bump to golang 1.24

stuggi · stuggi · commit facecd17bc94 · 2025-09-22T16:52:26.000+02:00
* bump in go.mod (base and api)
* bump go-toolset in Dockerfile
* bump in github jobs ('.github/workflows')
* Bump the golangci-lint version in the .pre-commit-config.yaml to v2.4.0
* Bump build_root_image in .ci-operator.yaml to ci-build-root-golang-1.24-sdk-1.31

Also fixes golangci-lint reported issues for new v2.4.0 version.

Jira: OSPRH-12935
Signed-off-by: Martin Schuppert &lt;mschuppert@redhat.com&gt;
Co-authored-by: Claude (Anthropic) claude@anthropic.com
diff --git a/.ci-operator.yaml b/.ci-operator.yaml
@@ -1,4 +1,4 @@
 build_root_image:
   name: tools
   namespace: openstack-k8s-operators
-  tag: ci-build-root-golang-1.21-sdk-1.31
+  tag: ci-build-root-golang-1.24-sdk-1.31
diff --git a/.github/workflows/build-barbican-operator.yaml b/.github/workflows/build-barbican-operator.yaml
@@ -15,7 +15,7 @@ jobs:
     uses: openstack-k8s-operators/openstack-k8s-operators-ci/.github/workflows/reusable-build-operator.yaml@main
     with:
       operator_name: barbican
-      go_version: 1.21.x
+      go_version: 1.24.x
       operator_sdk_version: 1.31.0
     secrets:
       IMAGENAMESPACE: ${{ secrets.IMAGENAMESPACE }}
diff --git a/.github/workflows/force-bump-pr-manual.yaml b/.github/workflows/force-bump-pr-manual.yaml
@@ -9,5 +9,6 @@ jobs:
     with:
       operator_name: barbican
       branch_name: ${{ github.ref_name }}
+      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.31
     secrets:
       FORCE_BUMP_PULL_REQUEST_PAT: ${{ secrets.FORCE_BUMP_PULL_REQUEST_PAT }}
diff --git a/.github/workflows/force-bump-pr-scheduled.yaml b/.github/workflows/force-bump-pr-scheduled.yaml
@@ -10,5 +10,6 @@ jobs:
     uses: openstack-k8s-operators/openstack-k8s-operators-ci/.github/workflows/force-bump-branches.yaml@main
     with:
       operator_name: barbican
+      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.31
     secrets:
       FORCE_BUMP_PULL_REQUEST_PAT: ${{ secrets.FORCE_BUMP_PULL_REQUEST_PAT }}
diff --git a/.golangci.yaml b/.golangci.yaml
@@ -1,17 +1,20 @@
+version: 2
+
 linters:
   # Enable specific linter
   # https://golangci-lint.run/usage/linters/#enabled-by-default
   enable:
     - errorlint
     - revive
     - ginkgolinter
-    - gofmt
     - govet
     - gosec
     - errname
     - err113
+
+formatters:
+  enable:
+    - gofmt
+
 run:
   timeout: 5m
-issues:
-  exclude:
-    - 'G101: Potential hardcoded credentials'
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -62,7 +62,7 @@ repos:
       entry: bashate --error . --ignore=E006,E040,E011,E020,E012
 
 - repo: https://github.com/golangci/golangci-lint
-  rev: v1.59.1
+  rev: v2.4.0
   hooks:
     - id: golangci-lint-full
       args: ["-v"]
diff --git a/Dockerfile b/Dockerfile
@@ -1,4 +1,4 @@
-ARG GOLANG_BUILDER=registry.access.redhat.com/ubi9/go-toolset:1.21
+ARG GOLANG_BUILDER=registry.access.redhat.com/ubi9/go-toolset:1.24
 ARG OPERATOR_BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest
 
 # Build the manager binary
diff --git a/Makefile b/Makefile
@@ -208,7 +208,7 @@ GINKGO ?= $(LOCALBIN)/ginkgo
 ## Tool Versions
 KUSTOMIZE_VERSION ?= v3.8.7
 CONTROLLER_TOOLS_VERSION ?= v0.14.0
-GOTOOLCHAIN_VERSION ?= go1.21.0
+GOTOOLCHAIN_VERSION ?= go1.24.0
 
 KUSTOMIZE_INSTALL_SCRIPT ?= "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"
 .PHONY: kustomize
diff --git a/api/go.mod b/api/go.mod
@@ -1,6 +1,6 @@
 module github.com/openstack-k8s-operators/barbican-operator/api
 
