Skip to content

Add support for pinning tool versions to minor releases #1421

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
istio-testing merged 3 commits into from
Dec 10, 2025
Merged

Add support for pinning tool versions to minor releases #1421

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a877374
Add support for pinning tool versions to minor releases
FilipB Dec 4, 2025
d5337fc
Make the linter happy
FilipB Dec 5, 2025
2677f31
Fix regex for getLatestMinorVersion and rename it to make better sense
FilipB Dec 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
117 changes: 91 additions & 26 deletions tools/update_deps.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,22 +25,81 @@ if [[ "$(uname)" == "Darwin" ]]; then
fi

UPDATE_BRANCH=${UPDATE_BRANCH:-"master"}
# When true, only update to the latest patch version (keeps major.minor version the same)
PIN_MINOR=${PIN_MINOR:-false}
# When true, skip Istio module updates (istio.io/istio and istio.io/client-go), do not add new Istio versions and only update tools
TOOLS_ONLY=${TOOLS_ONLY:-false}

@dgn dgn Dec 5, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why would we need this?

@FilipB FilipB Dec 5, 2025

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In case we want to add new versions of Istio to release branches still manually. If we add new Istio versions automatically, it will be automatically propagated to our fork where we are still adding new Istio versions manually. There would be temporarily a mismatch between istio version defined in the go.mod and Istio version defined in the versions.ossm.yaml. Maybe we can update our upstream release checklist to always resolve this mismatch in the fork. On the other hand I'm not sure if there is a real advantage of adding new Istio versions to release branches automatically. The release is still manual and having one extra step (PIN_MINOR=true ./tools/update_deps.sh) is not a problem for me personally. Only advantage would be that the Istio version is added earlier. Current approach is adding it only during manual release preps.

@dgn dgn Dec 5, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

okay, so we still need to run TOOLS_ONLY=false make update-deps before creating a new patch release?

@FilipB FilipB Dec 5, 2025

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, we need to choose between:

  • adding new istio versions by automator and facing the problem with mismatch in the fork I described above
  • update only tools by automator and run TOOLS_ONLY=false make update-deps manually before creating a new patch release


SCRIPTPATH="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
ROOTDIR=$(dirname "${SCRIPTPATH}")
cd "${ROOTDIR}"

# Extract tool versions from Makefile
function getVersionFromMakefile() {
grep "^${1} ?= " "${ROOTDIR}/Makefile.core.mk" | cut -d'=' -f2 | tr -d ' '
}

# Get current versions from Makefile and set as variables
# Only needed when PIN_MINOR is true (for patch version updates)
if [[ "${PIN_MINOR}" == "true" ]]; then
OPERATOR_SDK_VERSION=$(getVersionFromMakefile "OPERATOR_SDK_VERSION")
# shellcheck disable=SC2034
HELM_VERSION=$(getVersionFromMakefile "HELM_VERSION")
CONTROLLER_TOOLS_VERSION=$(getVersionFromMakefile "CONTROLLER_TOOLS_VERSION")
CONTROLLER_RUNTIME_BRANCH=$(getVersionFromMakefile "CONTROLLER_RUNTIME_BRANCH")
OPM_VERSION=$(getVersionFromMakefile "OPM_VERSION")
OLM_VERSION=$(getVersionFromMakefile "OLM_VERSION")
GITLEAKS_VERSION=$(getVersionFromMakefile "GITLEAKS_VERSION")
RUNME_VERSION=$(getVersionFromMakefile "RUNME_VERSION")
MISSPELL_VERSION=$(getVersionFromMakefile "MISSPELL_VERSION")
fi


# getLatestVersion gets the latest released version of a github project
# $1 = org/repo
function getLatestVersion() {
curl -sL "https://api.github.com/repos/${1}/releases/latest" | yq '.tag_name'
}

# getLatestMinorVersion gets the latest released version of a github project with a specific minor version prefix
# getLatestVersionByPrefix gets the latest released version of a github project with a specific version prefix
# $1 = org/repo
# $2 = major version prefix
function getLatestMinorVersion() {
curl -sL "https://api.github.com/repos/${1}/releases" | yq -p json "[.[] | select(.tag_name | test(\"^$2\\.\")) | .tag_name] | .[0]"
# $2 = version prefix
function getLatestVersionByPrefix() {

@dgn dgn Dec 10, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thank you for improving this func 🙏

@dgn dgn Dec 10, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

now let's hope none of our deps ever reaches >100 releases on GitHub 😆

curl -sL "https://api.github.com/repos/${1}/releases?per_page=100" | \
yq -r '.[].tag_name' | \
grep -E "^v?${2}[.0-9]*$" | \
sort -V | \
tail -n 1
}

