Repository: kumahq/kuma
Pull request #12396 (2024-12-23 15:04:24)

chore(deps): bump github.com/cilium/ebpf from 0.16.0 to 0.17.1
Bumps [github.com/cilium/ebpf](https://github.com/cilium/ebpf) from 0.16.0 to 0.17.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/cilium/ebpf/releases">github.com/cilium/ebpf's releases</a>.</em></p>
<blockquote>
<h2>Hotfix: don't retry endlessly on verifier errors on kernels &lt;6.4</h2>
<p>During the prior removal of <code>ProgramOptions.LogSize</code> in v0.16, the tests weren't updated to exercise the retry logic. With the last-minute addition of <code>ProgramOptions.LogSizeStart</code>, a bug was introduced that would cause program loads to retry indefinitely without ever growing the buffer in case of a verifier error on kernels before 6.4. This is now fixed, and the tests were updated to exercise the retry logic.</p>
<ul>
<li>prog: fix shadowing log size variable in verifier log retry loop by <a href="https://github.com/ti-mo"><code>@​ti-mo</code></a> in <a href="https://redirect.github.com/cilium/ebpf/pull/1635">cilium/ebpf#1635</a></li>
</ul>
<h2>Global Variables, Decl Tags, and package <code>pin</code></h2>
<p><strong>Note: the hotfix release 0.17.1 is out. Users are highly encouraged to upgrade.</strong></p>
<p>As we close the door on the year 2024, we're also wrapping up the ebpf-go v0.17 development cycle. This release represents a large body of work and is our largest feature release since BTF.</p>
<p>Users are, as always, highly encouraged to upgrade, and we're looking forward to hearing your feedback on the new Global Variables API. We've been putting this interface trough its paces internally, along with a few eager community members, and we're ready to let the wider community make use of it.</p>
<p>This release also marks the end of our Go 1.21 support; Go 1.22 is required going forward.</p>
<h2>Breaking Changes</h2>
<p>Before we get to the fun stuff, we need to call out a few breaking changes:</p>
<ul>
<li>
<p><strong>Global variables with a <code>static</code> qualifier can no longer be rewritten using <code>CollectionSpec.RewriteConstants()</code>!</strong> See the section on global variables under major features below.</p>
</li>
<li>
<p>program: remove LogSize and VerifierError.Truncated by <a href="https://github.com/lmb"><code>@​lmb</code></a> in <a href="https://redirect.github.com/cilium/ebpf/pull/1526">cilium/ebpf#1526</a></p>
</li>
<li>
<p>prog: add ProgramOptions.LogSizeStart to obtain full log after verifier bug by <a href="https://github.com/ti-mo"><code>@​ti-mo</code></a> in <a href="https://redirect.github.com/cilium/ebpf/pull/1630">cilium/ebpf#1630</a></p>
<p>The <code>ProgramOptions.LogSize</code> field was deprecated and a no-op since 0.16 and has now been removed completely. In its place, a new field was added to obtain full verifier logs when the verifier hits an internal bug. The <code>ProgramOptions.LogSizeStart</code> field controls the starting size of the log buffer. Use this if you have a good understanding of the log size you're expecting, or if you're trying to pull out the full log when the verifier hits an internal bug. The error string now also contains some hints about what happened and how to handle this situation.</p>
</li>
<li>
<p>map: remove MapSpec.Freeze field by <a href="https://github.com/ti-mo"><code>@​ti-mo</code></a> in <a href="https://redirect.github.com/cilium/ebpf/pull/1558">cilium/ebpf#1558</a></p>
</li>
<li>
<p>elf_reader: don't use BPF_F_RDONLY_PROG flag to trigger map freezing by <a href="https://github.com/ti-mo"><code>@​ti-mo</code></a> in <a href="https://redirect.github.com/cilium/ebpf/pull/1568">cilium/ebpf#1568</a></p>
<p>The Freeze field was ambiguous from the start, and has been a source of subtle bugs over the years. Automatic map freezing is now done based solely on map name (.(ro)data prefix). If you were manually setting this flag, consider using a conventional map name instead.</p>
</li>
<li>
<p>info: expose ksym info and func info by ProgramInfo by <a href="https://github.com/Asphaltt"><code>@​Asphaltt</code></a> in <a href="https://redirect.github.com/cilium/ebpf/pull/1576">cilium/ebpf#1576</a></p>
</li>
<li>
<p>info: expose more prog jited info by <a href="https://github.com/Asphaltt"><code>@​Asphaltt</code></a> in <a href="https://redirect.github.com/cilium/ebpf/pull/1598">cilium/ebpf#1598</a></p>
<p>Some ext_info types in package btf were redefined to enable pulling raw func and line infos out of <code>Program.Info()</code>. These were all types without methods and all unexported fields, but calling them out regardless in case someone's doing <del>unintended</del> advanced things with BTF.</p>
</li>
<li>
<p>kallsyms: change Modules caching strategy, cache address lookups by <a href="https://github.com/ti-mo"><code>@​ti-mo</code></a> in <a href="https://redirect.github.com/cilium/ebpf/pull/1590">cilium/ebpf#1590</a></p>
<p>Users attaching bpf programs to kernel symbols should see a marked decrease in allocations made in the library during program creation in the general case. Only used entries are now cached, making kallsyms lookups on subsequent program loads free. In the pathological case (new kernel symbols on every load), scanning is repeated, resulting in more CPU time being used instead of holding on to all kallsyms symbols indefinitely. <code>ProgramSpec.KernelModule()</code> was unexported until further notice.</p>
<p>Also, bpf2go users should now be able to generate Go bindings as unprivileged users once again. Oops!</p>
</li>
</ul>
<h2>Major Features</h2>
<h3>Easy global variables: introducing <code>ebpf.VariableSpec</code> and <code>ebpf.Variable</code></h3>
<ul>
<li>CollectionSpec: add new Variables field to interact with constants and global variables by <a href="https://github.com/ti-mo"><code>@​ti-mo</code></a> in <a href="https://redirect.github.com/cilium/ebpf/pull/1564">cilium/ebpf#1564</a></li>
<li>Collection: add Variables field to interact with global variables by <a href="https://github.com/ti-mo"><code>@​ti-mo</code></a> in <a href="https://redirect.github.com/cilium/ebpf/pull/1572">cilium/ebpf#1572</a></li>
<li>bpf2go: generate assignment structs and Go types for Variables and VariableSpecs by <a href="https://github.com/smagnani96"><code>@​smagnani96</code></a> in <a href="https://redirect.github.com/cilium/ebpf/pull/1610">cilium/ebpf#1610</a></li>
</ul>
<p>This has been a frequent ask in the community for years, so we finally bit the bullet and committed to an API to interact with global bpf variables through <code>CollectionSpec.Variables</code> and <code>CollectionSpec.Variables</code>. We've published a small guide over on <a href="https://ebpf-go.dev/concepts/global-variables">ebpf-go.dev/concepts/global-variables</a> that details how to use them, so we're not going to reiterate here.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/cilium/ebpf/commit/e439d37e580e2d66e98f2b987f8ba0c295231439"><code>e439d37</code></a> prog: fix shadowing log size variable in verifier log retry loop</li>
<li><a href="https://github.com/cilium/ebpf/commit/228bb4e23714d7e133485a2e19841d86ed4c58dd"><code>228bb4e</code></a> examples: tcx: use Variable API</li>
<li><a href="https://github.com/cilium/ebpf/commit/580ff21224aa5b260a287fdd301541d5e11ce9b3"><code>580ff21</code></a> bpf2go: generate Go types used in global variables</li>
<li><a href="https://github.com/cilium/ebpf/commit/1e8f0798aac96c105a3fc849cb4a315b8917d1cb"><code>1e8f079</code></a> bpf2go: generate assignment structs for Variables and VariableSpecs</li>
<li><a href="https://github.com/cilium/ebpf/commit/c37b7afe4394b5c7fbd507faf50cb03b11af0a56"><code>c37b7af</code></a> bpf2go: test: remove unused typesEqualComparer function</li>
<li><a href="https://github.com/cilium/ebpf/commit/97cfce5d54c360fd9df3a854f422f34f1ffe1573"><code>97cfce5</code></a> map: automatically set CPUMap MaxEntries based on possible CPUs</li>
<li><a href="https://github.com/cilium/ebpf/commit/e8b05c5ff29b9d3a71199c91efdfe07bce52cec9"><code>e8b05c5</code></a> prog: add ProgramOptions.LogSizeStart to obtain full log after verifier bug</li>
<li><a href="https://github.com/cilium/ebpf/commit/f2831062a1f49c984adfe973a866d2ce77c0b066"><code>f283106</code></a> internal: add Between function for clamping a value between min and max</li>
<li><a href="https://github.com/cilium/ebpf/commit/6546014c10e632f3dd84035f14b95a3e6518e0db"><code>6546014</code></a> README.md: add pin package to the overview</li>
<li><a href="https://github.com/cilium/ebpf/commit/60405bb8b32b7c0af93c5209ce736442f8da7070"><code>60405bb</code></a> examples: annotate ringbuf and perf event arrays with value type information</li>
<li>Additional commits viewable in <a href="https://github.com/cilium/ebpf/compare/v0.16.0...v0.17.1">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/cilium/ebpf&package-manager=go_modules&previous-version=0.16.0&new-version=0.17.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

github-actions[bot]: ## Reviewer Checklist
:mag: Each of these sections need to be checked by the reviewer of the PR :mag::
If something doesn't apply please check the box and add a justification if the reason is non obvious.