-go 1.21
+go 1.24
 
 require (
 	github.com/onsi/ginkgo/v2 v2.20.1
diff --git a/controllers/barbican_common.go b/controllers/barbican_common.go
@@ -14,6 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+// Package controllers implements the barbican-operator Kubernetes controllers.
 package controllers
 
 import (
@@ -52,7 +53,6 @@ func ensureTopology(
 	conditionUpdater conditionUpdater,
 	defaultLabelSelector metav1.LabelSelector,
 ) (*topologyv1.Topology, error) {
-
 	topology, err := topologyv1.EnsureServiceTopology(
 		ctx,
 		helper,
@@ -94,7 +94,6 @@ func GenerateConfigsGeneric(
 	cmLabels map[string]string,
 	scripts bool,
 ) error {
-
 	cms := []util.Template{
 		// Templates where the BarbicanAPI config is stored
 		{
@@ -120,6 +119,7 @@ func GenerateConfigsGeneric(
 	return secret.EnsureSecrets(ctx, h, instance, cms, envVars)
 }
 
+// GenerateSecretStoreTemplateMap generates a template map for configured secret stores
 func GenerateSecretStoreTemplateMap(
 	enabledSecretStores []barbicanv1beta1.SecretStore,
 	globalDefaultSecretStore barbicanv1beta1.SecretStore,
diff --git a/controllers/barbican_controller.go b/controllers/barbican_controller.go
@@ -64,12 +64,18 @@ import (
 )
 
 const (
-	PKCS11PrepReadyCondition      = "PKCS11PrepReady"
-	PKCS11PrepReadyInitMessage    = "PKCS11 Prep job not started"
-	PKCS11PrepReadyMessage        = "PKCS11 Prep job completed"
-	PKCS11PrepReadyErrorMessage   = "PKCS11 Prep job error occurred %s"
+	// PKCS11PrepReadyCondition indicates whether PKCS11 preparation is ready
+	PKCS11PrepReadyCondition = "PKCS11PrepReady"
+	// PKCS11PrepReadyInitMessage is the initial message for PKCS11 prep status
+	PKCS11PrepReadyInitMessage = "PKCS11 Prep job not started"
+	// PKCS11PrepReadyMessage is the message when PKCS11 prep job is completed
+	PKCS11PrepReadyMessage = "PKCS11 Prep job completed"
+	// PKCS11PrepReadyErrorMessage is the error message template for PKCS11 prep job failures
+	PKCS11PrepReadyErrorMessage = "PKCS11 Prep job error occurred %s"
+	// PKCS11PrepReadyRunningMessage is the message when PKCS11 prep job is still running
 	PKCS11PrepReadyRunningMessage = "PKCS11 Prep job is still running"
-	PKCS11PrepReadyNotRunMessage  = "PKCS11 Prep job not run"
+	// PKCS11PrepReadyNotRunMessage is the message when PKCS11 prep job has not been run
+	PKCS11PrepReadyNotRunMessage = "PKCS11 Prep job not run"
 )
 
 // BarbicanReconciler reconciles a Barbican object
@@ -123,7 +129,7 @@ func (r *BarbicanReconciler) Reconcile(ctx context.Context, req ctrl.Request) (r
 	Log := r.GetLogger(ctx)
 
 	instance := &barbicanv1beta1.Barbican{}
-	err := r.Client.Get(ctx, req.NamespacedName, instance)
+	err := r.Get(ctx, req.NamespacedName, instance)
 	if err != nil {
 		if k8s_errors.IsNotFound(err) {
 			// Request object not found, could have been deleted after reconcile request.
@@ -554,13 +560,13 @@ func (r *BarbicanReconciler) reconcileDelete(ctx context.Context, instance *barb
 // fields to index to reconcile when change
 const (
 	passwordSecretField                 = ".spec.secret"
-	caBundleSecretNameField             = ".spec.tls.caBundleSecretName"
+	caBundleSecretNameField             = ".spec.tls.caBundleSecretName" // #nosec G101
 	tlsAPIInternalField                 = ".spec.tls.api.internal.secretName"
 	tlsAPIPublicField                   = ".spec.tls.api.public.secretName"
-	pkcs11LoginSecretField              = ".spec.pkcs11.loginSecret"
-	pkcs11ClientDataSecretField         = ".spec.pkcs11.clientDataSecret"
+	pkcs11LoginSecretField              = ".spec.pkcs11.loginSecret"      // #nosec G101
+	pkcs11ClientDataSecretField         = ".spec.pkcs11.clientDataSecret" // #nosec G101
 	topologyField                       = ".spec.topologyRef.Name"
-	customServiceConfigSecretsField     = ".spec.customServiceConfigSecrets"
+	customServiceConfigSecretsField     = ".spec.customServiceConfigSecrets" // #nosec G101
 	parentBarbicanConfigDataSecretField = ".status.parentBarbicanConfigDataSecret"
 )
 
