fix: cap konnectivity image to 0.34.0 (#128)

chore: bump cilium for CVE
chore: adjust taskfile to ignore worktrees during scanning

Author: cwrau

go.mod

@@ -11,7 +11,7 @@ require (
 	github.com/blang/semver/v4 v4.0.0
 	github.com/caarlos0/env/v6 v6.10.1
 	github.com/cert-manager/cert-manager v1.19.3
-	github.com/cilium/cilium v1.19.2
+	github.com/cilium/cilium v1.19.3
 	github.com/coredns/corefile-migration v1.0.30
 	github.com/go-logr/logr v1.4.3
 	github.com/onsi/gomega v1.39.1
@@ -30,17 +30,17 @@ require (
 	go4.org v0.0.0-20260112195520-a5071408f32f
 	golang.org/x/text v0.33.0
 	google.golang.org/grpc v1.80.0
-	k8s.io/api v0.35.2
-	k8s.io/apiextensions-apiserver v0.35.2
-	k8s.io/apimachinery v0.35.2
-	k8s.io/apiserver v0.35.2
-	k8s.io/client-go v0.35.2
+	k8s.io/api v0.35.3
+	k8s.io/apiextensions-apiserver v0.35.3
+	k8s.io/apimachinery v0.35.3
+	k8s.io/apiserver v0.35.3
+	k8s.io/client-go v0.35.3
 	k8s.io/cluster-bootstrap v0.35.0
-	k8s.io/component-base v0.35.2
+	k8s.io/component-base v0.35.3
 	k8s.io/kube-proxy v0.35.0
 	k8s.io/kubelet v0.35.0
 	k8s.io/kubernetes v1.35.1
-	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2
+	k8s.io/utils v0.0.0-20260319190234-28399d86e0b5
 	sigs.k8s.io/cluster-api v1.12.2
 	sigs.k8s.io/controller-runtime v0.23.3
 	sigs.k8s.io/gateway-api v1.4.1
@@ -186,7 +186,7 @@ require (
 	gopkg.in/go-jose/go-jose.v2 v2.6.3 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
-	k8s.io/cli-runtime v0.35.2 // indirect
+	k8s.io/cli-runtime v0.35.3 // indirect
 	k8s.io/cloud-provider v0.35.0 // indirect
 	k8s.io/component-helpers v0.35.0 // indirect
 	k8s.io/controller-manager v0.35.0 // indirect

go.sum

@@ -78,8 +78,8 @@ github.com/cert-manager/cert-manager v1.19.3 h1:3d0Nk/HO3BOmAdBJNaBh+6YgaO3Ciey3
 github.com/cert-manager/cert-manager v1.19.3/go.mod h1:e9NzLtOKxTw7y99qLyWGmPo6mrC1Nh0EKKcMkRfK+GE=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cilium/cilium v1.19.2 h1:891hXerzal4vBVjjlCsyV47DQDI77+f9mzf1ulWF54E=
-github.com/cilium/cilium v1.19.2/go.mod h1:BRn4WvJVo/V9clDdwE12uNCq4tdWSGm9hYjCL44LC5g=
+github.com/cilium/cilium v1.19.3 h1:foJrHPk45HwshOd8Qf/kptf9JxPfNySkIDKsetZa9+Y=
+github.com/cilium/cilium v1.19.3/go.mod h1:cd4P5LHAg4hyyZexrM4D055t5JwyudeAcZ/Jub9VxJY=
 github.com/cilium/ebpf v0.20.1-0.20260218191617-ee67e7f43dd9 h1:hQW7n5ePt/HDgeZLcyT3pFENyfa6vmaGU7M+tq2pa64=
 github.com/cilium/ebpf v0.20.1-0.20260218191617-ee67e7f43dd9/go.mod h1:EGj6HpG/oejvbTAsMWwlA4UbMU7WBAgILd+9OSvcDTc=
 github.com/cilium/hive v0.0.1 h1:NrHJ1DD74B77ib4UhujEQ0j4nCQmyKOic9qtwrreJRs=
@@ -532,8 +532,8 @@ k8s.io/kubelet v0.35.0 h1:8cgJHCBCKLYuuQ7/Pxb/qWbJfX1LXIw7790ce9xHq7c=
 k8s.io/kubelet v0.35.0/go.mod h1:ciRzAXn7C4z5iB7FhG1L2CGPPXLTVCABDlbXt/Zz8YA=
 k8s.io/kubernetes v1.35.1 h1:qmjXSCDPnOuXPuJb5pv+eLzpXhhlD09Jid1pG/OvFU8=
 k8s.io/kubernetes v1.35.1/go.mod h1:AaPpCpiS8oAqRbEwpY5r3RitLpwpVp5lVXKFkJril58=
-k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
-k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 h1:kBawHLSnx/mYHmRnNUf9d4CpjREbeZuxoSGOX/J+aYM=
+k8s.io/utils v0.0.0-20260319190234-28399d86e0b5/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 h1:hSfpvjjTQXQY2Fol2CS0QHMNs/WI1MOSGzCm1KhM5ec=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
 sigs.k8s.io/cluster-api v1.12.2 h1:+b+M2IygfvFZJq7bsaloNakimMEVNf81zkGR1IiuxXs=

pkg/operator/util/images.go

@@ -39,7 +39,9 @@ func ResolveKonnectivityImage(imageSpec *v1alpha1.ImageSpec, component string, m
 		imageSpec,
 		"registry.k8s.io",
 		fmt.Sprintf("kas-network-proxy/%s", component),
-		fmt.Sprintf("v0.%d.0", minorVersion),
+		// there is no image for 35 and above
+		// TODO: update when new image is available
+		fmt.Sprintf("v0.%d.0", min(minorVersion, 34)),
 	)
 }
 

taskfile.yaml

@@ -106,7 +106,7 @@ tasks:
     sources:
       - go.mod
       - go.sum
-    cmd: "{{ .grypeCmd }} --name cacpphcp dir:. --exclude ./build --only-fixed --by-cve --fail-on negligible"
+    cmd: "{{ .grypeCmd }} --name cacpphcp dir:. --exclude ./build --exclude ./*/worktree*/* --only-fixed --by-cve --fail-on negligible"
   lint:
     vars:
       fix: '{{ .fix | default "false" }}'