Bump golang.org/x/net (#3186 )

Bumps the go_modules group with 1 update in the /test/tests/websocket directory: [golang.org/x/net](https://github.com/golang/net). Updates `golang.org/x/net` from 0.25.0 to 0.36.0 - [Commits](https://github.com/golang/net/compare/v0.25.0...v0.36.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Update release version v1.22.0 (#3270 )
2025-11-03 18:18:54 +05:30 · 2025-11-03 18:18:14 +05:30 · 2025-11-03 11:03:54 +05:30 · 2025-11-01 12:29:11 +05:30 · 2025-10-31 17:40:13 +05:30 · 2025-10-30 17:44:37 +05:30
297 changed files with 8682 additions and 5242 deletions
@@ -0,0 +1,36 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: docker
+    directories:
+      - /cmd/builder
+      - /cmd/fetcher
+      - /cmd/fission-bundle
+      - /cmd/preupgradechecks
+      - /cmd/reporter
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      docker-images:
+        patterns:
+          - "*"
+
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      go-dependencies:
+        patterns:
+          - "*"
@@ -4,39 +4,47 @@ on:
  push:
    branches:
      - main
-    paths:
-      - '**.go'
-      - go.mod
-      - go.sum
+      - '!dependabot/**'
  pull_request:
    branches:
      - main
-    paths:
-      - '**.go'
-      - go.mod
-      - go.sum
  schedule:
    - cron: "0 0 * * 0"
-  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fission-codeql-${{ github.ref }}
+  cancel-in-progress: true

 jobs:
  CodeQL-Build:
-    runs-on: ubuntu-latest
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/analyze to upload SARIF results
+    runs-on: ubuntu-24.04
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
      - name: Check out code
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: setup go
-        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@461ef6c76dfe95d5c364de2f431ddbd31a417628 # v3.26.9
+        uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
        with:
          languages: go

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@461ef6c76dfe95d5c364de2f431ddbd31a417628 # v3.26.9
+        uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
@@ -0,0 +1,31 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fission-dependency-review-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@40c09b7dc99638e5ddb0bfd91c1673effc064d8a # v4.8.1
@@ -11,25 +11,27 @@ on:
      - main
    paths:
      - 'charts/fission-all/dashboards/**.json'
-  workflow_dispatch:
+
+permissions:
+  contents: read

 jobs:
  lint-dashboards:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
      - name: Check out code
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Set up Go
-        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          go-version-file: "go.mod"

-      - name: Install dashboard linter
-        run: |
-          go get github.com/grafana/dashboard-linter
-          go install github.com/grafana/dashboard-linter
-
      - name: Run dashboard linter
        run: ./hack/lint-dashboards.sh
@@ -15,22 +15,36 @@ on:
      - "**.go"
      - go.mod
      - go.sum
-  workflow_dispatch:

 env:
-  GOLANGCI_LINT_VERSION: v1.61.0
+  GOLANGCI_LINT_VERSION: v2.6.0
  GOLANGCI_LINT_TIMEOUT: 5m

+permissions:
+  contents: read
+
+concurrency:
+  group: fission-lint-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
  lint:
-    runs-on: ubuntu-latest
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for golangci/golangci-lint-action to fetch pull requests
+    runs-on: ubuntu-24.04
    # if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
      - name: Check out code
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Set up Go
-        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          go-version-file: "go.mod"
          cache: true
@@ -41,7 +55,7 @@ jobs:
          go mod download

      - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86 # v6.1.0
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
        with:
          skip-cache: true
          version: ${{ env.GOLANGCI_LINT_VERSION }}
@@ -62,7 +76,7 @@ jobs:
        run: ./hack/runtests.sh

      - name: Upload Coverage report to CodeCov
-        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
+        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          flags: unittests
@@ -4,6 +4,7 @@ on:
  push:
    branches:
      - main
+      - '!dependabot/**'
    paths:
      - "**.go"
      - "charts/**"
@@ -19,13 +20,19 @@ on:
      - "test/**"
      - go.mod
      - go.sum
-  workflow_dispatch:

 env:
-  HELM_VERSION: v3.13.0
-  KIND_VERSION: v0.23.0
+  HELM_VERSION: v3.19.0
+  KIND_VERSION: v0.30.0
  KIND_CLUSTER_NAME: kind

+permissions:
+  contents: read
+
+concurrency:
+  group: fission-ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
  # Job to run change detection
  integration-test:
@@ -34,31 +41,36 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        kindversion: ["v1.25.16", "v1.27.13", "v1.30.0"]
-        os: [ubuntu-latest]
+        kindversion: ["v1.28.15", "v1.30.8", "v1.32.0"]
+        os: [ubuntu-24.04]
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
      - name: Checkout sources
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: setup go
-        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Checkout sources
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          repository: fission/examples
          path: examples

      - name: Helm installation
-        uses: Azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
+        uses: Azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
        with:
          version: ${{ env.HELM_VERSION }}

      - name: Kind Cluster
-        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
        with:
          node_image: kindest/node:${{ matrix.kindversion }}
          version: ${{ env.KIND_VERSION }}
@@ -79,12 +91,12 @@ jobs:

      - name: Install Skaffold
        run: |
-          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.13.2/skaffold-linux-amd64
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.14.0/skaffold-linux-amd64
          sudo install skaffold /usr/local/bin/
          skaffold version

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
        with:
          install-only: true
          version: "~> v2"
@@ -145,7 +157,7 @@ jobs:
      - name: Archive fission dump
        timeout-minutes: 10
        if: ${{ failure() || cancelled() }}
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: fission-dump/*.zip
@@ -154,7 +166,7 @@ jobs:
      - name: Archive prometheus dump
        timeout-minutes: 10
        if: ${{ always() }}
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: prom-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: /tmp/prometheus/*
@@ -163,7 +175,7 @@ jobs:
      - name: Archive kind logs
        timeout-minutes: 10
        if: ${{ always() }}
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
          path: kind-logs/*
@@ -178,30 +190,35 @@ jobs:
      fail-fast: false
      matrix:
        kindversion: ["v1.19.16"]
-        os: [ubuntu-latest]
+        os: [ubuntu-24.04]
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
      - name: Checkout sources
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: setup go
-        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Checkout sources
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          repository: fission/examples
          path: examples

      - name: Helm installation
-        uses: Azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
+        uses: Azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
        with:
          version: ${{ env.HELM_VERSION }}

      - name: Kind Cluster
-        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
        with:
          node_image: kindest/node:${{ matrix.kindversion }}
          version: ${{ env.KIND_VERSION }}
@@ -222,12 +239,12 @@ jobs:

      - name: Install Skaffold
        run: |
-          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.13.2/skaffold-linux-amd64
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.14.0/skaffold-linux-amd64
          sudo install skaffold /usr/local/bin/
          skaffold version

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
        with:
          install-only: true
          version: "~> v2"
@@ -291,7 +308,7 @@ jobs:
      - name: Archive fission dump
        timeout-minutes: 10
        if: ${{ failure() || cancelled() }}
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: fission-dump/*.zip
@@ -300,7 +317,7 @@ jobs:
      - name: Archive prometheus dump
        timeout-minutes: 10
        if: ${{ always() }}
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: prom-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: /tmp/prometheus/*
@@ -309,7 +326,7 @@ jobs:
      - name: Archive kind logs
        timeout-minutes: 10
        if: ${{ always() }}
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
          path: kind-logs/*
@@ -6,21 +6,36 @@ on:
      - v2.**

 env:
-  KIND_VERSION: v0.23.0
-  KIND_NODE_IMAGE_TAG: v1.25.16
+  KIND_VERSION: v0.30.0
+  KIND_NODE_IMAGE_TAG: v1.28.15
  KIND_CLUSTER_NAME: kind
+  COSIGN_VERSION: v3.0.2

 jobs:
  create-draft-release:
-    runs-on: ubuntu-latest
+    name: Create Draft Release with Goreleaser
+    outputs:
+      hashes: ${{ steps.binary.outputs.hashes }}
+      ghcr_images: ${{ steps.image.outputs.ghcr_images }}
+      version: ${{ steps.get_version.outputs.VERSION }}
+    permissions:
+      contents: write # for goreleaser/goreleaser-action to create a GitHub release
+      packages: write # for goreleaser/goreleaser-action to upload artifacts to GitHub Packages
+      id-token: write # for cosign to sign the image and binary
+    runs-on: ubuntu-24.04
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
      - name: Check out code
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0

      - name: Setup go
-        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          go-version-file: "go.mod"
          cache: true
@@ -30,13 +45,13 @@ jobs:
        run: echo "VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_OUTPUT

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
        with:
          install-only: true
          version: "~> v2"

      - name: Kind Cluster
-        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
        with:
          node_image: kindest/node:${{ env.KIND_NODE_IMAGE_TAG }}
          version: ${{ env.KIND_VERSION }}
@@ -44,34 +59,24 @@ jobs:
          cluster_name: ${{ env.KIND_CLUSTER_NAME }}

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0

      - name: Login to ghcr.io
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

-      - name: Login to docker.io
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
      - name: Install Cosign
-        uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
        with:
-          cosign-release: "v2.2.1"
+          cosign-release: ${{ env.COSIGN_VERSION }}

      - name: Check cosign install!
        run: cosign version

-      - name: Write cosign signing key to disk
-        run: 'echo "$KEY" > cosign.key'
-        shell: bash
-        env:
-          KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+      - uses: anchore/sbom-action/download-syft@8e94d75ddd33f69f691467e42275782e4bfefe84 #v0.20.9

      - name: Generate yaml for manifest, Minikube and Openshift installation
        run: ${GITHUB_WORKSPACE}/hack/build-yaml.sh $VERSION
@@ -80,14 +85,191 @@ jobs:
        shell: bash

      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
+        id: goreleaser
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
        with:
          version: "~> v2"
          args: release
        env:
-          COSIGN_PWD: ${{ secrets.COSIGN_PWD }}
          GORELEASER_CURRENT_TAG: ${{ steps.get_version.outputs.VERSION }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DOCKER_CLI_EXPERIMENTAL: "enabled"

-    #ToDo - Verify and upload releases
+      - name: Generate binary hashes
+        id: binary
+        env:
+          ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
+        run: |
+          set -euo pipefail
+
+          checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
+          echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT"
+
+      - name: Image digest
+        id: image
+        env:
+          ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
+        run: |
+          set -euo pipefail
+          image_and_digest=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Docker Manifest") | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {name} + {digest} | join("@") | sub("^sha256:";"")' | grep -v latest)
+          ghcr_images=$(echo "${image_and_digest}" | grep ghcr.io | jq -R -s -c '
+            split("\n")
+            | map(select(. != ""))
+            | map(
+                split("@")
+                | {
+                    "image": .[0] | split(":")[0],
+                    "checksum": .[1]
+                  }
+              )')
+          echo "ghcr_images=$ghcr_images" >> "$GITHUB_OUTPUT"
+
+  binary-provenance:
+    name: Create Binary Provenance
+    needs: [create-draft-release]
+    permissions:
+      actions: read # To read the workflow path.
+      id-token: write # To sign the provenance.
+      contents: write # To add assets to a release.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0  # Do not use commit hash
+    with:
+      base64-subjects: "${{ needs.create-draft-release.outputs.hashes }}"
+      provenance-name: "fission_${{ needs.create-draft-release.outputs.version }}.intoto.jsonl"
+      upload-assets: true # upload to a new release
+      draft-release: true # create a draft release
+
+  image-provenance-ghcr:
+    name: Create Image Provenance
+    needs: [create-draft-release]
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
+    permissions:
+      actions: read
+      id-token: write
+      packages: write
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0 # Do not use commit hash
+    with:
+      image: ${{ fromJson(toJson(matrix)).image }}
+      digest: ${{ fromJson(toJson(matrix)).checksum }}
+      registry-username: ${{ github.actor }}
+    secrets:
+      registry-password: ${{ secrets.GITHUB_TOKEN }}
+
+  image-sbom-ghcr:
+    name: Create SBOM for container images
+    # Goreleaser does not support generating SBOM for container images.
+    needs: [create-draft-release]
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
+    permissions:
+      actions: write
+      id-token: write
+      packages: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run Trivy in fs mode to generate SBOM
+        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
+        with:
+          scan-type: "fs"
+          format: "spdx-json"
+          output: "spdx.sbom.json"
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        with:
+          cosign-release: ${{ env.COSIGN_VERSION }}
+      - name: Sign image and sbom
+        env:
+          IMAGE: ${{ fromJson(toJson(matrix)).image }}
+          DIGEST: ${{ fromJson(toJson(matrix)).checksum }}
+        run: |
+          #!/usr/bin/env bash
+          set -euo pipefail
+          cosign attach sbom --sbom spdx.sbom.json $IMAGE@$DIGEST
+          cosign sign -a git_sha=$GITHUB_SHA --attachment sbom $IMAGE@$DIGEST --yes
+
+  binary-provenance-verification-with-slsa-verifier:
+    name : Verify Binary Provenance
+    needs: [create-draft-release, binary-provenance]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write # To download the assets from draft release.
+    steps:
+      - name: Install the verifier
+        uses: slsa-framework/slsa-verifier/actions/installer@ea584f4502babc6f60d9bc799dbbb13c1caa9ee6 # v2.7.1
+
+      - name: Download assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PROVENANCE: ${{ needs.binary-provenance.outputs.provenance-name }}
+          VERSION: ${{ needs.create-draft-release.outputs.version }}
+        run: |
+          set -euo pipefail
+          echo "repo=$GITHUB_REPOSITORY"
+          echo "ref=$VERSION"
+          gh -R "$GITHUB_REPOSITORY" release download "$VERSION" -p "$PROVENANCE"
+
+      - name: Verify assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CHECKSUMS: ${{ needs.create-draft-release.outputs.hashes }}
+          PROVENANCE: ${{ needs.binary-provenance.outputs.provenance-name }}
+          VERSION: ${{ needs.create-draft-release.outputs.version }}
+        run: |
+          set -euo pipefail
+          echo "CHECKSUMS=$CHECKSUMS"
+          echo "PROVENANCE=$PROVENANCE"
+          checksums=$(echo "$CHECKSUMS" | base64 -d)
+          while read -r line; do
+              fn=$(echo $line | cut -d ' ' -f2)
+              echo "Verifying $fn"
+              gh -R "$GITHUB_REPOSITORY" release download "$VERSION" -p "$fn"
+              slsa-verifier verify-artifact --provenance-path "$PROVENANCE" \
+                                            --source-uri "github.com/$GITHUB_REPOSITORY" \
+                                            --source-tag "$VERSION" \
+                                            "$fn"
+          done <<<"$checksums"
+
+  image-provenance-verification-with-cosign:
+    name: Verify Image Provenance
+    needs: [create-draft-release, image-provenance-ghcr]
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
+    runs-on: ubuntu-24.04
+    permissions: read-all
+    steps:
+      - name: Login
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        with:
+          cosign-release: ${{ env.COSIGN_VERSION }}
+
+      - name: Verify image
+        env:
+          IMAGE: ${{ fromJson(toJson(matrix)).image }}
+          DIGEST: ${{ fromJson(toJson(matrix)).checksum }}
+        run: |
+          echo "Verifying $IMAGE@$DIGEST"
+          cosign verify-attestation \
+             --type slsaprovenance \
+             --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+             --certificate-identity-regexp '^https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v[0-9]+.[0-9]+.[0-9]+$' \
+             $IMAGE@$DIGEST
@@ -0,0 +1,78 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '41 18 * * 0'
+  push:
+    branches: [ "main" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-24.04
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: "Checkout code"
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v3.pre.node20
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+        with:
+          sarif_file: results.sarif
@@ -4,6 +4,7 @@ on:
  push:
    branches:
      - main
+      - '!dependabot/**'
    paths:
      - "**.go"
      - "charts/**"
@@ -19,13 +20,19 @@ on:
      - "test/**"
      - go.mod
      - go.sum
-  workflow_dispatch:

 env:
-  HELM_VERSION: v3.13.0
-  KIND_VERSION: v0.23.0
+  HELM_VERSION: v3.19.0
+  KIND_VERSION: v0.26.0
  KIND_CLUSTER_NAME: kind

+permissions:
+  contents: read
+
+concurrency:
+  group: fission-upgrade-test-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
  upgrade-test:
    runs-on: ${{ matrix.os }}
@@ -33,32 +40,37 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        kindversion: ["v1.25.16"]
-        os: [ubuntu-latest]
+        kindversion: ["v1.28.15"]
+        os: [ubuntu-24.04]
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
      - name: Checkout action sources
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Setup go
-        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Setup Helm
-        uses: Azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
+        uses: Azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
        with:
          version: ${{ env.HELM_VERSION }}

      - name: Setup Kind Cluster
-        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
        with:
          node_image: kindest/node:${{ matrix.kindversion }}
          version: ${{ env.KIND_VERSION }}
          cluster_name: ${{ env.KIND_CLUSTER_NAME }}

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
        with:
          install-only: true
          version: "~> v2"
@@ -106,7 +118,7 @@ jobs:

      - name: Archive fission dump
        if: ${{ failure() || cancelled() }}
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: fission-dump/*.zip
@@ -114,7 +126,7 @@ jobs:

      - name: Archive kind logs
        if: ${{ always() }}
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
          path: kind-logs/*
@@ -1,35 +1,51 @@
+version: "2"
 linters:
  enable:
-    # Default linter
    - errcheck
-    - gosimple
    - govet
    - ineffassign
-    - staticcheck
-    - typecheck
-    - unused
-    # Additional linters
-    - gofmt
-    - goimports
    - misspell
    - nakedret
-    - unconvert
    - promlinter
-    # Enable in future
-    # - bodyclose
-    # - dogsled
-    # - dupl
-    # - gosec
-    # - nilerr
-    # - prealloc
-    # - revive
-    # - unparam
-    # - wrapcheck
-    # - gocritic
-linters-settings:
-  errcheck:
-    ignore: go.uber.org/zap:Sync
-  goimports:
-    # put imports beginning with prefix after 3rd-party packages;
-    # it's a comma-separated list of prefixes
-    local: github.com/fission/fission
+    - unconvert
+    - unused
+    - staticcheck
+  settings:
+    errcheck:
+      exclude-functions:
+        - (*go.uber.org/zap.Logger).Sync
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+    rules:
+      - linters:
+        - staticcheck
+        text: "QF1008"
+      - linters:
+          - staticcheck
+        text: "QF1001"
+      - linters:
+          - staticcheck
+        text: "QF1003"
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/fission/fission
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
@@ -1,11 +1,14 @@
 version: 2

+env:
+  - GHCR_REPO=ghcr.io/fission
+
 project_name: fission
 release:
  github:
    owner: fission
    name: fission
-  prerelease: true
+  prerelease: "true"
  draft: true
  header: |
    Release Highlights: https://fission.io/docs/releases/{{ .Tag }}/
@@ -75,10 +78,8 @@ dockers:
    ids:
      - builder
    image_templates:
-      - "fission/builder:latest-amd64"
-      - "fission/builder:{{ .Tag }}-amd64"
-      - "ghcr.io/fission/builder:latest-amd64"
-      - "ghcr.io/fission/builder:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/builder:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-amd64"
    dockerfile: cmd/builder/Dockerfile
    build_flag_templates:
      - "--label=org.opencontainers.image.description=The builder assists in building the fission function source code for deployment."
@@ -87,14 +88,15 @@ dockers:
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - <<: *docker-amd64
    ids:
      - fetcher
    image_templates:
-      - "fission/fetcher:latest-amd64"
-      - "fission/fetcher:{{ .Tag }}-amd64"
-      - "ghcr.io/fission/fetcher:latest-amd64"
-      - "ghcr.io/fission/fetcher:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-amd64"
    dockerfile: cmd/fetcher/Dockerfile
    build_flag_templates:
      - "--label=org.opencontainers.image.description=Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
@@ -103,14 +105,15 @@ dockers:
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - <<: *docker-amd64
    ids:
      - fission-bundle
    image_templates:
-      - "fission/fission-bundle:latest-amd64"
-      - "fission/fission-bundle:{{ .Tag }}-amd64"
-      - "ghcr.io/fission/fission-bundle:latest-amd64"
-      - "ghcr.io/fission/fission-bundle:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-amd64"
    dockerfile: cmd/fission-bundle/Dockerfile
    build_flag_templates:
      - "--label=org.opencontainers.image.description=fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
@@ -119,14 +122,15 @@ dockers:
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - <<: *docker-amd64
    ids:
      - pre-upgrade-checks
    image_templates:
-      - "fission/pre-upgrade-checks:latest-amd64"
-      - "fission/pre-upgrade-checks:{{ .Tag }}-amd64"
-      - "ghcr.io/fission/pre-upgrade-checks:latest-amd64"
-      - "ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-amd64"
    dockerfile: cmd/preupgradechecks/Dockerfile
    build_flag_templates:
      - "--label=org.opencontainers.image.description=Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
@@ -135,14 +139,15 @@ dockers:
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - <<: *docker-amd64
    ids:
      - reporter
    image_templates:
-      - "fission/reporter:latest-amd64"
-      - "fission/reporter:{{ .Tag }}-amd64"
-      - "ghcr.io/fission/reporter:latest-amd64"
-      - "ghcr.io/fission/reporter:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/reporter:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-amd64"
    dockerfile: cmd/reporter/Dockerfile
    build_flag_templates:
      - "--label=org.opencontainers.image.description=The reporter gathers information that assists in improving fission."
@@ -151,6 +156,9 @@ dockers:
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - &docker-arm64
    use: buildx
    goos: linux
@@ -158,10 +166,8 @@ dockers:
    ids:
      - builder
    image_templates:
-      - "fission/builder:latest-arm64"
-      - "fission/builder:{{ .Tag }}-arm64"
-      - "ghcr.io/fission/builder:latest-arm64"
-      - "ghcr.io/fission/builder:{{ .Tag }}-arm64"
+      - "{{ .Env.GHCR_REPO }}/builder:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-arm64"
    dockerfile: cmd/builder/Dockerfile
    build_flag_templates:
      - "--label=org.opencontainers.image.description=The builder assists in building the fission function source code for deployment."
@@ -170,14 +176,15 @@ dockers:
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - <<: *docker-arm64
    ids:
      - fetcher
    image_templates:
-      - "fission/fetcher:latest-arm64"
-      - "fission/fetcher:{{ .Tag }}-arm64"
-      - "ghcr.io/fission/fetcher:latest-arm64"
-      - "ghcr.io/fission/fetcher:{{ .Tag }}-arm64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-arm64"
    dockerfile: cmd/fetcher/Dockerfile
    build_flag_templates:
      - "--label=org.opencontainers.image.description=Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
@@ -186,14 +193,15 @@ dockers:
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - <<: *docker-arm64
    ids:
      - fission-bundle
    image_templates:
-      - "fission/fission-bundle:latest-arm64"
-      - "fission/fission-bundle:{{ .Tag }}-arm64"
-      - "ghcr.io/fission/fission-bundle:latest-arm64"
-      - "ghcr.io/fission/fission-bundle:{{ .Tag }}-arm64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-arm64"
    dockerfile: cmd/fission-bundle/Dockerfile
    build_flag_templates:
      - "--label=org.opencontainers.image.description=fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
@@ -202,14 +210,15 @@ dockers:
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - <<: *docker-arm64
    ids:
      - pre-upgrade-checks
    image_templates:
-      - "fission/pre-upgrade-checks:latest-arm64"
-      - "fission/pre-upgrade-checks:{{ .Tag }}-arm64"
-      - "ghcr.io/fission/pre-upgrade-checks:latest-arm64"
-      - "ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-arm64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-arm64"
    dockerfile: cmd/preupgradechecks/Dockerfile
    build_flag_templates:
      - "--label=org.opencontainers.image.description=Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
@@ -218,14 +227,15 @@ dockers:
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
  - <<: *docker-arm64
    ids:
      - reporter
    image_templates:
-      - "fission/reporter:latest-arm64"
-      - "fission/reporter:{{ .Tag }}-arm64"
-      - "ghcr.io/fission/reporter:latest-arm64"
-      - "ghcr.io/fission/reporter:{{ .Tag }}-arm64"
+      - "{{ .Env.GHCR_REPO }}/reporter:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-arm64"
    dockerfile: cmd/reporter/Dockerfile
    build_flag_templates:
      - "--label=org.opencontainers.image.description=The reporter gathers information that assists in improving fission."
@@ -234,95 +244,59 @@ dockers:
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
 docker_manifests:
-  - name_template: ghcr.io/fission/builder:{{ .Tag }}
+  - name_template: "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}"
    image_templates:
-      - ghcr.io/fission/builder:{{ .Tag }}-amd64
-      - ghcr.io/fission/builder:{{ .Tag }}-arm64
-  - name_template: fission/builder:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}"
    image_templates:
-      - fission/builder:{{ .Tag }}-amd64
-      - fission/builder:{{ .Tag }}-arm64
-  - name_template: ghcr.io/fission/fetcher:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}"
    image_templates:
-      - ghcr.io/fission/fetcher:{{ .Tag }}-amd64
-      - ghcr.io/fission/fetcher:{{ .Tag }}-arm64
-  - name_template: fission/fetcher:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}"
    image_templates:
-      - fission/fetcher:{{ .Tag }}-amd64
-      - fission/fetcher:{{ .Tag }}-arm64
-  - name_template: ghcr.io/fission/fission-bundle:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}"
    image_templates:
-      - ghcr.io/fission/fission-bundle:{{ .Tag }}-amd64
-      - ghcr.io/fission/fission-bundle:{{ .Tag }}-arm64
-  - name_template: fission/fission-bundle:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/builder:latest"
    image_templates:
-      - fission/fission-bundle:{{ .Tag }}-amd64
-      - fission/fission-bundle:{{ .Tag }}-arm64
-  - name_template: ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/builder:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/builder:latest-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/fetcher:latest"
    image_templates:
-      - ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-amd64
-      - ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-arm64
-  - name_template: fission/pre-upgrade-checks:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/fetcher:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:latest-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/fission-bundle:latest"
    image_templates:
-      - fission/pre-upgrade-checks:{{ .Tag }}-amd64
-      - fission/pre-upgrade-checks:{{ .Tag }}-arm64
-  - name_template: ghcr.io/fission/reporter:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest"
    image_templates:
-      - ghcr.io/fission/reporter:{{ .Tag }}-amd64
-      - ghcr.io/fission/reporter:{{ .Tag }}-arm64
-  - name_template: fission/reporter:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/reporter:latest"
    image_templates:
-      - fission/reporter:{{ .Tag }}-amd64
-      - fission/reporter:{{ .Tag }}-arm64
-  - name_template: ghcr.io/fission/builder:latest
-    image_templates:
-      - ghcr.io/fission/builder:latest-amd64
-      - ghcr.io/fission/builder:latest-arm64
-  - name_template: fission/builder:latest
-    image_templates:
-      - fission/builder:latest-amd64
-      - fission/builder:latest-arm64
-  - name_template: ghcr.io/fission/fetcher:latest
-    image_templates:
-      - ghcr.io/fission/fetcher:latest-amd64
-      - ghcr.io/fission/fetcher:latest-arm64
-  - name_template: fission/fetcher:latest
-    image_templates:
-      - fission/fetcher:latest-amd64
-      - fission/fetcher:latest-arm64
-  - name_template: ghcr.io/fission/fission-bundle:latest
-    image_templates:
-      - ghcr.io/fission/fission-bundle:latest-amd64
-      - ghcr.io/fission/fission-bundle:latest-arm64
-  - name_template: fission/fission-bundle:latest
-    image_templates:
-      - fission/fission-bundle:latest-amd64
-      - fission/fission-bundle:latest-arm64
-  - name_template: ghcr.io/fission/pre-upgrade-checks:latest
-    image_templates:
-      - ghcr.io/fission/pre-upgrade-checks:latest-amd64
-      - ghcr.io/fission/pre-upgrade-checks:latest-arm64
-  - name_template: fission/pre-upgrade-checks:latest
-    image_templates:
-      - fission/pre-upgrade-checks:latest-amd64
-      - fission/pre-upgrade-checks:latest-arm64
-  - name_template: ghcr.io/fission/reporter:latest
-    image_templates:
-      - ghcr.io/fission/reporter:latest-amd64
-      - ghcr.io/fission/reporter:latest-arm64
-  - name_template: fission/reporter:latest
-    image_templates:
-      - fission/reporter:latest-amd64
-      - fission/reporter:latest-arm64
+      - "{{ .Env.GHCR_REPO }}/reporter:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/reporter:latest-arm64"
 changelog:
  disable: true
 archives:
  - id: fission
-    builds:
+    ids:
      - fission-cli
    name_template: "{{ .ProjectName }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}"
-    format: binary
+    formats:
+      - binary
 checksum:
  name_template: "checksums.txt"
  algorithm: sha256
@@ -330,27 +304,37 @@ checksum:
 # signs the checksum file
 # https://goreleaser.com/customization/sign
 signs:
- cmd: cosign
-  artifacts: all
-  stdin: '{{ .Env.COSIGN_PWD }}'
-  output: true
-  args:
-    - sign-blob
-    - '--key=cosign.key'
-    - '--output-certificate=${certificate}'
-    - '--output-signature=${signature}'
-    - '${artifact}'
-    - '--yes' # needed for cosign 2.0.0+
+  - id: cosign-binary
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    certificate: "${artifact}.pem"
+    cmd: cosign
+    artifacts: binary
+    args:
+      - sign-blob
+      - "--output-signature=${signature}"
+      - "--output-certificate=${certificate}"
+      - "${artifact}"
+      - "--yes" # needed for cosign 2.0.0+

 # signs our docker image
 # https://goreleaser.com/customization/docker_sign
 docker_signs:
- cmd: cosign
-  artifacts: all
-  stdin: '{{ .Env.COSIGN_PWD }}'
-  output: true
-  args:
-    - 'sign'
-    - '--key=cosign.key'
-    - '${artifact}'
-    - '--yes' # needed for cosign 2.0.0+
+  - cmd: cosign
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    artifacts: all
+    args:
+      - sign
+      - "${artifact}"
+      - "--yes" # needed for cosign 2.0.0+
+
+sboms:
+  - artifacts: archive
+    id: archive
+  - artifacts: source
+    id: source
+  - artifacts: binary
+    id: binary
+  - artifacts: package
+    id: package
@@ -0,0 +1,18 @@
+repos:
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.16.3
+  hooks:
+  - id: gitleaks
+- repo: https://github.com/golangci/golangci-lint
+  rev: v1.52.2
+  hooks:
+  - id: golangci-lint
+- repo: https://github.com/jumanjihouse/pre-commit-hooks
+  rev: 3.0.0
+  hooks:
+  - id: shellcheck
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+  - id: end-of-file-fixer
+  - id: trailing-whitespace
@@ -59,23 +59,20 @@ install-fission-cli:
 	mv dist/fission-cli_$(GOOS)_$(GOARCH)_v1/fission$(FISSION-CLI-SUFFIX) /usr/local/bin/fission

 ### Codegen
-codegen: controller-gen-install
+codegen:
 	@./hack/update-codegen.sh
-	$(GOPATH)/bin/controller-gen object:headerFile="hack/boilerplate.txt" paths="./..."
+	go tool controller-gen object:headerFile="hack/boilerplate.txt" paths="./..."

 ### CRDs
-controller-gen-install:
-	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.16.3
-
-generate-crds: controller-gen-install
-	$(GOPATH)/bin/controller-gen crd \
+generate-crds:
+	go tool controller-gen crd \
 	paths=./pkg/apis/core/v1  \
 	output:crd:artifacts:config=crds/v1

 ### Webhook generation: it generates webhook configs with help of kubebuilder:webhook tag
-generate-webhooks: controller-gen-install
-	$(GOPATH)/bin/controller-gen webhook \
-	 paths=./pkg/apis/core/v1 \
+generate-webhooks:
+	go tool controller-gen webhook \
+	 paths=./pkg/webhook \
 	 output:dir=charts/fission-all/templates/webhook-server


@@ -99,12 +96,9 @@ generate-swagger-doc:
 generate-cli-docs:
 	go run tools/cmd-docs/main.go -o "../fission.io/content/en/docs/reference/fission-cli"

-install-crd-ref-docs:
-	go install github.com/elastic/crd-ref-docs@v0.1.0
-
-generate-crd-ref-docs: install-crd-ref-docs
+generate-crd-ref-docs:
 	# crd-ref-docs: https://github.com/elastic/crd-ref-docs
-	$(GOPATH)/bin/crd-ref-docs --source-path=pkg/apis/core/v1 --config=tools/crd-ref-docs/config.yaml --renderer markdown
+	go tool crd-ref-docs --source-path=pkg/apis/core/v1 --config=tools/crd-ref-docs/config.yaml --renderer markdown
 	cp tools/crd-ref-docs/header.md crd_docs.md
 	cat out.md >> crd_docs.md && rm out.md
 	mv crd_docs.md ../fission.io/content/en/docs/reference/crd-reference.md
@@ -128,10 +122,3 @@ release:
 	@./hack/release.sh $(VERSION)
 	@./hack/release-tag.sh $(VERSION)
 	@./hack/changelog.sh
-
-## Envtest
-install-envtest:
-	go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
-
-setup-envtest:
-	setup-envtest -p path use 1.23.x
@@ -36,6 +36,12 @@
  <a href="https://github.com/fission/fission">
    <img alt="GitHub Repo stars" src="https://img.shields.io/github/stars/fission/fission?style=social">
  </a>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/fission/fission">
+    <image alt="OpenSSF Scorecard" src="https://api.scorecard.dev/projects/github.com/fission/fission/badge">
+  </a>
+  <a href="https://www.bestpractices.dev/projects/4986">
+    <img src="https://www.bestpractices.dev/projects/4986/badge">
+  </a>
 </p>

 --------------
@@ -88,7 +94,7 @@ aggregation &mdash; also helps with ops on your Fission deployment.

 ```bash
  # Add the stock NodeJS env to your Fission deployment
-  $ fission env create --name nodejs --image fission/node-env
+  $ fission env create --name nodejs --image ghcr.io/fission/node-env

  # Create a function with a javascript one-liner that prints "hello world"
  $ fission function create --name hello --env nodejs --code https://raw.githubusercontent.com/fission/examples/master/nodejs/hello.js
@@ -6,12 +6,12 @@ Please refer using [latest stable release](https://github.com/fission/fission/re

 | Version | Supported          |
 | ------- | ------------------ |
-| >=1.14.x   | :white_check_mark: |
-| < 1.14.0   | :x:                |
+| >=1.20.x   | :white_check_mark: |
+| < 1.20.0   | :x:                |

 ## Reporting a Vulnerability

 Please send the details to both of us:

- Sanket Sudake sanket@infracloud.io
- Vishal Biyani vishal@infracloud.io
+- Sanket Sudake sanket[at]infracloud.io
+- Vishal Biyani vishal[at]infracloud.io
@@ -1,9 +1,9 @@
 apiVersion: v2
 name: fission-all
-version: v1.20.5
-appVersion: v1.20.5
+version: v1.22.0
+appVersion: v1.22.0
 description: Fission is a fast serverless framework for Kubernetes.
-kubeVersion: ">=1.25.0-0"
+kubeVersion: ">=1.27.0-0"
 home: https://fission.io/
 icon: https://fission.io/images/fission-logo-white.svg
 sources:
@@ -20,7 +20,7 @@ Windows:
 {{- end }}

  # Create an environment
-  $ fission env create --name nodejs --image fission/node-env --namespace {{ .Values.defaultNamespace }}
+  $ fission env create --name nodejs --image ghcr.io/fission/node-env --namespace {{ .Values.defaultNamespace }}

  # Get a hello world
  $ curl https://raw.githubusercontent.com/fission/examples/master/nodejs/hello.js > hello.js
@@ -37,38 +37,37 @@ auth:
 {{- end -}}

 {{/*
-This template generates the image name for the deployment depending on the value of "repository" field in values.yaml file.
+Helper template to construct image names with repository and tag
 */}}
-{{- define "fission-bundleImage" -}}
-{{- if .Values.repository -}}
-  {{- if eq .Values.imageTag "" -}}
-    {{ .Values.repository }}/{{ .Values.image }}
-  {{- else -}}
-    {{ .Values.repository }}/{{ .Values.image }}:{{ .Values.imageTag }}
-  {{- end }}
+{{- define "imageWithTag" -}}
+{{- $repository := index . 0 -}}
+{{- $image := index . 1 -}}
+{{- $tag := index . 2 -}}
+{{- if $repository -}}
+{{- printf "%s/%s%s" $repository $image (ne $tag "" | ternary (printf ":%s" $tag) "") -}}
 {{- else -}}
-  {{- if eq .Values.imageTag "" -}}
-    {{ .Values.image }}
-  {{- else -}}
-    {{ .Values.image }}:{{ .Values.imageTag }}
-  {{- end }}
-{{- end }}
+{{- printf "%s%s" $image (ne $tag "" | ternary (printf ":%s" $tag) "") -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "fission-bundleImage" -}}
+{{- $args := list .Values.repository .Values.image .Values.imageTag -}}
+{{- include "imageWithTag" $args -}}
 {{- end -}}

 {{- define "reporterImage" -}}
-{{- if .Values.repository -}}
-  {{- if eq .Values.imageTag "" -}}
-    {{ .Values.repository }}/{{ .Values.postInstallReportImage }}
-  {{- else -}}
-    {{ .Values.repository }}/{{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-  {{- end }}
-{{- else -}}
-  {{- if eq .Values.imageTag "" -}}
-    {{ .Values.postInstallReportImage }}
-  {{- else -}}
-    {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-  {{- end }}
-{{- end }}
+{{- $args := list .Values.repository .Values.postInstallReportImage .Values.imageTag -}}
+{{- include "imageWithTag" $args -}}
+{{- end -}}
+
+{{- define "fetcherImage" -}}
+{{- $args := list (.Values.fetcher.repository | default .Values.repository) .Values.fetcher.image .Values.fetcher.imageTag -}}
+{{- include "imageWithTag" $args -}}
+{{- end -}}
+
+{{- define "preUpgradeChecksImage" -}}
+{{- $args := list (.Values.preUpgradeChecks.repository | default .Values.repository) .Values.preUpgradeChecks.image .Values.preUpgradeChecks.imageTag -}}
+{{- include "imageWithTag" $args -}}
 {{- end -}}

 {{- define "opentelemtry.envs" }}
@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: {{ template "fullname" . }}-{{ .Chart.Version }}
+  name: {{ template "fullname" . }}-{{ .Chart.Version }}-post-install
  labels:
    # The "release" convention makes it easy to tie a release to all of the
    # Kubernetes resources that were created as part of that release.
@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: {{ template "fullname" . }}-{{ .Chart.Version }}
+  name: {{ template "fullname" . }}-{{ .Chart.Version }}-post-upgrade
  labels:
    # The "release" convention makes it easy to tie a release to all of the
    # Kubernetes resources that were created as part of that release.
@@ -30,11 +30,7 @@ spec:
        args: ["--builderMgr", "--storageSvcUrl", "http://storagesvc.{{ .Release.Namespace }}"]
        env:
        - name: FETCHER_IMAGE
-        {{- if eq .Values.fetcher.imageTag "" }}
-          value: "{{ .Values.fetcher.image }}"
-        {{- else }}
-          value: "{{ .Values.fetcher.image }}:{{ .Values.fetcher.imageTag }}"
-        {{- end }}
+          value: {{ include "fetcherImage" . | quote }}
        - name: FETCHER_IMAGE_PULL_POLICY
          value: "{{ .Values.pullPolicy }}"
        - name: BUILDER_IMAGE_PULL_POLICY
@@ -30,11 +30,7 @@ spec:
        args: ["--executorPort", "8888"]
        env:
        - name: FETCHER_IMAGE
-        {{- if eq .Values.fetcher.imageTag "" }}
-          value: "{{ .Values.fetcher.image }}"
-        {{- else }}
-          value: "{{ .Values.fetcher.image }}:{{ .Values.fetcher.imageTag }}"
-        {{- end }}
+          value: {{ include "fetcherImage" . | quote }}
        - name: FETCHER_IMAGE_PULL_POLICY
          value: "{{ .Values.pullPolicy }}"
        - name: RUNTIME_IMAGE_PULL_POLICY
@@ -28,11 +28,7 @@ spec:
      restartPolicy: Never
      containers:
      - name: pre-upgrade-job
-      {{- if .Values.preUpgradeChecks.imageTag }}
-        image: {{ .Values.preUpgradeChecks.image }}:{{ .Values.preUpgradeChecks.imageTag }}
-      {{- else }}
-        image: {{ .Values.preUpgradeChecks.image }}
-      {{- end }}
+        image: {{ include "preUpgradeChecksImage" . | quote }}
        imagePullPolicy: {{ .Values.pullPolicy }}
        command: [ "/pre-upgrade-checks" ]
        env:
@@ -12,6 +12,12 @@ spec:
    matchLabels:
      svc: storagesvc
      application: fission-storage
+  strategy:
+    type: {{ .Values.storagesvc.deploymentStrategy.type }}
+    {{- if eq .Values.storagesvc.deploymentStrategy.type "RollingUpdate" }}
+    rollingUpdate:
+      {{- toYaml .Values.storagesvc.deploymentStrategy.rollingUpdate | nindent 6}}
+    {{- end }}
  template:
    metadata:
      labels:
@@ -113,7 +119,7 @@ spec:
      priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
    {{- with .Values.imagePullSecrets }}
-      imagePullSecrets: 
+      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
    {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}
@@ -38,6 +38,8 @@ spec:
        ports:
          - containerPort: 8080
            name: metrics
+        resources:
+          {{- toYaml .Values.webhook.resources | nindent 10 }}
      volumes:
      - name: serving-certs
        secret:
@@ -25,13 +25,13 @@ image: fission/fission-bundle
 ## It is also used by the chart to identify version of the few more images apart from fission-bundle.
 ## Keep it empty for using latest tag.
 ##
-imageTag: v1.20.5
+imageTag: v1.22.0

 ## pullPolicy represents the pull policy to use for images in the chart.
 ##
 pullPolicy: IfNotPresent

-## imageppullsecrets 
+## imagepullsecrets
 imagePullSecrets: []

 ## priorityClassName represents the priority class name to use for Fission components.
@@ -80,7 +80,7 @@ builderNamespace: ""
 functionNamespace: ""

 ## Fission will watch the following namespaces along with the `defaultNamespace` for fission custom resources.
-## additionalFissionNamespaces: 
+## additionalFissionNamespaces:
 ## - namespace1
 ## - namespace2
 ## - namespace3
@@ -117,10 +117,14 @@ kubernetesClientBurst: 500
 ## fetcher helps in fetching function source code/build and uploading it when function is invoked.
 ##
 fetcher:
+  ## repository represents the repository of the fetcher component.
+  ##
+  ## By default, it is empty, which means global repository will be used.
+  repository: ""
  ## image represents the image of the fetcher component.
  image: fission/fetcher
  ## imageTag represents the tag of the image of the fetcher component.
-  imageTag: v1.20.5
+  imageTag: v1.22.0

  ## Fetcher is only for to downloading or uploading archive.
  ## Normally, you don't need to change the value here, unless necessary.
@@ -159,7 +163,7 @@ executor:
  ## This is applicable to Pool Manager executor type only.
  ##
  podReadyTimeout: 300s
-  
+
  ## Pod resources as:
  ##  resources:
  ##    limits:
@@ -332,7 +336,7 @@ router:
    runAsGroup: 10001

 ## The builder manager watches the package & environments CRD changes and manages the builds of function source code.
-## 
+##
 buildermgr:
  ## Pod resources as:
  ##  resources:
@@ -358,7 +362,7 @@ buildermgr:
    runAsGroup: 10001

 ## webhook is the component that validates API calls.
-## It contains validation and mutation for functions, triggers, environments, Kubernetes event watches, etc. 
+## It contains validation and mutation for functions, triggers, environments, Kubernetes event watches, etc.
 ##
 webhook:
  ## Pod resources as:
@@ -435,6 +439,16 @@ storagesvc:
  ##
  resources: {}

+  ## Deployment strategy defaults to RollingUpdate but use Recreate if new pods fail to
+  ## attach to the volume until the old pod has released it.
+  ## deploymentStrategy:
+  ##   type: Recreate
+  deploymentStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+
  ## Archive pruner removes archives from storage which are not referenced by any package.
  archivePruner:
    enabled: true
@@ -537,7 +551,7 @@ serviceMonitor:
  #  key: "value"

 # The following components expose Prometheus metrics and have podmonitors in this chart (disabled by default)
-# 
+#
 podMonitor:
  enabled: false
  ##namespace in which you want to deploy podmonitor
@@ -573,7 +587,7 @@ persistence:
  #   region: <awsRegion>
  ## For Minio and other s3 compatible storage systems set endPoint property
  #   endPoint: <s3StorageUrl>
-  
+
  ## A manually managed Persistent Volume Claim name
  ## Requires persistence.enabled: true
  ## If defined, PVC must be created manually before volume will be bound
@@ -683,12 +697,16 @@ preUpgradeChecks:
  ## Run pre-install/pre-upgrade checks if true
  ##
  enabled: true
+  ## Repository for pre-install/pre-upgrade checks image
+  ## By default it uses the global repository
+  ##
+  repository: ""
  ## pre-install/pre-upgrade checks live in this image
  ##
  image: fission/pre-upgrade-checks
  ## pre-install/pre-upgrade checks image version
  ##
-  imageTag: v1.20.5
+  imageTag: v1.22.0

 ## Fission post-install/post-upgrade reporting live in this image
 ##
@@ -756,12 +774,12 @@ authentication:
  ## jwtSigningKey is the signing key used for
  ## signing the JWT token
  ##
-  jwtSigningKey: 
+  jwtSigningKey:
  ## jwtExpiryTime is the JWT expiry time
  ## in seconds
  ## default '120'
  ##
-  jwtExpiryTime: 
+  jwtExpiryTime:
  ## jwtIssuer is the issuer of JWT
  ## default 'fission'
  ##
@@ -866,7 +884,7 @@ runtimePodSpec:
  ## Setting it false by default so that integration tests pass
  ##
  enabled: false
-  
+
  ## Checkout PodSpec in https://fission.io/docs/reference/crd-reference/#runtime
  ##
  podSpec:
@@ -1,3 +1,3 @@
-FROM cgr.dev/chainguard/static:latest
+FROM cgr.dev/chainguard/static:latest@sha256:939a132511fcbc2702e0e251b6f3ea368c0ad4f114678ae5973903352357d01a
 COPY builder /builder
 ENTRYPOINT ["/builder"]
@@ -1,3 +1,3 @@
-FROM cgr.dev/chainguard/static:latest
+FROM cgr.dev/chainguard/static:latest@sha256:939a132511fcbc2702e0e251b6f3ea368c0ad4f114678ae5973903352357d01a
 COPY fetcher /
 ENTRYPOINT ["/fetcher"]
@@ -1,3 +1,3 @@
-FROM cgr.dev/chainguard/static:latest
+FROM cgr.dev/chainguard/static:latest@sha256:939a132511fcbc2702e0e251b6f3ea368c0ad4f114678ae5973903352357d01a
 COPY fission-bundle /
 ENTRYPOINT ["/fission-bundle"]
@@ -21,9 +21,7 @@ import (
 	"flag"
 	"fmt"
 	"os"
-	"strconv"

-	docopt "github.com/docopt/docopt-go"
 	"go.uber.org/zap"
 	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
 	cnwebhook "sigs.k8s.io/controller-runtime/pkg/webhook"
@@ -48,120 +46,38 @@ import (
 	"github.com/fission/fission/pkg/webhook"
 )

-// runWebhook starts admission webhook server
-func runWebhook(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, port int) error {
-	return webhook.Start(ctx, clientGen, logger, cnwebhook.Options{
-		Port: port,
-	})
+// Command line arguments
+type CommandLineArgs struct {
+	// Flags
+	canaryConfig bool
+	kubewatcher  bool
+	timer        bool
+	mqt          bool
+	mqt_keda     bool
+	builderMgr   bool
+	showVersion  bool
+	logger       bool
+
+	// Port values
+	webhookPort        int
+	routerPort         int
+	executorPort       int
+	storageServicePort int
+
+	// URL values
+	executorUrl   string
+	routerUrl     string
+	storageSvcUrl string
+
+	// Other configurations
+	storageType string
 }

-func runCanaryConfigServer(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface) error {
-	return canaryconfigmgr.StartCanaryServer(ctx, clientGen, logger, mgr, false)
-}
-
-func runRouter(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, port int, executorUrl string) error {
-	return router.Start(ctx, clientGen, logger, mgr, port, eclient.MakeClient(logger, executorUrl))
-}
-
-func runExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, port int) error {
-	return executor.StartExecutor(ctx, clientGen, logger, mgr, port)
-}
-
-func runKubeWatcher(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerUrl string) error {
-	return kubewatcher.Start(ctx, clientGen, logger, mgr, routerUrl)
-}
-
-func runTimer(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerUrl string) error {
-	return timer.Start(ctx, clientGen, logger, mgr, routerUrl)
-}
-
-func runMessageQueueMgr(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerUrl string) error {
-	return mqtrigger.Start(ctx, clientGen, logger, mgr, routerUrl)
-}
-
-// KEDA based MessageQueue Trigger Manager
-func runMQManager(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerURL string) error {
-	return mqt.StartScalerManager(ctx, clientGen, logger, mgr, routerURL)
-}
-
-func runStorageSvc(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, port int, storage storagesvc.Storage) error {
-	return storagesvc.Start(ctx, clientGen, logger, storage, mgr, port)
-}
-
-func runBuilderMgr(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, storageSvcUrl string) error {
-	return buildermgr.Start(ctx, clientGen, logger, mgr, storageSvcUrl)
-}
-
-func runLogger(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger) error {
-	return functionLogger.Start(ctx, clientGen, logger)
-}
-
-func getPort(logger *zap.Logger, portArg interface{}) int {
-	portArgStr := portArg.(string)
-	port, err := strconv.Atoi(portArgStr)
-	if err != nil {
-		logger.Fatal("invalid port number", zap.Error(err), zap.String("port", portArgStr))
-	}
-	return port
-}
-
-func getStringArgWithDefault(arg interface{}, defaultValue string) string {
-	if arg != nil {
-		return arg.(string)
-	} else {
-		return defaultValue
-	}
-}
-
-func getServiceName(arguments map[string]interface{}) string {
-	serviceName := "Fission-Unknown"
-
-	if arguments["--routerPort"] != nil {
-		serviceName = "Fission-Router"
-	} else if arguments["--executorPort"] != nil {
-		serviceName = "Fission-Executor"
-	} else if arguments["--kubewatcher"] == true {
-		serviceName = "Fission-KubeWatcher"
-	} else if arguments["--timer"] == true {
-		serviceName = "Fission-Timer"
-	} else if arguments["--mqt"] == true {
-		serviceName = "Fission-MessageQueueTrigger"
-	} else if arguments["--builderMgr"] == true {
-		serviceName = "Fission-BuilderMgr"
-	} else if arguments["--storageServicePort"] != nil {
-		serviceName = "Fission-StorageSvc"
-	} else if arguments["--mqt_keda"] == true {
-		serviceName = "Fission-Keda-MQTrigger"
-	}
-
-	return serviceName
-}
-
-func exitWithSync(logger *zap.Logger) {
-	// Ignore error, safe to ignore as per https://github.com/uber-go/zap/issues/328
-	_ = logger.Sync()
-	os.Exit(1)
-}
-
-func main() {
-	mgr := manager.New()
-	defer mgr.Wait()
-
-	var err error
-
-	// From https://github.com/containous/traefik/pull/1817/files
-	// Tell glog to log into STDERR. Otherwise, we risk
-	// certain kinds of API errors getting logged into a directory not
-	// available in a `FROM scratch` Docker container, causing glog to abort
-	// hard with an exit code > 0.
-	// TODO: fix the lint error. Error checking here is causing all components to crash with error "logtostderr not found"
-	flag.Set("logtostderr", "true") //nolint: errcheck
-
-	usage := `fission-bundle: Package of all fission microservices: router, executor.
+// Usage information
+const usageText string = `fission-bundle: Package of all fission microservices: router, executor.

 Use it to start one or more of the fission servers:

-
 Pool manager maintains a pool of generalized function containers, and
 specializes them on-demand. Executor must be run from a pod in a
 Kubernetes cluster.
@@ -198,142 +114,231 @@ Options:
  --storageServicePort=<port>     Port that the storage service should listen on.
  --executorUrl=<url>             Executor URL. Not required if --executorPort is specified.
  --routerUrl=<url>               Router URL.
-  --etcdUrl=<etcdUrl>             Etcd URL.
  --storageSvcUrl=<url>           StorageService URL.
-  --filePath=<filePath>           Directory to store functions in.
-  --namespace=<namespace>         Kubernetes namespace in which to run function containers. Defaults to 'fission-function'.
  --kubewatcher                   Start Kubernetes events watcher.
  --timer                         Start Timer.
  --mqt                           Start message queue trigger.
  --mqt_keda					  Start message queue trigger of kind KEDA
  --builderMgr                    Start builder manager.
-  --version                       Print version information
-`
-	logger := loggerfactory.GetLogger()
-	defer exitWithSync(logger)
+  --version                       Print version information`

-	ctx := signals.SetupSignalHandler()
-	profile.ProfileIfEnabled(ctx, logger, mgr)
+func main() {
+	mgr := manager.New()
+	defer mgr.Wait()

-	version := fmt.Sprintf("Fission Bundle Version: %s", info.BuildInfo().String())
-	arguments, err := docopt.ParseArgs(usage, nil, version)
-	if err != nil {
-		logger.Error("failed to parse arguments", zap.Error(err))
-		return
+	// Set up command line parsing
+	args := setupCommandLineArgs()
+
+	// Handle version request specially - exit after printing
+	if args.showVersion {
+		fmt.Printf("Fission Bundle Version: %s\n", info.BuildInfo().String())
+		os.Exit(0)
 	}

-	shutdown, err := otel.InitProvider(ctx, logger, getServiceName(arguments))
+	// Initialize logger
+	logger := loggerfactory.GetLogger()
+	defer func() {
+		// Ignore error, safe to ignore as per https://github.com/uber-go/zap/issues/328
+		_ = logger.Sync()
+	}()
+
+	// Set up signal handling for graceful shutdown
+	ctx := signals.SetupSignalHandler()
+
+	// Enable profiling if configured
+	profile.ProfileIfEnabled(ctx, logger, mgr)
+
+	// Initialize OpenTelemetry
+	serviceName := getServiceNameFromArgs(args)
+	shutdown, err := otel.InitProvider(ctx, logger, serviceName)
 	if err != nil {
-		logger.Error("error initializing provider for OTLP", zap.Error(err), zap.Any("argument", arguments))
+		logger.Error("error initializing provider for OTLP", zap.Error(err))
 		return
 	}
 	if shutdown != nil {
 		defer shutdown(ctx)
 	}

-	executorUrl := getStringArgWithDefault(arguments["--executorUrl"], "http://executor.fission")
-	routerUrl := getStringArgWithDefault(arguments["--routerUrl"], "http://router.fission")
-	storageSvcUrl := getStringArgWithDefault(arguments["--storageSvcUrl"], "http://storagesvc.fission")
+	// Initialize client generator
 	clientGen := crd.NewClientGenerator()

-	if arguments["--webhookPort"] != nil {
-		port := getPort(logger, arguments["--webhookPort"])
-		err = runWebhook(ctx, clientGen, logger, port)
+	// Start the appropriate service based on command line arguments
+	startRequestedService(ctx, args, clientGen, logger, mgr)
+
+	<-ctx.Done()
+	logger.Error("exiting")
+}
+
+// setupCommandLineArgs parses command line arguments and returns them
+func setupCommandLineArgs() *CommandLineArgs {
+	args := &CommandLineArgs{}
+
+	// Override the default usage function
+	flag.Usage = func() {
+		fmt.Println(usageText)
+	}
+
+	// Tell glog to log into STDERR
+	flag.Set("logtostderr", "true") //nolint: errcheck
+
+	// Define flags
+	flag.BoolVar(&args.canaryConfig, "canaryConfig", false, "Start canary config server")
+	flag.BoolVar(&args.kubewatcher, "kubewatcher", false, "Start Kubernetes events watcher")
+	flag.BoolVar(&args.timer, "timer", false, "Start Timer")
+	flag.BoolVar(&args.mqt, "mqt", false, "Start message queue trigger")
+	flag.BoolVar(&args.mqt_keda, "mqt_keda", false, "Start message queue trigger of kind KEDA")
+	flag.BoolVar(&args.builderMgr, "builderMgr", false, "Start builder manager")
+	flag.BoolVar(&args.showVersion, "version", false, "Print version information")
+	flag.BoolVar(&args.logger, "logger", false, "Start logger")
+
+	// Port flags
+	flag.IntVar(&args.webhookPort, "webhookPort", 0, "Port that the webhook should listen on")
+	flag.IntVar(&args.routerPort, "routerPort", 0, "Port that the router should listen on")
+	flag.IntVar(&args.executorPort, "executorPort", 0, "Port that the executor should listen on")
+	flag.IntVar(&args.storageServicePort, "storageServicePort", 0, "Port that the storage service should listen on")
+
+	// URL flags
+	flag.StringVar(&args.executorUrl, "executorUrl", "http://executor.fission", "Executor URL")
+	flag.StringVar(&args.routerUrl, "routerUrl", "http://router.fission", "Router URL")
+	flag.StringVar(&args.storageSvcUrl, "storageSvcUrl", "http://storagesvc.fission", "StorageService URL")
+
+	// Other configuration flags
+	flag.StringVar(&args.storageType, "storageType", "", "Type of storage to use")
+
+	// Parse flags
+	flag.Parse()
+
+	return args
+}
+
+// getServiceNameFromArgs determines which service is being started based on command line args
+func getServiceNameFromArgs(args *CommandLineArgs) string {
+	serviceName := "Fission-Unknown"
+
+	if args.routerPort != 0 {
+		serviceName = "Fission-Router"
+	} else if args.executorPort != 0 {
+		serviceName = "Fission-Executor"
+	} else if args.kubewatcher {
+		serviceName = "Fission-KubeWatcher"
+	} else if args.timer {
+		serviceName = "Fission-Timer"
+	} else if args.mqt {
+		serviceName = "Fission-MessageQueueTrigger"
+	} else if args.builderMgr {
+		serviceName = "Fission-BuilderMgr"
+	} else if args.storageServicePort != 0 {
+		serviceName = "Fission-StorageSvc"
+	} else if args.mqt_keda {
+		serviceName = "Fission-Keda-MQTrigger"
+	}
+
+	return serviceName
+}
+
+// startRequestedService starts the service specified by command line arguments
+func startRequestedService(ctx context.Context, args *CommandLineArgs, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface) {
+	var err error
+
+	// Start the requested service based on command line arguments
+	if args.webhookPort != 0 {
+		err = webhook.Start(ctx, clientGen, logger, cnwebhook.Options{
+			Port: args.webhookPort,
+		})
 		logger.Error("webhook server exited:", zap.Error(err))
 		return
 	}

-	if arguments["--canaryConfig"] == true {
-		err := runCanaryConfigServer(ctx, clientGen, logger, mgr)
+	if args.canaryConfig {
+		err = canaryconfigmgr.StartCanaryServer(ctx, clientGen, logger, mgr, false)
 		if err != nil {
 			logger.Error("canary config server exited with error: ", zap.Error(err))
-			return
 		}
+		return
 	}

-	if arguments["--routerPort"] != nil {
-		port := getPort(logger, arguments["--routerPort"])
-		err = runRouter(ctx, clientGen, logger, mgr, port, executorUrl)
+	if args.routerPort != 0 {
+		err = router.Start(ctx, clientGen, logger, mgr, args.routerPort, eclient.MakeClient(logger, args.executorUrl))
 		if err != nil {
 			logger.Error("router exited", zap.Error(err))
-			return
 		}
+		return
 	}

-	if arguments["--executorPort"] != nil {
-		port := getPort(logger, arguments["--executorPort"])
-		err = runExecutor(ctx, clientGen, logger, mgr, port)
+	if args.executorPort != 0 {
+		err = executor.StartExecutor(ctx, clientGen, logger, mgr, args.executorPort)
 		if err != nil {
 			logger.Error("executor exited", zap.Error(err))
-			return
 		}
+		return
 	}

-	if arguments["--kubewatcher"] == true {
-		err = runKubeWatcher(ctx, clientGen, logger, mgr, routerUrl)
+	if args.kubewatcher {
+		err = kubewatcher.Start(ctx, clientGen, logger, mgr, args.routerUrl)
 		if err != nil {
 			logger.Error("kubewatcher exited", zap.Error(err))
-			return
 		}
+		return
 	}

-	if arguments["--timer"] == true {
-		err = runTimer(ctx, clientGen, logger, mgr, routerUrl)
+	if args.timer {
+		err = timer.Start(ctx, clientGen, logger, mgr, args.routerUrl)
 		if err != nil {
 			logger.Error("timer exited", zap.Error(err))
-			return
 		}
+		return
 	}

-	if arguments["--mqt"] == true {
-		err = runMessageQueueMgr(ctx, clientGen, logger, mgr, routerUrl)
+	if args.mqt {
+		err = mqtrigger.Start(ctx, clientGen, logger, mgr, args.routerUrl)
 		if err != nil {
 			logger.Error("message queue manager exited", zap.Error(err))
-			return
 		}
+		return
 	}

-	if arguments["--mqt_keda"] == true {
-		err = runMQManager(ctx, clientGen, logger, mgr, routerUrl)
+	if args.mqt_keda {
+		err = mqt.StartScalerManager(ctx, clientGen, logger, mgr, args.routerUrl)
 		if err != nil {
 			logger.Error("mqt scaler manager exited", zap.Error(err))
-			return
 		}
+		return
 	}

-	if arguments["--builderMgr"] == true {
-		err = runBuilderMgr(ctx, clientGen, logger, mgr, storageSvcUrl)
+	if args.builderMgr {
+		err = buildermgr.Start(ctx, clientGen, logger, mgr, args.storageSvcUrl)
 		if err != nil {
 			logger.Error("builder manager exited", zap.Error(err))
-			return
 		}
+		return
 	}

-	if arguments["--logger"] == true {
-		err = runLogger(ctx, clientGen, logger)
+	if args.logger {
+		err = functionLogger.Start(ctx, clientGen, logger)
 		if err != nil {
 			logger.Error("logger exited", zap.Error(err))
 		}
 		return
 	}

-	if arguments["--storageServicePort"] != nil {
-		port := getPort(logger, arguments["--storageServicePort"])
+	if args.storageServicePort != 0 {
+		startStorageService(ctx, args, clientGen, logger, mgr)
+		return
+	}
+}

-		var storage storagesvc.Storage
+// startStorageService initializes and starts the storage service
+func startStorageService(ctx context.Context, args *CommandLineArgs, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface) {
+	var storage storagesvc.Storage

-		if arguments["--storageType"] != nil && arguments["--storageType"] == string(storagesvc.StorageTypeS3) {
-			storage = storagesvc.NewS3Storage()
-		} else if arguments["--storageType"] == string(storagesvc.StorageTypeLocal) {
-			storage = storagesvc.NewLocalStorage("/fission")
-		}
-		err := runStorageSvc(ctx, clientGen, logger, mgr, port, storage)
-		if err != nil {
-			logger.Error("storage service exited", zap.Error(err))
-			return
-		}
+	if args.storageType == string(storagesvc.StorageTypeS3) {
+		storage = storagesvc.NewS3Storage()
+	} else if args.storageType == string(storagesvc.StorageTypeLocal) {
+		storage = storagesvc.NewLocalStorage("/fission")
 	}

-	<-ctx.Done()
-	logger.Error("exiting")
+	err := storagesvc.Start(ctx, clientGen, logger, storage, mgr, args.storageServicePort)
+	if err != nil {
+		logger.Error("storage service exited", zap.Error(err))
+	}
 }
@@ -24,7 +24,6 @@ import (
 	"strings"
 	"time"

-	"github.com/pkg/errors"
 	"go.uber.org/zap"

 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
@@ -41,12 +40,12 @@ import (
 func Start(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerUrl string) error {
 	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		return errors.Wrap(err, "failed to get fission client")
+		return fmt.Errorf("failed to get fission client: %w", err)
 	}

 	err = crd.WaitForFunctionCRDs(ctx, logger, fissionClient)
 	if err != nil {
-		return errors.Wrap(err, "error waiting for CRDs")
+		return fmt.Errorf("error waiting for CRDs: %w", err)
 	}

 	mqType := (fv1.MessageQueueType)(os.Getenv("MESSAGE_QUEUE_TYPE"))
@@ -14,7 +14,8 @@ limitations under the License.
 package app

 import (
-	"github.com/pkg/errors"
+	"fmt"
+
 	"github.com/spf13/cobra"

 	"github.com/fission/fission/pkg/fission-cli/cliwrapper/cli"
@@ -65,7 +66,7 @@ func App(clientOptions cmd.ClientOptions) *cobra.Command {
 				// }
 				client, err := cmd.NewClient(clientOptions)
 				if err != nil {
-					return errors.Wrap(err, "failed to get fission client")
+					return fmt.Errorf("failed to get fission client: %w", err)
 				}
 				cmd.SetClientset(*client)
 				return nil
@@ -1,3 +1,3 @@
-FROM cgr.dev/chainguard/static:latest
+FROM cgr.dev/chainguard/static:latest@sha256:939a132511fcbc2702e0e251b6f3ea368c0ad4f114678ae5973903352357d01a
 COPY pre-upgrade-checks /
 ENTRYPOINT ["/pre-upgrade-checks"]
@@ -1,7 +1,6 @@
 package main

 import (
-	"context"
 	"testing"

 	"github.com/stretchr/testify/require"
@@ -12,8 +11,7 @@ import (
 func TestPreUpgradeTaskClient(t *testing.T) {
 	f := framework.NewFramework()
 	defer f.Logger().Sync()
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()
 	err := f.Start(ctx)
 	require.NoError(t, err)

@@ -1,3 +1,3 @@
-FROM cgr.dev/chainguard/static:latest
+FROM cgr.dev/chainguard/static:latest@sha256:939a132511fcbc2702e0e251b6f3ea368c0ad4f114678ae5973903352357d01a
 COPY reporter /
 ENTRYPOINT ["/reporter"]
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.17.2
  name: canaryconfigs.fission.io
 spec:
  group: fission.io
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.17.2
  name: httptriggers.fission.io
 spec:
  group: fission.io
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.17.2
  name: kuberneteswatchtriggers.fission.io
 spec:
  group: fission.io
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.17.2
  name: packages.fission.io
 spec:
  group: fission.io
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.17.2
  name: timetriggers.fission.io
 spec:
  group: fission.io
@@ -1,13 +1,15 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-commonLabels:
-  group: fission.io
 resources:
-  - fission.io_canaryconfigs.yaml
-  - fission.io_environments.yaml
-  - fission.io_functions.yaml
-  - fission.io_httptriggers.yaml
-  - fission.io_kuberneteswatchtriggers.yaml
-  - fission.io_messagequeuetriggers.yaml
-  - fission.io_packages.yaml
-  - fission.io_timetriggers.yaml
+- fission.io_canaryconfigs.yaml
+- fission.io_environments.yaml
+- fission.io_functions.yaml
+- fission.io_httptriggers.yaml
+- fission.io_kuberneteswatchtriggers.yaml
+- fission.io_messagequeuetriggers.yaml
+- fission.io_packages.yaml
+- fission.io_timetriggers.yaml
+labels:
+- includeSelectors: true
+  pairs:
+    group: fission.io
@@ -1,118 +1,178 @@
 module github.com/fission/fission

-go 1.23.1
+go 1.25.3

 require (
-	dario.cat/mergo v1.0.1
-	github.com/IBM/sarama v1.43.3
+	dario.cat/mergo v1.0.2
+	github.com/IBM/sarama v1.46.3
 	github.com/bep/debounce v1.2.1
 	github.com/dchest/uniuri v1.2.0
-	github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815
 	github.com/dustin/go-humanize v1.0.1
-	github.com/elastic/crd-ref-docs v0.1.0
-	github.com/fatih/color v1.17.0
-	github.com/fsnotify/fsnotify v1.7.0
-	github.com/go-git/go-git/v5 v5.12.0
+	github.com/fatih/color v1.18.0
+	github.com/fsnotify/fsnotify v1.9.0
+	github.com/go-git/go-git/v5 v5.16.3
 	github.com/go-logr/zapr v1.3.0
-	github.com/golang-jwt/jwt/v4 v4.5.0
-	github.com/google/go-cmp v0.6.0
+	github.com/golang-jwt/jwt/v4 v4.5.2
+	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
 	github.com/graymeta/stow v0.2.8
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/hashicorp/go-retryablehttp v0.7.7
-	github.com/influxdata/influxdb v1.11.6
-	github.com/kedacore/keda/v2 v2.15.1
-	github.com/mholt/archiver/v3 v3.5.1
-	github.com/minio/minio-go v6.0.14+incompatible
-	github.com/ory/dockertest v3.3.5+incompatible
-	github.com/pkg/errors v0.9.1
-	github.com/prometheus/client_golang v1.20.4
-	github.com/prometheus/common v0.59.1
+	github.com/hashicorp/go-retryablehttp v0.7.8
+	github.com/influxdata/influxdb v1.12.2
+	github.com/kedacore/keda/v2 v2.18.0
+	github.com/mholt/archives v0.1.5
+	github.com/minio/minio-go/v7 v7.0.95
+	github.com/ory/dockertest/v3 v3.12.0
+	github.com/prometheus/client_golang v1.23.2
+	github.com/prometheus/common v0.67.2
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06
-	github.com/spf13/cobra v1.8.1
-	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.9.0
+	github.com/spf13/cobra v1.10.1
+	github.com/spf13/pflag v1.0.10
+	github.com/stretchr/testify v1.11.1
 	github.com/wcharczuk/go-chart v2.0.1+incompatible
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.55.0
-	go.opentelemetry.io/contrib/propagators/autoprop v0.55.0
-	go.opentelemetry.io/otel v1.30.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.30.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.30.0
-	go.opentelemetry.io/otel/sdk v1.30.0
-	go.opentelemetry.io/otel/trace v1.30.0
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0
+	go.opentelemetry.io/contrib/propagators/autoprop v0.63.0
+	go.opentelemetry.io/otel v1.38.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0
+	go.opentelemetry.io/otel/sdk v1.38.0
+	go.opentelemetry.io/otel/trace v1.38.0
 	go.uber.org/zap v1.27.0
-	golang.org/x/net v0.29.0
-	google.golang.org/grpc v1.67.1
-	k8s.io/api v0.31.1
-	k8s.io/apiextensions-apiserver v0.31.1
-	k8s.io/apimachinery v0.31.1
-	k8s.io/client-go v0.31.1
-	k8s.io/code-generator v0.31.1
-	k8s.io/metrics v0.31.1
-	sigs.k8s.io/controller-runtime v0.19.0
-	sigs.k8s.io/controller-tools v0.16.3
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.1
-	sigs.k8s.io/yaml v1.4.0
+	golang.org/x/net v0.46.0
+	google.golang.org/grpc v1.76.0
+	k8s.io/api v0.34.1
+	k8s.io/apiextensions-apiserver v0.34.1
+	k8s.io/apimachinery v0.34.1
+	k8s.io/client-go v0.34.1
+	k8s.io/metrics v0.34.1
+	sigs.k8s.io/controller-runtime v0.22.3
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0
+	sigs.k8s.io/yaml v1.6.0
 )

 require (
-	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	cel.dev/expr v0.24.0 // indirect
+	cloud.google.com/go v0.121.0 // indirect
+	cloud.google.com/go/auth v0.16.0 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
+	cloud.google.com/go/compute/metadata v0.9.0 // indirect
+	cloud.google.com/go/iam v1.5.0 // indirect
+	cloud.google.com/go/monitoring v1.24.1 // indirect
+	cloud.google.com/go/storage v1.52.0 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
+	github.com/BurntSushi/toml v1.4.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver v1.5.0 // indirect
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig v2.22.0+incompatible // indirect
-	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
-	github.com/ProtonMail/go-crypto v1.0.0 // indirect
-	github.com/andybalholm/brotli v1.1.0 // indirect
-	github.com/aws/aws-sdk-go v1.42.34 // indirect
+	github.com/ProtonMail/go-crypto v1.1.6 // indirect
+	github.com/STARRY-S/zip v0.2.3 // indirect
+	github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b // indirect
+	github.com/andybalholm/brotli v1.2.0 // indirect
+	github.com/armon/go-metrics v0.4.1 // indirect
+	github.com/aws/aws-sdk-go v1.55.7 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blend/go-sdk v1.20220112.5 // indirect
-	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
+	github.com/bodgit/plumbing v1.3.0 // indirect
+	github.com/bodgit/sevenzip v1.6.1 // indirect
+	github.com/bodgit/windows v1.0.1 // indirect
+	github.com/c2h5oh/datasize v0.0.0-20231215233829-aa82cc1e6500 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
+	github.com/cespare/xxhash v1.1.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/cloudflare/circl v1.3.7 // indirect
-	github.com/containerd/continuity v0.2.2 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
-	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
+	github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect
+	github.com/containerd/continuity v0.4.5 // indirect
+	github.com/coreos/go-semver v0.3.1 // indirect
+	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
+	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-units v0.4.0 // indirect
-	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
+	github.com/dennwc/varint v1.0.0 // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/docker/cli v27.4.1+incompatible // indirect
+	github.com/docker/docker v28.1.1+incompatible // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
 	github.com/eapache/go-resiliency v1.7.0 // indirect
 	github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3 // indirect
 	github.com/eapache/queue v1.1.0 // indirect
-	github.com/emicklei/go-restful/v3 v3.12.0 // indirect
+	github.com/edsrzf/mmap-go v1.2.0 // indirect
+	github.com/elastic/crd-ref-docs v0.2.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
-	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
-	github.com/expr-lang/expr v1.16.9 // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
+	github.com/expr-lang/expr v1.17.6 // indirect
+	github.com/facette/natsort v0.0.0-20181210072756-2cd4dd1e2dcb // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.5.0 // indirect
-	github.com/go-ini/ini v1.66.4 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-git/go-billy/v5 v5.6.2 // indirect
+	github.com/go-ini/ini v1.67.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.2 // indirect
+	github.com/go-kit/log v0.2.1 // indirect
+	github.com/go-logfmt/logfmt v0.6.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
-	github.com/gobuffalo/flect v1.0.2 // indirect
-	github.com/goccy/go-yaml v1.11.3 // indirect
+	github.com/go-redis/redis/v8 v8.11.5 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/gobuffalo/flect v1.0.3 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/goccy/go-yaml v1.18.0 // indirect
+	github.com/gogo/googleapis v1.4.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/gogo/status v1.1.1 // indirect
 	github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/gorilla/websocket v1.5.1 // indirect
-	github.com/gotestyourself/gotestyourself v2.2.0+incompatible // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 // indirect
+	github.com/golang/snappy v1.0.0 // indirect
+	github.com/google/btree v1.1.3 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
+	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
+	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
+	github.com/grafana/dashboard-linter v0.0.0-20241224134444-1765d94aec4a // indirect
+	github.com/grafana/dskit v0.0.0-20241216174023-0450f2ba7c3d // indirect
+	github.com/grafana/gomemcache v0.0.0-20241016125027-0a5bcc5aef40 // indirect
+	github.com/grafana/jsonparser v0.0.0-20241004153430-023329977675 // indirect
+	github.com/grafana/loki/pkg/push v0.0.0-20241220083700-6c49cc07305e // indirect
+	github.com/grafana/loki/v3 v3.3.2 // indirect
+	github.com/grafana/pyroscope-go/godeltaprof v0.1.8 // indirect
+	github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
+	github.com/hashicorp/consul/api v1.32.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-hclog v1.6.3 // indirect
+	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
+	github.com/hashicorp/go-msgpack/v2 v2.1.2 // indirect
+	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
-	github.com/huandu/xstrings v1.3.3 // indirect
+	github.com/hashicorp/golang-lru v1.0.2 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
+	github.com/hashicorp/memberlist v0.5.1 // indirect
+	github.com/hashicorp/serf v0.10.1 // indirect
+	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
@@ -123,73 +183,148 @@ require (
 	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
+	github.com/jpillora/backoff v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.17.9 // indirect
-	github.com/klauspost/pgzip v1.2.5 // indirect
-	github.com/lib/pq v1.10.4 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/klauspost/compress v1.18.1 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/klauspost/pgzip v1.2.6 // indirect
+	github.com/magiconair/properties v1.8.9 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mdlayher/socket v0.5.1 // indirect
+	github.com/mdlayher/vsock v1.2.1 // indirect
+	github.com/miekg/dns v1.1.65 // indirect
+	github.com/mikelolasagasti/xz v1.0.1 // indirect
+	github.com/minio/crc64nvme v1.0.2 // indirect
+	github.com/minio/md5-simd v1.1.2 // indirect
+	github.com/minio/minlz v1.0.1 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/spdystream v0.4.0 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/spdystream v0.5.0 // indirect
+	github.com/moby/sys/user v0.3.0 // indirect
+	github.com/moby/term v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
-	github.com/nwaples/rardecode v1.1.0 // indirect
+	github.com/nwaples/rardecode/v2 v2.2.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runc v1.1.14 // indirect
-	github.com/pierrec/lz4/v4 v4.1.21 // indirect
-	github.com/pjbgf/sha1cd v0.3.0 // indirect
+	github.com/opencontainers/image-spec v1.1.0 // indirect
+	github.com/opencontainers/runc v1.2.3 // indirect
+	github.com/opentracing-contrib/go-grpc v0.1.0 // indirect
+	github.com/opentracing-contrib/go-stdlib v1.1.0 // indirect
+	github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b // indirect
+	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/philhofer/fwd v1.2.0 // indirect
+	github.com/pierrec/lz4/v4 v4.1.22 // indirect
+	github.com/pires/go-proxyproto v0.8.0 // indirect
+	github.com/pjbgf/sha1cd v0.3.2 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/exporter-toolkit v0.14.0 // indirect
+	github.com/prometheus/procfs v0.17.0 // indirect
+	github.com/prometheus/prometheus v0.55.1 // indirect
+	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
+	github.com/rs/xid v1.6.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/sagikazarmark/locafero v0.6.0 // indirect
+	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
+	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
+	github.com/sercand/kuberesolver/v5 v5.1.1 // indirect
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
+	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/skeema/knownhosts v1.2.2 // indirect
-	github.com/ulikunitz/xz v0.5.9 // indirect
+	github.com/skeema/knownhosts v1.3.1 // indirect
+	github.com/sony/gobreaker v1.0.0 // indirect
+	github.com/sorairolake/lzip-go v0.3.8 // indirect
+	github.com/sourcegraph/conc v0.3.0 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/viper v1.19.0 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	github.com/tinylib/msgp v1.3.0 // indirect
+	github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect
+	github.com/uber/jaeger-lib v2.4.1+incompatible // indirect
+	github.com/ulikunitz/xz v0.5.15 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
-	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
-	go.opentelemetry.io/contrib/propagators/aws v1.30.0 // indirect
-	go.opentelemetry.io/contrib/propagators/b3 v1.30.0 // indirect
-	go.opentelemetry.io/contrib/propagators/jaeger v1.30.0 // indirect
-	go.opentelemetry.io/contrib/propagators/ot v1.30.0 // indirect
-	go.opentelemetry.io/otel/metric v1.30.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	github.com/zeebo/errs v1.4.0 // indirect
+	github.com/zeitlinger/conflate v0.0.0-20240927101413-c06be92f798f // indirect
+	go.etcd.io/etcd/api/v3 v3.6.4 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.6.4 // indirect
+	go.etcd.io/etcd/client/v3 v3.6.4 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/collector/pdata v1.22.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
+	go.opentelemetry.io/contrib/propagators/aws v1.38.0 // indirect
+	go.opentelemetry.io/contrib/propagators/b3 v1.38.0 // indirect
+	go.opentelemetry.io/contrib/propagators/jaeger v1.38.0 // indirect
+	go.opentelemetry.io/contrib/propagators/ot v1.38.0 // indirect
+	go.opentelemetry.io/otel/metric v1.38.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
+	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.27.0 // indirect
-	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
+	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
+	golang.org/x/crypto v0.43.0 // indirect
+	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
 	golang.org/x/image v0.18.0 // indirect
-	golang.org/x/mod v0.20.0 // indirect
-	golang.org/x/oauth2 v0.22.0 // indirect
-	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/sys v0.25.0 // indirect
-	golang.org/x/term v0.24.0 // indirect
-	golang.org/x/text v0.18.0 // indirect
-	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.24.0 // indirect
-	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
-	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 // indirect
-	google.golang.org/protobuf v1.34.2 // indirect
+	golang.org/x/mod v0.29.0 // indirect
+	golang.org/x/oauth2 v0.32.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.37.0 // indirect
+	golang.org/x/term v0.36.0 // indirect
+	golang.org/x/text v0.30.0 // indirect
+	golang.org/x/time v0.13.0 // indirect
+	golang.org/x/tools v0.38.0 // indirect
+	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
+	google.golang.org/api v0.230.0 // indirect
+	google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	gotest.tools v2.2.0+incompatible // indirect
-	k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70 // indirect
+	k8s.io/code-generator v0.34.1 // indirect
+	k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
-	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
-	knative.dev/pkg v0.0.0-20240805063731-c88d5dad9653 // indirect
-	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
+	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
+	knative.dev/pkg v0.0.0-20250326102644-9f3e60a9244c // indirect
+	sigs.k8s.io/controller-runtime/tools/setup-envtest v0.0.0-20250211091558-894df3a7e664 // indirect
+	sigs.k8s.io/controller-tools v0.19.0 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
 )
+
+tool (
+	github.com/elastic/crd-ref-docs
+	github.com/grafana/dashboard-linter
+	k8s.io/code-generator
+	sigs.k8s.io/controller-runtime/tools/setup-envtest
+	sigs.k8s.io/controller-tools/cmd/controller-gen
+)
+
+replace k8s.io/code-generator => github.com/fission/code-generator v0.18.0-alpha.1.0.20250914164041-5cd640227cd4
@@ -12,5 +12,5 @@ DASHBOARD_PATH="$BASE_PATH/charts/fission-all/dashboards/*"

 for f in $DASHBOARD_PATH
 do
-    dashboard-linter lint --strict --verbose $f
+    go tool dashboard-linter lint --strict --verbose $f
 done
@@ -28,8 +28,7 @@ set +x
 # for codecov
 echo "" > coverage.txt

-make install-envtest
-KUBEBUILDER_ASSETS=$(setup-envtest -p path use 1.23.x)
+KUBEBUILDER_ASSETS=$(go tool setup-envtest -p path use 1.30.x)
 export KUBEBUILDER_ASSETS

 # The executor unit test only works with NodePort-type services for
@@ -3,11 +3,18 @@ set -o errexit
 set -o nounset
 set -o pipefail

+CODEGEN_PKG_VERSION=$(go list -m -f '{{.Replace.Version}}' k8s.io/code-generator)
+if [ -z "$CODEGEN_PKG_VERSION" ]; then
+	echo "Error: could not determine code-generator version from go.mod"
+	echo "Received output: '$CODEGEN_PKG_VERSION'"
+	exit 1
+fi
 GOPATH=$(go env GOPATH)
+GOMODCACHEPATH=$(go env GOMODCACHE)
 SCRIPT_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 CODEGEN_PKG=${CODEGEN_PKG:-$(
 	cd "${SCRIPT_ROOT}"
-	ls -d -1 ${SCRIPT_ROOT}/../code-generator 2>/dev/null || echo $GOPATH/pkg/mod/k8s.io/code-generator@v0.30.0
+	echo ${GOMODCACHEPATH}/github.com/fission/code-generator@${CODEGEN_PKG_VERSION}
 )}
 OUTDIR="${SCRIPT_ROOT}/pkg/generated"

@@ -167,3 +167,7 @@ const (
 	ConfigMaps  = "configmaps"
 	Secrets     = "secrets"
 )
+
+const (
+	BuilderContainerName = "builder"
+)
@@ -1,73 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var environmentlog = loggerfactory.GetLogger().Named("environment-resource")
-
-func (r *Environment) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-environment,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=environments,verbs=create;update,versions=v1,name=menvironment.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &Environment{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *Environment) Default() {
-	environmentlog.Debug("default", zap.String("name", r.Name))
-}
-
-// user: change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-environment,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=environments,verbs=create,versions=v1,name=venvironment.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &Environment{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (r *Environment) ValidateCreate() (admission.Warnings, error) {
-	environmentlog.Debug("validate create", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("Environment", err)
-		return nil, err
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *Environment) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	environmentlog.Debug("validate update", zap.String("name", r.Name))
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *Environment) ValidateDelete() (admission.Warnings, error) {
-	environmentlog.Debug("validate delete", zap.String("name", r.Name))
-	return nil, nil
-}
@@ -1,105 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"fmt"
-
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var functionlog = loggerfactory.GetLogger().Named("function-resource")
-
-func (r *Function) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-function,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=functions,verbs=create;update,versions=v1,name=mfunction.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &Function{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *Function) Default() {
-}
-
-// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-function,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=functions,verbs=create;update,versions=v1,name=vfunction.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &Function{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (r *Function) ValidateCreate() (admission.Warnings, error) {
-	functionlog.Debug("validate create", zap.String("name", r.Name))
-
-	for _, cnfMap := range r.Spec.ConfigMaps {
-		if cnfMap.Namespace != r.ObjectMeta.Namespace {
-			err := fmt.Errorf("ConfigMap's [%s] and function's Namespace [%s] are different. ConfigMap needs to be present in the same namespace as function", cnfMap.Namespace, r.ObjectMeta.Namespace)
-			return nil, AggregateValidationErrors("Function", err)
-		}
-	}
-	for _, secret := range r.Spec.Secrets {
-		if secret.Namespace != r.ObjectMeta.Namespace {
-			err := fmt.Errorf("secret  [%s] and function's Namespace [%s] are different. Secret needs to be present in the same namespace as function", secret.Namespace, r.ObjectMeta.Namespace)
-			return nil, AggregateValidationErrors("Function", err)
-		}
-	}
-
-	err := r.Validate()
-	if err != nil {
-		return nil, AggregateValidationErrors("Function", err)
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *Function) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	functionlog.Debug("validate update", zap.String("name", r.Name))
-
-	for _, cnfMap := range r.Spec.ConfigMaps {
-		if cnfMap.Namespace != r.ObjectMeta.Namespace {
-			err := fmt.Errorf("ConfigMap's [%s] and function's Namespace [%s] are different. ConfigMap needs to be present in the same namespace as function", cnfMap.Namespace, r.ObjectMeta.Namespace)
-			return nil, AggregateValidationErrors("Function", err)
-		}
-	}
-	for _, secret := range r.Spec.Secrets {
-		if secret.Namespace != r.ObjectMeta.Namespace {
-			err := fmt.Errorf("secret  [%s] and function's Namespace [%s] are different. Secret needs to be present in the same namespace as function", secret.Namespace, r.ObjectMeta.Namespace)
-			return nil, AggregateValidationErrors("Function", err)
-		}
-	}
-
-	err := r.Validate()
-	if err != nil {
-		return nil, AggregateValidationErrors("Function", err)
-	}
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *Function) ValidateDelete() (admission.Warnings, error) {
-	functionlog.Debug("validate delete", zap.String("name", r.Name))
-	return nil, nil
-}
@@ -1,80 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var httptriggerlog = loggerfactory.GetLogger().Named("httptrigger-resource")
-
-func (r *HTTPTrigger) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-httptrigger,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=httptriggers,verbs=create;update,versions=v1,name=mhttptrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &HTTPTrigger{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *HTTPTrigger) Default() {
-	httptriggerlog.Debug("default", zap.String("name", r.Name))
-}
-
-// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-httptrigger,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=httptriggers,verbs=create;update,versions=v1,name=vhttptrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &HTTPTrigger{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (t *HTTPTrigger) ValidateCreate() (admission.Warnings, error) {
-	httptriggerlog.Debug("validate create", zap.String("name", t.Name))
-	err := t.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("HTTPTrigger", err)
-		return nil, err
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *HTTPTrigger) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	httptriggerlog.Debug("validate update", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("HTTPTrigger", err)
-		return nil, err
-	}
-
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *HTTPTrigger) ValidateDelete() (admission.Warnings, error) {
-	httptriggerlog.Debug("validate delete", zap.String("name", r.Name))
-
-	return nil, nil
-}
@@ -1,73 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var kuberneteswatchtriggerlog = loggerfactory.GetLogger().Named("kuberneteswatchtrigger-resource")
-
-func (r *KubernetesWatchTrigger) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-kuberneteswatchtrigger,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=kuberneteswatchtriggers,verbs=create;update,versions=v1,name=mkuberneteswatchtrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &KubernetesWatchTrigger{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *KubernetesWatchTrigger) Default() {
-	kuberneteswatchtriggerlog.Debug("default", zap.String("name", r.Name))
-}
-
-// user: change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-kuberneteswatchtrigger,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=kuberneteswatchtriggers,verbs=create,versions=v1,name=vkuberneteswatchtrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &KubernetesWatchTrigger{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (r *KubernetesWatchTrigger) ValidateCreate() (admission.Warnings, error) {
-	kuberneteswatchtriggerlog.Debug("validate create", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("Watch", err)
-		return nil, err
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *KubernetesWatchTrigger) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	// WATCH UPDATE NOT IMPLEMENTED
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *KubernetesWatchTrigger) ValidateDelete() (admission.Warnings, error) {
-	kuberneteswatchtriggerlog.Debug("validate delete", zap.String("name", r.Name))
-	return nil, nil
-}
@@ -1,108 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"fmt"
-
-	"github.com/dustin/go-humanize"
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	ferror "github.com/fission/fission/pkg/error"
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var packagelog = loggerfactory.GetLogger().Named("package-resource")
-
-func (r *Package) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-//+kubebuilder:webhook:path=/mutate-fission-io-v1-package,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=packages,verbs=create;update,versions=v1,name=mpackage.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &Package{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *Package) Default() {
-	packagelog.Debug("default", zap.String("name", r.Name))
-	if r.Status.BuildStatus == "" {
-		if !r.Spec.Deployment.IsEmpty() {
-			// deployment package exists
-			r.Status.BuildStatus = BuildStatusNone
-		} else if !r.Spec.Source.IsEmpty() {
-			// source package with no deployment is a pending build
-			r.Status.BuildStatus = BuildStatusPending
-		} else {
-			r.Status.BuildStatus = BuildStatusFailed // empty package
-			r.Status.BuildLog = "Both source and deployment are empty"
-		}
-	}
-}
-
-// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-package,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=packages,verbs=create;update,versions=v1,name=vpackage.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &Package{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (r *Package) ValidateCreate() (admission.Warnings, error) {
-	packagelog.Debug("validate create", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("Package", err)
-		return nil, err
-	}
-
-	// Ensure size limits
-	if len(r.Spec.Source.Literal) > int(ArchiveLiteralSizeLimit) {
-		err := ferror.MakeError(ferror.ErrorInvalidArgument,
-			fmt.Sprintf("Package literal larger than %s", humanize.Bytes(uint64(ArchiveLiteralSizeLimit))))
-		return nil, err
-	}
-	if len(r.Spec.Deployment.Literal) > int(ArchiveLiteralSizeLimit) {
-		err := ferror.MakeError(ferror.ErrorInvalidArgument,
-			fmt.Sprintf("Package literal larger than %s", humanize.Bytes(uint64(ArchiveLiteralSizeLimit))))
-		return nil, err
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *Package) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	packagelog.Debug("validate update", zap.String("name", r.Name))
-	err := r.Validate()
-
-	if err != nil {
-		err = AggregateValidationErrors("Package", err)
-		return nil, err
-	}
-
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *Package) ValidateDelete() (admission.Warnings, error) {
-	packagelog.Debug("validate delete", zap.String("name", r.Name))
-	return nil, nil
-}
@@ -1,92 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	ferror "github.com/fission/fission/pkg/error"
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var timetriggerlog = loggerfactory.GetLogger().Named("timetrigger-resource")
-
-func (r *TimeTrigger) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-timetrigger,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=timetriggers,verbs=create;update,versions=v1,name=mtimetrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &TimeTrigger{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *TimeTrigger) Default() {
-	timetriggerlog.Debug("default", zap.String("name", r.Name))
-}
-
-// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-timetrigger,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=timetriggers,verbs=create;update,versions=v1,name=vtimetrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &TimeTrigger{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (r *TimeTrigger) ValidateCreate() (admission.Warnings, error) {
-	timetriggerlog.Debug("validate create", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("TimeTrigger", err)
-		return nil, err
-	}
-
-	err = IsValidCronSpec(r.Spec.Cron)
-	if err != nil {
-		err = ferror.MakeError(ferror.ErrorInvalidArgument, "TimeTrigger cron spec is not valid")
-		return nil, err
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *TimeTrigger) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	timetriggerlog.Debug("validate update", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("TimeTrigger", err)
-		return nil, err
-	}
-
-	err = IsValidCronSpec(r.Spec.Cron)
-	if err != nil {
-		err = ferror.MakeError(ferror.ErrorInvalidArgument, "TimeTrigger cron spec is not valid")
-		return nil, err
-	}
-
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *TimeTrigger) ValidateDelete() (admission.Warnings, error) {
-	timetriggerlog.Debug("validate delete", zap.String("name", r.Name))
-	return nil, nil
-}
@@ -599,7 +599,7 @@ func (e *Environment) Validate() error {

 	if e.Spec.Runtime.PodSpec != nil {
 		for _, container := range e.Spec.Runtime.PodSpec.Containers {
-			if container.Command == nil && container.Image == e.Spec.Runtime.Image && container.Name != e.ObjectMeta.Name {
+			if container.Command == nil && container.Image == e.Spec.Runtime.Image && container.Name != e.Name {
 				result = multierror.Append(result, errors.New("container with image same as runtime image in podspec, must have name same as environment name"))
 			}
 		}
@@ -23,7 +23,7 @@ package v1
 import (
 	"k8s.io/api/autoscaling/v2"
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/runtime"
+	runtime "k8s.io/apimachinery/pkg/runtime"
 )

 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
@@ -31,7 +31,6 @@ import (
 	"time"

 	"github.com/dchest/uniuri"
-	"github.com/pkg/errors"
 	"go.uber.org/zap"

 	"github.com/fission/fission/pkg/info"
@@ -122,9 +121,19 @@ func (builder *Builder) Handler(w http.ResponseWriter, r *http.Request) {
 	logger.Info("builder received request", zap.Any("request", req))

 	logger.Debug("starting build")
-	srcPkgPath := filepath.Join(builder.sharedVolumePath, req.SrcPkgFilename)
+	srcPkgPath, err := utils.SanitizeFilePath(filepath.Join(builder.sharedVolumePath, req.SrcPkgFilename), builder.sharedVolumePath)
+	if err != nil {
+		logger.Error(err.Error(), zap.String("filename", req.SrcPkgFilename))
+		builder.reply(r.Context(), w, "", err.Error(), http.StatusBadRequest)
+		return
+	}
 	deployPkgFilename := fmt.Sprintf("%s-%s", req.SrcPkgFilename, strings.ToLower(uniuri.NewLen(6)))
-	deployPkgPath := filepath.Join(builder.sharedVolumePath, deployPkgFilename)
+	deployPkgPath, err := utils.SanitizeFilePath(filepath.Join(builder.sharedVolumePath, deployPkgFilename), builder.sharedVolumePath)
+	if err != nil {
+		logger.Error(err.Error(), zap.String("filename", req.SrcPkgFilename))
+		builder.reply(r.Context(), w, "", err.Error(), http.StatusBadRequest)
+		return
+	}

 	var buildArgs []string
 	buildCmd := req.BuildCommand
@@ -196,7 +205,7 @@ func (builder *Builder) reply(ctx context.Context, w http.ResponseWriter, pkgFil

 	rBody, err := json.Marshal(resp)
 	if err != nil {
-		e := errors.Wrap(err, "error encoding response body")
+		e := fmt.Errorf("error encoding response body: %w", err)
 		rBody = []byte(fmt.Sprintf(`{"buildLogs": "%s"}`, e.Error()))
 		statusCode = http.StatusInternalServerError
 	}
@@ -237,12 +246,12 @@ func (builder *Builder) build(ctx context.Context, command string, args []string

 	stdout, err := cmd.StdoutPipe()
 	if err != nil {
-		return "", errors.Wrap(err, "error creating stdout pipe for cmd")
+		return "", fmt.Errorf("error creating stdout pipe for cmd: %w", err)
 	}

 	stderr, err := cmd.StderrPipe()
 	if err != nil {
-		return "", errors.Wrap(err, "error creating stderr pipe for cmd")
+		return "", fmt.Errorf("error creating stderr pipe for cmd: %w", err)
 	}

 	// Init logs
@@ -253,7 +262,7 @@ func (builder *Builder) build(ctx context.Context, command string, args []string

 	err = cmd.Start()
 	if err != nil {
-		return "", errors.Wrap(err, "error starting cmd")
+		return "", fmt.Errorf("error starting cmd: %w", err)
 	}
 	fmt.Printf("========= START =========\n")
 	defer fmt.Printf("========= END ===========\n")
@@ -266,14 +275,14 @@ func (builder *Builder) build(ctx context.Context, command string, args []string
 	}

 	if err := scanner.Err(); err != nil {
-		scanErr := errors.Wrap(err, "error reading cmd output")
+		scanErr := fmt.Errorf("error reading cmd output: %w", err)
 		fmt.Println(scanErr)
 		return buildLogs, scanErr
 	}

 	err = cmd.Wait()
 	if err != nil {
-		cmdErr := errors.Wrapf(err, "error waiting for cmd %q", command)
+		cmdErr := fmt.Errorf("error waiting for cmd %q: %w", command, err)
 		fmt.Println(cmdErr)
 		return buildLogs, cmdErr
 	}
@@ -20,12 +20,12 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"strings"

 	"github.com/hashicorp/go-retryablehttp"
-	"github.com/pkg/errors"
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
 	"go.uber.org/zap"
 	"golang.org/x/net/context/ctxhttp"
@@ -68,26 +68,26 @@ func (c *client) Build(ctx context.Context, req *builder.PackageBuildRequest) (*

 	body, err := json.Marshal(req)
 	if err != nil {
-		return nil, errors.Wrap(err, "error marshaling json")
+		return nil, fmt.Errorf("error marshaling json: %w", err)
 	}

 	resp, err := ctxhttp.Post(ctx, c.httpClient.StandardClient(), c.url, "application/json", bytes.NewReader(body))
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("error sending request: %w", err)
 	}
 	defer resp.Body.Close()

 	rBody, err := io.ReadAll(resp.Body)
 	if err != nil {
 		logger.Error("error reading resp body", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error reading response body: %w", err)
 	}

 	pkgBuildResp := builder.PackageBuildResponse{}
 	err = json.Unmarshal(rBody, &pkgBuildResp)
 	if err != nil {
 		logger.Error("error parsing resp body", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error parsing response body: %w", err)
 	}

 	return &pkgBuildResp, ferror.MakeErrorFromHTTP(resp)
@@ -98,7 +98,7 @@ func (c *client) Clean(ctx context.Context, srcPkgFilename string) error {

 	req, err := http.NewRequest(http.MethodDelete, c.getCleanUrl(srcPkgFilename), http.NoBody)
 	if err != nil {
-		return errors.Wrap(err, "failed to create http request for clean api")
+		return fmt.Errorf("error creating http request: %w", err)
 	}

 	resp, err := ctxhttp.Do(ctx, c.httpClient.StandardClient(), req)
@@ -18,10 +18,10 @@ package buildermgr

 import (
 	"context"
+	"fmt"
 	"os"
 	"time"

-	"github.com/pkg/errors"
 	"go.uber.org/zap"

 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
@@ -38,21 +38,21 @@ func Start(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *

 	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		return errors.Wrap(err, "failed to get fission client")
+		return fmt.Errorf("failed to get fission client: %w", err)
 	}
 	kubernetesClient, err := clientGen.GetKubernetesClient()
 	if err != nil {
-		return errors.Wrap(err, "failed to get kubernetes client")
+		return fmt.Errorf("failed to get kubernetes client: %w", err)
 	}

 	err = crd.WaitForFunctionCRDs(ctx, logger, fissionClient)
 	if err != nil {
-		return errors.Wrap(err, "error waiting for CRDs")
+		return fmt.Errorf("error waiting for CRDs: %w", err)
 	}

 	fetcherConfig, err := fetcherConfig.MakeFetcherConfig("/packages")
 	if err != nil {