@@ -626,7 +632,7 @@ func (r *BarbicanReconciler) findObjectForSrc(ctx context.Context, src client.Ob
 	listOps := &client.ListOptions{
 		Namespace: src.GetNamespace(),
 	}
-	err := r.Client.List(ctx, crList, listOps)
+	err := r.List(ctx, crList, listOps)
 	if err != nil {
 		Log.Error(err, fmt.Sprintf("listing %s for namespace: %s", crList.GroupVersionKind().Kind, src.GetNamespace()))
 		return requests
@@ -673,7 +679,7 @@ func (r *BarbicanReconciler) generateServiceConfig(
 	}
 
 	var tlsCfg *tls.Service
-	if instance.Spec.BarbicanAPI.TLS.Ca.CaBundleSecretName != "" {
+	if instance.Spec.BarbicanAPI.TLS.CaBundleSecretName != "" {
 		tlsCfg = &tls.Service{}
 	}
 	customData := map[string]string{
@@ -819,7 +825,7 @@ func (r *BarbicanReconciler) apiDeploymentCreateOrUpdate(ctx context.Context, in
 	}
 
 	// Note: The top-level .spec.apiTimeout ALWAYS overrides .spec.barbicanAPI.apiTimeout
-	apiSpec.BarbicanAPITemplate.APITimeout = instance.Spec.APITimeout
+	apiSpec.APITimeout = instance.Spec.APITimeout
 
 	deployment := &barbicanv1beta1.BarbicanAPI{
 		ObjectMeta: metav1.ObjectMeta{
@@ -1171,7 +1177,6 @@ func (r *BarbicanReconciler) ensureDB(
 		ctx, h, instance.Spec.DatabaseAccount,
 		instance.Namespace, false, barbican.DatabaseUsernamePrefix,
 	)
-
 	if err != nil {
 		instance.Status.Conditions.Set(condition.FalseCondition(
 			mariadbv1.MariaDBAccountReadyCondition,
@@ -1199,7 +1204,6 @@ func (r *BarbicanReconciler) ensureDB(
 
 	// create or patch the DB
 	ctrlResult, err := db.CreateOrPatchAll(ctx, h)
-
 	if err != nil {
 		instance.Status.Conditions.Set(condition.FalseCondition(
 			condition.DBReadyCondition,
diff --git a/controllers/barbicanapi_controller.go b/controllers/barbicanapi_controller.go
@@ -61,6 +61,7 @@ import (
 )
 
 const (
+	// TransportURL is the configuration key for transport URL
 	TransportURL = "transport_url"
 )
 
@@ -101,7 +102,7 @@ func (r *BarbicanAPIReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 	Log := r.GetLogger(ctx)
 
 	instance := &barbicanv1beta1.BarbicanAPI{}
-	err := r.Client.Get(ctx, req.NamespacedName, instance)
+	err := r.Get(ctx, req.NamespacedName, instance)
 	if err != nil {
 		if k8s_errors.IsNotFound(err) {
 			// Object not found
@@ -622,7 +623,7 @@ func (r *BarbicanAPIReconciler) reconcileNormal(ctx context.Context, instance *b
 		}
 	}
 
-	//check CustomServiceConfigSecrets
+	// check CustomServiceConfigSecrets
 	for _, v := range instance.Spec.CustomServiceConfigSecrets {
 		Log.Info(fmt.Sprintf("[API] Verify secret '%s' from CustomServiceConfigSecrets", v))
 		ctrlResult, err = r.verifySecret(ctx, helper, instance, v, []string{}, &configVars)
diff --git a/controllers/barbicankeystonelistener_controller.go b/controllers/barbicankeystonelistener_controller.go
@@ -82,7 +82,7 @@ func (r *BarbicanKeystoneListenerReconciler) Reconcile(ctx context.Context, req
 	Log := r.GetLogger(ctx)
 
 	instance := &barbicanv1beta1.BarbicanKeystoneListener{}
-	err := r.Client.Get(ctx, req.NamespacedName, instance)
+	err := r.Get(ctx, req.NamespacedName, instance)
 	if err != nil {
 		if k8s_errors.IsNotFound(err) {
 			// Object not found
diff --git a/controllers/barbicanworker_controller.go b/controllers/barbicanworker_controller.go
@@ -80,7 +80,7 @@ func (r *BarbicanWorkerReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 	Log := r.GetLogger(ctx)
 
 	instance := &barbicanv1beta1.BarbicanWorker{}
-	err := r.Client.Get(ctx, req.NamespacedName, instance)
+	err := r.Get(ctx, req.NamespacedName, instance)
 	if err != nil {
 		if k8s_errors.IsNotFound(err) {
 			// Object not found
diff --git a/go.mod b/go.mod
@@ -1,6 +1,6 @@
 module github.com/openstack-k8s-operators/barbican-operator
 
-go 1.21
+go 1.24
 
 require (
 	github.com/go-logr/logr v1.4.3
diff --git a/main.go b/main.go
@@ -14,6 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+// Package main implements the barbican-operator controller manager.
 package main
 
 import (
diff --git a/pkg/barbican/const.go b/pkg/barbican/const.go
@@ -1,3 +1,4 @@
+// Package barbican contains barbican service constants and configuration.
 package barbican
 
 import "github.com/openstack-k8s-operators/lib-common/modules/storage"
@@ -35,7 +36,7 @@ const (
 	// CustomServiceConfigFileName -
 	CustomServiceConfigFileName = "02-service-custom.conf"
 	// CustomServiceConfigSecretsFileName -
-	CustomServiceConfigSecretsFileName = "03-secrets-custom.conf"
+	CustomServiceConfigSecretsFileName = "03-secrets-custom.conf" // #nosec G101
 	// BarbicanAPI defines the barbican-api group
 	BarbicanAPI storage.PropagationType = "BarbicanAPI"
 	// BarbicanWorker defines the barbican-worker group
@@ -61,9 +62,9 @@ const (
 	ScriptVolume = "scripts"
 	// ScriptMountPoint is the mount point for scripts
 	ScriptMountPoint = "/usr/local/bin/container-scripts"
-	// PKCS11DataVolume is the volume used to mount PKCS11 client Data
+	// PKCS11ClientDataVolume is the volume used to mount PKCS11 client Data
 	PKCS11ClientDataVolume = "pkcs11-client-data"
-	// PKCS11DataVolume is the mount point used for PKCS11 client Data
+	// PKCS11ClientDataMountPoint is the mount point used for PKCS11 client Data
 	PKCS11ClientDataMountPoint = "/var/lib/config-data/hsm"
 	// BarbicanUID - based on https://github.com/openstack-k8s-operators/tcib/blob/main/container-images/kolla/base/uid_gid_manage.sh
 	BarbicanUID int64 = 42403
diff --git a/pkg/barbican/volumes.go b/pkg/barbican/volumes.go
@@ -29,7 +29,6 @@ func GetVolumes(name string) []corev1.Volume {
 
 // GetVolumeMounts - general VolumeMounts
 func GetVolumeMounts() []corev1.VolumeMount {
-
 	return []corev1.VolumeMount{
 		{
 			Name:      ConfigVolume,
@@ -96,7 +95,7 @@ func GetKollaConfigVolumeMount(serviceName string) corev1.VolumeMount {
 	}
 }
 
-// GetHSMVolume - Returns Volumes for HSM secrets
+// GetHSMVolumes returns Volumes for HSM secrets
 func GetHSMVolumes(pkcs11 barbicanv1beta1.BarbicanPKCS11Template) []corev1.Volume {
 	return []corev1.Volume{
 		{
@@ -111,7 +110,7 @@ func GetHSMVolumes(pkcs11 barbicanv1beta1.BarbicanPKCS11Template) []corev1.Volum
 	}
 }
 
-// GetHSMVolumeMount - Returns Volume Mounts for HSM secrets
+// GetHSMVolumeMounts returns Volume Mounts for HSM secrets
 func GetHSMVolumeMounts() []corev1.VolumeMount {
 	return []corev1.VolumeMount{
 		{
diff --git a/pkg/barbicanapi/deployment.go b/pkg/barbicanapi/deployment.go
@@ -1,3 +1,4 @@
+// Package barbicanapi contains barbican API deployment functionality.
 package barbicanapi
 
 import (
diff --git a/pkg/barbicanapi/volumes.go b/pkg/barbicanapi/volumes.go
@@ -11,9 +11,8 @@ import (
 	corev1 "k8s.io/api/core/v1"
 )
 
-// GetVolumesAndMounts - return the volumes and mounts for a BarbicanAPI deployment
+// GetAPIVolumesAndMounts returns the volumes and mounts for a BarbicanAPI deployment
 func GetAPIVolumesAndMounts(instance *barbicanv1beta1.BarbicanAPI) ([]corev1.Volume, []corev1.VolumeMount, error) {
-
 	apiVolumes := []corev1.Volume{
 		barbican.GetCustomConfigVolume(instance.Name),
 		barbican.GetLogVolume(),
diff --git a/pkg/barbicankeystonelistener/deployment.go b/pkg/barbicankeystonelistener/deployment.go
@@ -1,3 +1,4 @@
+// Package barbicankeystonelistener contains barbican keystone listener deployment functionality.
 package barbicankeystonelistener
 
 import (
diff --git a/pkg/barbicankeystonelistener/volumes.go b/pkg/barbicankeystonelistener/volumes.go
@@ -6,9 +6,8 @@ import (
 	corev1 "k8s.io/api/core/v1"
 )
 
-// GetVolumesAndMounts - return the volumes and mounts for a BarbicanKeystoneListener deployment
+// GetListenerVolumesAndMounts returns the volumes and mounts for a BarbicanKeystoneListener deployment
 func GetListenerVolumesAndMounts(instance *barbicanv1beta1.BarbicanKeystoneListener) ([]corev1.Volume, []corev1.VolumeMount) {
-
 	listenerVolumes := []corev1.Volume{
 		barbican.GetCustomConfigVolume(instance.Name),
 		barbican.GetLogVolume(),
diff --git a/pkg/barbicanworker/deployment.go b/pkg/barbicanworker/deployment.go
@@ -1,3 +1,4 @@
+// Package barbicanworker contains barbican worker deployment functionality.
 package barbicanworker
 
 import (
@@ -93,8 +94,8 @@ func Deployment(
 							Env:             env.MergeEnvs([]corev1.EnvVar{}, envVars),
 							VolumeMounts:    []corev1.VolumeMount{barbican.GetLogVolumeMount()},
 							Resources:       instance.Spec.Resources,
-							//ReadinessProbe: readinessProbe,
-							//LivenessProbe:  livenessProbe,
+							// ReadinessProbe: readinessProbe,
+							// LivenessProbe:  livenessProbe,
 						},
 						{
 							Name: barbican.ServiceName + "-worker",
@@ -107,8 +108,8 @@ func Deployment(
 							Env:             env.MergeEnvs([]corev1.EnvVar{}, envVars),
 							VolumeMounts:    workerVolumeMounts,
 							Resources:       instance.Spec.Resources,
-							//ReadinessProbe: readinessProbe,
-							//LivenessProbe:  livenessProbe,
+							// ReadinessProbe: readinessProbe,
+							// LivenessProbe:  livenessProbe,
 						},
 					},
 				},
diff --git a/pkg/barbicanworker/volumes.go b/pkg/barbicanworker/volumes.go
@@ -8,9 +8,8 @@ import (
 	corev1 "k8s.io/api/core/v1"
 )
 
-// GetVolumesAndMounts - return the volumes and mounts for a BarbicanWorker deployment
+// GetWorkerVolumesAndMounts returns the volumes and mounts for a BarbicanWorker deployment
 func GetWorkerVolumesAndMounts(instance *barbicanv1beta1.BarbicanWorker) ([]corev1.Volume, []corev1.VolumeMount) {
-
 	workerVolumes := []corev1.Volume{
 		barbican.GetCustomConfigVolume(instance.Name),
 		barbican.GetLogVolume(),
diff --git a/tests/functional/barbican_test_data.go b/tests/functional/barbican_test_data.go
diff --git a/tests/functional/suite_test.go b/tests/functional/suite_test.go

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-ARG GOLANG_BUILDER=registry.access.redhat.com/ubi9/go-toolset:1.21`
	`1`	`+ARG GOLANG_BUILDER=registry.access.redhat.com/ubi9/go-toolset:1.24`
`2`	`2`	`ARG OPERATOR_BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest`
`3`	`3`
`4`	`4`	`# Build the manager binary`