- [ ] Is the PR title satisfactory? Is this part of a larger feature and should be grouped using `> Changelog`?
- [ ] PR description is clear and complete. It [Links to relevant issue][1] as well as docs and UI issues
- [ ] This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as an image registry)
- [ ] IPv6 is taken into account (.e.g: no string concatenation of host port)
- [ ] Tests (Unit test, E2E tests, manual test on universal and k8s)
    - Don't forget `ci/` labels to run additional/fewer tests
- [ ] Does this contain a change that needs to be notified to users? In this case, [`UPGRADE.md`](../blob/master/UPGRADE.md) should be updated.
- [ ] Does it need to be backported according to the [backporting policy](../blob/master/CONTRIBUTING.md#backporting)? ([this](https://github.com/kumahq/kuma/actions/workflows/auto-backport.yaml) GH action will add "backport" label based on these [file globs](https://github.com/kumahq/kuma/blob/master/.github/workflows/auto-backport.yaml#L6), if you want to prevent it from adding the "backport" label use [no-backport-autolabel](https://github.com/kumahq/kuma/blob/master/.github/workflows/auto-backport.yaml#L8) label)

[1]: https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword
<!-- Sticky Pull Request CommentPR reviewer checklist -->

Patch:
diff --git a/deployments/charts/kuma/README.md b/deployments/charts/kuma/README.md
index 90b7cccb5..224873ea7 100644
--- a/deployments/charts/kuma/README.md
+++ b/deployments/charts/kuma/README.md
@@ -207,7 +207,7 @@ A Helm chart for the Kuma Control Plane
 | kumactl.image.tag | string | `nil` | The kumactl image tag. When not specified, the value is copied from global.tag |
 | kubectl.image.registry | string | `"docker.io"` | The kubectl image registry |
 | kubectl.image.repository | string | `"bitnami/kubectl"` | The kubectl image repository |
-| kubectl.image.tag | string | `"1.31.4"` | The kubectl image tag |
+| kubectl.image.tag | string | `"1.32.0"` | The kubectl image tag |
 | hooks.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node selector for the HELM hooks |
 | hooks.tolerations | list | `[]` | Tolerations for the HELM hooks |
 | hooks.podSecurityContext | object | `{"runAsNonRoot":true}` | Security context at the pod level for crd/webhook/ns |
diff --git a/deployments/charts/kuma/values.yaml b/deployments/charts/kuma/values.yaml
index ecc781485..e765d6137 100644
--- a/deployments/charts/kuma/values.yaml
+++ b/deployments/charts/kuma/values.yaml
@@ -695,7 +695,7 @@ kubectl:
     # -- The kubectl image repository
     repository: bitnami/kubectl
     # -- The kubectl image tag
-    tag: "1.31.4"
+    tag: "1.32.0"
 hooks:
   # -- Node selector for the HELM hooks
   nodeSelector:
diff --git a/docs/generated/raw/helm-values.yaml b/docs/generated/raw/helm-values.yaml
index ecc781485..e765d6137 100644
--- a/docs/generated/raw/helm-values.yaml
+++ b/docs/generated/raw/helm-values.yaml
@@ -695,7 +695,7 @@ kubectl:
     # -- The kubectl image repository
     repository: bitnami/kubectl
     # -- The kubectl image tag
-    tag: "1.31.4"
+    tag: "1.32.0"
 hooks:
   # -- Node selector for the HELM hooks
   nodeSelector:
diff --git a/go.mod b/go.mod
index 56b0cb569..c387cd73d 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/Nordix/simple-ipam v1.0.0
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
 	github.com/bakito/go-log-logr-adapter v0.0.3-0.20231211113354-bfa42fa7e121
-	github.com/cilium/ebpf v0.16.0
+	github.com/cilium/ebpf v0.17.1
 	github.com/containernetworking/cni v1.2.3
 	github.com/containernetworking/plugins v1.6.1
