Repository: knative/pkg
Pull request #2479 (2022-04-05 13:16:28)

Add `NewProxyAutoTLSTransport` and `DialTLSWithBackOff` to support TLS proxy
Part of: https://github.com/knative/serving/issues/12503
PoC: https://github.com/knative/serving/pull/12815

This patch `NewProxyAutoTLSTransport` which is `NewProxyAutoTransport + TLS config.
Current proxy does not support TLS but it needs for https://github.com/knative/serving/issues/12503.

`DialTLSWithBackOff` is also `DialWithBackOff` + TLS config. It needs
`newH2Transport` which handles HTTP2 with TLS.

/cc @evankanderson @skonto @rhuss 

knative-prow[bot]: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative/pkg/pull/2479#" title="Author self-approved">nak3</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **vagababov** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @vagababov` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative%2Fpkg).

<details open>
Needs approval from an approver in each of these files:

- **[network/OWNERS](https://github.com/knative/pkg/blob/main/network/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["vagababov"]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative/pkg/pull/2479?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) Report
> Merging [#2479](https://codecov.io/gh/knative/pkg/pull/2479?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) (c6acdcb) into [main](https://codecov.io/gh/knative/pkg/commit/c2f1f3ec291f9fcd94819639e119d0158fa5e01c?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) (c2f1f3e) will **increase** coverage by `0.42%`.
> The diff coverage is `40.54%`.

```diff
@@            Coverage Diff             @@
##             main    #2479      +/-   ##
==========================================
+ Coverage   81.32%   81.74%   +0.42%     
==========================================
  Files         163      163              
  Lines        6499     9653    +3154     
==========================================
+ Hits         5285     7891    +2606     
- Misses        981     1527     +546     
- Partials      233      235       +2     
```


| [Impacted Files](https://codecov.io/gh/knative/pkg/pull/2479?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) | Coverage Δ | |
|---|---|---|
| [network/h2c.go](https://codecov.io/gh/knative/pkg/pull/2479/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-bmV0d29yay9oMmMuZ28=) | `16.66% <0.00%> (-8.34%)` | :arrow_down: |
| [network/transports.go](https://codecov.io/gh/knative/pkg/pull/2479/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-bmV0d29yay90cmFuc3BvcnRzLmdv) | `71.95% <50.00%> (-14.10%)` | :arrow_down: |
| [webhook/certificates/resources/secret.go](https://codecov.io/gh/knative/pkg/pull/2479/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-d2ViaG9vay9jZXJ0aWZpY2F0ZXMvcmVzb3VyY2VzL3NlY3JldC5nbw==) | `81.25% <0.00%> (-4.47%)` | :arrow_down: |
| [injection/informers.go](https://codecov.io/gh/knative/pkg/pull/2479/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-aW5qZWN0aW9uL2luZm9ybWVycy5nbw==) | `64.70% <0.00%> (-4.05%)` | :arrow_down: |
| [metrics/workqueue.go](https://codecov.io/gh/knative/pkg/pull/2479/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-bWV0cmljcy93b3JrcXVldWUuZ28=) | `80.82% <0.00%> (-2.90%)` | :arrow_down: |
| [apis/duck/v1alpha1/binding\_types.go](https://codecov.io/gh/knative/pkg/pull/2479/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-YXBpcy9kdWNrL3YxYWxwaGExL2JpbmRpbmdfdHlwZXMuZ28=) | `90.47% <0.00%> (-2.86%)` | :arrow_down: |
| [metrics/config.go](https://codecov.io/gh/knative/pkg/pull/2479/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-bWV0cmljcy9jb25maWcuZ28=) | `75.55% <0.00%> (-2.80%)` | :arrow_down: |
| [webhook/certificates/resources/certs.go](https://codecov.io/gh/knative/pkg/pull/2479/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-d2ViaG9vay9jZXJ0aWZpY2F0ZXMvcmVzb3VyY2VzL2NlcnRzLmdv) | `58.92% <0.00%> (-2.70%)` | :arrow_down: |
| [configmap/hash-gen/main.go](https://codecov.io/gh/knative/pkg/pull/2479/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-Y29uZmlnbWFwL2hhc2gtZ2VuL21haW4uZ28=) | `62.96% <0.00%> (-2.50%)` | :arrow_down: |
| [apis/duck/v1/podspec\_types.go](https://codecov.io/gh/knative/pkg/pull/2479/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative#diff-YXBpcy9kdWNrL3YxL3BvZHNwZWNfdHlwZXMuZ28=) | `93.10% <0.00%> (-2.14%)` | :arrow_down: |
| ... and [155 more](https://codecov.io/gh/knative/pkg/pull/2479/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/knative/pkg/pull/2479?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/knative/pkg/pull/2479?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative). Last update [4f42bf4...c6acdcb](https://codecov.io/gh/knative/pkg/pull/2479?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative).

evankanderson: I think we need a transition plan for "current config" to "always secure". We can end up with any of the following transition scenarios:

* Insecure activator -> secure `queue-proxy`
* Secure activator -> insecure `queue-proxy`

I think we want to not serve errors during the update process, which means we either need a way to ensure we know the ordering, or have the ability to fall back to insecure during the transition and then "lock the gate" with a second config change 

Full disclosure: I'd like to turn this on for every Knative user, all the time, in some future release.

Patch:
diff --git a/.github/workflows/knative-downstream.yaml b/.github/workflows/knative-downstream.yaml
index 13122eb06..16d5ac3c1 100644
--- a/.github/workflows/knative-downstream.yaml
+++ b/.github/workflows/knative-downstream.yaml
@@ -83,7 +83,7 @@ jobs:
 
     - name: Install Dependencies
       run: |
-        go get github.com/google/go-licenses
+        go install github.com/google/go-licenses@latest
 
     - name: Checkout upstream at ${{ github.base_ref }}
       uses: actions/checkout@v2
diff --git a/.github/workflows/knative-releasability.yaml b/.github/workflows/knative-releasability.yaml
index 2a6f1b26b..afb55aa05 100644
--- a/.github/workflows/knative-releasability.yaml
+++ b/.github/workflows/knative-releasability.yaml
@@ -14,12 +14,15 @@ on:
       releaseFamily:
         description: 'Release? (vX.Y)'
         required: false
+        default: 'v1.4'
       moduleReleaseFamily:
         description: 'Module Release? (vX.Y)'
         required: false
+        default: 'v0.31'
       slackChannel:
         description: 'Slack Channel? (release-#)'
         required: false
+        default: 'release-1dot4'
 
 jobs:
   releasability:
diff --git a/.github/workflows/tekton-downstream.yaml b/.github/workflows/tekton-downstream.yaml
index 27504416c..0aad336dc 100644
--- a/.github/workflows/tekton-downstream.yaml
+++ b/.github/workflows/tekton-downstream.yaml
@@ -41,14 +41,14 @@ jobs:
 
     steps:
 
-    - name: Set up Go 1.16.x
+    - name: Set up Go 1.17.x
       uses: actions/setup-go@v2
       with:
-        go-version: 1.16.x
+        go-version: 1.17.x
 
     - name: Install Dependencies
       run: |
-        go get github.com/google/go-licenses
+        go install github.com/google/go-licenses@latest
 
     - name: Checkout Upstream
       uses: actions/checkout@v2
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
index 9dbd056f4..844da59bd 100644
--- a/OWNERS_ALIASES
+++ b/OWNERS_ALIASES
@@ -54,6 +54,7 @@ aliases:
   - lberk
   eventing-wg-leads:
   - lionelvillard
+  - pierDipi
   eventing-writers:
   - akashrv
   - aliok
@@ -63,7 +64,6 @@ aliases:
   - matzew
   - odacremolbap
   - pierDipi
-  - vaikas
   knative-admin:
   - csantanapr
   - dprotaso
@@ -71,6 +71,7 @@ aliases:
   - ikvmw
   - itsmurugappan
   - julz
+  - knative-automation
   - knative-prow-releaser-robot
   - knative-prow-robot
   - knative-prow-updater-robot
@@ -87,6 +88,7 @@ aliases:
   - ikvmw
   - nader-ziada
   knative-robots:
+  - knative-automation
   - knative-prow-releaser-robot
   - knative-prow-robot
   - knative-prow-updater-robot
diff --git a/leaderelection/context.go b/leaderelection/context.go
index 9e4a91822..f52733ea3 100644
--- a/leaderelection/context.go
+++ b/leaderelection/context.go
@@ -273,7 +273,7 @@ func (ue *unopposedElector) Run(ctx context.Context) {
 
 func (ue *unopposedElector) InitialBuckets() []reconciler.Bucket {
 	return []reconciler.Bucket{
-		reconciler.UniversalBucket(),
+		ue.bkt,
 	}
 }
 
diff --git a/network/h2c.go b/network/h2c.go
index f950b9c34..6cc0fa733 100644
--- a/network/h2c.go
+++ b/network/h2c.go
@@ -54,3 +54,16 @@ func newH2CTransport(disableCompression bool) http.RoundTripper {
 		},
 	}
 }
+
+// newH2Transport constructs a neew H2 transport. That transport will handles HTTPS traffic
+// with TLS config.
+func newH2Transport(disableCompression bool, tlsConf *tls.Config) http.RoundTripper {
+	return &http2.Transport{
+		DisableCompression: disableCompression,
+		DialTLS: func(netw, addr string, tlsConf *tls.Config) (net.Conn, error) {
+			return DialTLSWithBackOff(context.Background(),
+				netw, addr, tlsConf)
+		},
+		TLSClientConfig: tlsConf,
+	}
+}
diff --git a/network/transports.go b/network/transports.go
index 26ce82395..d96eda117 100644
--- a/network/transports.go
+++ b/network/transports.go
@@ -18,6 +18,7 @@ package network
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"net"
@@ -45,7 +46,7 @@ func newAutoTransport(v1, v2 http.RoundTripper) http.RoundTripper {
 	})
 }
 
-const sleepTO = 30 * time.Millisecond
+const sleep = 30 * time.Millisecond
 
 var backOffTemplate = wait.Backoff{
 	Duration: 50 * time.Millisecond,
@@ -63,11 +64,21 @@ var DialWithBackOff = NewBackoffDialer(backOffTemplate)
 // between tries.
 func NewBackoffDialer(backoffConfig wait.Backoff) func(context.Context, string, string) (net.Conn, error) {
 	return func(ctx context.Context, network, address string) (net.Conn, error) {
-		return dialBackOffHelper(ctx, network, address, backoffConfig, sleepTO)
+		return dialBackOffHelper(ctx, network, address, backoffConfig, nil)
 	}
 }
 
-func dialBackOffHelper(ctx context.Context, network, address string, bo wait.Backoff, sleep time.Duration) (net.Conn, error) {
+// DialTLSWithBackOff is same with DialWithBackOff but takes tls config.
+var DialTLSWithBackOff = NewTLSBackoffDialer(backOffTemplate)
+
+// NewTLSBackoffDialer is same with NewBackoffDialer but takes tls config.
+func NewTLSBackoffDialer(backoffConfig wait.Backoff) func(context.Context, string, string, *tls.Config) (net.Conn, error) {
+	return func(ctx context.Context, network, address string, tlsConf *tls.Config) (net.Conn, error) {
+		return dialBackOffHelper(ctx, network, address, backoffConfig, tlsConf)
+	}
+}
+
+func dialBackOffHelper(ctx context.Context, network, address string, bo wait.Backoff, tlsConf *tls.Config) (net.Conn, error) {
 	dialer := &net.Dialer{
 		Timeout:   bo.Duration, // Initial duration.
 		KeepAlive: 5 * time.Second,
@@ -75,7 +86,15 @@ func dialBackOffHelper(ctx context.Context, network, address string, bo wait.Bac
 	}
 	start := time.Now()
 	for {
-		c, err := dialer.DialContext(ctx, network, address)
+		var (
+			c   net.Conn
+			err error
+		)
+		if tlsConf == nil {
+			c, err = dialer.DialContext(ctx, network, address)
+		} else {
+			c, err = tls.DialWithDialer(dialer, network, address, tlsConf)
+		}
 		if err != nil {
 			var errNet net.Error
 			if errors.As(err, &errNet) && errNet.Timeout() {
@@ -105,6 +124,19 @@ func newHTTPTransport(disableKeepAlives, disableCompression bool, maxIdle, maxId
 	return transport
 }
 
+func newHTTPSTransport(disableKeepAlives, disableCompression bool, maxIdle, maxIdlePerHost int, tlsConf *tls.Config) http.RoundTripper {
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	transport.DialContext = DialWithBackOff
+	transport.DisableKeepAlives = disableKeepAlives
+	transport.MaxIdleConns = maxIdle
+	transport.MaxIdleConnsPerHost = maxIdlePerHost
+	transport.ForceAttemptHTTP2 = false
+	transport.DisableCompression = disableCompression
+
+	transport.TLSClientConfig = tlsConf
+	return transport
+}
+
 // NewProberTransport creates a RoundTripper that is useful for probing,
 // since it will not cache connections.
 func NewProberTransport() http.RoundTripper {
@@ -113,6 +145,13 @@ func NewProberTransport() http.RoundTripper {
 		NewH2CTransport())
 }
 
+// NewProxyAutoTLSTransport is same with NewProxyAutoTransport but it has tls.Config to create HTTPS request.
+func NewProxyAutoTLSTransport(maxIdle, maxIdlePerHost int, tlsConf *tls.Config) http.RoundTripper {
+	return newAutoTransport(
+		newHTTPSTransport(false /*disable keep-alives*/, true /*disable auto-compression*/, maxIdle, maxIdlePerHost, tlsConf),
+		newH2Transport(true /*disable auto-compression*/, tlsConf))
+}
+
 // NewAutoTransport creates a RoundTripper that can use appropriate transport
 // based on the request's HTTP version.
 func NewAutoTransport(maxIdle, maxIdlePerHost int) http.RoundTripper {
diff --git a/version/version.go b/version/version.go
index b304f2b0a..39e34464b 100644
--- a/version/version.go
+++ b/version/version.go
@@ -33,7 +33,7 @@ const (
 	// NOTE: If you are changing this line, please also update the minimum kubernetes
 	// version listed here:
 	// https://github.com/knative/docs/blob/mkdocs/docs/snippets/prerequisites.md
-	defaultMinimumVersion = "v1.21.0"
+	defaultMinimumVersion = "v1.22.0"
 )
 
 func getMinimumVersion() string {


Test patch:
diff --git a/leaderelection/context_test.go b/leaderelection/context_test.go
index ab8878158..7467cee91 100644
--- a/leaderelection/context_test.go
+++ b/leaderelection/context_test.go
@@ -384,8 +384,10 @@ func TestStandardBucketName(t *testing.T) {
 }
 
 func TestUnopposedElectorInitialBucket(t *testing.T) {
-	u := &unopposedElector{}
-	if u.InitialBuckets()[0] != reconciler.UniversalBucket() {
-		t.Errorf("expected the unopposedElector to return the universal bucket")
+	u := &unopposedElector{
+		bkt: reconciler.UniversalBucket(),
+	}
+	if diff := cmp.Diff(u.InitialBuckets(), []reconciler.Bucket{reconciler.UniversalBucket()}); diff != "" {
+		t.Errorf("unexpected u.InitialBuckets() (-want,+got): %s", diff)
 	}
 }
diff --git a/network/transports_test.go b/network/transports_test.go
index cdc62baac..7691e1628 100644
--- a/network/transports_test.go
+++ b/network/transports_test.go
@@ -18,6 +18,9 @@ package network
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -26,6 +29,11 @@ import (
 	"k8s.io/apimachinery/pkg/util/sets"
 )
 
+const (
+	timeoutErr           = "timed out dialing"
+	connectionRefusedErr = "connection refused"
+)
+
 func TestHTTPRoundTripper(t *testing.T) {
 	wants := sets.NewString()
 	frt := func(key string) http.RoundTripper {
@@ -69,34 +77,66 @@ func TestHTTPRoundTripper(t *testing.T) {
 }
 
 func TestDialWithBackoff(t *testing.T) {
+	// Make the test short.
+	bo := backOffTemplate
+	bo.Steps = 2
+
 	// Nobody's listening on a random port. Usually.
-	c, err := DialWithBackOff(context.Background(), "tcp4", "127.0.0.1:41482")
-	if err == nil {
-		c.Close()
-		t.Error("Unexpected success dialing")
+	c, err := dialBackOffHelper(context.Background(), "tcp4", "127.0.0.1:41482", bo, nil)
+	verifyFailedConnection(t, c, err, connectionRefusedErr)
+
+	// Timeout. Use special testing IP address.
+	c, err = dialBackOffHelper(context.Background(), "tcp4", "198.18.0.254:8888", bo, nil)
+	verifyFailedConnection(t, c, err, timeoutErr)
+
+	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	defer s.Close()
+
+	c, err = DialWithBackOff(context.Background(), "tcp4", strings.TrimPrefix(s.URL, "http://"))
+	if err != nil {
+		t.Fatal("Dial error =", err)
 	}
+	c.Close()
+}
 
+func TestDialTLSWithBackoff(t *testing.T) {
 	// Make the test short.
 	bo := backOffTemplate
 	bo.Steps = 2
 
-	// Timeout. Use special testing IP address.
-	c, err = dialBackOffHelper(context.Background(), "tcp4", "198.18.0.254:8888", bo, sleepTO)
-	if err == nil {
-		c.Close()
-		t.Error("Unexpected success dialing")
-	}
-	const expectedErrPrefix = "timed out dialing"
-	if err == nil || !strings.HasPrefix(err.Error(), expectedErrPrefix) {
-		t.Errorf("Error = %v, want: %s(...)", err, expectedErrPrefix)
+	tlsConf := &tls.Config{
+		InsecureSkipVerify: false,
+		ServerName:         "example.com",
+		MinVersion:         tls.VersionTLS12,
 	}
 
-	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	// Nobody's listening on a random port. Usually.
+	c, err := dialBackOffHelper(context.Background(), "tcp4", "127.0.0.1:41482", bo, tlsConf)
+	verifyFailedConnection(t, c, err, connectionRefusedErr)
+
+	// Timeout. Use special testing IP address.
+	c, err = dialBackOffHelper(context.Background(), "tcp4", "198.18.0.254:8888", bo, tlsConf)
+	verifyFailedConnection(t, c, err, timeoutErr)
+
+	s := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
 	defer s.Close()
 
-	c, err = DialWithBackOff(context.Background(), "tcp4", strings.TrimPrefix(s.URL, "http://"))
+	rootCAs := x509.NewCertPool()
+	rootCAs.AddCert(s.Certificate())
+	tlsConf.RootCAs = rootCAs
+
+	c, err = DialTLSWithBackOff(context.Background(), "tcp4", strings.TrimPrefix(s.URL, "https://"), tlsConf)
 	if err != nil {
 		t.Fatal("Dial error =", err)
 	}
 	c.Close()
 }
+
+func verifyFailedConnection(t *testing.T, c net.Conn, err error, prefix string) {
+	if err == nil {
+		c.Close()
+		t.Error("Unexpected success dialing")
+	} else if !strings.Contains(err.Error(), prefix) {
+		t.Errorf("Error = %v, want: %s(...)", err, prefix)
+	}
+}
diff --git a/version/version_test.go b/version/version_test.go
index fa3c1efc4..6fa6d09d8 100644
--- a/version/version_test.go
+++ b/version/version_test.go
@@ -40,16 +40,16 @@ func TestVersionCheck(t *testing.T) {
 		wantError       bool
 	}{{
 		name:          "greater version (patch)",
-		actualVersion: &testVersioner{version: "v1.21.1"},
+		actualVersion: &testVersioner{version: "v1.22.1"},
 	}, {
 		name:          "greater version (patch), no v",
-		actualVersion: &testVersioner{version: "1.21.1"},
+		actualVersion: &testVersioner{version: "1.22.1"},
 	}, {
 		name:          "greater version (patch), pre-release",
-		actualVersion: &testVersioner{version: "1.21.1-kpn-065dce"},
+		actualVersion: &testVersioner{version: "1.22.1-kpn-065dce"},
 	}, {
 		name:          "greater version (patch), pre-release with build",
-		actualVersion: &testVersioner{version: "1.21.1-1095+9689d22dc3121e-dirty"},
+		actualVersion: &testVersioner{version: "1.22.1-1095+9689d22dc3121e-dirty"},
 	}, {
 		name:            "greater version (patch), pre-release, envvar override",
 		actualVersion:   &testVersioner{version: "1.15.11-kpn-065dce"},
@@ -60,16 +60,16 @@ func TestVersionCheck(t *testing.T) {
 		versionOverride: "1.15.11-0",
 	}, {
 		name:          "greater version (minor)",
-		actualVersion: &testVersioner{version: "v1.22.0"},
+		actualVersion: &testVersioner{version: "v1.23.0"},
 	}, {
 		name:          "same version",
-		actualVersion: &testVersioner{version: "v1.21.0"},
+		actualVersion: &testVersioner{version: "v1.22.0"},
 	}, {
 		name:          "same version with build",
-		actualVersion: &testVersioner{version: "v1.21.0+k3s.1"},
+		actualVersion: &testVersioner{version: "v1.22.0+k3s.1"},
 	}, {
 		name:          "same version with pre-release",
-		actualVersion: &testVersioner{version: "v1.21.0-k3s.1"},
+		actualVersion: &testVersioner{version: "v1.22.0-k3s.1"},
 	}, {
 		name:          "smaller version",
 		actualVersion: &testVersioner{version: "v1.14.3"},