# getLatestPatchVersion gets the latest patch version for a given major.minor version
# $1 = org/repo
# $2 = current version (e.g., v1.2.3)
function getLatestPatchVersion() {
local repo=$1
local current_version=$2

# Extract major.minor from current version
# Handle versions with or without 'v' prefix
local version_no_v=${current_version#v}
local major_minor=""
major_minor=$(echo "${version_no_v}" | cut -d'.' -f1,2)

getLatestVersionByPrefix "$repo" "${major_minor}"
}

# getVersionForUpdate chooses between getLatestVersion and getLatestPatchVersion based on PIN_MINOR
# $1 = org/repo
# $2 = current version (optional, required if PIN_MINOR=true)
function getVersionForUpdate() {
local repo=$1
local current_version=$2

if [[ "${PIN_MINOR}" == "true" ]]; then
getLatestPatchVersion "${repo}" "${current_version}"
else
getLatestVersion "${repo}"
fi
}

function getReleaseBranch() {
Expand All @@ -62,62 +121,63 @@ NEW_IMAGE_MASTER=$(grep IMAGE_VERSION= < common/scripts/setup_env.sh | cut -d= -

# Update go dependencies
export GO111MODULE=on
go get -u "istio.io/istio@${UPDATE_BRANCH}"
go get -u "istio.io/client-go@${UPDATE_BRANCH}"
go mod tidy
if [[ "${TOOLS_ONLY}" != "true" ]]; then
go get -u "istio.io/istio@${UPDATE_BRANCH}"
go get -u "istio.io/client-go@${UPDATE_BRANCH}"
go mod tidy
else
echo "Skipping Istio module updates (TOOLS_ONLY=true)"
fi

# Update operator-sdk
OPERATOR_SDK_LATEST_VERSION=$(getLatestVersion operator-framework/operator-sdk)
OPERATOR_SDK_LATEST_VERSION=$(getVersionForUpdate operator-framework/operator-sdk "${OPERATOR_SDK_VERSION}")
"$SED_CMD" -i "s|OPERATOR_SDK_VERSION ?= .*|OPERATOR_SDK_VERSION ?= ${OPERATOR_SDK_LATEST_VERSION}|" "${ROOTDIR}/Makefile.core.mk"
find "${ROOTDIR}/chart/templates/olm/scorecard.yaml" -type f -exec "$SED_CMD" -i "s|quay.io/operator-framework/scorecard-test:.*|quay.io/operator-framework/scorecard-test:${OPERATOR_SDK_LATEST_VERSION}|" {} +

# Update helm (FIXME: pinned to v3 as we don't support helm4 yet, see https://github.com/istio-ecosystem/sail-operator/issues/1371)
HELM_LATEST_VERSION=$(getLatestMinorVersion helm/helm v3)
HELM_LATEST_VERSION=$(getLatestVersionByPrefix helm/helm v3)
"$SED_CMD" -i "s|HELM_VERSION ?= .*|HELM_VERSION ?= ${HELM_LATEST_VERSION}|" "${ROOTDIR}/Makefile.core.mk"

# Update controller-tools
CONTROLLER_TOOLS_LATEST_VERSION=$(getLatestVersion kubernetes-sigs/controller-tools)
CONTROLLER_TOOLS_LATEST_VERSION=$(getVersionForUpdate kubernetes-sigs/controller-tools "${CONTROLLER_TOOLS_VERSION}")
"$SED_CMD" -i "s|CONTROLLER_TOOLS_VERSION ?= .*|CONTROLLER_TOOLS_VERSION ?= ${CONTROLLER_TOOLS_LATEST_VERSION}|" "${ROOTDIR}/Makefile.core.mk"

# Update controller-runtime
CONTROLLER_RUNTIME_LATEST_VERSION=$(getLatestVersion kubernetes-sigs/controller-runtime)
# Note: For controller-runtime, we use the branch to determine the current version
CONTROLLER_RUNTIME_CURRENT_VERSION="v${CONTROLLER_RUNTIME_BRANCH#release-}.0"
CONTROLLER_RUNTIME_LATEST_VERSION=$(getVersionForUpdate kubernetes-sigs/controller-runtime "${CONTROLLER_RUNTIME_CURRENT_VERSION}")
# FIXME: Do not use `go get -u` until https://github.com/kubernetes/apimachinery/issues/190 is resolved
# go get -u "sigs.k8s.io/controller-runtime@${CONTROLLER_RUNTIME_LATEST_VERSION}"
go get "sigs.k8s.io/controller-runtime@${CONTROLLER_RUNTIME_LATEST_VERSION}"
CONTROLLER_RUNTIME_BRANCH=$(getReleaseBranch "${CONTROLLER_RUNTIME_LATEST_VERSION}")
"$SED_CMD" -i "s|CONTROLLER_RUNTIME_BRANCH ?= .*|CONTROLLER_RUNTIME_BRANCH ?= ${CONTROLLER_RUNTIME_BRANCH}|" "${ROOTDIR}/Makefile.core.mk"

