Merge branch 'main' into tg/explain-fork-in-readme

.github/workflows/build.yml

@@ -20,17 +20,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
         with:
           fetch-depth: 0
       - name: Install go
-        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.0.1
+        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
           go-version-file: "go.mod"
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2
+        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@ecf95283f03858871ff00b787d79c419715afc34 # v2
+        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
 
       - name: Generate metadata
         id: meta
@@ -40,14 +40,14 @@ jobs:
           metadata_tags: ${{ env.metadata_tags }}
 
       - name: Login to ghcr.io for CI
-        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@dd6b2e2b610a11fd73dd187a43d57cc1394e35f9 # v3.0.5
+        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
 
       - name: Setup Env
         run: |
@@ -57,7 +57,7 @@ jobs:
           echo 'EOF' >> $GITHUB_ENV
 
       - name: Build and push manager image
-        uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825 # v4
+        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
         id: docker_build_release
         with:
           provenance: false
@@ -84,7 +84,7 @@ jobs:
 
       # Upload artifact digests
       - name: Upload artifact digests
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1
         with:
           name: image-digest hetzner-cloud-controller-manager
           path: image-digest

.github/workflows/release.yml

@@ -19,14 +19,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
         with:
           fetch-depth: 0
       - uses: ./.github/actions/setup-go
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2
+        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2
+        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
 
       - name: Generate metadata
         id: meta
@@ -36,19 +36,18 @@ jobs:
           metadata_tags: ${{ env.metadata_tags }}
 
       - name: Login to ghcr.io for CI
-        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2
-
+        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
       - name: Install Bom
         shell: bash
         run: |
-          curl -L https://github.com/kubernetes-sigs/bom/releases/download/v0.4.1/bom-linux-amd64 -o bom
+          curl -L https://github.com/kubernetes-sigs/bom/releases/download/v0.6.0/bom-linux-amd64 -o bom
           sudo mv ./bom /usr/local/bin/bom
           sudo chmod +x /usr/local/bin/bom
 
@@ -60,7 +59,7 @@ jobs:
           echo 'EOF' >> $GITHUB_ENV
 
       - name: Build and push manager image
-        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5
+        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
         id: docker_build_release
         with:
           provenance: false
@@ -110,7 +109,7 @@ jobs:
 
       # Upload artifact digests
       - name: Upload artifact digests
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1
         with:
           name: image-digest hetzner-cloud-controller-manager
           path: image-digest
@@ -131,13 +130,12 @@ jobs:
       - name: Set env
         run: echo "RELEASE_TAG=${GITHUB_REF:10}" >> $GITHUB_ENV
       - name: checkout code
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
         with:
           fetch-depth: 0
       - name: Install go
-        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
           go-version-file: "go.mod"
           cache: true
           cache-dependency-path: go.sum
-

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.18
+FROM alpine:3.20.3
 RUN apk add --no-cache ca-certificates bash
 COPY hetzner-cloud-controller-manager /bin/hetzner-cloud-controller-manager
 LABEL org.opencontainers.image.source https://github.com/syself/hetzner-cloud-controller-manager

hack/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.21 as builder
+FROM golang:1.23.4 as builder
 WORKDIR /hccm
 ADD go.mod go.sum /hccm/
 RUN go mod download
@@ -8,7 +8,7 @@ RUN ls -al
 ARG SKAFFOLD_GO_GCFLAGS
 RUN CGO_ENABLED=0 go build -gcflags="${SKAFFOLD_GO_GCFLAGS}" -o hcloud-cloud-controller-manager.bin github.com/hetznercloud/hcloud-cloud-controller-manager
 
-FROM alpine:3.18
+FROM alpine:3.20.3
 RUN apk add --no-cache ca-certificates bash
 COPY --from=builder /hccm/hcloud-cloud-controller-manager.bin /bin/hcloud-cloud-controller-manager
 ENTRYPOINT ["/bin/hcloud-cloud-controller-manager"]

hcloud/cloud_test.go

@@ -54,7 +54,6 @@ func newTestEnv() testEnv {
 		hcloud.WithEndpoint(server.URL),
 		hcloud.WithToken("jr5g7ZHpPptyhJzZyHw2Pqu4g9gTqDvEceYpngPf79jNZXCeTYQ4uArypFM3nh75"),
 		hcloud.WithBackoffFunc(func(_ int) time.Duration { return 0 }),
-		hcloud.WithDebugWriter(os.Stdout),
 	)
 	robotClient := hrobot.NewBasicAuthClient("", "")
 	robotClient.SetBaseURL(server.URL + "/robot")

hcloud/instances_test.go

@@ -104,6 +104,9 @@ func TestInstances_InstanceExists(t *testing.T) {
 		}, {
 			name: "existing robot server by id",
 			node: &corev1.Node{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "bm-server1",
+				},
 				Spec: corev1.NodeSpec{ProviderID: "hcloud://bm-321"},
 			},
 			expected: true,
@@ -116,6 +119,9 @@ func TestInstances_InstanceExists(t *testing.T) {
 		}, {
 			name: "missing robot server by id",
 			node: &corev1.Node{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "bm-server2",
+				},
 				Spec: corev1.NodeSpec{ProviderID: "hcloud://bm-322"},
 			},
 			expected: false,
@@ -223,6 +229,9 @@ func TestInstances_InstanceShutdown(t *testing.T) {
 			name: "bm server",
 			node: &corev1.Node{
 				Spec: corev1.NodeSpec{ProviderID: "hcloud://bm-321"},
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "bm-server1",
+				},
 			},
 			expected: false,
 		},
@@ -307,6 +316,9 @@ func TestInstances_InstanceMetadataRobotServer(t *testing.T) {
 	instances := newInstances(env.Client, env.RobotClient, AddressFamilyIPv4, 0)
 
 	metadata, err := instances.InstanceMetadata(context.TODO(), &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "bm-server1",
+		},
 		Spec: corev1.NodeSpec{ProviderID: "hcloud://bm-321"},
 	})
 	if err != nil {

hcloud/util.go

@@ -82,8 +82,11 @@ func getRobotServerByName(c robotclient.Client, node *corev1.Node) (server *mode
 	return server, nil
 }
 
