Support for Go version 1.21

[SuchitraShelke]

Type of question

Open question

Question

What did you do?

Using operator-sdk images as base image in our docker file
FROM quay.io/operator-framework/ansible-operator:v1.33.0

What did you expect to see? :

Want to upgrade internal Go version used by base image to 1.21.x.

What did you see instead? Under which circumstances?

Even after using latest operator-sdk image [ 1.33 ] , getting Go version as 1.20.11 .

sh-4.4$ ansible-operator version
ansible-operator version: "v1.33.0", commit: "23ab2b642f96c18070b7666a7d8f97797be2c27b", kubernetes version: "v1.27.0", go version: "go1.20.11", GOOS: "linux", GOARCH: "amd64"

Environment

Operator type: Ansible & helm

Kubernetes cluster type: OCP

$ operator-sdk version : v1.33.0

$ go version (if language is Go) : go1.20.11

$ kubectl version : v1.27.0

Additional context

In the internal security scan for my product getting some critical PSIRT raised because of the Go version used in operator-sdk base image . And to address those have to upgrade Go version to 1.21.x .
So wanted to know when new operator-sdk release/image will be available with Go version uplifted to 1.21.x

[Neo2308]

Maybe we need to bump the version at https://github.com/operator-framework/operator-sdk/blob/master/images/operator-sdk/Dockerfile#L22 as well?

Some usages of go 1.20:

• operator-sdk/testdata/go/v4/memcached-operator/Dockerfile

  Line 4 in 5429668

  ARG TARGETARCH

• operator-sdk/testdata/go/v4/memcached-operator/go.mod

  Line 4 in 5429668

• operator-sdk/testdata/go/v4/monitoring/memcached-operator/go.mod

  Line 4 in 5429668

• operator-sdk/testdata/go/v4/monitoring/memcached-operator/Dockerfile

  Line 4 in 5429668

  ARG TARGETARCH

[SuchitraShelke]

For helm-operator , found that Go version is upgraded to 1.21 :

bash-4.4# helm-operator version
helm-operator version: "v1.33.0", commit: "542966812906456a8d67cf7284fc6410b104e118", kubernetes version: "v1.27.0", go version: "go1.21.5", GOOS: "linux", GOARCH: "amd64"

which can be seen here as well :

operator-sdk/images/helm-operator/Dockerfile

Line 2 in 5429668

FROM --platform=$BUILDPLATFORM golang:1.21 as builder

But for ansible operator, I think code is refactored & maintained here : https://github.com/operator-framework/ansible-operator-plugins
And in this git repo, Go version used is 1.20 : https://github.com/operator-framework/ansible-operator-plugins/blob/23ab2b642f96c18070b7666a7d8f97797be2c27b/go.mod#L3C3-L3C3

Because of this might be ansible-operator version 1.33 is showing Go version as 1.20.11.
Now the question is , by when we can expect Go version for ansible operator getting upgraded to 1.21.x [ may be in this repo ] ?

[stefanb]

It is not working with Go 1.22 either, see Homebrew/homebrew-core#157782

Also note, that when Go 1.22 is released (scheduled for February) the Go 1.20 will become unsupported.

[varshaprasad96]

@everettraven would be taking a look at the go version for the base images. Will update here accordingly.
@SuchitraShelke would you be open to helping with this issue? Thank you!

[everettraven]

Maybe we need to bump the version at https://github.com/operator-framework/operator-sdk/blob/master/images/operator-sdk/Dockerfile#L22 as well?

@Neo2308 This looks to be correct

Because of this might be ansible-operator version 1.33 is showing Go version as 1.20.11.
Now the question is , by when we can expect Go version for ansible operator getting upgraded to 1.21.x [ may be in this repo ] ?

@SuchitraShelke That repo is correct for the ansible operator. The binary in the base image there is built with the same go version in the projects go.mod file which is currently go 1.20. I'm not sure if there are plans to update this outside of the regular k8s version bumps (which is typically when we update the go version).