# Update opm
OPM_LATEST_VERSION=$(getLatestVersion operator-framework/operator-registry)
OPM_LATEST_VERSION=$(getVersionForUpdate operator-framework/operator-registry "${OPM_VERSION}")
"$SED_CMD" -i "s|OPM_VERSION ?= .*|OPM_VERSION ?= ${OPM_LATEST_VERSION}|" "${ROOTDIR}/Makefile.core.mk"

# Update olm
OLM_LATEST_VERSION=$(getLatestVersion operator-framework/operator-lifecycle-manager)
OLM_LATEST_VERSION=$(getVersionForUpdate operator-framework/operator-lifecycle-manager "${OLM_VERSION}")
"$SED_CMD" -i "s|OLM_VERSION ?= .*|OLM_VERSION ?= ${OLM_LATEST_VERSION}|" "${ROOTDIR}/Makefile.core.mk"

# Update gateway-api
GW_API_LATEST_VERSION=$(getLatestVersion kubernetes-sigs/gateway-api)
"$SED_CMD" -i "s|GW_API_VERSION=.*|GW_API_VERSION=\${GW_API_VERSION:-${GW_API_LATEST_VERSION}}|" "${ROOTDIR}/tests/e2e/setup/setup-kind.sh"

# Update kube-rbac-proxy
RBAC_PROXY_LATEST_VERSION=$(getLatestVersion brancz/kube-rbac-proxy | cut -d/ -f1)
# Only update it if the newer image is available in the registry
if docker manifest inspect "gcr.io/kubebuilder/kube-rbac-proxy:${RBAC_PROXY_LATEST_VERSION}" >/dev/null 2>/dev/null; then
"$SED_CMD" -i "s|gcr.io/kubebuilder/kube-rbac-proxy:.*|gcr.io/kubebuilder/kube-rbac-proxy:${RBAC_PROXY_LATEST_VERSION}|" "${ROOTDIR}/chart/values.yaml"
fi

# Update gitleaks
GITLEAKS_VERSION=$(getLatestVersion gitleaks/gitleaks)
"$SED_CMD" -i "s|GITLEAKS_VERSION ?= .*|GITLEAKS_VERSION ?= ${GITLEAKS_VERSION}|" "${ROOTDIR}/Makefile.core.mk"
GITLEAKS_LATEST_VERSION=$(getVersionForUpdate gitleaks/gitleaks "${GITLEAKS_VERSION}")
"$SED_CMD" -i "s|GITLEAKS_VERSION ?= .*|GITLEAKS_VERSION ?= ${GITLEAKS_LATEST_VERSION}|" "${ROOTDIR}/Makefile.core.mk"

# Update runme
RUNME_LATEST_VERSION=$(getLatestVersion runmedev/runme)
# Remove the leading "v" from the version string
# Add 'v' prefix to current version for comparison if it doesn't have one
RUNME_VERSION_WITH_V="v${RUNME_VERSION}"
RUNME_LATEST_VERSION=$(getVersionForUpdate runmedev/runme "${RUNME_VERSION_WITH_V}")
# Remove the leading "v" from the version string for storage in Makefile
RUNME_LATEST_VERSION=${RUNME_LATEST_VERSION#v}
"$SED_CMD" -i "s|RUNME_VERSION ?= .*|RUNME_VERSION ?= ${RUNME_LATEST_VERSION}|" "${ROOTDIR}/Makefile.core.mk"

# Update misspell
MISSPELL_LATEST_VERSION=$(getLatestVersion client9/misspell)
MISSPELL_LATEST_VERSION=$(getVersionForUpdate client9/misspell "${MISSPELL_VERSION}")
"$SED_CMD" -i "s|MISSPELL_VERSION ?= .*|MISSPELL_VERSION ?= ${MISSPELL_LATEST_VERSION}|" "${ROOTDIR}/Makefile.core.mk"

# Update KIND_IMAGE. Look for KIND_IMAGE := docker.io in the make file and look on docker.io/kindest/node for the latest version.
Expand All @@ -132,4 +192,9 @@ fi
./hack/update-istio-in-docs.sh

# Regenerate files
make update-istio gen
if [[ "${TOOLS_ONLY}" != "true" ]]; then
make update-istio gen
else
echo "Skipping 'make update-istio' (TOOLS_ONLY=true), running 'make gen' only"
make gen
fi
Loading