chore: bump go, e2e: flux/argo & restructure e2e-bin build (#5333)

* chore: bump flux/argo & restructure e2e-bin build

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

* remove explicit cache

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

* fix: use go-version-file everywhere

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

---------

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

.github/actions/e2e-managed/action.yml

@@ -38,9 +38,9 @@ runs:
           return result;
 
     - name: Setup Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
       with:
-        go-version: "1.24"
+        go-version-file: go.mod
 
     - name: Find the Go Cache
       id: go
@@ -50,7 +50,7 @@ runs:
         echo "mod-cache=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT
 
     - name: Cache the Go Build Cache
-      uses: actions/cache@v3
+      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
       with:
         path: ${{ steps.go.outputs.build-cache }}
         key: ${{ runner.os }}-build-unit-tests-${{ github.sha }}-${{ hashFiles('**/go.sum') }}

.github/actions/e2e/action.yml

@@ -12,9 +12,9 @@ runs:
         aws-region: ${{ env.AWS_REGION }}
 
     - name: Setup Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
       with:
-        go-version: "${{ env.GO_VERSION }}"
+        go-version-file: go.mod
 
     - name: Find the Go Cache
       id: go
@@ -24,7 +24,7 @@ runs:
         echo "mod-cache=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT
 
     - name: Cache the Go Build Cache
-      uses: actions/cache@v3
+      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
       with:
         path: ${{ steps.go.outputs.build-cache }}
         key: ${{ runner.os }}-build-unit-tests-${{ github.sha }}-${{ hashFiles('**/go.sum') }}
@@ -51,18 +51,8 @@ runs:
         version: ${{ env.DOCKER_BUILDX_VERSION }}
         install: true
 
-    - name: run go mod tidy
-      shell: bash
-      run: |
-        go install github.com/onsi/ginkgo/v2/ginkgo@${{ env.GINKGO_VERSION }}
-        go version
-        ginkgo version
-        cd e2e && go mod tidy && git status && git diff
     - name: Run e2e Tests
       shell: bash
       env:
         DOCKER_BUILD_ARGS: --load
-      run: |
-        export PATH=$PATH:$(go env GOPATH)/bin
-        go install github.com/onsi/ginkgo/v2/ginkgo@${{ env.GINKGO_VERSION }}
-        make test.e2e
+      run: make test.e2e

.github/actions/sign/action.yml

@@ -37,9 +37,9 @@ runs:
         password: ${{ github.token }}
 
     - name: Setup Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
       with:
-        go-version-file: "go.mod"
+        go-version-file: go.mod
 
     - name: Set up crane
       shell: bash

.github/workflows/ci.yml

@@ -8,8 +8,8 @@ on:
 
 env:
   # Common versions
-  GOLANGCI_VERSION: 'v2.1.6'
-  KUBERNETES_VERSION: '1.31.x'
+  GOLANGCI_VERSION: 'v2.4.0'
+  KUBERNETES_VERSION: '1.33.x'
 
   # Sonar
   SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/e2e-managed.yml

@@ -7,8 +7,6 @@ permissions:
 
 env:
   # Common versions
-  GO_VERSION: '1.24'
-  GINKGO_VERSION: 'v2.8.0'
   DOCKER_BUILDX_VERSION: 'v0.4.2'
 
   # Common users. We can't run a step 'if secrets.GHCR_USERNAME != ""' but we can run

.github/workflows/e2e.yml

@@ -10,8 +10,6 @@ name: e2e tests
 
 env:
   # Common versions
-  GO_VERSION: '1.24'
-  GINKGO_VERSION: 'v2.8.0'
   DOCKER_BUILDX_VERSION: 'v0.4.2'
   KIND_VERSION: 'v0.30.0'
   KIND_IMAGE: 'kindest/node:v1.33.4'

.github/workflows/update-deps.yml

@@ -43,10 +43,6 @@ jobs:
     - uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
       with:
         egress-policy: audit
-    - name: Setup Go
-      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
-      with:
-        go-version: "1.24"
 
       # we can not use the default GHA token, as it prevents subsequent GHA
       # from running: we can create a PR but the tests won't run :/
@@ -63,6 +59,12 @@ jobs:
         token: ${{ steps.generate_token.outputs.token }}
         ref: ${{ matrix.branch }}
         fetch-depth: 0
+
+    - name: Setup Go
+      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+      with:
+        go-version-file: go.mod
+
     - name: create pull request
       run: |
         git config --global user.email "ExternalSecretsOperator@users.noreply.github.com"

Makefile

@@ -393,8 +393,8 @@ ENVTEST ?= $(LOCALBIN)/setup-envtest
 GOLANGCI_LINT ?= $(LOCALBIN)/golangci-lint
 
 ## Tool Versions
-GOLANGCI_VERSION := 2.1.6
-KUBERNETES_VERSION := 1.30.x
+GOLANGCI_VERSION := 2.4.0
+KUBERNETES_VERSION := 1.33.x
 TILT_VERSION := 0.33.21
 CTY_VERSION := 1.1.3
 

e2e/Dockerfile

@@ -1,20 +1,5 @@
 FROM golang:1.25.1-bookworm@sha256:6ad9415c04f1cdb7888141cb247cabb28fa74fcc597034494c65d5bc783246a0 AS builder
-
-ENV KUBECTL_VERSION="v1.28.3"
-ENV HELM_VERSION="v3.13.1"
-
 RUN go install github.com/onsi/ginkgo/v2/ginkgo@v2.1.6
-RUN wget --max-redirect=0 -q https://storage.googleapis.com/kubernetes-release/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl -O /usr/local/bin/kubectl && \
-    chmod +x /usr/local/bin/kubectl && \
-    wget --max-redirect=0 -q https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz -O - | tar -xzO linux-amd64/helm > /usr/local/bin/helm && \
-    chmod +x /usr/local/bin/helm
-
-WORKDIR /usr/src/app
-COPY go.mod go.sum ./
-RUN go mod download && go mod verify
-COPY . .
-WORKDIR /usr/src/app/e2e
-RUN make e2e-bin
 
 FROM alpine:3.22.1@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1
 RUN apk add -U --no-cache \
@@ -25,15 +10,20 @@ RUN apk add -U --no-cache \
     libc6-compat \
     openssl
 
+ENV KUBECTL_VERSION="v1.34.1"
+ENV HELM_VERSION="v3.19.0"
+RUN curl -LO https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl && \
+    chmod +x kubectl && \
+    install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl && \
+    wget -q https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz -O - | tar -xzO linux-amd64/helm > /usr/local/bin/helm && \
+    chmod +x /usr/local/bin/helm
 COPY --from=builder /go/bin/ginkgo /usr/local/bin/
-COPY --from=builder /usr/local/bin/kubectl /usr/local/bin/
-COPY --from=builder /usr/local/bin/helm /usr/local/bin/
 
-COPY --from=builder /usr/src/app/e2e/entrypoint.sh                   /entrypoint.sh
-COPY --from=builder /usr/src/app/e2e/suites/provider/provider.test   /provider.test
-COPY --from=builder /usr/src/app/e2e/suites/argocd/argocd.test       /argocd.test
-COPY --from=builder /usr/src/app/e2e/suites/flux/flux.test           /flux.test
-COPY --from=builder /usr/src/app/e2e/suites/generator/generator.test /generator.test
-COPY --from=builder /usr/src/app/e2e/k8s                             /k8s
+ADD e2e/entrypoint.sh /entrypoint.sh
+ADD e2e/k8s /k8s
+ADD e2e/suites/provider/provider.test /provider.test
+ADD e2e/suites/argocd/argocd.test /argocd.test
+ADD e2e/suites/flux/flux.test /flux.test
+ADD e2e/suites/generator/generator.test /generator.test
 
 CMD [ "/entrypoint.sh" ]

e2e/Makefile

@@ -18,6 +18,10 @@ start-kind: ## Start kind cluster
 	  --retain \
 	  --image "$(KIND_IMG)"
 
+stop-kind: ## Stop kind cluster
+	kind delete cluster \
+		--name external-secrets \
+
 test: e2e-image ## Run e2e tests against current kube context
 	$(MAKE) -C ../ docker.build \
 		IMAGE_NAME=$(IMAGE_NAME) \
@@ -54,19 +58,21 @@ test.managed: e2e-image ## Run e2e tests against current kube context
 		VERSION=$(VERSION)
 	./run.sh
 
-e2e-bin:
-	CGO_ENABLED=0 go run github.com/onsi/ginkgo/v2/ginkgo build ./suites/...
 
-e2e-image:
+e2e-bin: install-ginkgo
+	   CGO_ENABLED=0 ginkgo build ./suites/...
+
+e2e-image: e2e-bin
 	-rm -rf ./k8s/deploy
 	mkdir -p k8s
 	$(MAKE) -C ../ helm.generate
 	cp -r ../deploy ./k8s
 	docker build $(DOCKER_BUILD_ARGS) -t $(E2E_IMAGE_NAME):$(VERSION) -f Dockerfile ..
 
-stop-kind: ## Stop kind cluster
-	kind delete cluster \
-		--name external-secrets \
+GINKGO_VERSION := $(shell grep 'github.com/onsi/ginkgo/v2' go.mod | awk '{print $$2}')
+install-ginkgo:
+	   @echo "Installing ginkgo version $(GINKGO_VERSION) from go.mod"
+	   go install github.com/onsi/ginkgo/v2/ginkgo@$(GINKGO_VERSION)
 
 help: ## displays this help message
 	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_\/-]+:.*?## / {printf "\033[34m%-18s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST) | \

e2e/framework/addon/eso_flux_helm.go

@@ -23,9 +23,9 @@ import (
 	"net/http"
 	"time"
 
-	fluxhelm "github.com/fluxcd/helm-controller/api/v2beta1"
+	fluxhelm "github.com/fluxcd/helm-controller/api/v2"
 	"github.com/fluxcd/pkg/apis/meta"
-	fluxsrc "github.com/fluxcd/source-controller/api/v1beta2"
+	fluxsrc "github.com/fluxcd/source-controller/api/v1"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	v1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
@@ -90,7 +90,7 @@ func (c *FluxHelmRelease) Install() error {
 					Retries: -1,
 				},
 			},
-			Chart: fluxhelm.HelmChartTemplate{
+			Chart: &fluxhelm.HelmChartTemplate{
 				Spec: fluxhelm.HelmChartTemplateSpec{
 					Version: c.HelmRevision,
 					Chart:   c.HelmChart,

e2e/framework/addon/helmserver.go

@@ -26,6 +26,7 @@ import (
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 )
 
 type HelmServer struct {
@@ -37,6 +38,8 @@ type HelmServer struct {
 	serveDir string
 }
 
+const serviceName = "e2e-helmserver"
+
 func (s *HelmServer) Setup(config *Config) error {
 	s.config = config
 	var err error
@@ -60,11 +63,14 @@ func (s *HelmServer) Setup(config *Config) error {
 		return fmt.Errorf("unable to create helm index: %w %s", err, string(out))
 	}
 
-	_, err = s.config.KubeClientSet.CoreV1().Services("default").Create(GinkgoT().Context(), &v1.Service{
+	svc := &v1.Service{
 		ObjectMeta: metav1.ObjectMeta{
-			Name: "e2e-helmserver",
+			Name:      serviceName,
+			Namespace: "default",
 		},
-		Spec: v1.ServiceSpec{
+	}
+	_, err = controllerutil.CreateOrUpdate(GinkgoT().Context(), s.config.CRClient, svc, func() error {
+		svc.Spec = v1.ServiceSpec{
 			Selector: map[string]string{
 				// set via e2e/run.sh
 				"app": "eso-e2e",
@@ -75,8 +81,10 @@ func (s *HelmServer) Setup(config *Config) error {
 					Port:       80,
 					TargetPort: intstr.FromInt(3000),
 				},
-			}},
-	}, metav1.CreateOptions{})
+			}}
+		return nil
+	})
+
 	return err
 }
 
@@ -95,7 +103,7 @@ func (s *HelmServer) Logs() error {
 }
 
 func (s *HelmServer) Uninstall() error {
-	err := s.config.KubeClientSet.CoreV1().Services("default").Delete(GinkgoT().Context(), "e2e-helmserver", metav1.DeleteOptions{})
+	err := s.config.KubeClientSet.CoreV1().Services("default").Delete(GinkgoT().Context(), serviceName, metav1.DeleteOptions{})
 	if err != nil {
 		return err
 	}

e2e/framework/util/util.go

@@ -25,8 +25,8 @@ import (
 	"path/filepath"
 	"time"
 
-	fluxhelm "github.com/fluxcd/helm-controller/api/v2beta1"
-	fluxsrc "github.com/fluxcd/source-controller/api/v1beta2"
+	fluxhelm "github.com/fluxcd/helm-controller/api/v2"
+	fluxsrc "github.com/fluxcd/source-controller/api/v1"
 	v1 "k8s.io/api/core/v1"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"

e2e/go.mod

@@ -1,6 +1,6 @@
 module github.com/external-secrets/external-secrets-e2e
 
-go 1.24.6
+go 1.25.1
 
 replace (
 	github.com/Masterminds/sprig/v3 => github.com/external-secrets/sprig/v3 v3.3.0
@@ -56,9 +56,9 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/ssm v1.65.1
 	github.com/cyberark/conjur-api-go v0.13.5
 	github.com/external-secrets/external-secrets v0.0.0
-	github.com/fluxcd/helm-controller/api v0.37.2
-	github.com/fluxcd/pkg/apis/meta v1.2.0
-	github.com/fluxcd/source-controller/api v1.2.3
+	github.com/fluxcd/helm-controller/api v1.3.0
+	github.com/fluxcd/pkg/apis/meta v1.21.0
+	github.com/fluxcd/source-controller/api v1.7.0
 	github.com/golang-jwt/jwt/v4 v4.5.2
 	github.com/grafana/grafana-openapi-client-go v0.0.0-20250925215610-d92957c70d5c
 	github.com/hashicorp/vault/api v1.21.0
@@ -127,8 +127,8 @@ require (
 	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fluxcd/pkg/apis/acl v0.1.0 // indirect
-	github.com/fluxcd/pkg/apis/kustomize v1.2.0 // indirect
+	github.com/fluxcd/pkg/apis/acl v0.9.0 // indirect
+	github.com/fluxcd/pkg/apis/kustomize v1.10.0 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.2 // indirect

e2e/go.sum

@@ -215,16 +215,16 @@ github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/fluxcd/helm-controller/api v0.37.2 h1:tkLezpRdqPDz7HoKHFu92sV+ppOCVDxkjFTh8/lpff8=
-github.com/fluxcd/helm-controller/api v0.37.2/go.mod h1:BuXZhAX9blQviil6yUN5zNM4RB753yhyBTJXxXff7Mo=
-github.com/fluxcd/pkg/apis/acl v0.1.0 h1:EoAl377hDQYL3WqanWCdifauXqXbMyFuK82NnX6pH4Q=
-github.com/fluxcd/pkg/apis/acl v0.1.0/go.mod h1:zfEZzz169Oap034EsDhmCAGgnWlcWmIObZjYMusoXS8=
-github.com/fluxcd/pkg/apis/kustomize v1.2.0 h1:vkVs+OumxaWso0jNCqdgFFfMHdh+qtZhykTkjl7OgmA=
-github.com/fluxcd/pkg/apis/kustomize v1.2.0/go.mod h1:VF7tR/WuVFeum+HaMTHwp+eCtsHiiQlY6ihgqtAnW/M=
-github.com/fluxcd/pkg/apis/meta v1.2.0 h1:O766PzGAdMdQKybSflGL8oV0+GgCNIkdsxfalRyzeO8=
-github.com/fluxcd/pkg/apis/meta v1.2.0/go.mod h1:fU/Az9AoVyIxC0oI4ihG0NVMNnvrcCzdEym3wxjIQsc=
-github.com/fluxcd/source-controller/api v1.2.3 h1:71mXv3Qg9HEhcpqOq1ObmoE+P/HuZNaAvxfI7dqZMo8=
-github.com/fluxcd/source-controller/api v1.2.3/go.mod h1:5gaIVVH7hgb8p3HKFp8P6hGmZEC8fKSt4EcrG3g5vZI=
+github.com/fluxcd/helm-controller/api v1.3.0 h1:PupXPuQbksmU0g2Lc6NjIYal2HJGL+6xohsf82eGVjo=
+github.com/fluxcd/helm-controller/api v1.3.0/go.mod h1:4b8PfdH0e/9Pfol2ogdMYbQ1nLjcVu9gAv27cQzIPK4=
+github.com/fluxcd/pkg/apis/acl v0.9.0 h1:wBpgsKT+jcyZEcM//OmZr9RiF8klL3ebrDp2u2ThsnA=
+github.com/fluxcd/pkg/apis/acl v0.9.0/go.mod h1:TttNS+gocsGLwnvmgVi3/Yscwqrjc17+vhgYfqkfrV4=
+github.com/fluxcd/pkg/apis/kustomize v1.10.0 h1:47EeSzkQvlQZdH92vHMe2lK2iR8aOSEJq95avw5idts=
+github.com/fluxcd/pkg/apis/kustomize v1.10.0/go.mod h1:UsqMV4sqNa1Yg0pmTsdkHRJr7bafBOENIJoAN+3ezaQ=
+github.com/fluxcd/pkg/apis/meta v1.21.0 h1:R+bN02chcs0HUmyVDQhqe/FHmYLjipVDMLnyYfNX850=
+github.com/fluxcd/pkg/apis/meta v1.21.0/go.mod h1:XUAEUgT4gkWDAEN79E141tmL+v4SV50tVZ/Ojpc/ueg=
+github.com/fluxcd/source-controller/api v1.7.0 h1:y6vjvbkIN4JzianhmaJqujeghVpvQn3gcsVW/f1xMeA=
+github.com/fluxcd/source-controller/api v1.7.0/go.mod h1:UOIEs9AACxPW7fQFqGWw1/FN2QqYDLG6WkvPIyscHkw=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=

e2e/suites/argocd/install.go

@@ -36,7 +36,7 @@ func installArgo() {
 		Namespace:    "argocd",
 		ReleaseName:  "argocd",
 		Chart:        "argo-cd/argo-cd",
-		ChartVersion: "8.2.5",
+		ChartVersion: "8.5.0",
 		Repo: addon.ChartRepo{
 			Name: "argo-cd",
 			URL:  "https://argoproj.github.io/argo-helm",

e2e/suites/flux/install.go

@@ -33,7 +33,7 @@ import (
 
 const (
 	helmChartRevision = "0.0.0-e2e"
-	fluxManifests     = "https://github.com/fluxcd/flux2/releases/download/v0.29.3/install.yaml"
+	fluxManifests     = "https://github.com/fluxcd/flux2/releases/download/v2.6.4/install.yaml"
 )
 
 func installFlux() {

go.mod

@@ -1,6 +1,6 @@
 module github.com/external-secrets/external-secrets
 
-go 1.24.6
+go 1.25.1
 
 replace github.com/Masterminds/sprig/v3 => github.com/external-secrets/sprig/v3 v3.3.0