[chore] Update operator to Go 1.25

[OpinionatedHeron]

Description

Updated operator to Go 1.25.

Based on this change - I also updated the CONTROLLER_TOOLS_VERSION to v0.17.0 as it was causing issues when trying to make test and lint. This is the latest version of this tool. Also updated the go.mod and go.sum files to ensure they are compatible with the latest version of go by running go mod tidy.

Which issue(s) does this PR fix or relate to

RHIDP-8979

PR acceptance criteria

• Tests
• Documentation

How to test changes / Special notes to the reviewer

I tested changes by running make test and make lint - both ran without errors. Also built a local docker image to ensure that the image would build with the updated version without causing issues. All ran without noticeable errors.

[rhdh-qodo-merge]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 RHIDP-8979 - Partially compliant Compliant requirements: Bump the operator to Go 1.25 to stay current with security and bug fixes. Keep the operator build/test/lint working after the upgrade. Non-compliant requirements: Use the available Go toolset image (UBI9 go-toolset 1.25) as the basis for the upgrade (as applicable to the build/release process). Requires further human verification: Confirm the build/release pipeline (Dockerfile/OSBS/Konflux/etc.) is actually using the UBI9 go-toolset 1.25 image/tag intended by the ticket. Confirm CI runs with the Go 1.25 toolchain (and does not override/downgrade it).

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🔒 No security concerns identified

⚡ Recommended focus areas for review Version Mismatch The PR bumps core Kubernetes modules (k8s.io/*) to v0.35.0 while keeping sigs.k8s.io/controller-runtime at v0.19.4. Please validate these are compatible together (and with the cluster versions you target), since mismatched Kubernetes library sets can cause subtle compile/runtime issues. k8s.io/api v0.35.0 k8s.io/apiextensions-apiserver v0.35.0 k8s.io/apimachinery v0.35.0 k8s.io/client-go v0.35.0 k8s.io/klog/v2 v2.130.1 k8s.io/utils v0.0.0-20260108192941-914a6e750570 sigs.k8s.io/controller-runtime v0.19.4 Build Toolchain The toolchain directive pins builds to go1.25.5. Ensure all build environments (local dev, CI, container builds) support fetching/using that exact toolchain version; otherwise builds may fail even if go 1.25.x is installed. go 1.25.0 toolchain go1.25.5

📄 References redhat-developer/rhdh-operator/docs/developer.md [20-31] redhat-developer/rhdh-operator/integration_tests/README.md [1-46] redhat-developer/rhdh-operator/tests/e2e/README.md [1-12] redhat-developer/rhdh-operator/tests/e2e/README.md [39-50] redhat-developer/rhdh-operator/tests/e2e/README.md [102-111] redhat-developer/rhdh-operator/tests/e2e/README.md [51-57] redhat-developer/rhdh-operator/tests/e2e/README.md [123-125] redhat-developer/rhdh-operator/tests/e2e/README.md [58-60]

[rhdh-qodo-merge]

PR Type

(Describe updated until commit 9365075)

Enhancement

---

Description

• Update Go version from 1.24 to 1.25 with toolchain compatibility

• Update controller-gen tool from v0.14.0 to v0.20.0 for CRD generation

• Update all Go dependencies to compatible versions via go mod tidy

• Regenerate bundle and installer manifests with updated tooling

---

File Walkthrough

	Relevant files
Dependencies	2 files go.mod Update Go version and dependencies to 1.25                              +54/-41  go.sum Update dependency checksums for Go 1.25                                    +115/-83
Configuration changes	2 files Makefile Update controller-gen and Go version constraints                  +1/-1      renovate.json Update Go constraint to 1.25                                                          +1/-1
Documentation	1 files README.md Update Go prerequisite version to 1.25                                      +1/-1
Miscellaneous	7 files rhdh.redhat.com_backstages.yaml Regenerate CRD with controller-gen v0.20.0                              +10/-49  install.yaml Regenerate installer manifest with updated tooling              +10/-49  install.yaml Regenerate installer manifest with updated tooling              +10/-49  rhdh.redhat.com_backstages.yaml Regenerate bundle CRD with controller-gen v0.20.0                +10/-49  rhdh.redhat.com_backstages.yaml Regenerate bundle CRD with controller-gen v0.20.0                +10/-49  backstage-operator.clusterserviceversion.yaml Update creation timestamp in operator metadata                      +1/-1      backstage-operator.clusterserviceversion.yaml Update creation timestamp in operator metadata                      +1/-1

---

[rhdh-qodo-merge]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Organization best practice	Update stale version comment Update or generalize this comment to match the new Kubernetes dependency versions (now v0.35.0) so readers aren’t misled about what versions are being pinned and why. go.mod [129-130] -// Replace directives to pin k8s.io dependencies to v0.31.3 +// Replace directives to pin k8s.io dependencies to v0.35.0 // This is necessary because: Apply / Chat Suggestion importance[1-10]: 6 __ Why: Relevant best practice - Keep documentation/comments synchronized with implementation changes (avoid stale version pin explanations).	Low
General	Consolidate YAML library dependencies Consolidate YAML dependencies in go.mod by removing the direct dependency on gopkg.in/yaml.v2, as it is a transitive dependency of sigs.k8s.io/yaml. go.mod [15-122] - gopkg.in/yaml.v2 v2.4.0 k8s.io/api v0.35.0 k8s.io/apiextensions-apiserver v0.35.0 ... sigs.k8s.io/kustomize/kyaml v0.18.1 sigs.k8s.io/yaml v1.6.0 ) require ( cel.dev/expr v0.24.0 // indirect ... go.uber.org/zap v1.26.0 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect golang.org/x/net v0.49.0 // indirect golang.org/x/oauth2 v0.30.0 // indirect ... gopkg.in/yaml.v3 v3.0.1 // indirect k8s.io/apiserver v0.35.0 // indirect k8s.io/component-base v0.35.0 // indirect ... [To ensure code accuracy, apply this suggestion manually] Suggestion importance[1-10]: 5 __ Why: The suggestion correctly identifies multiple YAML dependencies and proposes a valid cleanup by removing a redundant direct dependency on gopkg.in/yaml.v2, which improves dependency hygiene.	Low
Update

[github-actions]

⚠️ Files changed in bundle and installer generation!

Those changes to the operator bundle/installer manifests should have been pushed automatically to your PR branch.

NOTE: If the PR checks are stuck after this additional commit, manually close the PR and immediately reopen it to trigger the checks again.

[github-actions]

PR images are available:

1. https://quay.io/rhdh-community/operator:0.9.0-pr-2127-9b204ad
2. https://quay.io/rhdh-community/operator-bundle:0.9.0-pr-2127-9b204ad
3. https://quay.io/rhdh-community/operator-catalog:0.9.0-pr-2127-9b204ad

[github-actions]

PR images are available:

1. https://quay.io/rhdh-community/operator:0.9.0-pr-2127-95a98a0
2. https://quay.io/rhdh-community/operator-bundle:0.9.0-pr-2127-95a98a0
3. https://quay.io/rhdh-community/operator-catalog:0.9.0-pr-2127-95a98a0

[github-actions]

PR images are available:

1. https://quay.io/rhdh-community/operator:0.9.0-pr-2127-1ad0327
2. https://quay.io/rhdh-community/operator-bundle:0.9.0-pr-2127-1ad0327
3. https://quay.io/rhdh-community/operator-catalog:0.9.0-pr-2127-1ad0327

[github-actions]

⚠️ Files changed in bundle and installer generation!

Those changes to the operator bundle/installer manifests should have been pushed automatically to your PR branch.

NOTE: If the PR checks are stuck after this additional commit, manually close the PR and immediately reopen it to trigger the checks again.

[rhdh-qodo-merge]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 RHIDP-8979 - Partially compliant Compliant requirements: Bump the operator to Go 1.25 to keep up with security and bug fixes. Non-compliant requirements: Use an available Go toolset image/release stream that provides Go 1.25 (per the referenced UBI9 go-toolset). Requires further human verification: Ensure the operator continues to build/test successfully after the Go bump. Confirm the container build uses the intended Go toolset image/version (and that it is available in the target build environment/CI).

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🔒 No security concerns identified

⚡ Recommended focus areas for review Toolchain Pin The module now pins a specific toolchain version via toolchain go1.25.6. This may cause unexpected behavior/failures in environments that do not support auto-downloading toolchains or require a different patch level. Verify CI/build container images provide Go 1.25.6 (or that toolchain download is allowed) and consider whether pinning to a patch version is desired for downstream consumers. go 1.25 toolchain go1.25.6 Version Mismatch The CRD annotation controller-gen.kubebuilder.io/version is updated to v0.20.0, while the PR description mentions updating controller tools to v0.17.0. Validate the repository’s actual controller-gen/controller-tools version used in make generate/CRD generation so that the annotation, tooling, and generated manifests remain consistent and reproducible. kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: backstages.rhdh.redhat.com

📄 References redhat-developer/rhdh-operator/bundle/backstage.io/tests/scorecard/config.yaml [5-47] redhat-developer/rhdh-operator/config/scorecard/patches/basic.config.yaml [1-11] redhat-developer/rhdh-operator/config/scorecard/patches/olm.config.yaml [1-40] redhat-developer/rhdh-operator/config/scorecard/patches/olm.config.yaml [41-50] redhat-developer/rhdh-operator/bundle/backstage.io/tests/scorecard/config.yaml [58-67] redhat-developer/rhdh-operator/bundle/backstage.io/tests/scorecard/config.yaml [48-57] redhat-developer/rhdh-operator/bundle/rhdh/tests/scorecard/config.yaml [58-67] redhat-developer/rhdh-operator/config/manager/deployment.yaml [11-40]

[rhdh-qodo-merge]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Organization best practice	Fix outdated version comment Update or remove this comment because the PR changes Kubernetes-related dependencies to v0.35.0, making the pinned version note misleading. go.mod [127-128] -// Replace directives to pin k8s.io dependencies to v0.31.3 +// Replace directives to pin k8s.io dependencies to v0.35.0 // This is necessary because: Apply / Chat Suggestion importance[1-10]: 6 __ Why: Relevant best practice - Keep documentation/comments synchronized with implementation changes (versions/defaults) to avoid user confusion.	Low
More

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

PR images are available:

1. https://quay.io/rhdh-community/operator:0.9.0-pr-2127-cf90b81
2. https://quay.io/rhdh-community/operator-bundle:0.9.0-pr-2127-cf90b81
3. https://quay.io/rhdh-community/operator-catalog:0.9.0-pr-2127-cf90b81

[rm3l]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rm3l

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [rm3l]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment