[gokulb04]

Summary

This fork was forked from flant/shell-operator in early 2023 and never updated — it had drifted 316 commits behind upstream main. That staleness is what caused the critical CVEs on golang.org/x/net flagged in the au-com-1-percs-devops-critical-cves remediation plan (row #11, infoblox/tags-operator image): the fork's go.mod was still pinned to golang.org/x/net v0.4.0, long after upstream itself moved on.

This PR rebases our 3 Infoblox-specific commits onto current upstream main, rather than hand-patching the stale base:

• 7c752d7 Add Jenkinsfile (Infoblox CI)
• 3cd3a34 Rename branch to main in jenkinsfile
• db59cad Added certwatcher to reload certs in webhook

Two commits from the original fork are not carried forward because upstream had already independently fixed/superseded them:

• The "Mutating Webhook bugfix" commit's actual code change (merging IncludeSnapshotsFrom for KubernetesMutating/KubernetesConversion bindings) is already present upstream under their refactored htypes package — same fix, just a different type-package name now.
• Its Dockerfile changes (newer kubectl, perl-utils, yq) are superseded by upstream's current Dockerfile, which already uses a newer kubectl (v1.35.8 vs our old v1.23.6), and no longer installs perl-utils at all or yq.

The cert-watcher commit (db59cad) is the one genuine Infoblox feature this fork adds beyond upstream: it swaps static tls.LoadX509KeyPair for sigs.k8s.io/controller-runtime/pkg/certwatcher so the webhook server picks up a cert-manager-renewed certificate without a pod restart. I reapplied this by hand against upstream's current, substantially-reworked webhook/server/server.go (upstream added graceful Shutdown(), a sync.Mutex-guarded server lifecycle, and switched off logrus to their own deckhouse/pkg/log in the 3 years since) — the automatic 3-way merge silently mis-resolved a line here, so I rewrote the function by hand rather than trust it.

What else moved for free

Since this rebases onto current upstream rather than patching the old base in place, this also picks up ~3 years of upstream's own fixes:

• golang.org/x/net is now whatever upstream currently pins (fixes the flagged CVE)
• Base images moved from golang:1.19-alpine3.16/alpine:3.16 (EOL) to Deckhouse's current container-factory images (Go 1.26.4 / Alpine 3.22)
• Internal JSON/jq filtering moved from CGO-linked libjq to the pure-Go itchyny/gojq — removes a C-library linking dependency entirely (the bundled /usr/bin/jq CLI binary for hook scripts to shell out to is unaffected, still present)
• perl-utils is no longer installed in the runtime image at all

Validation performed

• go build ./... — clean
• go vet ./... — clean
• go test ./... — all packages pass, including pkg/webhook/server (Test_ServerStart exercises certwatcher.New() with real test certs, not just a compile check)
• golangci-lint v2.11.4 (upstream's own CI-pinned version, --build-tags integration,test) — 0 issues
• Production Dockerfile builds successfully — confirmed registry.deckhouse.io base images are reachable and pull correctly
• Built image runs correctly: shell-operator version (confirms itchyny/gojq jq engine active), shell-operator --help, kubectl version --client (v1.35.8) all verified live

Known gap / out of scope here

The base-image registry (registry.deckhouse.io) is a new external dependency this rebase introduces versus the old Dockerfile (which pulled from flant/jq and plain golang/alpine on Docker Hub). I've confirmed it's reachable from my own sandbox, but this should be re-verified from Infoblox's actual Jenkins CI before merging, since that's a different network path than what I tested from.