Merge https://github.com/kubernetes-sigs/cloud-provider-azure:master (a34be35) into main

.ci-operator.yaml

@@ -1,4 +1,4 @@
 build_root_image:
   name: release
   namespace: openshift
-  tag: rhel-9-release-golang-1.24-openshift-4.21
+  tag: rhel-9-release-golang-1.24-openshift-4.22

.github/workflows/cleanupcache.yaml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
         with:
           egress-policy: audit
 

.github/workflows/codeql-azclient.yml

@@ -43,7 +43,7 @@ jobs:
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
       with:
         egress-policy: audit
 
@@ -60,7 +60,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v3.29.5
+      uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.29.5
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -77,4 +77,4 @@ jobs:
         echo "fail if files changed"
         git add . && git diff --quiet && git diff --cached --quiet 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v3.29.5
+      uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.29.5

.github/workflows/dependency-review.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
         with:
           egress-policy: audit
 

.github/workflows/go-mod-consistency.yaml

@@ -14,44 +14,71 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.2.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4.2.2
+
+      - name: Discover Go modules
+        id: gomods
+        run: |
+          set -euo pipefail
+          mapfile -t go_mods < <(git ls-files '**/go.mod')
+          if [ "${#go_mods[@]}" -eq 0 ]; then
+            echo "No go.mod files found" >&2
+            exit 1
+          fi
+
+          max=$(awk '$1=="go"{print $2}' "${go_mods[@]}" | sort -V | tail -n1)
+          if [ -z "${max}" ]; then
+            echo "No go directive found in go.mod files" >&2
+            exit 1
+          fi
+
+          modules=()
+          gosums=()
+          for mod in "${go_mods[@]}"; do
+            dir="$(dirname "$mod")"
+            modules+=("${dir}")
+            if [ -f "${dir}/go.sum" ]; then
+              gosums+=("${dir}/go.sum")
+            fi
+          done
+
+          mapfile -t modules < <(printf '%s\n' "${modules[@]}" | sort -u)
+          mapfile -t gosums < <(printf '%s\n' "${gosums[@]}" | sort -u)
+
+          {
+            echo "version=${max}"
+            echo "modules<<EOF"
+            printf '%s\n' "${modules[@]}"
+            echo "EOF"
+            echo "gosums<<EOF"
+            printf '%s\n' "${gosums[@]}"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Setup Go
         uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
         with:
-          go-version-file: go.mod
+          go-version: ${{ steps.gomods.outputs.version }}
           check-latest: true
-          cache-dependency-path: |
-            go.sum
-            tests/go.sum
-            pkg/azclient/go.sum
-            pkg/azclient/cache/go.sum
-            pkg/azclient/configloader/go.sum
-            pkg/azclient/trace/go.sum
-            pkg/azclient/client-gen/go.sum
-            health-probe-proxy/go.sum
-            kubetest2-aks/go.sum
+          cache-dependency-path: ${{ steps.gomods.outputs.gosums }}
 
       - name: Run go mod tidy and verify
         run: |
           set -euo pipefail
-          modules=(
-            .
-            tests
-            pkg/azclient
-            pkg/azclient/cache
-            pkg/azclient/configloader
-            pkg/azclient/trace
-            pkg/azclient/client-gen
-            health-probe-proxy
-            kubetest2-aks
-          )
+          mapfile -t modules <<< "${{ steps.gomods.outputs.modules }}"
+          if [ "${#modules[@]}" -eq 0 ]; then
+            echo "No modules found from discovery step" >&2
+            exit 1
+          fi
           for m in "${modules[@]}"; do
+            if [ -z "${m}" ]; then
+              continue
+            fi
             echo ">> go mod tidy (${m})"
             (cd "${m}" && go mod tidy)
             echo ">> go mod verify (${m})"

.github/workflows/lint-azclient.yaml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
         with:
           egress-policy: audit
       - name: Checkout

.github/workflows/release-azclient-trace.yml

@@ -15,7 +15,7 @@ jobs:
       contents: write  # Required for creating and pushing git tags
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
       with:
         egress-policy: audit
 

.github/workflows/release-azclient.yml

@@ -19,7 +19,7 @@ jobs:
       contents: write  # Required for creating and pushing git tags
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
       with:
         egress-policy: audit
 

.github/workflows/release-cache.yml

@@ -15,7 +15,7 @@ jobs:
       contents: write  # Required for creating and pushing git tags
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
       with:
         egress-policy: audit
 

.github/workflows/release-configloader.yml

@@ -15,7 +15,7 @@ jobs:
       contents: write  # Required for creating and pushing git tags
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
       with:
         egress-policy: audit
 

.github/workflows/scorecards.yml

@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
         with:
           egress-policy: audit
 
@@ -64,14 +64,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v3.29.5
+        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.29.5
         with:
           sarif_file: results.sarif

.github/workflows/update-trivy-db.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
         with:
           egress-policy: audit
 
@@ -31,7 +31,7 @@ jobs:
           rm db.tar.gz
 
       - name: Cache DBs
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         with:
           path: ${{ github.workspace }}/.cache/trivy
           key: cache-trivy-${{ steps.date.outputs.date }}

.github/workflows/update-vendor-license.yml

@@ -37,7 +37,7 @@ jobs:
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
       with:
         egress-policy: audit
 
@@ -56,7 +56,7 @@ jobs:
       run: |
         make update
     - name: Create Pull Request
-      uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
+      uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
       with:
         branch: doc/update-vendorlicense-${{github.ref_name}}
         delete-branch: true

Dockerfile

@@ -14,7 +14,7 @@
 
 # syntax=docker/dockerfile:1
 
-FROM --platform=linux/amd64 mcr.microsoft.com/oss/go/microsoft/golang:1.24.11-bookworm@sha256:911d1e831f87d39ac8e2c1a536ca02284e7cce1d97f33f6e0311be453e193d58 AS builder
+FROM --platform=linux/amd64 mcr.microsoft.com/oss/go/microsoft/golang:1.24.11-bookworm@sha256:522d54080ec5358575fd84485ebf81a073e1c5cd6a77fae6dd05d40e6967d2ce AS builder
 
 ARG ENABLE_GIT_COMMAND=true
 ARG ARCH=amd64

Makefile

@@ -200,7 +200,17 @@ push-ccm-image: ## Push controller-manager image.
 
 .PHONY: push-node-image-linux
 push-node-image-linux: ## Push node-manager image for Linux.
-	docker push $(NODE_MANAGER_LINUX_FULL_IMAGE_PREFIX)-$(ARCH)
+	@RETRY_COUNT=0; \
+	MAX_RETRIES=3; \
+	until docker push $(NODE_MANAGER_LINUX_FULL_IMAGE_PREFIX)-$(ARCH) || [ $$RETRY_COUNT -ge $$MAX_RETRIES ]; do \
+		RETRY_COUNT=$$((RETRY_COUNT+1)); \
+		echo "Retrying to push image $(NODE_MANAGER_LINUX_FULL_IMAGE_PREFIX)-$(ARCH), attempt #$$RETRY_COUNT"; \
+		sleep 30; \
+	done; \
+	if [ $$? -ne 0 ]; then \
+		echo "docker push failed after $$MAX_RETRIES attempts. Aborting."; \
+		exit 1; \
+	fi; \
 
 push-node-image-linux-push-name-%:
 	$(MAKE) ARCH=$* push-node-image-linux-push-name

cloud-node-manager.Dockerfile

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM --platform=linux/amd64 mcr.microsoft.com/oss/go/microsoft/golang:1.24.11-bookworm@sha256:911d1e831f87d39ac8e2c1a536ca02284e7cce1d97f33f6e0311be453e193d58 AS builder
+FROM --platform=linux/amd64 mcr.microsoft.com/oss/go/microsoft/golang:1.24.11-bookworm@sha256:522d54080ec5358575fd84485ebf81a073e1c5cd6a77fae6dd05d40e6967d2ce AS builder
 
 ARG ENABLE_GIT_COMMAND=true
 ARG ARCH=amd64

cmd/cloud-controller-manager/app/controllermanager.go

@@ -211,10 +211,10 @@ func NewCloudControllerManagerCommand() *cobra.Command {
 
 // RunWrapper adapts the ccm boot logic to the leader elector call back function
 func RunWrapper(s *options.CloudControllerManagerOptions, c *cloudcontrollerconfig.Config, h *controllerhealthz.MutableHealthzHandler) func(ctx context.Context) {
-	logger := log.Background().WithName("RunWrapper")
 	return func(ctx context.Context) {
+		logger := log.FromContextOrBackground(ctx).WithName("RunWrapper")
 		if !c.DynamicReloadingConfig.EnableDynamicReloading {
-			klog.V(1).Infof("using static initialization from config file %s", c.ComponentConfig.KubeCloudShared.CloudProvider.CloudConfigFile)
+			logger.V(1).Info("using static initialization from config file", "cloudConfigFile", c.ComponentConfig.KubeCloudShared.CloudProvider.CloudConfigFile)
 			if err := Run(ctx, c.Complete(), h); err != nil {
 				klog.Errorf("RunWrapper: failed to start cloud controller manager: %v", err)
 				os.Exit(1)
@@ -224,10 +224,10 @@ func RunWrapper(s *options.CloudControllerManagerOptions, c *cloudcontrollerconf
 
 		cloudConfigFile := c.ComponentConfig.KubeCloudShared.CloudProvider.CloudConfigFile
 		if cloudConfigFile != "" {
-			klog.V(1).Infof("RunWrapper: using dynamic initialization from config file %s, starting the file watcher", cloudConfigFile)
+			logger.V(1).Info("using dynamic initialization from config file, starting the file watcher", "cloudConfigFile", cloudConfigFile)
 			updateCh = dynamic.RunFileWatcherOrDie(cloudConfigFile)
 		} else {
-			klog.V(1).Infof("RunWrapper: using dynamic initialization from secret %s/%s, starting the secret watcher", c.DynamicReloadingConfig.CloudConfigSecretNamespace, c.DynamicReloadingConfig.CloudConfigSecretName)
+			logger.V(1).Info("using dynamic initialization from secret, starting the secret watcher", "namespace", c.DynamicReloadingConfig.CloudConfigSecretNamespace, "name", c.DynamicReloadingConfig.CloudConfigSecretName)
 			updateCh = dynamic.RunSecretWatcherOrDie(c)
 		}
 
@@ -236,7 +236,7 @@ func RunWrapper(s *options.CloudControllerManagerOptions, c *cloudcontrollerconf
 		for {
 			select {
 			case <-updateCh:
-				klog.V(2).Info("RunWrapper: detected the cloud config has been updated, re-constructing the cloud controller manager")
+				logger.V(2).Info("detected the cloud config has been updated, re-constructing the cloud controller manager")
 
 				// stop the previous goroutines
 				cancelFunc()
@@ -290,6 +290,7 @@ func shouldDisableCloudProvider(configFilePath string) (bool, error) {
 
 func runAsync(s *options.CloudControllerManagerOptions, errCh chan error, h *controllerhealthz.MutableHealthzHandler) context.CancelFunc {
 	ctx, cancelFunc := context.WithCancel(context.Background())
+	logger := log.FromContextOrBackground(ctx).WithName("runAsync")
 
 	go func() {
 		c, err := s.Config(KnownControllers(), ControllersDisabledByDefault.List(), names.CCMControllerAliases())
@@ -303,7 +304,7 @@ func runAsync(s *options.CloudControllerManagerOptions, errCh chan error, h *con
 			errCh <- err
 		}
 
-		klog.V(1).Infof("RunAsync: stopping")
+		logger.V(1).Info("stopping")
 	}()
 
 	return cancelFunc
@@ -343,7 +344,7 @@ func StartHTTPServer(ctx context.Context, c *cloudcontrollerconfig.CompletedConf
 
 // Run runs the ExternalCMServer.  This should never exit.
 func Run(ctx context.Context, c *cloudcontrollerconfig.CompletedConfig, h *controllerhealthz.MutableHealthzHandler) error {
-	logger := log.Background().WithName("Run")
+	logger := log.FromContextOrBackground(ctx).WithName("Run")
 	// To help debugging, immediately log version
 	logger.Info("Version", "version", version.Get())
 
@@ -400,7 +401,7 @@ func Run(ctx context.Context, c *cloudcontrollerconfig.CompletedConfig, h *contr
 // startControllers starts the cloud specific controller loops.
 func startControllers(ctx context.Context, controllerContext genericcontrollermanager.ControllerContext, completedConfig *cloudcontrollerconfig.CompletedConfig,
 	cloud cloudprovider.Interface, controllers map[string]initFunc, healthzHandler *controllerhealthz.MutableHealthzHandler) error {
-	logger := log.Background().WithName("startControllers")
+	logger := log.FromContextOrBackground(ctx).WithName("startControllers")
 	// Initialize the cloud provider with a reference to the clientBuilder
 	cloud.Initialize(completedConfig.ClientBuilder, ctx.Done())
 	// Set the informer on the user cloud object
@@ -415,7 +416,7 @@ func startControllers(ctx context.Context, controllerContext genericcontrollerma
 			continue
 		}
 
-		klog.V(1).Infof("Starting %q", controllerName)
+		logger.V(1).Info("Starting controller", "controller", controllerName)
 		ctrl, started, err := initFn(ctx, controllerContext, completedConfig, cloud)
 		if err != nil {
 			klog.Errorf("Error starting %q: %s", controllerName, err.Error())
@@ -448,11 +449,11 @@ func startControllers(ctx context.Context, controllerContext genericcontrollerma
 		klog.Fatalf("Failed to wait for apiserver being healthy: %v", err)
 	}
 
-	klog.V(2).Infof("startControllers: starting shared informers")
+	logger.V(2).Info("startControllers: starting shared informers")
 	completedConfig.SharedInformers.Start(ctx.Done())
 	controllerContext.InformerFactory.Start(ctx.Done())
 	<-ctx.Done()
-	klog.V(1).Infof("startControllers: received stopping signal, exiting")
+	logger.V(1).Info("startControllers: received stopping signal, exiting")
 
 	return nil
 }

cmd/cloud-controller-manager/app/core.go

@@ -105,7 +105,7 @@ func startServiceController(ctx context.Context, controllerContext genericcontro
 }
 
 func startRouteController(ctx context.Context, controllerContext genericcontrollermanager.ControllerContext, completedConfig *cloudcontrollerconfig.CompletedConfig, cloud cloudprovider.Interface) (http.Handler, bool, error) {
-	logger := log.Background().WithName("startRouteController")
+	logger := log.FromContextOrBackground(ctx).WithName("startRouteController")
 	if !completedConfig.ComponentConfig.KubeCloudShared.ConfigureCloudRoutes {
 		logger.Info("Will not configure cloud provider routes", "--configure-cloud-routes", completedConfig.ComponentConfig.KubeCloudShared.ConfigureCloudRoutes)
 		return nil, false, nil