-func getRobotServerByID(c robotclient.Client, id int, node *corev1.Node) (*models.Server, error) {
+func getRobotServerByID(c robotclient.Client, id int, node *corev1.Node) (s *models.Server, e error) {
 	const op = "robot/getServerByID"
+	if node.Name == "" {
+		return nil, fmt.Errorf("%s: node name is empty", op)
+	}
 
 	if c == nil {
 		return nil, errMissingRobotCredentials
@@ -95,7 +98,10 @@ func getRobotServerByID(c robotclient.Client, id int, node *corev1.Node) (*model
 	}
 
 	server, err := c.ServerGet(id)
-	if err != nil && !models.IsError(err, models.ErrorCodeServerNotFound) {
+	if models.IsError(err, models.ErrorCodeServerNotFound) {
+		return nil, nil
+	}
+	if err != nil {
 		hcops.HandleRateLimitExceededError(err, node)
 		return nil, fmt.Errorf("%s: %w", op, err)
 	}

images/hetzner-cloud-controller-manager/Dockerfile

@@ -13,7 +13,7 @@
 # limitations under the License.
 
 # Build the manager binary
-FROM --platform=${BUILDPLATFORM} docker.io/library/golang:1.20.5@sha256:fd9306e1c664bd49a11d4a4a04e41303430e069e437d137876e9290a555e06fb as build
+FROM --platform=${BUILDPLATFORM} docker.io/library/golang:1.23.4 as build
 ARG TARGETOS TARGETARCH
 
 COPY . /src/hetzner-cloud-controller-manager
@@ -28,4 +28,4 @@ WORKDIR /
 COPY --from=build /src/hetzner-cloud-controller-manager/manager /bin/hetzner-cloud-controller-manager
 # Use uid of nonroot user (65532) because kubernetes expects numeric user when applying pod security policies
 USER 65532
-ENTRYPOINT ["/bin/hetzner-cloud-controller-manager"]
+ENTRYPOINT ["/bin/hetzner-cloud-controller-manager"]

internal/hcops/load_balancer.go

@@ -728,8 +728,7 @@ func (l *LoadBalancerOps) ReconcileHCLBTargets(
 		if hclbTargetIDs[id] {
 			continue
 		}
-
-		if maxTargetsReached(numberOfTargets, lb.LoadBalancerType.Name) {
+		if lb.LoadBalancerType != nil && maxTargetsReached(numberOfTargets, lb.LoadBalancerType.Name) {
 			l.Recorder.Eventf(
 				svc,
 				"Warning",
@@ -785,7 +784,7 @@ func (l *LoadBalancerOps) ReconcileHCLBTargets(
 				continue
 			}
 
-			if maxTargetsReached(numberOfTargets, lb.LoadBalancerType.Name) {
+			if lb.LoadBalancerType != nil && maxTargetsReached(numberOfTargets, lb.LoadBalancerType.Name) {
 				l.Recorder.Eventf(
 					svc,
 					"Warning",

internal/hcops/ratelimit_test.go

@@ -26,6 +26,7 @@ func TestRateLimitIsExceeded(t *testing.T) {
 	rateLimitExceeded := rateLimitHandler{
 		exceeded:    true,
 		lastChecked: now.Add(-3 * time.Minute),
+		waitTime:    5 * time.Minute,
 	}
 
 	require.Equal(t, true, rateLimitExceeded.isExceeded())

tests/e2e/e2e_test.go

@@ -22,15 +22,17 @@ import (
 var testCluster TestCluster
 
 func TestMain(m *testing.M) {
+	fmt.Printf("the e2e tests seem to require a special setup. They are disabled in our fork.\n")
+	os.Exit(1)
 	if err := testCluster.Start(); err != nil {
-		fmt.Printf("%v\n", err)
+		fmt.Printf("testCluster.Start failed: %v\n", err)
 		os.Exit(1)
 	}
 
 	rc := m.Run()
 
 	if err := testCluster.Stop(); err != nil {
-		fmt.Printf("%v\n", err)
+		fmt.Printf("testCluster.Stop failed: %v\n", err)
 		os.Exit(1)
 	}
 	os.Exit(rc)

tests/e2e/testing.go

@@ -51,7 +51,7 @@ func (tc *TestCluster) Start() error {
 	if token == "" {
 		buf, err := os.ReadFile(fmt.Sprintf("../../hack/.token-%s", tc.scope))
 		if err != nil {
-			return err
+			return fmt.Errorf("HCLOUD_TOKEN not set and no token file found: %w", err)
 		}
 		token = string(buf)
 	}
@@ -67,10 +67,12 @@ func (tc *TestCluster) Start() error {
 	hcloudClient := hcloud.NewClient(opts...)
 	tc.hcloud = hcloudClient
 
-	err := os.Setenv("KUBECONFIG", "../../hack/.kubeconfig-"+tc.scope)
-	if err != nil {
-		return err
-	}
+	// Syself: the e2e tests seem to require a special environment.
+	// I tried it with a kind cluster, but this did not work.
+	// err := os.Setenv("KUBECONFIG", "../../hack/.kubeconfig-"+tc.scope)
+	// if err != nil {
+	// 	return err
+	// }
 
 	loadingRules := clientcmd.NewDefaultClientConfigLoadingRules()
 	configOverrides := &clientcmd.ConfigOverrides{}