Align third-party versions with calico-private release-calient-v3.23 - #5177
Conversation
This branch tracks calico-private release-calient-v3.23 (see config/enterprise_versions.yml libcalico-go), which is bumping its third-party pins in tigera/calico-private#13239. The operator deploys those images, so its own pins have to move with them. | component | before | after | |---|---|---| | eck-kibana | 8.19.16 | 8.19.20 | | eck-elasticsearch | 8.19.16 | 8.19.20 | | coreos-prometheus | v3.9.1 | v3.13.2 | | coreos-alertmanager | v0.30.1 | v0.33.1 | | eck-elasticsearch-operator | 3.4.0 | 3.4.1 | | ISTIO_VERSION (Makefile) | 1.29.4 | 1.29.6 | pkg/components/enterprise.go is regenerated from the yaml by gen-versions, not hand-edited. The eck-elasticsearch-operator move also repairs an inconsistency on this branch: pkg/imports/crds/enterprise/01-crd-eck-bundle.yaml was already synced to ECK 3.4.1 (#5173) while this pin still claimed 3.4.0. Not changed, deliberately: GO_VERSION stays 1.26.5 and K8S_VERSION stays v1.36.3. calico-private#13254 moves v3.23 to Go 1.25.13, but this branch is on the Go 1.26 line and k8s 1.36, and #5172 (helm v3.21.3) requires Go 1.26 here. Those two pins are not meant to track calico-private. Not changed: the version literals in hack/release/prep_test.go. They are inputs to a round-trip test asserting that updateConfigVersions leaves third-party pins alone; the values are arbitrary and match nothing real. Verified: - go build ./... passes. - Istio charts re-fetched at 1.29.6; pkg/render/istio passes. - pkg/render/logstorage/... (elasticsearch, kibana, eck), pkg/components and hack/release all pass.
There was a problem hiding this comment.
Pull request overview
Aligns the operator’s third-party version pins with Calico Enterprise release-calient-v3.23 so the operator continues to deploy images that are built/published for this branch line.
Changes:
- Bump ECK Elasticsearch/Kibana versions to
8.19.20. - Bump Prometheus/Alertmanager versions to
v3.13.2/v0.33.1and ECK operator to3.4.1. - Update the bundled Istio chart download version to
1.29.6in theMakefile.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| pkg/components/enterprise.go | Regenerated component version constants to match updated enterprise pins. |
| Makefile | Bumps ISTIO_VERSION used by the istio_charts download target. |
| config/enterprise_versions.yml | Updates enterprise third-party version pins (source of truth for generation). |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| @@ -239,7 +239,7 @@ endif | |||
|
|
|||
| # To update the Istio version, see "Updating the bundled version of Istio" in docs/common_tasks.md. | |||
dimitri-nicolo
added
dependencies
|
Valid finding, thanks — the pointer really is dead. It is not specific to this PR though: the comment has been wrong on master and on every release branch back to release-v1.40, and this PR only changes the version number two lines below it. So rather than patch the comment on two release branches (which would leave master still wrong, and have docs flowing backwards from release to master), I have written the missing section on master in #5179. I went with adding the section rather than rewording the comment, since the repo already documents the equivalent Envoy Gateway procedure there and the Istio one has two non-obvious traps worth recording:
Leaving this PR to version pins only; #5179 can be picked back to the release branches if the docs are wanted there. |
Description
Moves this branch's third-party pins to match calico-private
release-calient-v3.23, which is bumping them in tigera/calico-private#13239.This branch tracks
release-calient-v3.23(config/enterprise_versions.yml→libcalico-go), and the operator deploys those images, so its pins have to move with calico's or it will deploy versions that no longer get built.eck-kibanaeck-elasticsearchcoreos-prometheuscoreos-alertmanagereck-elasticsearch-operatorISTIO_VERSION(Makefile)pkg/components/enterprise.gois regenerated from the yaml bygen-versions— not hand-edited — sovalidate-gen-versionsstays clean.Also fixes an inconsistency
The
eck-elasticsearch-operatorbump repairs a mismatch already on this branch:pkg/imports/crds/enterprise/01-crd-eck-bundle.yamlwas synced to ECK 3.4.1 in #5173, while this pin still claimed 3.4.0. They now agree.Deliberately not changed
Go and k8s. calico-private#13254 moves v3.23 to Go 1.25.13, but this branch is on the Go 1.26 line (
GO_VERSION=1.26.5,K8S_VERSION=v1.36.3). Those pins are not meant to track calico-private, and #5172 (helm v3.21.3) requires Go 1.26 here — aligning them downward would break it. The operator/calico Go versions have been independent on this branch for a while.hack/release/prep_test.go. It contains the literals8.19.16andv3.9.1, so a grep for the old versions finds them. They're inputs to a self-contained round-trip test asserting thatupdateConfigVersionsleaves third-party pins alone while rewriting product versions; the values are arbitrary and match nothing real. Changing them would be diff noise.Verified
go build ./...passes.pkg/render/istiopasses (no golden fixtures are pinned to the chart version).pkg/render/logstorage/...(elasticsearch, kibana, eck, esgateway, esmetrics, linseed, dashboards),pkg/componentsandhack/releaseall pass.Companion PR
release-calient-v3.22, which additionally carries Go 1.25.12 → 1.25.13.Release Note