-report/resetfailure"
+	logutil "github.com/GoogleContainerTools/config-sync/pkg/util/log"
 	"github.com/spf13/cobra"
 	"k8s.io/klog/v2"
 )
@@ -36,6 +37,7 @@ func init() {
 
 func main() {
 	klog.InitFlags(nil)
+	logutil.ConfigureKlog(nil)
 	flag.Parse()
 
 	if err := rootCmd.Execute(); err != nil {

cmd/nomos/nomos.go

@@ -30,6 +30,7 @@ import (
 	"github.com/GoogleContainerTools/config-sync/cmd/nomos/vet"
 	"github.com/GoogleContainerTools/config-sync/pkg/api/configmanagement"
 	"github.com/GoogleContainerTools/config-sync/pkg/client/restconfig"
+	logutil "github.com/GoogleContainerTools/config-sync/pkg/util/log"
 	pkgversion "github.com/GoogleContainerTools/config-sync/pkg/version"
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 	"k8s.io/klog/v2"
@@ -70,6 +71,7 @@ func main() {
 
 	// Register klog flags
 	klog.InitFlags(fs)
+	logutil.ConfigureKlog(fs)
 
 	// Work around the controller-runtime init registering a --kubeconfig flag
 	// with no default value. Use the same default as kubectl instead.

go.mod

@@ -51,7 +51,7 @@ require (
 	k8s.io/client-go v0.35.3
 	k8s.io/cluster-registry v0.0.6
 	k8s.io/code-generator v0.35.3
-	k8s.io/klog/v2 v2.130.1
+	k8s.io/klog/v2 v2.140.0
 	k8s.io/kube-aggregator v0.35.3
 	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
 	k8s.io/kubectl v0.35.3

go.sum

@@ -502,8 +502,8 @@ k8s.io/controller-manager v0.35.0 h1:KteodmfVIRzfZ3RDaxhnHb72rswBxEngvdL9vuZOA9A
 k8s.io/controller-manager v0.35.0/go.mod h1:1bVuPNUG6/dpWpevsJpXioS0E0SJnZ7I/Wqc9Awyzm4=
 k8s.io/gengo/v2 v2.0.0-20250922181213-ec3ebc5fd46b h1:gMplByicHV/TJBizHd9aVEsTYoJBnnUAT5MHlTkbjhQ=
 k8s.io/gengo/v2 v2.0.0-20250922181213-ec3ebc5fd46b/go.mod h1:CgujABENc3KuTrcsdpGmrrASjtQsWCT7R99mEV4U/fM=
-k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
-k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
+k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
 k8s.io/kube-aggregator v0.35.3 h1:erIo8Dfapd0Fg44XAbgCNioJMtr3Z5mI/G1PSpj9B7Q=
 k8s.io/kube-aggregator v0.35.3/go.mod h1:lOLyWTEuiKT2kS/Wkj0foq+P+Xt4gs/xkrhz2r33lAQ=
 k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=

pkg/resourcegroup/controllers/log/setup.go

@@ -17,6 +17,7 @@ package log
 import (
 	"flag"
 
+	logutil "github.com/GoogleContainerTools/config-sync/pkg/util/log"
 	"k8s.io/klog/v2"
 	"k8s.io/klog/v2/textlogger"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -27,6 +28,7 @@ import (
 func InitFlags() {
 	// Register klog flags
 	klog.InitFlags(nil)
+	logutil.ConfigureKlog(nil)
 
 	// Override klog default values
 	if err := flag.Set("v", "1"); err != nil {

pkg/util/log/setup.go

@@ -21,9 +21,36 @@ import (
 	"k8s.io/klog/v2"
 )
 
+// setFlag is a helper type that abstracts over the global flag.Set and
+// a custom flag.FlagSet.Set so that ConfigureKlog can work with both.
+type setFlag func(name, value string) error
+
+// ConfigureKlog opts into the fixed stderrthreshold behavior introduced in
+// klog v2.140.0 (kubernetes/klog#212). Call this after klog.InitFlags and
+// before flag.Parse.
+//
+// If fs is nil the global flag.CommandLine is used; otherwise the provided
+// FlagSet is used. This keeps the logic in one place regardless of whether
+// the caller uses the global flags or a custom FlagSet.
+func ConfigureKlog(fs *flag.FlagSet) {
+	var set setFlag
+	if fs != nil {
+		set = fs.Set
+	} else {
+		set = flag.Set
+	}
+	if err := set("legacy_stderr_threshold_behavior", "false"); err != nil {
+		klog.Fatalf("Failed to set flag %q: %v", "legacy_stderr_threshold_behavior", err)
+	}
+	if err := set("stderrthreshold", "INFO"); err != nil {
+		klog.Fatalf("Failed to set flag %q: %v", "stderrthreshold", err)
+	}
+}
+
 // Setup sets up default logging configs for Nomos applications and logs the preamble.
 func Setup() {
 	klog.InitFlags(nil)
+	ConfigureKlog(nil)
 	if err := flag.Set("logtostderr", "true"); err != nil {
 		klog.Fatal(err)
 	}