-		return errors.Wrap(err, "error making fetcher config")
+		return fmt.Errorf("error making fetcher config: %w", err)
 	}

 	podSpecPatch, err := util.GetSpecFromConfigMap(fv1.BuilderPodSpecPath)
@@ -24,7 +24,6 @@ import (
 	"time"

 	"github.com/dchest/uniuri"
-	"github.com/pkg/errors"
 	"go.uber.org/zap"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

@@ -55,10 +54,10 @@ func buildPackage(ctx context.Context, logger *zap.Logger, fissionClient version
 		return nil, e, ferror.MakeError(http.StatusInternalServerError, e)
 	}

-	svcName := fmt.Sprintf("%v-%v.%v", env.ObjectMeta.Name, env.ObjectMeta.ResourceVersion, envBuilderNamespace)
-	srcPkgFilename := fmt.Sprintf("%v-%v", pkg.ObjectMeta.Name, strings.ToLower(uniuri.NewLen(6)))
-	fetcherC := fetcherClient.MakeClient(logger, fmt.Sprintf("http://%v:8000", svcName))
-	builderC := builderClient.MakeClient(logger, fmt.Sprintf("http://%v:8001", svcName))
+	svcName := fmt.Sprintf("%s-%s.%s", env.Name, env.ResourceVersion, envBuilderNamespace)
+	srcPkgFilename := fmt.Sprintf("%s-%s", pkg.Name, strings.ToLower(uniuri.NewLen(6)))
+	fetcherC := fetcherClient.MakeClient(logger, fmt.Sprintf("http://%s:8000", svcName))
+	builderC := builderClient.MakeClient(logger, fmt.Sprintf("http://%s:8001", svcName))

 	defer func() {
 		logger.Info("cleaning src pkg from builder storage", zap.String("source_package", srcPkgFilename))
@@ -162,7 +161,7 @@ func updatePackage(ctx context.Context, logger *zap.Logger, fissionClient versio
 	if err != nil {
 		e := "error updating package"
 		logger.Error(e, zap.Error(err))
-		return nil, errors.Wrap(err, e)
+		return nil, fmt.Errorf("%s: %w", e, err)
 	}

 	// return resource version for function to update function package ref
@@ -403,7 +403,7 @@ func (envw *environmentWatcher) createBuilderDeployment(ctx context.Context, env
 	}

 	container, err := util.MergeContainer(&apiv1.Container{
-		Name:                   "builder",
+		Name:                   fv1.BuilderContainerName,
 		Image:                  env.Spec.Builder.Image,
 		ImagePullPolicy:        envw.builderImagePullPolicy,
 		TerminationMessagePath: "/dev/termination-log",
@@ -461,7 +461,7 @@ func (canaryCfgMgr *canaryConfigMgr) rollback(ctx context.Context, canaryConfig
 	functionWeights[canaryConfig.Spec.NewFunction] = 0
 	functionWeights[canaryConfig.Spec.OldFunction] = 100

-	err := canaryCfgMgr.updateHttpTriggerWithRetries(ctx, trigger.ObjectMeta.Name, trigger.ObjectMeta.Namespace, functionWeights)
+	err := canaryCfgMgr.updateHttpTriggerWithRetries(ctx, trigger.Name, trigger.ObjectMeta.Namespace, functionWeights)
 	if err != nil {
 		return err
 	}
@@ -494,7 +494,7 @@ func (canaryCfgMgr *canaryConfigMgr) rollForward(ctx context.Context, canaryConf
 		zap.String("namespace", canaryConfig.ObjectMeta.Namespace),
 		zap.Any("function_weights", functionWeights))

-	err := canaryCfgMgr.updateHttpTriggerWithRetries(ctx, trigger.ObjectMeta.Name, trigger.ObjectMeta.Namespace, functionWeights)
+	err := canaryCfgMgr.updateHttpTriggerWithRetries(ctx, trigger.Name, trigger.ObjectMeta.Namespace, functionWeights)
 	return doneProcessingCanaryConfig, err
 }

@@ -18,8 +18,8 @@ package canaryconfigmgr

 import (
 	"context"
+	"fmt"

-	"github.com/pkg/errors"
 	"go.uber.org/zap"
 	"k8s.io/client-go/kubernetes"

@@ -47,7 +47,7 @@ func ConfigureFeatures(ctx context.Context, logger *zap.Logger, unitTestMode boo
 	// in the future when new optional features are added, we need to add corresponding feature handlers and invoke them here
 	canaryCfgMgr, err := MakeCanaryConfigMgr(ctx, logger, fissionClient, kubeClient, featureConfig.CanaryConfig.PrometheusSvc)
 	if err != nil {
-		return errors.Wrap(err, "failed to start canary config manager")
+		return fmt.Errorf("failed to start canary config manager: %w", err)
 	}
 	canaryCfgMgr.Run(ctx, mgr)

@@ -21,7 +21,6 @@ import (
 	"fmt"
 	"time"

-	"github.com/pkg/errors"
 	prometheus "github.com/prometheus/client_golang/api"
 	prometheusv1 "github.com/prometheus/client_golang/api/prometheus/v1"
 	"github.com/prometheus/common/model"
@@ -40,7 +39,7 @@ func MakePrometheusClient(logger *zap.Logger, prometheusSvc string) (*Prometheus

 	promApiClient, err := prometheus.NewClient(promApiConfig)
 	if err != nil {
-		return nil, errors.Wrapf(err, "error creating prometheus api client for svc: %s", prometheusSvc)
+		return nil, fmt.Errorf("error creating prometheus api client for svc: %s: %w", prometheusSvc, err)
 	}

 	apiQueryClient := prometheusv1.NewAPI(promApiClient)
@@ -63,7 +62,7 @@ func (promApiClient *PrometheusApiClient) GetFunctionFailurePercentage(ctx conte
 	}

 	if reqs <= 0 {
-		return -1, fmt.Errorf("no requests to this url %v and method %v in the window: %v", path, methods, window)
+		return -1, fmt.Errorf("no requests to this url %s and method %v in the window: %s", path, methods, window)
 	}

 	// next, get a total count of errored out requests to this function in the same window
@@ -91,14 +90,14 @@ func (promApiClient *PrometheusApiClient) GetRequestsToFuncInWindow(ctx context.

 	reqs, err := promApiClient.executeQuery(ctx, queryString)
 	if err != nil {
-		return 0, errors.Wrapf(err, "error executing query: %s", queryString)
+		return 0, fmt.Errorf("error executing query %s: %w", queryString, err)
 	}

 	queryString = fmt.Sprintf("fission_function_calls_total{%s} offset %v", queryLabels, window)

 	reqsInPrevWindow, err := promApiClient.executeQuery(ctx, queryString)
 	if err != nil {
-		return 0, errors.Wrapf(err, "error executing query: %s", queryString)
+		return 0, fmt.Errorf("error executing query %s: %w", queryString, err)
 	}

 	reqsInCurrentWindow := reqs - reqsInPrevWindow
@@ -117,14 +116,14 @@ func (promApiClient *PrometheusApiClient) GetTotalFailedRequestsToFuncInWindow(c

 	failedRequests, err := promApiClient.executeQuery(ctx, queryString)
 	if err != nil {
-		return 0, errors.Wrapf(err, "error executing query: %s", queryString)
+		return 0, fmt.Errorf("error executing query %s: %w", queryString, err)
 	}

 	queryString = fmt.Sprintf("fission_function_errors_total{%s} offset %v", queryLabels, window)

 	failedReqsInPrevWindow, err := promApiClient.executeQuery(ctx, queryString)
 	if err != nil {
-		return 0, errors.Wrapf(err, "error executing query: %s", queryString)
+		return 0, fmt.Errorf("error executing query %s: %w", queryString, err)
 	}

 	failedReqsInCurrentWindow := failedRequests - failedReqsInPrevWindow
@@ -142,7 +141,7 @@ func (promApiClient *PrometheusApiClient) executeQuery(ctx context.Context, quer

 	val, warn, err := promApiClient.client.Query(ctx, queryString, time.Now())
 	if err != nil {
-		return 0, errors.Wrapf(err, "error querying prometheus")
+		return 0, fmt.Errorf("error querying prometheus: %w", err)
 	}

 	if warn != nil {
@@ -21,6 +21,7 @@ import (
 	"fmt"
 	"time"

+	kedaClient "github.com/kedacore/keda/v2/pkg/generated/clientset/versioned"
 	"go.uber.org/zap"
 	apiextensionsclient "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -32,7 +33,6 @@ import (

 	"github.com/fission/fission/pkg/generated/clientset/versioned"
 	"github.com/fission/fission/pkg/utils"
-	kedaClient "github.com/kedacore/keda/v2/pkg/generated/clientset/versioned"
 )

 const (
@@ -1,20 +1,20 @@
 package error

 import (
+	"fmt"
 	"net/http"
 	"testing"

-	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
 )

 func TestIsNotFound(t *testing.T) {
 	errs := map[error]bool{
 		nil: false,
-		MakeError(ErrorNotFound, "someone not found"):                                          true,
-		MakeError(ErrorTooManyRequests, "too many requests"):                                   false,
-		errors.Wrap(MakeError(ErrorNotFound, "someone not found"), "other information"):        true,
-		errors.Wrap(MakeError(ErrorTooManyRequests, "too many requests"), "other information"): false,
+		MakeError(ErrorNotFound, "someone not found"):                                             true,
+		MakeError(ErrorTooManyRequests, "too many requests"):                                      false,
+		fmt.Errorf("other information: %w", MakeError(ErrorNotFound, "someone not found")):        true,
+		fmt.Errorf("other information: %w", MakeError(ErrorTooManyRequests, "too many requests")): false,
 	}

 	for err, want := range errs {
@@ -25,9 +25,9 @@ func TestIsNotFound(t *testing.T) {
 func TestGetHTTPError(t *testing.T) {
 	errs := map[int]error{
 		http.StatusBadRequest:      MakeError(ErrorInvalidArgument, ""),
-		http.StatusConflict:        errors.Wrap(MakeError(ErrorNameExists, ""), ""),
-		http.StatusNotFound:        errors.Wrap(MakeError(ErrorNotFound, ""), ""),
-		http.StatusTooManyRequests: errors.Wrap(MakeError(ErrorTooManyRequests, "too many requests"), "other information"),
+		http.StatusConflict:        fmt.Errorf("%w", MakeError(ErrorNameExists, "")),
+		http.StatusNotFound:        fmt.Errorf("%w", MakeError(ErrorNotFound, "")),
+		http.StatusTooManyRequests: fmt.Errorf("other information: %w", MakeError(ErrorTooManyRequests, "too many requests")),
 	}
 	for want, err := range errs {
 		code, _ := GetHTTPError(err)
@@ -20,13 +20,13 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/url"
 	"strings"
 	"time"

 	"github.com/hashicorp/go-retryablehttp"
-	"github.com/pkg/errors"
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
 	"go.uber.org/zap"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -80,18 +80,18 @@ func (c *client) GetServiceForFunction(ctx context.Context, fn *fv1.Function) (s

 	body, err := json.Marshal(fn)
 	if err != nil {
-		return "", errors.Wrap(err, "could not marshal request body for getting service for function")
+		return "", fmt.Errorf("could not marshal request body for getting service for function: %w", err)
 	}

 	req, err := retryablehttp.NewRequestWithContext(ctx, "POST", executorURL, bytes.NewReader(body))
 	if err != nil {
-		return "", errors.Wrap(err, "could not create request for getting service for function")
+		return "", fmt.Errorf("could not create request for getting service for function: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")

 	resp, err := c.httpClient.Do(req)
 	if err != nil {
-		return "", errors.Wrap(err, "error posting to getting service for function")
+		return "", fmt.Errorf("error posting to getting service for function: %w", err)
 	}
 	defer resp.Body.Close()

@@ -101,7 +101,7 @@ func (c *client) GetServiceForFunction(ctx context.Context, fn *fv1.Function) (s

 	svcName, err := io.ReadAll(resp.Body)
 	if err != nil {
-		return "", errors.Wrap(err, "error reading response body from getting service for function")
+		return "", fmt.Errorf("error reading response body from getting service for function: %w", err)
 	}

 	return string(svcName), nil
@@ -118,17 +118,17 @@ func (c *client) UnTapService(ctx context.Context, fnMeta metav1.ObjectMeta, exe

 	body, err := json.Marshal(tapSvc)
 	if err != nil {
-		return errors.Wrap(err, "could not marshal request body for getting service for function")
+		return fmt.Errorf("could not marshal request body for getting service for function: %w", err)
 	}
 	req, err := retryablehttp.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(body))
 	if err != nil {
-		return errors.Wrap(err, "could not create request for untap service for function")
+		return fmt.Errorf("could not create request for untap service for function: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")

 	resp, err := c.httpClient.Do(req)
 	if err != nil {
-		return errors.Wrap(err, "error posting to getting service for function")
+		return fmt.Errorf("error posting to getting service for function: %w", err)
 	}
 	defer resp.Body.Close()

@@ -194,7 +194,7 @@ func (c *client) _tapService(ctx context.Context, tapSvcReqs []TapServiceRequest

 	req, err := retryablehttp.NewRequestWithContext(ctx, "POST", executorURL, bytes.NewReader(body))
 	if err != nil {
-		return errors.Wrap(err, "could not create request for tap service request")
+		return fmt.Errorf("could not create request for tap service request: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")

@@ -58,13 +58,18 @@ func ConfigMapEventHandlers(ctx context.Context, logger *zap.Logger, fissionClie
 			oldCm := oldObj.(*apiv1.ConfigMap)
 			newCm := newObj.(*apiv1.ConfigMap)
 			if oldCm.ObjectMeta.ResourceVersion != newCm.ObjectMeta.ResourceVersion {
-				logger.Debug("Configmap changed",
-					zap.String("configmap_name", newCm.ObjectMeta.Name),
-					zap.String("configmap_namespace", newCm.ObjectMeta.Namespace))
 				funcs, err := getConfigmapRelatedFuncs(ctx, logger, &newCm.ObjectMeta, fissionClient)
 				if err != nil {
 					logger.Error("Failed to get functions related to configmap", zap.String("configmap_name", newCm.ObjectMeta.Name), zap.String("configmap_namespace", newCm.ObjectMeta.Namespace))
 				}
+
+				if len(funcs) == 0 {
+					return
+				}
+
+				logger.Debug("Configmap changed",
+					zap.String("configmap_name", newCm.ObjectMeta.Name),
+					zap.String("configmap_namespace", newCm.ObjectMeta.Namespace))
 				refreshPods(ctx, logger, funcs, types)
 			}
 		},
@@ -18,8 +18,8 @@ package cms

 import (
 	"context"
+	"fmt"

-	"github.com/pkg/errors"
 	"go.uber.org/zap"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/tools/cache"
@@ -72,7 +72,7 @@ func refreshPods(ctx context.Context, logger *zap.Logger, funcs []fv1.Function,
 		if exists {
 			err = et.RefreshFuncPods(ctx, logger, f)
 		} else {
-			err = errors.Errorf("Unknown executor type '%s'", f.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType)
+			err = fmt.Errorf("unknown executor type '%s'", f.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType)
 		}

 		if err != nil {
@@ -57,13 +57,18 @@ func SecretEventHandlers(ctx context.Context, logger *zap.Logger, fissionClient
 			oldS := oldObj.(*apiv1.Secret)
 			newS := newObj.(*apiv1.Secret)
 			if oldS.ObjectMeta.ResourceVersion != newS.ObjectMeta.ResourceVersion {
-				logger.Debug("Secret changed",
-					zap.String("configmap_name", newS.ObjectMeta.Name),
-					zap.String("configmap_namespace", newS.ObjectMeta.Namespace))
 				funcs, err := getSecretRelatedFuncs(ctx, logger, &newS.ObjectMeta, fissionClient)
 				if err != nil {
 					logger.Error("Failed to get functions related to secret", zap.String("secret_name", newS.ObjectMeta.Name), zap.String("secret_namespace", newS.ObjectMeta.Namespace))
 				}
+
+				if len(funcs) == 0 {
+					return
+				}
+
+				logger.Debug("Secret changed",
+					zap.String("secret_name", newS.ObjectMeta.Name),
+					zap.String("secret_namespace", newS.ObjectMeta.Namespace))
 				refreshPods(ctx, logger, funcs, types)
 			}
 		},
@@ -26,7 +26,6 @@ import (
 	"time"

 	"github.com/dchest/uniuri"
-	"github.com/pkg/errors"
 	"go.uber.org/zap"
 	k8sCache "k8s.io/client-go/tools/cache"

@@ -155,12 +154,11 @@ func (executor *Executor) serveCreateFuncServices(ctx context.Context) {
 			// create a waitgroup for other requests for
 			// the same function to wait on
 			wg := &sync.WaitGroup{}
-			wg.Add(1)
 			executor.fsCreateWg.Store(fnkeyUR, wg)

 			// launch a goroutine for each request, to parallelize
 			// the specialization of different functions
-			go func() {
+			wg.Go(func() {
 				// Control overall specialization time by setting function
 				// specialization time to context. The reason not to use
 				// context from router requests is because a request maybe
@@ -189,8 +187,7 @@ func (executor *Executor) serveCreateFuncServices(ctx context.Context) {
 					err:     err,
 				}
 				executor.fsCreateWg.Delete(fnkeyUR)
-				wg.Done()
-			}()
+			})
 		} else {
 			// There's an existing request for this function, wait for it to finish
 			go func() {
@@ -213,7 +210,7 @@ func (executor *Executor) serveCreateFuncServices(ctx context.Context) {
 				// It normally happened if there are multiple requests are
 				// waiting for the same function and executor failed to cre-
 				// ate service for function.
-				err = errors.Wrapf(err, "error getting service for function %s", fnName)
+				err = fmt.Errorf("error getting service for function %s: %w", fnName, err)
 				req.respChan <- &createFuncServiceResponse{
 					funcSvc: fsvc,
 					err:     err,
@@ -233,7 +230,7 @@ func (executor *Executor) createServiceForFunction(ctx context.Context, fn *fv1.
 	t := fn.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType
 	e, ok := executor.executorTypes[t]
 	if !ok {
-		return nil, errors.Errorf("Unknown executor type '%s'", t)
+		return nil, fmt.Errorf("unknown executor type '%s'", t)
 	}

 	fsvc, fsvcErr := e.GetFuncSvc(ctx, fn)
@@ -243,7 +240,7 @@ func (executor *Executor) createServiceForFunction(ctx context.Context, fn *fv1.
 			zap.Error(fsvcErr),
 			zap.String("function_name", fn.ObjectMeta.Name),
 			zap.String("function_namespace", fn.ObjectMeta.Namespace))
-		fsvcErr = errors.Wrap(fsvcErr, fmt.Sprintf("[%s] %s", fn.ObjectMeta.Name, e))
+		fsvcErr = fmt.Errorf("[%s] %s: %w", fn.ObjectMeta.Name, e, fsvcErr)
 	}

 	return fsvc, fsvcErr
@@ -254,7 +251,7 @@ func (executor *Executor) getFunctionServiceFromCache(ctx context.Context, fn *f
 	t := fn.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType
 	e, ok := executor.executorTypes[t]
 	if !ok {
-		return nil, errors.Errorf("Unknown executor type '%s'", t)
+		return nil, fmt.Errorf("unknown executor type '%s'", t)
 	}
 	return e.GetFuncSvcFromCache(ctx, fn)
 }
@@ -265,11 +262,11 @@ func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface,

 	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		return errors.Wrap(err, "error making the fission client")
+		return fmt.Errorf("error making the fission client: %w", err)
 	}
 	kubernetesClient, err := clientGen.GetKubernetesClient()
 	if err != nil {
-		return errors.Wrap(err, "error making the kube client")
+		return fmt.Errorf("error making the kube client: %w", err)
 	}
 	metricsClient, err := clientGen.GetMetricsClient()
 	if err != nil {
@@ -278,12 +275,12 @@ func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface,

 	err = crd.WaitForFunctionCRDs(ctx, logger, fissionClient)
 	if err != nil {
-		return errors.Wrap(err, "error waiting for CRDs")
+		return fmt.Errorf("error waiting for CRDs: %w", err)
 	}

 	fetcherConfig, err := fetcherConfig.MakeFetcherConfig("/userfunc")
 	if err != nil {
-		return errors.Wrap(err, "Error making fetcher config")
+		return fmt.Errorf("error making fetcher config: %w", err)
 	}

 	executorInstanceID := strings.ToLower(uniuri.NewLen(8))
@@ -312,7 +309,7 @@ func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface,
 		finformerFactory,
 		gpmInformerFactory, podSpecPatch)
 	if err != nil {
-		return errors.Wrap(err, "pool manager creation failed")
+		return fmt.Errorf("pool manager creation failed: %w", err)
 	}

 	executorLabel, err = utils.GetInformerLabelByExecutor(fv1.ExecutorTypeNewdeploy)
@@ -327,7 +324,7 @@ func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface,
 		finformerFactory,
 		ndmInformerFactory, podSpecPatch)
 	if err != nil {
-		return errors.Wrap(err, "new deploy manager creation failed")
+		return fmt.Errorf("new deploy manager creation failed: %w", err)
 	}

 	executorLabel, err = utils.GetInformerLabelByExecutor(fv1.ExecutorTypeContainer)
@@ -341,7 +338,7 @@ func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface,
 		executorInstanceID, finformerFactory,
 		cnmInformerFactory)
 	if err != nil {
-		return errors.Wrap(err, "container manager creation failed")
+		return fmt.Errorf("container manager creation failed: %w", err)
 	}

 	executorTypes := make(map[fv1.ExecutorType]executortype.ExecutorType)
@@ -353,14 +350,14 @@ func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface,

 	wg := &sync.WaitGroup{}
 	for _, et := range executorTypes {
-		wg.Add(1)
-		go func(et executortype.ExecutorType) {
-			defer wg.Done()
-			if adoptExistingResources {
-				et.AdoptExistingResources(ctx)
-			}
-			et.CleanupOldExecutorObjects(ctx)
-		}(et)
+		wg.Go(func() {
+			func(et executortype.ExecutorType) {
+				if adoptExistingResources {
+					et.AdoptExistingResources(ctx)
+				}
+				et.CleanupOldExecutorObjects(ctx)
+			}(et)
+		})
 	}
 	// set hard timeout for resource adoption
 	// TODO: use context to control the waiting time once kubernetes client supports it.
@@ -302,17 +302,14 @@ func (caaf *Container) AdoptExistingResources(ctx context.Context) {
 		for i := range fnList.Items {
 			fn := &fnList.Items[i]
 			if fn.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType == fv1.ExecutorTypeContainer {
-				wg.Add(1)
-				go func() {
-					defer wg.Done()
-
+				wg.Go(func() {
 					_, err = caaf.fnCreate(ctx, fn)
 					if err != nil {
 						caaf.logger.Warn("failed to adopt resources for function", zap.Error(err))
 						return
 					}
 					caaf.logger.Info("adopt resources for function", zap.String("function", fn.ObjectMeta.Name))
-				}()
+				})
 			}
 		}
 	}
@@ -436,27 +433,27 @@ func (caaf *Container) fnCreate(ctx context.Context, fn *fv1.Function) (*fscache
 		{
 			// obj.TypeMeta.Kind does not work hence this, needs investigation and a fix
 			Kind:            "deployment",
-			Name:            depl.ObjectMeta.Name,
-			APIVersion:      depl.TypeMeta.APIVersion,
-			Namespace:       depl.ObjectMeta.Namespace,
-			ResourceVersion: depl.ObjectMeta.ResourceVersion,
-			UID:             depl.ObjectMeta.UID,
+			Name:            depl.Name,
+			APIVersion:      depl.APIVersion,
+			Namespace:       depl.Namespace,
+			ResourceVersion: depl.ResourceVersion,
+			UID:             depl.UID,
 		},
 		{
 			Kind:            "service",
-			Name:            svc.ObjectMeta.Name,
-			APIVersion:      svc.TypeMeta.APIVersion,
-			Namespace:       svc.ObjectMeta.Namespace,
-			ResourceVersion: svc.ObjectMeta.ResourceVersion,
-			UID:             svc.ObjectMeta.UID,
+			Name:            svc.Name,
+			APIVersion:      svc.APIVersion,
+			Namespace:       svc.Namespace,
+			ResourceVersion: svc.ResourceVersion,
+			UID:             svc.UID,
 		},
 		{
 			Kind:            "horizontalpodautoscaler",
-			Name:            hpa.ObjectMeta.Name,
-			APIVersion:      hpa.TypeMeta.APIVersion,
-			Namespace:       hpa.ObjectMeta.Namespace,
-			ResourceVersion: hpa.ObjectMeta.ResourceVersion,
-			UID:             hpa.ObjectMeta.UID,
+			Name:            hpa.Name,
+			APIVersion:      hpa.APIVersion,
+			Namespace:       hpa.Namespace,
+			ResourceVersion: hpa.ResourceVersion,
+			UID:             hpa.UID,
 		},
 	}

@@ -471,18 +468,18 @@ func (caaf *Container) fnCreate(ctx context.Context, fn *fv1.Function) (*fscache
 	_, err = caaf.fsCache.Add(*fsvc)
 	if err != nil {
 		caaf.logger.Error("error adding function to cache", zap.Error(err), zap.Any("function", fsvc.Function))
-		metrics.ColdStartsError.WithLabelValues(fn.ObjectMeta.Name, fn.ObjectMeta.Namespace).Inc()
+		metrics.ColdStartsError.WithLabelValues(fn.Name, fn.Namespace).Inc()
 		return fsvc, err
 	}

-	metrics.ColdStarts.WithLabelValues(fn.ObjectMeta.Name, fn.ObjectMeta.Namespace).Inc()
+	metrics.ColdStarts.WithLabelValues(fn.Name, fn.Namespace).Inc()

 	return fsvc, nil
 }

 func (caaf *Container) updateFunction(ctx context.Context, oldFn *fv1.Function, newFn *fv1.Function) error {

-	if oldFn.ObjectMeta.ResourceVersion == newFn.ObjectMeta.ResourceVersion {
+	if oldFn.ResourceVersion == newFn.ResourceVersion {
 		return nil
 	}

@@ -281,10 +281,20 @@ func (deploy *NewDeploy) getDeploymentSpec(ctx context.Context, fn *fv1.Function
 		},
 	}

+	// If custom runtime container name - default env name
+	mainContainerName := env.ObjectMeta.Name
+	if env.Spec.Runtime.Container != nil && env.Spec.Runtime.Container.Name != "" && env.Spec.Runtime.PodSpec != nil {
+		if util.DoesContainerExistInPodSpec(env.Spec.Runtime.Container.Name, env.Spec.Runtime.PodSpec) {
+			mainContainerName = env.Spec.Runtime.Container.Name
+		} else {
+			return nil, fmt.Errorf("runtime container %s not found in pod spec", env.Spec.Runtime.Container.Name)
+		}
+	}
+
 	// Order of merging is important here - first fetcher, then containers and lastly pod spec
 	err = deploy.fetcherConfig.AddSpecializingFetcherToPodSpec(
 		&deployment.Spec.Template.Spec,
-		env.ObjectMeta.Name,
+		mainContainerName,
 		fn,
 		env,
 	)
@@ -322,17 +322,14 @@ func (deploy *NewDeploy) AdoptExistingResources(ctx context.Context) {
 		for i := range fnList.Items {
 			fn := &fnList.Items[i]
 			if fn.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType == fv1.ExecutorTypeNewdeploy {
-				wg.Add(1)
-				go func() {
-					defer wg.Done()
-
+				wg.Go(func() {
 					_, err = deploy.fnCreate(ctx, fn)
 					if err != nil {
 						deploy.logger.Warn("failed to adopt resources for function", zap.Error(err))
 						return
 					}
 					deploy.logger.Info("adopt resources for function", zap.String("function", fn.ObjectMeta.Name))
-				}()
+				})
 			}
 		}
 	}
@@ -482,7 +479,7 @@ func (deploy *NewDeploy) fnCreate(ctx context.Context, fn *fv1.Function) (*fscac
 			// obj.TypeMeta.Kind does not work hence this, needs investigation and a fix
 			Kind:            "deployment",
 			Name:            depl.ObjectMeta.Name,
-			APIVersion:      depl.TypeMeta.APIVersion,
+			APIVersion:      depl.APIVersion,
 			Namespace:       depl.ObjectMeta.Namespace,
 			ResourceVersion: depl.ObjectMeta.ResourceVersion,
 			UID:             depl.ObjectMeta.UID,
@@ -490,7 +487,7 @@ func (deploy *NewDeploy) fnCreate(ctx context.Context, fn *fv1.Function) (*fscac
 		{
 			Kind:            "service",
 			Name:            svc.ObjectMeta.Name,
-			APIVersion:      svc.TypeMeta.APIVersion,
+			APIVersion:      svc.APIVersion,
 			Namespace:       svc.ObjectMeta.Namespace,
 			ResourceVersion: svc.ObjectMeta.ResourceVersion,
 			UID:             svc.ObjectMeta.UID,
@@ -498,7 +495,7 @@ func (deploy *NewDeploy) fnCreate(ctx context.Context, fn *fv1.Function) (*fscac
 		{
 			Kind:            "horizontalpodautoscaler",
 			Name:            hpa.ObjectMeta.Name,
-			APIVersion:      hpa.TypeMeta.APIVersion,
+			APIVersion:      hpa.APIVersion,
 			Namespace:       hpa.ObjectMeta.Namespace,
 			ResourceVersion: hpa.ObjectMeta.ResourceVersion,
 			UID:             hpa.ObjectMeta.UID,
@@ -37,7 +37,7 @@ const (
 func TestRefreshFuncPods(t *testing.T) {
 	os.Setenv("DEBUG_ENV", "true")
 	mgr := manager.New()
-	defer mgr.Wait()
+	t.Cleanup(mgr.Wait)
 	logger := loggerfactory.GetLogger()
 	kubernetesClient := fake.NewSimpleClientset()
 	fissionClient := fClient.NewSimpleClientset()
@@ -50,8 +50,7 @@ func TestRefreshFuncPods(t *testing.T) {
 	}
 	ndmInformerFactory := utils.GetInformerFactoryByExecutor(kubernetesClient, executorLabel, time.Minute*30)

-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()

 	fetcherConfig, err := fetcherConfig.MakeFetcherConfig("/userfunc")
 	if err != nil {
@@ -19,6 +19,7 @@ package poolmgr
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"math"
 	"net"
@@ -28,7 +29,6 @@ import (
 	"time"

 	"github.com/dchest/uniuri"
-	"github.com/pkg/errors"
 	"go.uber.org/zap"
 	appsv1 "k8s.io/api/apps/v1"
 	apiv1 "k8s.io/api/core/v1"
@@ -304,21 +304,23 @@ func (gp *GenericPool) choosePod(ctx context.Context, newLabels map[string]strin
 			// Relabel.  If the pod already got picked and
 			// modified, this should fail; in that case just
 			// retry.
-			labelPatch, _ := json.Marshal(newLabels)
-
 			// Append executor instance id to pod annotations to
 			// indicate this pod is managed by this executor.
 			annotations := gp.getDeployAnnotations(gp.env)
-			annotationPatch, _ := json.Marshal(annotations)
-
-			patch := fmt.Sprintf(`{"metadata":{"annotations":%v, "labels":%v}}`, string(annotationPatch), string(labelPatch))
-			logger.Info("relabel pod", zap.String("pod", patch))
-			newPod, err := gp.kubernetesClient.CoreV1().Pods(chosenPod.Namespace).Patch(ctx, chosenPod.Name, k8sTypes.StrategicMergePatchType, []byte(patch), metav1.PatchOptions{})
+			patch := map[string]interface{}{
+				"metadata": map[string]interface{}{
+					"annotations": annotations,
+					"labels":      newLabels,
+				},
+			}
+			patchBytes, _ := json.Marshal(patch)
+			logger.Info("relabel pod", zap.String("pod", string((patchBytes))))
+			newPod, err := gp.kubernetesClient.CoreV1().Pods(chosenPod.Namespace).Patch(ctx, chosenPod.Name, k8sTypes.StrategicMergePatchType, patchBytes, metav1.PatchOptions{})
 			if err != nil && errors.Is(err, context.Canceled) {
 				// ending retry loop when the request canceled
 				gp.readyPodQueue.Done(key)
 				gp.readyPodQueue.AddAfter(key, expoDelay)
-				return "", nil, errors.Errorf("failed to relabel pod: %s", err)
+				return "", nil, fmt.Errorf("failed to relabel pod: %s", err)
 			} else if err != nil {
 				logger.Error("failed to relabel pod", zap.Error(err), zap.String("pod", chosenPod.Name), zap.Duration("delay", expoDelay))
 				gp.readyPodQueue.Done(key)
@@ -333,13 +335,13 @@ func (gp *GenericPool) choosePod(ctx context.Context, newLabels map[string]strin
 			// So we have to check both of them to ensure the patch success.
 			for k, v := range newLabels {
 				if newPod.Labels[k] != v {
-					return "", nil, errors.Errorf("value of necessary labels '%s' mismatch: want '%s', get '%v'",
+					return "", nil, fmt.Errorf("value of necessary labels '%s' mismatch: want '%s', get '%v'",
 						k, v, newPod.Labels[k])
 				}
 			}
 			for k, v := range annotations {
 				if newPod.Annotations[k] != v {
-					return "", nil, errors.Errorf("value of necessary annotations '%s' mismatch: want '%s', get '%v'",
+					return "", nil, fmt.Errorf("value of necessary annotations '%s' mismatch: want '%s', get '%v'",
 						k, v, newPod.Annotations[k])
 				}
 			}
@@ -413,7 +415,7 @@ func (gp *GenericPool) specializePod(ctx context.Context, pod *apiv1.Pod, fn *fv
 	// for fetcher we don't need to create a service, just talk to the pod directly
 	podIP := pod.Status.PodIP
 	if len(podIP) == 0 {
-		return errors.Errorf("Pod %s in namespace %s has no IP", pod.ObjectMeta.Name, pod.ObjectMeta.Namespace)
+		return fmt.Errorf("pod %s in namespace %s has no IP", pod.ObjectMeta.Name, pod.ObjectMeta.Namespace)
 	}
 	for _, cm := range fn.Spec.ConfigMaps {
 		_, err := gp.kubernetesClient.CoreV1().ConfigMaps(gp.fnNamespace).Get(ctx, cm.Name, metav1.GetOptions{})
@@ -569,7 +571,7 @@ func (gp *GenericPool) getFuncSvc(ctx context.Context, fn *fv1.Function) (*fscac
 		}
 		if svc.ObjectMeta.Name != svcName {
 			go gp.scheduleDeletePod(context.Background(), pod.ObjectMeta.Name)
-			return nil, errors.Errorf("sanity check failed for svc %s", svc.ObjectMeta.Name)
+			return nil, fmt.Errorf("sanity check failed for svc %s", svc.ObjectMeta.Name)
 		}

 		// the fission router isn't in the same namespace, so return a
@@ -599,7 +601,7 @@ func (gp *GenericPool) getFuncSvc(ctx context.Context, fn *fv1.Function) (*fscac
 		{
 			Kind:            "pod",
 			Name:            pod.ObjectMeta.Name,
-			APIVersion:      pod.TypeMeta.APIVersion,
+			APIVersion:      pod.APIVersion,
 			Namespace:       pod.ObjectMeta.Namespace,
 			ResourceVersion: pod.ObjectMeta.ResourceVersion,
 			UID:             pod.ObjectMeta.UID,
@@ -189,8 +189,18 @@ func (gp *GenericPool) genDeploymentSpec(env *fv1.Environment) (*appsv1.Deployme
 		Template: pod,
 	}

+	// If custom runtime container name - default env name
+	mainContainerName := env.ObjectMeta.Name
+	if env.Spec.Runtime.Container != nil && env.Spec.Runtime.Container.Name != "" && env.Spec.Runtime.PodSpec != nil {
+		if util.DoesContainerExistInPodSpec(env.Spec.Runtime.Container.Name, env.Spec.Runtime.PodSpec) {
+			mainContainerName = env.Spec.Runtime.Container.Name
+		} else {
+			return nil, fmt.Errorf("runtime container %s not found in pod spec", env.Spec.Runtime.Container.Name)
+		}
+	}
+
 	// Order of merging is important here - first fetcher, then containers and lastly pod spec
-	err = gp.fetcherConfig.AddFetcherToPodSpec(&deploymentSpec.Template.Spec, env.ObjectMeta.Name)
+	err = gp.fetcherConfig.AddFetcherToPodSpec(&deploymentSpec.Template.Spec, mainContainerName)
 	if err != nil {
 		return nil, err
 	}
@@ -27,7 +27,6 @@ import (
 	"sync"
 	"time"

-	"github.com/fission/fission/pkg/executor/metrics"
 	"go.opentelemetry.io/otel/attribute"
 	"go.uber.org/zap"
 	apiv1 "k8s.io/api/core/v1"
@@ -47,6 +46,7 @@ import (
 	"github.com/fission/fission/pkg/crd"
 	"github.com/fission/fission/pkg/executor/executortype"
 	"github.com/fission/fission/pkg/executor/fscache"
+	"github.com/fission/fission/pkg/executor/metrics"
 	"github.com/fission/fission/pkg/executor/reaper"
 	executorUtils "github.com/fission/fission/pkg/executor/util"
 	fetcherConfig "github.com/fission/fission/pkg/fetcher/config"
@@ -368,9 +368,7 @@ func (gpm *GenericPoolManager) AdoptExistingResources(ctx context.Context) {
 			env := envs.Items[i]

 			if getEnvPoolSize(&env) > 0 {
-				wg.Add(1)
-				go func() {
-					defer wg.Done()
+				wg.Go(func() {
 					_, created, err := gpm.getPool(ctx, &env)
 					if err != nil {
 						gpm.logger.Error("adopt pool failed", zap.Error(err))
@@ -378,11 +376,11 @@ func (gpm *GenericPoolManager) AdoptExistingResources(ctx context.Context) {
 					if created {
 						gpm.logger.Info("created pool for the environment", zap.String("env", env.ObjectMeta.Name), zap.String("namespace", gpm.nsResolver.ResolveNamespace(gpm.nsResolver.FunctionNamespace)))
 					}
-				}()
+				})
 			}

 			// create environment map for later use
-			key := fmt.Sprintf("%s/%s", env.ObjectMeta.Namespace, env.ObjectMeta.Name)
+			key := k8sCache.MetaObjectToName(&env.ObjectMeta).String()
 			envMap[key] = env
 		}
 	}
@@ -407,10 +405,7 @@ func (gpm *GenericPoolManager) AdoptExistingResources(ctx context.Context) {
 				continue
 			}

-			wg.Add(1)
-			go func() {
-				defer wg.Done()
-
+			wg.Go(func() {
 				// avoid too many requests arrive Kubernetes API server at the same time.
 				time.Sleep(time.Duration(rand.Intn(30)) * time.Millisecond)

@@ -458,7 +453,7 @@ func (gpm *GenericPoolManager) AdoptExistingResources(ctx context.Context) {
 						{
 							Kind:            "pod",
 							Name:            pod.Name,
-							APIVersion:      pod.TypeMeta.APIVersion,
+							APIVersion:      pod.APIVersion,
 							Namespace:       pod.ObjectMeta.Namespace,
 							ResourceVersion: pod.ObjectMeta.ResourceVersion,
 							UID:             pod.ObjectMeta.UID,
@@ -482,7 +477,7 @@ func (gpm *GenericPoolManager) AdoptExistingResources(ctx context.Context) {

 				gpm.logger.Info("adopt function pod",
 					zap.String("pod", pod.Name), zap.Any("labels", pod.Labels), zap.Any("annotations", pod.Annotations))
-			}()
+			})
 		}
 	}

@@ -548,7 +543,7 @@ func (gpm *GenericPoolManager) service() {
 			pool, ok := gpm.pools[key]
 			if !ok {
 				gpm.logger.Error("Could not find pool", zap.String("environment", env.ObjectMeta.Name), zap.String("namespace", env.ObjectMeta.Namespace))
-				return
+				continue
 			}
 			delete(gpm.pools, key)
 			if pool != nil {
@@ -84,9 +84,9 @@ func NewPoolPodController(ctx context.Context, logger *zap.Logger,
 		envListerSynced:      make(map[string]k8sCache.InformerSynced, 0),
 		podLister:            make(map[string]corelisters.PodLister),
 		podListerSynced:      make(map[string]k8sCache.InformerSynced),
-		envCreateUpdateQueue: workqueue.NewTypedRateLimitingQueueWithConfig[string](workqueue.DefaultTypedControllerRateLimiter[string](), workqueue.TypedRateLimitingQueueConfig[string]{Name: "EnvAddUpdateQueue"}),
-		envDeleteQueue:       workqueue.NewTypedRateLimitingQueueWithConfig[*fv1.Environment](workqueue.DefaultTypedControllerRateLimiter[*fv1.Environment](), workqueue.TypedRateLimitingQueueConfig[*fv1.Environment]{Name: "EnvDeleteQueue"}),
-		spCleanupPodQueue:    workqueue.NewTypedRateLimitingQueueWithConfig[string](workqueue.DefaultTypedControllerRateLimiter[string](), workqueue.TypedRateLimitingQueueConfig[string]{Name: "SpecializedPodCleanupQueue"}),
+		envCreateUpdateQueue: workqueue.NewTypedRateLimitingQueueWithConfig(workqueue.DefaultTypedControllerRateLimiter[string](), workqueue.TypedRateLimitingQueueConfig[string]{Name: "EnvAddUpdateQueue"}),
+		envDeleteQueue:       workqueue.NewTypedRateLimitingQueueWithConfig(workqueue.DefaultTypedControllerRateLimiter[*fv1.Environment](), workqueue.TypedRateLimitingQueueConfig[*fv1.Environment]{Name: "EnvDeleteQueue"}),
+		spCleanupPodQueue:    workqueue.NewTypedRateLimitingQueueWithConfig(workqueue.DefaultTypedControllerRateLimiter[string](), workqueue.TypedRateLimitingQueueConfig[string]{Name: "SpecializedPodCleanupQueue"}),
 	}
 	if p.enableIstio {
 		for _, factory := range finformerFactory {
@@ -16,7 +16,6 @@ limitations under the License.
 package poolmgr

 import (
-	"context"
 	"strings"
 	"testing"
 	"time"
@@ -39,9 +38,8 @@ import (

 func TestPoolPodControllerPodCleanup(t *testing.T) {
 	mgr := manager.New()
-	defer mgr.Wait()
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	t.Cleanup(mgr.Wait)
+	ctx := t.Context()
 	logger := loggerfactory.GetLogger()
 	kubernetesClient := fake.NewSimpleClientset()
 	fissionClient := fClient.NewSimpleClientset()
@@ -33,7 +33,9 @@ func (gp *GenericPool) setupReadyPodController() error {
 	// avoid concurrent access to gp.deployment
 	gp.lock.Lock()
 	defer gp.lock.Unlock()
-	gp.readyPodQueue = workqueue.TypedNewDelayingQueue[string]()
+	gp.readyPodQueue = workqueue.NewTypedDelayingQueueWithConfig(workqueue.TypedDelayingQueueConfig[string]{
+		Name: "readyPodQueue",
+	})
 	informerFactory, err := utils.GetInformerFactoryByReadyPod(gp.kubernetesClient, gp.fnNamespace, gp.deployment.Spec.Selector)
 	if err != nil {
 		return err
@@ -22,7 +22,6 @@ import (
 	"sync"
 	"time"

-	"github.com/pkg/errors"
 	"go.opentelemetry.io/otel/attribute"
 	"go.uber.org/zap"
 	apiv1 "k8s.io/api/core/v1"
@@ -292,7 +291,7 @@ func (fsc *FunctionServiceCache) Add(fsvc FuncSvc) (*FuncSvc, error) {
 		if IsNameExistError(err) {
 			err = nil
 		} else {
-			err = errors.Wrap(err, "error caching fsvc")
+			err = fmt.Errorf("error caching fsvc: %w", err)
 		}
 		return nil, err
 	}
@@ -304,7 +303,7 @@ func (fsc *FunctionServiceCache) Add(fsvc FuncSvc) (*FuncSvc, error) {
 		if IsNameExistError(err) {
 			err = nil
 		} else {
-			err = errors.Wrap(err, "error caching fsvc by function uid")
+			err = fmt.Errorf("error caching fsvc by function uid: %w", err)
 		}
 		return nil, err
 	}
@@ -383,10 +382,6 @@ func (fsc *FunctionServiceCache) DeleteFunctionSvc(ctx context.Context, fsvc *Fu
 	}
 }

-func (fsc *FunctionServiceCache) SetCPUUtilization(key crd.CacheKeyURG, svcHost string, cpuUsage resource.Quantity) {
-	fsc.connFunctionCache.SetCPUUtilization(key, svcHost, cpuUsage)
-}
-
 // DeleteOld deletes aged function service entries from cache.
 func (fsc *FunctionServiceCache) DeleteOld(fsvc *FuncSvc, minAge time.Duration) (bool, error) {
 	if time.Since(fsvc.Atime) < minAge {
@@ -1,7 +1,6 @@
 package fscache

 import (
-	"context"
 	"log"
 	"testing"
 	"time"
@@ -157,8 +156,7 @@ func TestFunctionServiceNewCache(t *testing.T) {
 		},
 	}

-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()

 	fsc.AddFunc(ctx, *fsvc, 10, fn.GetRetainPods())
 	concurrency := 10
@@ -306,7 +306,7 @@ func (c *PoolCache) service() {
 			datawriter := bufio.NewWriter(req.dumpWriter)

 			writefnSvcGrp := func(svcGrp *funcSvcGroup) error {
-				_, err := datawriter.WriteString(fmt.Sprintf("svc_waiting:%d\tqueue_len:%d", svcGrp.svcWaiting, svcGrp.queue.Len()))
+				_, err := fmt.Fprintf(datawriter, "svc_waiting:%d\tqueue_len:%d", svcGrp.svcWaiting, svcGrp.queue.Len())
 				if err != nil {
 					return err
 				}
@@ -319,8 +319,8 @@ func (c *PoolCache) service() {
 				}

 				for addr, fnSvc := range svcGrp.svcs {
-					_, err := datawriter.WriteString(fmt.Sprintf("\tfunction_name:%s\tfn_svc_address:%s\tactive_req:%d\tcurrent_cpu_usage:%v\tcpu_limit:%v\n",
-						fnSvc.val.Function.Name, addr, fnSvc.activeRequests, fnSvc.currentCPUUsage, fnSvc.cpuLimit))
+					_, err := fmt.Fprintf(datawriter, "\tfunction_name:%s\tfn_svc_address:%s\tactive_req:%d\tcurrent_cpu_usage:%v\tcpu_limit:%v\n",
+						fnSvc.val.Function.Name, addr, fnSvc.activeRequests, fnSvc.currentCPUUsage, fnSvc.cpuLimit)
 					if err != nil {
 						return err
 					}
@@ -24,8 +24,7 @@ func checkErr(err error) {
 }

 func TestPoolCache(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()
 	logger := loggerfactory.GetLogger()
 	concurrency := 5
 	requestsPerPod := 2
@@ -225,32 +224,33 @@ func TestPoolCacheRequests(t *testing.T) {
 			}
 			for i := 1; i <= tt.requests; i++ {
 				reqno := i
-				wg.Add(1)
-				go func(reqno int) {
-					defer wg.Done()
-					svc, err := p.GetSvcValue(context.Background(), key, tt.rpp, tt.concurrency)
-					if err != nil {
-						code, _ := ferror.GetHTTPError(err)
-						if code == http.StatusNotFound {
-							atomic.AddUint64(&svcCounter, 1)
-							address := fmt.Sprintf("svc-%d", atomic.LoadUint64(&svcCounter))
-							p.SetSvcValue(context.Background(), key, address, &FuncSvc{
-								Name: address,
-							}, resource.MustParse("45m"), tt.rpp, tt.retainPods)
+				wg.Go(func() {
+					func(reqno int) {
+						svc, err := p.GetSvcValue(context.Background(), key, tt.rpp, tt.concurrency)
+						if err != nil {
+							code, _ := ferror.GetHTTPError(err)
+							if code == http.StatusNotFound {
+								atomic.AddUint64(&svcCounter, 1)
+								address := fmt.Sprintf("svc-%d", atomic.LoadUint64(&svcCounter))
+								p.SetSvcValue(context.Background(), key, address, &FuncSvc{
+									Name: address,
+								}, resource.MustParse("45m"), tt.rpp, tt.retainPods)
+							} else {
+								t.Log(reqno, "=>", err)
+								atomic.AddUint64(&failedRequests, 1)
+							}
 						} else {
-							t.Log(reqno, "=>", err)
-							atomic.AddUint64(&failedRequests, 1)
+							if svc == nil {
+								t.Log(reqno, "=>", "svc is nil")
+								atomic.AddUint64(&failedRequests, 1)
+							}
+							// } else {
+							// 	t.Log(reqno, "=>", svc.Name)
+							// }
 						}
-					} else {
-						if svc == nil {
-							t.Log(reqno, "=>", "svc is nil")
-							atomic.AddUint64(&failedRequests, 1)
-						}
-						// } else {
-						// 	t.Log(reqno, "=>", svc.Name)
-						// }
-					}
-				}(reqno)
+					}(reqno)
+				})
+
 				if reqno%simultaneous == 0 {
 					wg.Wait()
 				}
@@ -262,12 +262,12 @@ func TestPoolCacheRequests(t *testing.T) {

 			for i := 0; i < tt.concurrency; i++ {
 				for j := 0; j < tt.rpp; j++ {
-					wg.Add(1)
 					svcno := i
-					go func(svcno int) {
-						defer wg.Done()
-						p.MarkAvailable(key, fmt.Sprintf("svc-%d", svcno+1))
-					}(svcno)
+					wg.Go(func() {
+						func(svcno int) {
+							p.MarkAvailable(key, fmt.Sprintf("svc-%d", svcno+1))
+						}(svcno)
+					})
 				}
 			}
 			wg.Wait()
@@ -48,16 +48,14 @@ func TestQueuePushWithConcurrentRequest(t *testing.T) {
 	q := NewQueue()
 	noOfRequests := 20
 	var wg sync.WaitGroup
-	wg.Add(noOfRequests)
 	for i := 0; i < noOfRequests; i++ {
-		go func() {
-			defer wg.Done()
+		wg.Go(func() {
 			item := &svcWait{
 				svcChannel: make(chan *FuncSvc),
 				ctx:        nil,
 			}
 			q.Push(item)
-		}()
+		})
 	}

 	wg.Wait()
@@ -17,8 +17,9 @@ limitations under the License.
 package metrics

 import (
-	"github.com/fission/fission/pkg/utils/metrics"
 	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/fission/fission/pkg/utils/metrics"
 )

 var (
@@ -16,7 +16,6 @@ limitations under the License.
 package hpa

 import (
-	"context"
 	"strings"
 	"testing"

@@ -58,8 +57,7 @@ func TestHpaOps(t *testing.T) {
 		t.Errorf("Expected instanceID to be %v, got %v", instanceID, hpaops.instanceID)
 	}

-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()

 	deployLabels := map[string]string{
 		"test-label": "test-label-value",
@@ -168,3 +168,13 @@ func CreateDumpFile(logger *zap.Logger) (*os.File, error) {

 	return os.Create(fmt.Sprintf("%s/%s-%d.txt", dumpPath, dumpFileName, time.Now().Unix()))
 }
+
+// DoesContainerExistInPodSpec checks if the container with the given name exists in the pod spec
+func DoesContainerExistInPodSpec(containerName string, podSpec *apiv1.PodSpec) bool {
+	for _, container := range podSpec.Containers {
+		if container.Name == containerName {
+			return true
+		}
+	}
+	return false
+}
@@ -23,10 +23,10 @@ import (
 	"testing"

 	"github.com/google/go-cmp/cmp"
+	apiv1 "k8s.io/api/core/v1"

 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
 	"github.com/fission/fission/pkg/utils/loggerfactory"
-	apiv1 "k8s.io/api/core/v1"
 )

 func TestGetSpecFromConfigMap(t *testing.T) {
@@ -55,7 +55,7 @@ securityContext:
 	}

 	var permissionNum int64 = 10001
-	var runAsNonRoot bool = true
+	var runAsNonRoot = true

 	testSpecPatch := apiv1.PodSpec{
 		SecurityContext: &apiv1.PodSecurityContext{
@@ -4,12 +4,12 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"strings"
 	"time"

-	"github.com/pkg/errors"
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
 	"go.uber.org/zap"
 	"golang.org/x/net/context/ctxhttp"
@@ -104,7 +104,7 @@ func sendRequest(logger *zap.Logger, ctx context.Context, httpClient *http.Clien
 		// skip retry and return directly due to context deadline exceeded
 		if err == context.DeadlineExceeded {
 			msg := "error specializing function pod, either increase the specialization timeout for function or check function pod log would help."
-			err = errors.Wrap(err, msg)
+			err = fmt.Errorf("%s: %w", msg, err)
 			logger.Error(msg, zap.Error(err), zap.String("url", url))
 			return nil, err
 		}
@@ -7,7 +7,6 @@ import (
 	"path/filepath"

 	"github.com/hashicorp/go-multierror"
-	"github.com/pkg/errors"
 	apiv1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -69,7 +68,7 @@ func MakeFetcherConfig(sharedMountPath string) (*Config, error) {

 	fetcherImage := os.Getenv("FETCHER_IMAGE")
 	if len(fetcherImage) == 0 {
-		fetcherImage = "fission/fetcher"
+		fetcherImage = "ghcr.io/fission/fetcher"
 	}

 	fetcherImagePullPolicy := os.Getenv("FETCHER_IMAGE_PULL_POLICY")
@@ -305,7 +304,7 @@ func (cfg *Config) addFetcherToPodSpecWithCommand(podSpec *apiv1.PodSpec, mainCo
 		for _, existingContainer := range podSpec.Containers {
 			existingContainerNames = append(existingContainerNames, existingContainer.Name)
 		}
-		return errors.Errorf("could not find main container '%s' in given PodSpec. Found: %v",
+		return fmt.Errorf("could not find main container '%s' in given PodSpec. Found: %v",
 			mainContainerName,
 			existingContainerNames)
 	}
@@ -20,6 +20,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -29,8 +30,6 @@ import (
 	"time"

 	"github.com/google/uuid"
-	"github.com/mholt/archiver/v3"
-	"github.com/pkg/errors"
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
 	"go.uber.org/zap"
 	"golang.org/x/net/context/ctxhttp"
@@ -93,21 +92,21 @@ func MakeFetcher(logger *zap.Logger, clientGen crd.ClientGeneratorInterface, sha

 	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		return nil, errors.Wrap(err, "error making the fission client")
+		return nil, fmt.Errorf("error making the fission client: %w", err)
 	}
 	kubeClient, err := clientGen.GetKubernetesClient()
 	if err != nil {
-		return nil, errors.Wrap(err, "error making the kube client")
+		return nil, fmt.Errorf("error making the kube client: %w", err)
 	}

 	name, err := os.ReadFile(podInfoMountDir + "/name")
 	if err != nil {
-		return nil, errors.Wrap(err, "error reading pod name from downward volume")
+		return nil, fmt.Errorf("error reading pod name from downward volume: %w", err)
 	}

 	namespace, err := os.ReadFile(podInfoMountDir + "/namespace")
 	if err != nil {
-		return nil, errors.Wrap(err, "error reading pod namespace from downward volume")
+		return nil, fmt.Errorf("error reading pod namespace from downward volume: %w", err)
 	}

 	hc := &http.Client{Transport: otelhttp.NewTransport(http.DefaultTransport)}
@@ -141,7 +140,7 @@ func writeSecretOrConfigMap(dataMap map[string][]byte, dirPath string) error {
 		writeFilePath := filepath.Join(dirPath, key)
 		err := os.WriteFile(writeFilePath, val, 0750)
 		if err != nil {
-			return errors.Wrapf(err, "Failed to write file %s", writeFilePath)
+			return fmt.Errorf("failed to write file %s: %w", writeFilePath, err)
 		}
 	}
 	return nil
@@ -253,15 +252,14 @@ func (fetcher *Fetcher) SpecializeHandler(w http.ResponseWriter, r *http.Request
 func (fetcher *Fetcher) Fetch(ctx context.Context, pkg *fv1.Package, req FunctionFetchRequest) (int, error) {
 	logger := otelUtils.LoggerWithTraceID(ctx, fetcher.logger)

-	// check that the requested filename is not an empty string and error out if so
-	if len(req.Filename) == 0 {
-		e := "fetch request received for an empty file name"
-		logger.Error(e, zap.Any("request", req))
-		return http.StatusBadRequest, errors.New(fmt.Sprintf("%s, request: %v", e, req))
+	storePath, err := utils.SanitizeFilePath(filepath.Join(fetcher.sharedVolumePath, req.Filename), fetcher.sharedVolumePath)
+	if err != nil {
+		logger.Error(err.Error(), zap.String("filename", req.Filename))
+		return http.StatusBadRequest, fmt.Errorf("%s, request: %v", err, req)
 	}

 	// verify first if the file already exists.
-	if _, err := os.Stat(filepath.Join(fetcher.sharedVolumePath, req.Filename)); err == nil {
+	if _, err := os.Stat(storePath); err == nil {
 		logger.Info("requested file already exists at shared volume - skipping fetch",
 			zap.String("requested_file", req.Filename),
 			zap.String("shared_volume_path", fetcher.sharedVolumePath))
@@ -269,8 +267,11 @@ func (fetcher *Fetcher) Fetch(ctx context.Context, pkg *fv1.Package, req Functio
 		return http.StatusOK, nil
 	}

-	tmpFile := req.Filename + ".tmp"
-	tmpPath := filepath.Join(fetcher.sharedVolumePath, tmpFile)
+	tmpPath, err := utils.SanitizeFilePath(storePath+".tmp", fetcher.sharedVolumePath)
+	if err != nil {
+		logger.Error(err.Error(), zap.String("filename", req.Filename))
+		return http.StatusBadRequest, fmt.Errorf("%s, request: %v", err, req)
+	}

 	if req.FetchType == fv1.FETCH_URL {
 		otelUtils.SpanTrackEvent(ctx, "fetch_url", otelUtils.MapToAttributes(map[string]string{
@@ -283,7 +284,7 @@ func (fetcher *Fetcher) Fetch(ctx context.Context, pkg *fv1.Package, req Functio
 		if err != nil {
 			e := "failed to download url"
 			logger.Error(e, zap.Error(err), zap.String("url", req.Url))
-			return http.StatusBadRequest, errors.Wrapf(err, "%s: %s", e, req.Url)
+			return http.StatusBadRequest, fmt.Errorf("%s: %s: %w", e, req.Url, err)
 		}
 	} else {
 		var archive *fv1.Archive
@@ -297,10 +298,10 @@ func (fetcher *Fetcher) Fetch(ctx context.Context, pkg *fv1.Package, req Functio
 			if pkg.Status.BuildStatus != fv1.BuildStatusSucceeded && pkg.Status.BuildStatus != fv1.BuildStatusNone {
 				e := fmt.Sprintf("cannot fetch deployment: package build status was not %q", fv1.BuildStatusSucceeded)
 				logger.Error(e,
-					zap.String("package_name", pkg.ObjectMeta.Name),
-					zap.String("package_namespace", pkg.ObjectMeta.Namespace),
+					zap.String("package_name", pkg.Name),
+					zap.String("package_namespace", pkg.Namespace),
 					zap.Any("package_build_status", pkg.Status.BuildStatus))
-				return http.StatusInternalServerError, errors.New(fmt.Sprintf("%s: pkg %s.%s has a status of %s", e, pkg.ObjectMeta.Name, pkg.ObjectMeta.Namespace, pkg.Status.BuildStatus))
+				return http.StatusInternalServerError, fmt.Errorf("%s: pkg %s.%s has a status of %s", e, pkg.Name, pkg.Namespace, pkg.Status.BuildStatus)
 			}
 			archive = &pkg.Spec.Deployment
 		} else {
@@ -314,7 +315,7 @@ func (fetcher *Fetcher) Fetch(ctx context.Context, pkg *fv1.Package, req Functio
 			if err != nil {
 				e := "failed to write file"
 				logger.Error(e, zap.Error(err), zap.String("location", tmpPath))
-				return http.StatusInternalServerError, errors.Wrapf(err, "%s %s", e, tmpPath)
+				return http.StatusInternalServerError, fmt.Errorf("%s %s: %w", e, tmpPath, err)
 			}
 			otelUtils.SpanTrackEvent(ctx, "archiveLiteral", otelUtils.GetAttributesForPackage(pkg)...)
 		} else {
@@ -328,7 +329,7 @@ func (fetcher *Fetcher) Fetch(ctx context.Context, pkg *fv1.Package, req Functio
 			if err != nil {
 				e := "failed to download url"
 				logger.Error(e, zap.Error(err), zap.String("url", req.Url))
-				return http.StatusBadRequest, errors.Wrapf(err, "%s %s", e, req.Url)
+				return http.StatusBadRequest, fmt.Errorf("%s %s: %w", e, req.Url, err)
 			}

 			// check file integrity only if checksum is not empty.
@@ -337,23 +338,23 @@ func (fetcher *Fetcher) Fetch(ctx context.Context, pkg *fv1.Package, req Functio
 				if err != nil {
 					e := "failed to get checksum"
 					logger.Error(e, zap.Error(err))
-					return http.StatusBadRequest, errors.Wrap(err, e)
+					return http.StatusBadRequest, fmt.Errorf("%s: %w", e, err)
 				}
 				err = verifyChecksum(checksum, &archive.Checksum)
 				if err != nil {
 					e := "failed to verify checksum"
 					logger.Error(e, zap.Error(err))
-					return http.StatusBadRequest, errors.Wrap(err, e)
+					return http.StatusBadRequest, fmt.Errorf("%s: %w", e, err)
 				}
 			}
 		}
 	}

 	// checking if file is a zip
-	if match, _ := utils.IsZip(tmpPath); match && !req.KeepArchive {
+	if match, _ := utils.IsZip(ctx, tmpPath); match && !req.KeepArchive {
 		// unarchive tmp file to a tmp unarchive path
 		tmpUnarchivePath := filepath.Join(fetcher.sharedVolumePath, uuid.NewString())
-		err := fetcher.unarchive(tmpPath, tmpUnarchivePath)
+		err := utils.Unarchive(ctx, tmpPath, tmpUnarchivePath)
 		if err != nil {
 			logger.Error("error unarchive",
 				zap.Error(err),
@@ -366,18 +367,17 @@ func (fetcher *Fetcher) Fetch(ctx context.Context, pkg *fv1.Package, req Functio
 	}

 	// move tmp file to requested filename
-	renamePath := filepath.Join(fetcher.sharedVolumePath, req.Filename)
-	err := fetcher.rename(tmpPath, renamePath)
+	err = fetcher.rename(tmpPath, storePath)
 	if err != nil {
 		logger.Error("error renaming file",
 			zap.Error(err),
 			zap.String("original_path", tmpPath),
-			zap.String("rename_path", renamePath))
-		return http.StatusInternalServerError, err
+			zap.String("rename_path", storePath))
+		return http.StatusInternalServerError, fmt.Errorf("error renaming file: %w", err)
 	}

 	otelUtils.SpanTrackEvent(ctx, "packageFetched", otelUtils.GetAttributesForPackage(pkg)...)
-	logger.Info("successfully placed", zap.String("location", renamePath))
+	logger.Info("successfully placed", zap.String("location", storePath))
 	return http.StatusOK, nil
 }

@@ -406,8 +406,12 @@ func (fetcher *Fetcher) FetchSecretsAndCfgMaps(ctx context.Context, secrets []fv
 				return httpCode, errors.New(e)
 			}

-			secretPath := filepath.Join(secret.Namespace, secret.Name)
-			secretDir := filepath.Join(fetcher.sharedSecretPath, secretPath)
+			secretDir, err := utils.SanitizeFilePath(filepath.Join(fetcher.sharedSecretPath, secret.Namespace, secret.Name), fetcher.sharedSecretPath)
+			if err != nil {
+				logger.Error(err.Error(), zap.String("directory", secretDir), zap.String("secret_name", secret.Name), zap.String("secret_namespace", secret.Namespace))
+				return http.StatusBadRequest, fmt.Errorf("%s, request: %v", err, secret)
+			}
+
 			err = os.MkdirAll(secretDir, os.ModeDir|0750)
 			if err != nil {
 				e := "failed to create directory for secret"
@@ -416,7 +420,7 @@ func (fetcher *Fetcher) FetchSecretsAndCfgMaps(ctx context.Context, secrets []fv
 					zap.String("directory", secretDir),
 					zap.String("secret_name", secret.Name),
 					zap.String("secret_namespace", secret.Namespace))
-				return http.StatusInternalServerError, errors.Wrapf(err, "%s: %s", e, secretDir)
+				return http.StatusInternalServerError, fmt.Errorf("%s: %s: %w", e, secretDir, err)
 			}
 			err = writeSecretOrConfigMap(data.Data, secretDir)
 			if err != nil {
@@ -454,8 +458,13 @@ func (fetcher *Fetcher) FetchSecretsAndCfgMaps(ctx context.Context, secrets []fv
 				return httpCode, errors.New(e)
 			}

-			configPath := filepath.Join(config.Namespace, config.Name)
-			configDir := filepath.Join(fetcher.sharedConfigPath, configPath)
+			configDir, err := utils.SanitizeFilePath(filepath.Join(fetcher.sharedConfigPath, config.Namespace, config.Name), fetcher.sharedConfigPath)
+			if err != nil {
+				logger.Error(err.Error(), zap.String("directory", configDir), zap.String("config_map_name", config.Name), zap.String("config_map_namespace", config.Namespace))
+				return http.StatusBadRequest, fmt.Errorf("%s, request: %v", err,
+					config)
+			}
+
 			err = os.MkdirAll(configDir, os.ModeDir|0750)
 			if err != nil {
 				e := "failed to create directory for configmap"
@@ -464,7 +473,7 @@ func (fetcher *Fetcher) FetchSecretsAndCfgMaps(ctx context.Context, secrets []fv
 					zap.String("directory", configDir),
 					zap.String("config_map_name", config.Name),
 					zap.String("config_map_namespace", config.Namespace))
-				return http.StatusInternalServerError, errors.Wrapf(err, "%s: %s", e, configDir)
+				return http.StatusInternalServerError, fmt.Errorf("%s: %s: %w", e, configDir, err)
 			}
 			configMap := make(map[string][]byte)
 			for key, val := range data.Data {
@@ -519,11 +528,21 @@ func (fetcher *Fetcher) UploadHandler(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, err.Error(), http.StatusBadRequest)
 		return
 	}
+
 	logger.Info("fetcher received upload request", zap.Any("request", req))

-	zipFilename := req.Filename + ".zip"
-	srcFilepath := filepath.Join(fetcher.sharedVolumePath, req.Filename)
-	dstFilepath := filepath.Join(fetcher.sharedVolumePath, zipFilename)
+	srcFilepath, err := utils.SanitizeFilePath(filepath.Join(fetcher.sharedVolumePath, req.Filename), fetcher.sharedVolumePath)
+	if err != nil {
+		logger.Error("error sanitizing file path", zap.Error(err))
+		http.Error(w, fmt.Sprintf("%s: %v", err, req.Filename), http.StatusBadRequest)
+		return
+	}
+	dstFilepath, err := utils.SanitizeFilePath(filepath.Join(fetcher.sharedVolumePath, req.Filename+".zip"), fetcher.sharedVolumePath)
+	if err != nil {
+		logger.Error("error sanitizing file path", zap.Error(err))
+		http.Error(w, fmt.Sprintf("%s: %v", err, req.Filename), http.StatusBadRequest)
+		return
+	}

 	defer func() {
 		errC := utils.DeleteOldPackages(srcFilepath, "DEPLOY_PKG")
@@ -534,7 +553,7 @@ func (fetcher *Fetcher) UploadHandler(w http.ResponseWriter, r *http.Request) {
 	}()

 	if req.ArchivePackage {
-		err = fetcher.archive(srcFilepath, dstFilepath)
+		err = utils.Archive(ctx, srcFilepath, dstFilepath)
 		if err != nil {
 			e := "error archiving zip file"
 			logger.Error(e, zap.Error(err), zap.String("source", srcFilepath), zap.String("destination", dstFilepath))
@@ -598,40 +617,7 @@ func (fetcher *Fetcher) UploadHandler(w http.ResponseWriter, r *http.Request) {
 func (fetcher *Fetcher) rename(src string, dst string) error {
 	err := os.Rename(src, dst)
 	if err != nil {
-		return errors.Wrap(err, "failed to move file")
-	}
-	return nil
-}
-
-// archive zips the contents of directory at src into a new zip file
-// at dst (note that the contents are zipped, not the directory itself).
-func (fetcher *Fetcher) archive(src string, dst string) error {
-	var files []string
-	target, err := os.Stat(src)
-	if err != nil {
-		return errors.Wrap(err, "failed to zip file")
-	}
-	if target.IsDir() {
-		// list all
-		fs, _ := os.ReadDir(src)
-		for _, f := range fs {
-			files = append(files, filepath.Join(src, f.Name()))
-		}
-	} else {
-		files = append(files, src)
-	}
-	zip := archiver.NewZip()
-	defer zip.Close()
-	return zip.Archive(files, dst)
-}
-
-// unarchive is a function that unzips a zip file to destination
-func (fetcher *Fetcher) unarchive(src string, dst string) error {
-	zip := archiver.NewZip()
-	defer zip.Close()
-	err := zip.Unarchive(src, dst)
-	if err != nil {
-		return fmt.Errorf("failed to unzip file: %w", err)
+		return fmt.Errorf("failed to move file: %w", err)
 	}
 	return nil
 }
@@ -687,17 +673,17 @@ func (fetcher *Fetcher) SpecializePod(ctx context.Context, fetchReq FunctionFetc

 	pkg, err := fetcher.getPkgInformation(ctx, fetchReq)
 	if err != nil {
-		return errors.Wrap(err, "error getting package information")
+		return fmt.Errorf("error getting package information: %w", err)
 	}

 	_, err = fetcher.Fetch(ctx, pkg, fetchReq)
 	if err != nil {
-		return errors.Wrap(err, "error fetching deploy package")
+		return fmt.Errorf("error fetching deploy package: %w", err)
 	}

 	_, err = fetcher.FetchSecretsAndCfgMaps(ctx, fetchReq.Secrets, fetchReq.ConfigMaps)
 	if err != nil {
-		return errors.Wrap(err, "error fetching secrets/configs")
+		return fmt.Errorf("error fetching secrets/configs: %w", err)
 	}

 	// Specialize the pod
@@ -709,7 +695,7 @@ func (fetcher *Fetcher) SpecializePod(ctx context.Context, fetchReq FunctionFetc

 	loadPayload, err := json.Marshal(loadReq)
 	if err != nil {
-		return errors.Wrap(err, "error encoding load request")
+		return fmt.Errorf("error encoding load request: %w", err)
 	}

 	// Instead of using "localhost", here we use "127.0.0.1" for
@@ -753,10 +739,10 @@ func (fetcher *Fetcher) SpecializePod(ctx context.Context, fetchReq FunctionFetc
 			err = ferror.MakeErrorFromHTTP(resp)
 		}

-		return errors.Wrap(err, "error specializing function pod")
+		return fmt.Errorf("error specializing function pod: %w", err)
 	}

-	return errors.Wrapf(err, "error specializing function pod after %v times", maxRetries)
+	return fmt.Errorf("error specializing function pod after %v times: %w", maxRetries, err)
 }

 // WsStartHandler is used to generate websocket events in Kubernetes
@@ -266,7 +266,7 @@ func (u Cli) Int64(key string) int64 {

 func (u Cli) Int64Slice(key string) []int64 {
 	v, _ := u.c.Flags().GetIntSlice(key)
-	vals := make([]int64, len(v))
+	vals := make([]int64, 0, len(v))
 	for _, i := range v {
 		vals = append(vals, int64(i))
 	}
@@ -17,10 +17,10 @@ limitations under the License.
 package canaryconfig

 import (
+	"errors"
 	"fmt"
 	"time"

-	"github.com/pkg/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
@@ -57,7 +57,7 @@ func (opts *CreateSubCommand) complete(input cli.Input) (err error) {

 	_, fnNs, err := opts.GetResourceNamespace(input, flagkey.NamespaceFunction)
 	if err != nil {
-		return errors.Wrap(err, "error in creating canaryconfig")
+		return fmt.Errorf("error in creating canaryconfig: %w", err)
 	}
 	incrementStep := input.Int(flagkey.CanaryWeightIncrement)
 	failureThreshold := input.Int(flagkey.CanaryFailureThreshold)
@@ -66,13 +66,13 @@ func (opts *CreateSubCommand) complete(input cli.Input) (err error) {
 	// check for time parsing
 	_, err = time.ParseDuration(incrementInterval)
 	if err != nil {
-		return errors.Wrap(err, "error parsing time duration")
+		return fmt.Errorf("error parsing time duration: %w", err)
 	}

 	// check that the trigger exists in the same namespace.
 	htTrigger, err := opts.Client().FissionClientSet.CoreV1().HTTPTriggers(fnNs).Get(input.Context(), ht, metav1.GetOptions{})
 	if err != nil {
-		return errors.Wrap(err, "error finding http trigger referenced in the canary config")
+		return fmt.Errorf("error finding http trigger referenced in the canary config: %w", err)
 	}

 	// check that the trigger has function reference type function weights
@@ -95,7 +95,7 @@ func (opts *CreateSubCommand) complete(input cli.Input) (err error) {
 	fnList := []string{newFunc, oldFunc}
 	err = util.CheckFunctionExistence(input.Context(), opts.Client(), fnList, fnNs)
 	if err != nil {
-		return errors.Wrap(err, "error checking functions existence")
+		return fmt.Errorf("error checking functions existence: %w", err)
 	}

 	// finally create canaryCfg in the same namespace as the functions referenced
@@ -124,7 +124,7 @@ func (opts *CreateSubCommand) complete(input cli.Input) (err error) {
 func (opts *CreateSubCommand) run(input cli.Input) error {
 	_, err := opts.Client().FissionClientSet.CoreV1().CanaryConfigs(opts.canary.ObjectMeta.Namespace).Create(input.Context(), opts.canary, metav1.CreateOptions{})
 	if err != nil {
-		return errors.Wrap(err, "error creating canary config")
+		return fmt.Errorf("error creating canary config: %w", err)
 	}

 	fmt.Printf("canary config '%s' created\n", opts.canary.ObjectMeta.Name)
@@ -19,7 +19,6 @@ package canaryconfig
 import (
 	"fmt"

-	"github.com/pkg/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

 	"github.com/fission/fission/pkg/fission-cli/cliwrapper/cli"
@@ -39,7 +38,7 @@ func Delete(input cli.Input) error {
 func (opts *DeleteSubCommand) run(input cli.Input) (err error) {
 	_, namespace, err := opts.GetResourceNamespace(input, flagkey.NamespaceCanary)
 	if err != nil {
-		return errors.Wrap(err, "error in deleting canaryConfig ")
+		return fmt.Errorf("error in deleting canaryConfig: %w", err)
 	}

 	err = opts.Client().FissionClientSet.CoreV1().CanaryConfigs(namespace).Delete(input.Context(), input.String(flagkey.CanaryName), metav1.DeleteOptions{})
@@ -47,7 +46,7 @@ func (opts *DeleteSubCommand) run(input cli.Input) (err error) {
 		if input.Bool(flagkey.IgnoreNotFound) && util.IsNotFound(err) {
 			return nil
 		}
-		return errors.Wrap(err, "error deleting canary config")
+		return fmt.Errorf("error deleting canary config: %w", err)
 	}

 	fmt.Printf("canaryconfig '%v.%v' deleted\n", input.String(flagkey.CanaryName), namespace)
@@ -21,7 +21,6 @@ import (
 	"os"
 	"text/tabwriter"

-	"github.com/pkg/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

 	"github.com/fission/fission/pkg/fission-cli/cliwrapper/cli"
@@ -41,12 +40,12 @@ func (opts *GetSubCommand) run(input cli.Input) (err error) {

 	_, namespace, err := opts.GetResourceNamespace(input, flagkey.NamespaceCanary)
 	if err != nil {
-		return errors.Wrap(err, "error getting canary config")
+		return fmt.Errorf("error getting canary config: %w", err)
 	}

 	canaryCfg, err := opts.Client().FissionClientSet.CoreV1().CanaryConfigs(namespace).Get(input.Context(), input.String(flagkey.CanaryName), metav1.GetOptions{})
 	if err != nil {
-		return errors.Wrap(err, "error getting canary config")
+		return fmt.Errorf("error getting canary config: %w", err)
 	}

 	w := tabwriter.NewWriter(os.Stdout, 0, 0, 1, ' ', 0)
@@ -21,7 +21,6 @@ import (
 	"os"
 	"text/tabwriter"

-	"github.com/pkg/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

 	"github.com/fission/fission/pkg/fission-cli/cliwrapper/cli"
@@ -49,7 +48,7 @@ func (opts *ListSubCommand) do(input cli.Input) error {
 func (opts *ListSubCommand) complete(input cli.Input) (err error) {
 	_, opts.namespace, err = opts.GetResourceNamespace(input, flagkey.NamespaceCanary)
 	if err != nil {
-		return errors.Wrap(err, "error in listing canary config ")
+		return fmt.Errorf("error in listing canary config: %w", err)
 	}
 	return nil
 }
@@ -62,7 +61,7 @@ func (opts *ListSubCommand) run(input cli.Input) (err error) {
 	canaryCfgs, err := opts.Client().FissionClientSet.CoreV1().CanaryConfigs(opts.namespace).List(input.Context(), metav1.ListOptions{})

 	if err != nil {
-		return errors.Wrap(err, "error listing canary config")
+		return fmt.Errorf("error listing canary config: %w", err)
 	}

 	w := tabwriter.NewWriter(os.Stdout, 0, 0, 1, ' ', 0)
--- a/Show More
+++ b/Show More