Drop containerd by moving to helm v3.21.3

[dimitri-nicolo]

Description

Cherry-pick of master's 3fce8aca0 ("chore(deps): bump helm to v3.21.3 and oras-go to v2.6.2 to drop vulnerable containerd", #5100), to remove containerd from the operator on this branch instead of bumping it again.

containerd isn't used here. It arrives via pkg/render/istio → helm's pkg/action → helm's OCI pkg/registry → containerd/remotes. That render code only uses helm as a local template renderer — it never contacts a registry — but pkg/action imports pkg/registry unconditionally, so containerd is linked into the binary on a path nothing can reach. helm v3.21.3 swapped containerd for oras-go/v2, so moving to it drops containerd entirely.

This branch is the furthest behind of the three, so this is the heaviest of the set. Reviewers should weigh it on that basis rather than by analogy to the v1.42 pick.

1. It needs a Go toolchain lift

helm v3.21.3 declares go 1.26.0; this branch builds with Go 1.25.7, so go mod tidy refuses outright:

helm.sh/helm/v3@v3.21.3 requires go >= 1.26.0 (running go 1.25.7; GOTOOLCHAIN=local)

There is no way around this by picking a lower helm — v3.21.3 is the only containerd-free release, and everything from v3.21.1 up requires Go 1.26:

helm	go directive	containerd in go.mod
v3.20.0 – v3.21.0	1.25.0	yes
v3.21.1, v3.21.2	1.26.0	yes
v3.21.3	1.26.0	no

GO_BUILD_VER and the build image do not change. Instead CONTAINERIZED gains one line — -e GOTOOLCHAIN=go1.26.4+auto — letting the container fetch the newer toolchain, and go.mod's directive moves to go 1.26.0. This is the same arrangement release-v1.40 already runs (it builds with the Go 1.25.12 image and a go 1.26.5 directive), so it's an established pattern on a release branch, not a new one.

2. It's a two-minor k8s jump

helm v3.21.3 requires client-go v0.36.2, and controller-runtime has to move with it:

	before	after
helm	v3.19.5	v3.21.3
controller-runtime	v0.22.5	v0.24.1
k8s.io/{api,client-go,apimachinery,apiserver,apiextensions-apiserver,kube-aggregator}	v0.34.3	v0.36.2
oras-go/v2	v2.6.0	v2.6.2
containerd	v1.7.29 + 3 more	gone

oras-go goes to v2.6.2 rather than the v2.6.1 tidy selects, to match the CVE-2026-50151 / CVE-2026-50163 pin the other branches carry.

These can't be split into separate buildable commits: k8s.io/api v0.36 removed scheduling/v1alpha1, which helm v3.19.5's k8s.io/kubectl still imports, and controller-runtime v0.22.5 doesn't support client-go v0.36.

Verified

• go build ./... passes under Go 1.26.4. No code changes were needed, despite the two-minor controller-runtime jump.
• containerd drops to 0 linked packages and leaves go.mod entirely.
• go test ./pkg/render/istio/... (the only helm consumer) passes.
• go test ./pkg/... behaves identically to pristine release-v1.41: every package passes on both trees except pkg/controller/installation, which hits go test's default 600s timeout on both alike. CI runs ginkgo rather than go test, so that timeout is an artifact of the local invocation, not a regression. Diffed against a clean checkout of the branch.

Companion PRs

• release-v1.42: Drop containerd by moving to helm v3.21.3 #5172 — the cheap one. That branch is already on controller-runtime v0.24.1 / client-go v0.36.3, so only helm and oras-go move (+43/-55).
• release-v1.40: Drop containerd by moving to helm v3.21.3 #5168 — mid-weight. Carries controller-runtime v0.23.3 → v0.24.1 and k8s.io v0.35.7 → v0.36.2, no Go change (+83/-98).

If the Go toolchain lift isn't wanted on this branch, the alternative is to keep bumping containerd here as advisories land — it's unreachable code, so exposure is limited either way. That's a reasonable call to make for v1.41 specifically, and it doesn't affect the other two PRs.

Release Note

None

[Copilot]

Pull request overview

This PR updates the operator’s Go module graph to remove the vulnerable github.com/containerd/containerd dependency by upgrading Helm to v3.21.3 (and aligning required Kubernetes/controller-runtime versions), and adjusts the containerized build to use an auto-fetched Go 1.26 toolchain to satisfy Helm’s go 1.26 requirement.

Changes:

• Add GOTOOLCHAIN=go1.26.4+auto to the containerized build environment in the Makefile.
• Lift go.mod’s go directive to 1.26.0 and bump Helm to v3.21.3.
• Align transitive dependency floors (notably k8s.io/* to v0.36.2 and controller-runtime to v0.24.1) and update go.sum accordingly.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
Makefile	Sets GOTOOLCHAIN for containerized builds so the build image can fetch Go 1.26 automatically.
go.mod	Raises the Go directive to 1.26 and bumps Helm + required k8s/controller-runtime versions to match.
go.sum	Refreshes checksums for the new dependency graph and removes github.com/containerd/containerd sums.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[dimitri-nicolo]

Closing in favour of #5176.

This PR needed Go 1.26 on a branch that builds with Go 1.25.7, and we do not want to move release-v1.41 to Go 1.26. The CI failure made the cost concrete: golangci-lint in the branch's go-build image is built with Go 1.25 and refuses to lint a module targeting 1.26 (the Go language version (go1.25) used to build golangci-lint is lower than the targeted Go version (1.26.0)). That is fixable — release-v1.40 works around it with a separate CALICO_BUILD_LINT image — but it only papers over the fact that the operator binary would then be compiled by Go 1.26.4 via GOTOOLCHAIN.

There is no smaller helm that achieves the containerd removal: v3.21.3 is the only containerd-free release and every helm from v3.21.1 on declares go 1.26.0.

#5176 instead takes everything that is reachable under Go 1.25 — oras-go v2.6.0 → v2.6.2 (10 advisories → 0), helm v3.19.5 → v3.20.2 (chart extraction path traversal), containerd v1.7.29 → v1.7.34, and the k8s/controller-runtime floor those require. containerd stays, with three CRI-checkpoint advisories that only the helm v3.21.3 route can clear.