 	github.com/emicklei/go-restful/v3 v3.12.1
@@ -26,7 +26,7 @@ require (
 	github.com/google/go-cmp v0.6.0
 	github.com/google/uuid v1.6.0
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
-	github.com/gruntwork-io/terratest v0.48.0
+	github.com/gruntwork-io/terratest v0.48.1
 	github.com/hoisie/mustache v0.0.0-20160804235033-6375acf62c69
 	github.com/jackc/pgx/v5 v5.7.1
 	github.com/josephburnett/jd/v2 v2.0.0-20230813234251-7b2e87c80934
@@ -36,7 +36,7 @@ require (
 	github.com/miekg/dns v1.1.62
 	github.com/moby/sys/mountinfo v0.7.2
 	github.com/natefinch/atomic v1.0.1
-	github.com/onsi/ginkgo/v2 v2.22.0
+	github.com/onsi/ginkgo/v2 v2.22.1
 	github.com/onsi/gomega v1.36.1
 	github.com/patrickmn/go-cache v2.1.0+incompatible
 	github.com/pkg/errors v0.9.1
@@ -73,7 +73,7 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576
 	google.golang.org/grpc v1.69.0
-	google.golang.org/protobuf v1.36.0
+	google.golang.org/protobuf v1.36.1
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	helm.sh/helm/v3 v3.16.4
 	k8s.io/api v0.32.0
@@ -176,7 +176,7 @@ require (
 	github.com/gonvenience/ytbx v1.4.4 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db // indirect
+	github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad // indirect
 	github.com/gorilla/websocket v1.5.1 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 // indirect
 	github.com/gruntwork-io/go-commons v0.8.0 // indirect
@@ -253,11 +253,11 @@ require (
 	go.uber.org/atomic v1.10.0 // indirect
 	golang.org/x/crypto v0.31.0 // indirect
 	golang.org/x/exp v0.0.0-20240904232852-e7e105dedf7e // indirect
-	golang.org/x/mod v0.21.0 // indirect
+	golang.org/x/mod v0.22.0 // indirect
 	golang.org/x/oauth2 v0.24.0 // indirect
 	golang.org/x/term v0.27.0 // indirect
 	golang.org/x/time v0.8.0 // indirect
-	golang.org/x/tools v0.26.0 // indirect
+	golang.org/x/tools v0.28.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
diff --git a/go.sum b/go.sum
index 6cea4bbf5..d9549feca 100644
--- a/go.sum
+++ b/go.sum
@@ -119,8 +119,8 @@ github.com/census-instrumentation/opencensus-proto v0.4.1 h1:iKLQ0xPNFxR/2hzXZMr
 github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cilium/ebpf v0.16.0 h1:+BiEnHL6Z7lXnlGUsXQPPAE7+kenAd4ES8MQ5min0Ok=
-github.com/cilium/ebpf v0.16.0/go.mod h1:L7u2Blt2jMM/vLAVgjxluxtBKlz3/GWjB0dMOEngfwE=
+github.com/cilium/ebpf v0.17.1 h1:G8mzU81R2JA1nE5/8SRubzqvBMmAmri2VL8BIZPWvV0=
+github.com/cilium/ebpf v0.17.1/go.mod h1:vay2FaYSmIlv3r8dNACd4mW/OCaZLJKJOo+IHBvCIO8=
 github.com/cncf/xds/go v0.0.0-20240905190251-b4127c9b8d78 h1:QVw89YDxXxEe+l8gU8ETbOasdwEV+avkR75ZzsVV9WI=
 github.com/cncf/xds/go v0.0.0-20240905190251-b4127c9b8d78/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
@@ -237,8 +237,8 @@ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad h1:a6HEuzUHeKH6hwfN/ZoQgRgVIWFJljSWa/zetS2WTvg=
+github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
@@ -251,8 +251,8 @@ github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 h1:TmHmbvxPmaegwhDubVz0lICL0J5
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0/go.mod h1:qztMSjm835F2bXf+5HKAPIS5qsmQDqZna/PgVt4rWtI=
 github.com/gruntwork-io/go-commons v0.8.0 h1:k/yypwrPqSeYHevLlEDmvmgQzcyTwrlZGRaxEM6G0ro=
 github.com/gruntwork-io/go-commons v0.8.0/go.mod h1:gtp0yTtIBExIZp7vyIV9I0XQkVwiQZze678hvDXof78=
-github.com/gruntwork-io/terratest v0.48.0 h1:OoqJYAnBxejInn7TPizFGJNMCFvPHbiWNS3hGFKdHhA=
-github.com/gruntwork-io/terratest v0.48.0/go.mod h1:U2EQW4Odlz75XJUH16Kqkr9c93p+ZZtkpVez7GkZFa4=
+github.com/gruntwork-io/terratest v0.48.1 h1:pnydDjkWbZCUYXvQkr24y21fBo8PfJC5hRGdwbl1eXM=
+github.com/gruntwork-io/terratest v0.48.1/go.mod h1:U2EQW4Odlz75XJUH16Kqkr9c93p+ZZtkpVez7GkZFa4=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -378,8 +378,8 @@ github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
 github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
-github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/ginkgo/v2 v2.22.1 h1:QW7tbJAUDyVDVOM5dFa7qaybo+CRfR7bemlQUN6Z8aM=
+github.com/onsi/ginkgo/v2 v2.22.1/go.mod h1:S6aTpoRsSq2cZOd+pssHAlKW/Q/jZt6cPrPlnj4a1xM=
 github.com/onsi/gomega v1.36.1 h1:bJDPBO7ibjxcbHMgSCoo4Yj18UWbKDlLwX1x9sybDcw=
 github.com/onsi/gomega v1.36.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -539,8 +539,8 @@ golang.org/x/exp v0.0.0-20240904232852-e7e105dedf7e h1:I88y4caeGeuDQxgdoFPUq097j
 golang.org/x/exp v0.0.0-20240904232852-e7e105dedf7e/go.mod h1:akd2r19cwCdwSwWeIdzYQGa/EZZyqcOdwWiwj5L5eKQ=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
-golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
+golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -585,8 +585,8 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ=
-golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
+golang.org/x/tools v0.28.0 h1:WuB6qZ4RPCQo5aP3WdKZS7i595EdWqWR8vqJTlwTVK8=
+golang.org/x/tools v0.28.0/go.mod h1:dcIOrVd3mfQKTgrDVQHqCPMWy6lnhfhtX3hLXYVLfRw=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -601,8 +601,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
 google.golang.org/grpc v1.69.0 h1:quSiOM1GJPmPH5XtU+BCoVXcDVJJAzNcoyfC2cCjGkI=
 google.golang.org/grpc v1.69.0/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
-google.golang.org/protobuf v1.36.0 h1:mjIs9gYtt56AzC4ZaffQuh88TZurBGhIJMBZGSxNerQ=
-google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
+google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
diff --git a/mk/dependencies/deps.lock b/mk/dependencies/deps.lock
index 3101f2bcb..1c2dfba52 100644
--- a/mk/dependencies/deps.lock
+++ b/mk/dependencies/deps.lock
@@ -1,1 +1,1 @@
-3eb5d667201f601438755d6ed935301b4eec721b
+acc400697b78e893585e39c43c83f113b033a00f
diff --git a/mk/dependencies/go-deps.versions b/mk/dependencies/go-deps.versions
index c0afe5131..9574fbfd8 100644
--- a/mk/dependencies/go-deps.versions
+++ b/mk/dependencies/go-deps.versions
@@ -3,7 +3,7 @@ google.golang.org/protobuf/cmd/protoc-gen-go@v1.28.1
 google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.1.0
 github.com/chrusty/protoc-gen-jsonschema/cmd/protoc-gen-jsonschema@v0.0.0-20230606235304-e35f2ad05c0c
 github.com/envoyproxy/protoc-gen-validate@v1.1.0
-github.com/onsi/ginkgo/v2/ginkgo@v2.22.0
+github.com/onsi/ginkgo/v2/ginkgo@v2.22.1
 sigs.k8s.io/controller-tools/cmd/controller-gen@v0.16.5
 github.com/mikefarah/yq/v4@v4.30.8
 github.com/norwoodj/helm-docs/cmd/helm-docs@v1.11.0
diff --git a/tools/releases/dockerfiles/kuma-init.Dockerfile b/tools/releases/dockerfiles/kuma-init.Dockerfile
index 4d2a7b760..4cfd95c19 100644
--- a/tools/releases/dockerfiles/kuma-init.Dockerfile
+++ b/tools/releases/dockerfiles/kuma-init.Dockerfile
@@ -1,4 +1,4 @@
-FROM gcr.io/k8s-staging-build-image/distroless-iptables:v0.6.5
+FROM gcr.io/k8s-staging-build-image/distroless-iptables:v0.6.6
 ARG ARCH
 
 COPY /build/artifacts-linux-$ARCH/kumactl/kumactl /usr/bin


Test patch:
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml
index ecc781485..e765d6137 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml
@@ -695,7 +695,7 @@ kubectl:
     # -- The kubectl image repository
     repository: bitnami/kubectl
     # -- The kubectl image tag
-    tag: "1.31.4"
+    tag: "1.32.0"
 hooks:
   # -- Node selector for the HELM hooks
   nodeSelector: