chore: update all dependencies to latest versions

[bryantbiggs]

This PR brings the entire repository up to date — Go toolchain, all module dependencies, Docker base images, and GitHub Actions — and takes the opportunity to resolve several long-standing structural problems in the test infrastructure that have made the project harder to maintain and contributed to the dependency debt in the first place.

Why this matters

The k8s.io/kubernetes monorepo problem (and why it kept coming back)

The root cause of the stale dependency situation was a structural one: both test modules depended on k8s.io/kubernetes, the full Kubernetes monorepo. That single dependency dragged in 29–32 replace directives per module, all of which had to be kept manually in sync with each other and with the monorepo version. Every time any of those packages released a new version, the replace directives would fall out of sync and go mod tidy would either fail or produce an inconsistent module graph. This is why Dependabot PRs in this repo tend to stack up — updating one group of deps often conflicts with the replace directive web.

This PR removes k8s.io/kubernetes from both test modules entirely. The e2e module goes from 114 lines and 29 replace directives to 65 lines and zero. The integration module goes from 201 lines and 32 replace directives to 95 lines and zero. Future dependency updates — whether manual or via Dependabot — will be straightforward.

The integration tests weren't actually testing the auth webhook

The integration tests existed to verify that the IAM authentication webhook works end-to-end: a client presents a token, the kube-apiserver calls the webhook, the webhook calls STS, and access is granted or denied based on the IAM role mapping. That flow was silently broken.

The root cause: execRestCfg (the client config used to test IAM-authenticated access) had both TLSClientConfig.CertData and ExecProvider set simultaneously. When both are present, client-go uses mTLS — the client certificate satisfies authentication before the webhook is ever called. The ExecProvider (which invokes aws-iam-authenticator token) was ignored entirely. The tests were passing because the client cert auth succeeded, not because the IAM webhook worked.

This PR fixes that by clearing the cert fields from execRestCfg before attaching the ExecProvider. The webhook is now actually exercised on every test run — STS calls are visible in the test output, and the test correctly fails with "identity is not mapped" when a valid AWS role is not configured, as expected.

The go:linkname hack is gone

The old integration test framework used //go:linkname startEtcd k8s.io/kubernetes/test/integration/framework.startEtcd to call an unexported function in the monorepo. This was fragile (any internal refactor of the monorepo would silently break it), relied on unsafe, and was the primary reason k8s.io/kubernetes couldn't be removed. The migration to sigs.k8s.io/controller-runtime/pkg/envtest eliminates this entirely — envtest is the standard, supported way to run integration tests against a real kube-apiserver in the Kubernetes ecosystem.

go.work for clean multi-module management

The three Go modules in this repo (root, tests/e2e, tests/integration) previously relied on replace directives to reference each other locally. go.work is the idiomatic solution for this since Go 1.18 — it handles cross-module references at the workspace level without polluting individual go.mod files. go.work.sum is committed so the workspace is immediately usable after git clone with no extra setup.

What changed

Dependencies

• Go toolchain: 1.25.7 → 1.26.1
• k8s.io/*: → v0.35.2 across all modules
• AWS SDK v2: all packages updated to latest
• All other direct dependencies updated to latest compatible versions
• Docker: go-runner eks-1-34 → eks-1-35, minimal-base-nonroot → 2026-03-10
• GitHub Actions: checkout v5→v6, golangci-lint-action v9.0→v9.2 (linter v2.4→v2.11), goreleaser-action v6→v7

Test infrastructure

• k8s.io/kubernetes removed from tests/e2e/go.mod and tests/integration/go.mod
• All replace directives removed (was 29 in e2e, 32 in integration)
• go.work added at repo root; go.work* removed from .gitignore
• Integration tests migrated to controller-runtime/pkg/envtest
• Integration test auth flow fixed (ExecProvider now actually used)
• Server and healthz ports allocated dynamically in tests (no more hardcoded 21362/21363 risk under parallel execution)
• config.Config.HealthPort field added; server.Run uses it with a default of 21363 (fully backward compatible)
• os.MkdirTemp error handling fixed
• context.TODO() → context.Background() in server initialization
• testEnv.Stop() errors logged rather than suppressed
• setup-envtest pinned to 1.35.0 for reproducible binary downloads

Running the integration tests locally

# One-time setup
go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
export KUBEBUILDER_ASSETS=$(setup-envtest use 1.35.0 -p path)

# Build the authenticator binary
make bin/aws-iam-authenticator

# Run
go test -v -run TestServer ./tests/integration/server/ \
  -authenticator-binary-path=./_output/bin/aws-iam-authenticator \
  -test-artifacts-dir=/tmp/iam-auth-integration-test \
  -role-arn=<AWS_ROLE_ARN>

Resolves

Resolves #996
Resolves #993
Resolves #992
Resolves #991
Resolves #989
Resolves #987
Resolves #984

Test plan

• go test ./pkg/... — 157 tests, 33 packages, all passing
• go build ./... clean across all three modules
• go vet ./... clean
• golangci-lint run clean
• Integration tests pass with valid AWS credentials and role ARN

[bryantbiggs]

cc @kmala - I know its a big PR ( apologies) but it cleans up a number of outdated modules and practices which should resolve most open PRs and make maintenance easier going forward

[kmala]

Thanks a lot for this @bryantbiggs
I was making changes to fix few lint issues but this is more exhaustive and future proof.
/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryantbiggs, kmala

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [kmala]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment