Update dependabot.yml for formatting and ignore rules (#3292 )

* Update dependabot.yml for formatting and ignore rules Adjusted formatting and added ignore rules for dependencies in test directories. Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * Fix dependabot file Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * code cleanup Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * All paths under test ignore Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * more fix Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> --------- Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
Chart version update (#3291 )
2025-12-15 13:30:10 +05:30 · 2025-12-15 12:04:14 +05:30 · 2025-12-15 10:22:27 +05:30 · 2025-12-15 09:51:10 +05:30 · 2025-12-15 09:50:13 +05:30 · 2025-12-15 09:49:37 +05:30
243 changed files with 5059 additions and 3122 deletions
@@ -20,6 +20,8 @@ updates:
    schedule:
      interval: weekly
    open-pull-requests-limit: 5
+    exclude-paths:
+      - "test/**"
    groups:
      docker-images:
        patterns:
@@ -30,7 +32,19 @@ updates:
    schedule:
      interval: weekly
    open-pull-requests-limit: 5
+    exclude-paths:
+      - "test/**"
    groups:
      go-dependencies:
        patterns:
          - "*"
+
+  - package-ecosystem: helm
+    directory: /charts/fission-all
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      helm-charts:
+        patterns:
+          - "*"
@@ -14,6 +14,10 @@ on:
 permissions:
  contents: read

+concurrency:
+  group: fission-codeql-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
  CodeQL-Build:
    permissions:
@@ -24,23 +28,23 @@ jobs:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Check out code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: setup go
-        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
+        uses: github/codeql-action/init@1b168cd39490f61582a9beae412bb7057a6b2c4e # v4.31.8
        with:
          languages: go

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
+        uses: github/codeql-action/analyze@1b168cd39490f61582a9beae412bb7057a6b2c4e # v4.31.8
@@ -12,16 +12,20 @@ on: [pull_request]
 permissions:
  contents: read

+concurrency:
+  group: fission-dependency-review-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
  dependency-review:
    runs-on: ubuntu-24.04
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: 'Checkout Repository'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
+        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
@@ -21,22 +21,17 @@ jobs:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Check out code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Set up Go
-        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version-file: "go.mod"

-      - name: Install dashboard linter
-        run: |
-          go get github.com/grafana/dashboard-linter
-          go install github.com/grafana/dashboard-linter
-
      - name: Run dashboard linter
        run: ./hack/lint-dashboards.sh
@@ -17,12 +17,16 @@ on:
      - go.sum

 env:
-  GOLANGCI_LINT_VERSION: v1.63.4
+  GOLANGCI_LINT_VERSION: v2.6.2
  GOLANGCI_LINT_TIMEOUT: 5m

 permissions:
  contents: read

+concurrency:
+  group: fission-lint-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
  lint:
    permissions:
@@ -32,15 +36,15 @@ jobs:
    # if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Check out code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Set up Go
-        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version-file: "go.mod"
          cache: true
@@ -51,7 +55,7 @@ jobs:
          go mod download

      - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
        with:
          skip-cache: true
          version: ${{ env.GOLANGCI_LINT_VERSION }}
@@ -72,7 +76,7 @@ jobs:
        run: ./hack/runtests.sh

      - name: Upload Coverage report to CodeCov
-        uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          flags: unittests
@@ -22,13 +22,18 @@ on:
      - go.sum

 env:
-  HELM_VERSION: v3.16.4
-  KIND_VERSION: v0.26.0
+  HELM_VERSION: v4.0.1
+  KIND_VERSION: v0.30.0
  KIND_CLUSTER_NAME: kind
+  SKAFFOLD_VERSION: v2.17.0

 permissions:
  contents: read

+concurrency:
+  group: fission-ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
  # Job to run change detection
  integration-test:
@@ -37,36 +42,36 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        kindversion: ["v1.28.15", "v1.30.8", "v1.32.0"]
+        kindversion: ["v1.28.15", "v1.32.8", "v1.34.0"]
        os: [ubuntu-24.04]
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout sources
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: setup go
-        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Checkout sources
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          repository: fission/examples
          path: examples

      - name: Helm installation
-        uses: Azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
+        uses: Azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
        with:
          version: ${{ env.HELM_VERSION }}

      - name: Kind Cluster
-        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
+        uses: helm/kind-action@92086f6be054225fa813e0a4b13787fc9088faab # v1.13.0
        with:
          node_image: kindest/node:${{ matrix.kindversion }}
          version: ${{ env.KIND_VERSION }}
@@ -87,12 +92,12 @@ jobs:

      - name: Install Skaffold
        run: |
-          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.13.2/skaffold-linux-amd64
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/${{ env.SKAFFOLD_VERSION }}/skaffold-linux-amd64
          sudo install skaffold /usr/local/bin/
          skaffold version

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
        with:
          install-only: true
          version: "~> v2"
@@ -153,7 +158,7 @@ jobs:
      - name: Archive fission dump
        timeout-minutes: 10
        if: ${{ failure() || cancelled() }}
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: fission-dump/*.zip
@@ -162,7 +167,7 @@ jobs:
      - name: Archive prometheus dump
        timeout-minutes: 10
        if: ${{ always() }}
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: prom-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: /tmp/prometheus/*
@@ -171,7 +176,7 @@ jobs:
      - name: Archive kind logs
        timeout-minutes: 10
        if: ${{ always() }}
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
          path: kind-logs/*
@@ -185,36 +190,36 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        kindversion: ["v1.19.16"]
+        kindversion: ["v1.31.12"]
        os: [ubuntu-24.04]
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout sources
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: setup go
-        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Checkout sources
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          repository: fission/examples
          path: examples

      - name: Helm installation
-        uses: Azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
+        uses: Azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
        with:
          version: ${{ env.HELM_VERSION }}

      - name: Kind Cluster
-        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
+        uses: helm/kind-action@92086f6be054225fa813e0a4b13787fc9088faab # v1.13.0
        with:
          node_image: kindest/node:${{ matrix.kindversion }}
          version: ${{ env.KIND_VERSION }}
@@ -235,12 +240,12 @@ jobs:

      - name: Install Skaffold
        run: |
-          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.13.2/skaffold-linux-amd64
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/${{ env.SKAFFOLD_VERSION }}/skaffold-linux-amd64
          sudo install skaffold /usr/local/bin/
          skaffold version

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
        with:
          install-only: true
          version: "~> v2"
@@ -304,7 +309,7 @@ jobs:
      - name: Archive fission dump
        timeout-minutes: 10
        if: ${{ failure() || cancelled() }}
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: fission-dump/*.zip
@@ -313,7 +318,7 @@ jobs:
      - name: Archive prometheus dump
        timeout-minutes: 10
        if: ${{ always() }}
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: prom-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: /tmp/prometheus/*
@@ -322,7 +327,7 @@ jobs:
      - name: Archive kind logs
        timeout-minutes: 10
        if: ${{ always() }}
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
          path: kind-logs/*
@@ -6,36 +6,36 @@ on:
      - v2.**

 env:
-  KIND_VERSION: v0.26.0
+  KIND_VERSION: v0.30.0
  KIND_NODE_IMAGE_TAG: v1.28.15
  KIND_CLUSTER_NAME: kind
-  COSIGN_VERSION: v2.4.1
+  COSIGN_VERSION: v3.0.3

 jobs:
  create-draft-release:
    name: Create Draft Release with Goreleaser
    outputs:
-      hashes: ${{ steps.binary.outputs.hashes }}
      ghcr_images: ${{ steps.image.outputs.ghcr_images }}
      version: ${{ steps.get_version.outputs.VERSION }}
    permissions:
      contents: write # for goreleaser/goreleaser-action to create a GitHub release
      packages: write # for goreleaser/goreleaser-action to upload artifacts to GitHub Packages
      id-token: write # for cosign to sign the image and binary
+      attestations: write # for goreleaser/goreleaser-action to upload attestations
    runs-on: ubuntu-24.04
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Check out code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0

      - name: Setup go
-        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version-file: "go.mod"
          cache: true
@@ -45,13 +45,13 @@ jobs:
        run: echo "VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_OUTPUT

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
        with:
          install-only: true
          version: "~> v2"

      - name: Kind Cluster
-        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
+        uses: helm/kind-action@92086f6be054225fa813e0a4b13787fc9088faab # v1.13.0
        with:
          node_image: kindest/node:${{ env.KIND_NODE_IMAGE_TAG }}
          version: ${{ env.KIND_VERSION }}
@@ -59,24 +59,27 @@ jobs:
          cluster_name: ${{ env.KIND_CLUSTER_NAME }}

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Login to ghcr.io
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Cosign
-        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
        with:
          cosign-release: ${{ env.COSIGN_VERSION }}

      - name: Check cosign install!
        run: cosign version

-      - uses: anchore/sbom-action/download-syft@df80a981bc6edbc4e220a492d3cbe9f5547a6e75 #v0.17.9
+      - uses: anchore/sbom-action/download-syft@43a17d6e7add2b5535efe4dcae9952337c479a93 #v0.20.11

      - name: Generate yaml for manifest, Minikube and Openshift installation
        run: ${GITHUB_WORKSPACE}/hack/build-yaml.sh $VERSION
@@ -86,7 +89,7 @@ jobs:

      - name: Run GoReleaser
        id: goreleaser
-        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
        with:
          version: "~> v2"
          args: release
@@ -95,15 +98,12 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DOCKER_CLI_EXPERIMENTAL: "enabled"

-      - name: Generate binary hashes
-        id: binary
-        env:
-          ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
-        run: |
-          set -euo pipefail
-
-          checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
-          echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT"
+      # Attest binary artifacts
+      # https://goreleaser.com/customization/attestations/
+      - name: Attest binary artifacts
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+        with:
+          subject-checksums: ./dist/checksums.txt

      - name: Image digest
        id: image
@@ -111,7 +111,7 @@ jobs:
          ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
        run: |
          set -euo pipefail
-          image_and_digest=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Docker Manifest") | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {name} + {digest} | join("@") | sub("^sha256:";"")' | grep -v latest)
+          image_and_digest=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Docker Image") | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {name} + {digest} | join("@") | sub("^sha256:";"")' | grep -v latest)
          ghcr_images=$(echo "${image_and_digest}" | grep ghcr.io | jq -R -s -c '
            split("\n")
            | map(select(. != ""))
@@ -124,40 +124,8 @@ jobs:
              )')
          echo "ghcr_images=$ghcr_images" >> "$GITHUB_OUTPUT"

-  binary-provenance:
-    name: Create Binary Provenance
-    needs: [create-draft-release]
-    permissions:
-      actions: read # To read the workflow path.
-      id-token: write # To sign the provenance.
-      contents: write # To add assets to a release.
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0  # Do not use commit hash
-    with:
-      base64-subjects: "${{ needs.create-draft-release.outputs.hashes }}"
-      provenance-name: "fission_${{ needs.create-draft-release.outputs.version }}.intoto.jsonl"
-      upload-assets: true # upload to a new release
-      draft-release: true # create a draft release
-
-  image-provenance-ghcr:
-    name: Create Image Provenance
-    needs: [create-draft-release]
-    strategy:
-      matrix:
-        include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
-    permissions:
-      actions: read
-      id-token: write
-      packages: write
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0 # Do not use commit hash
-    with:
-      image: ${{ fromJson(toJson(matrix)).image }}
-      digest: ${{ fromJson(toJson(matrix)).checksum }}
-      registry-username: ${{ github.actor }}
-    secrets:
-      registry-password: ${{ secrets.GITHUB_TOKEN }}
-
-  image-sbom-ghcr:
-    name: Create SBOM for container images
+  image-sbom-provenance-ghcr:
+    name: Create SBOM & Provenance for container images
    # Goreleaser does not support generating SBOM for container images.
    needs: [create-draft-release]
    runs-on: ubuntu-24.04
@@ -168,82 +136,41 @@ jobs:
      actions: write
      id-token: write
      packages: write
+      attestations: write
    steps:
      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Run Trivy in fs mode to generate SBOM
-        uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0
+        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
        with:
          scan-type: "fs"
          format: "spdx-json"
-          output: "spdx.sbom.json"
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
+          output: "sbom.spdx.json"
+      - name: Attest SBOM for image
+        uses: actions/attest-sbom@4651f806c01d8637787e274ac3bdf724ef169f34 # v3.0.0
        with:
-          cosign-release: ${{ env.COSIGN_VERSION }}
-      - name: Sign image and sbom
-        env:
-          IMAGE: ${{ fromJson(toJson(matrix)).image }}
-          DIGEST: ${{ fromJson(toJson(matrix)).checksum }}
-        run: |
-          #!/usr/bin/env bash
-          set -euo pipefail
-          cosign attach sbom --sbom spdx.sbom.json $IMAGE@$DIGEST
-          cosign sign -a git_sha=$GITHUB_SHA --attachment sbom $IMAGE@$DIGEST --yes
-
-  binary-provenance-verification-with-slsa-verifier:
-    name : Verify Binary Provenance
-    needs: [create-draft-release, binary-provenance]
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: write # To download the assets from draft release.
-    steps:
-      - name: Install the verifier
-        uses: slsa-framework/slsa-verifier/actions/installer@3714a2a4684014deb874a0e737dffa0ee02dd647 # v2.6.0
-
-      - name: Download assets
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PROVENANCE: ${{ needs.binary-provenance.outputs.provenance-name }}
-          VERSION: ${{ needs.create-draft-release.outputs.version }}
-        run: |
-          set -euo pipefail
-          echo "repo=$GITHUB_REPOSITORY"
-          echo "ref=$VERSION"
-          gh -R "$GITHUB_REPOSITORY" release download "$VERSION" -p "$PROVENANCE"
-
-      - name: Verify assets
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECKSUMS: ${{ needs.create-draft-release.outputs.hashes }}
-          PROVENANCE: ${{ needs.binary-provenance.outputs.provenance-name }}
-          VERSION: ${{ needs.create-draft-release.outputs.version }}
-        run: |
-          set -euo pipefail
-          echo "CHECKSUMS=$CHECKSUMS"
-          echo "PROVENANCE=$PROVENANCE"
-          checksums=$(echo "$CHECKSUMS" | base64 -d)
-          while read -r line; do
-              fn=$(echo $line | cut -d ' ' -f2)
-              echo "Verifying $fn"
-              gh -R "$GITHUB_REPOSITORY" release download "$VERSION" -p "$fn"
-              slsa-verifier verify-artifact --provenance-path "$PROVENANCE" \
-                                            --source-uri "github.com/$GITHUB_REPOSITORY" \
-                                            --source-tag "$VERSION" \
-                                            "$fn"
-          done <<<"$checksums"
+          sbom-path: sbom.spdx.json
+          subject-name: ${{ fromJson(toJson(matrix)).image }}
+          subject-digest: ${{ fromJson(toJson(matrix)).checksum }}
+          push-to-registry: true
+      - name: Attest provenance for image
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+        with:
+          subject-name: ${{ fromJson(toJson(matrix)).image }}
+          subject-digest: ${{ fromJson(toJson(matrix)).checksum }}
+          push-to-registry: true

  image-provenance-verification-with-cosign:
    name: Verify Image Provenance
-    needs: [create-draft-release, image-provenance-ghcr]
+    needs: [create-draft-release, image-sbom-provenance-ghcr]
    strategy:
      matrix:
        include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
@@ -251,14 +178,14 @@ jobs:
    permissions: read-all
    steps:
      - name: Login
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Cosign
-        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
        with:
          cosign-release: ${{ env.COSIGN_VERSION }}

@@ -269,7 +196,7 @@ jobs:
        run: |
          echo "Verifying $IMAGE@$DIGEST"
          cosign verify-attestation \
-             --type slsaprovenance \
+             --type https://slsa.dev/provenance/v1 \
             --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-             --certificate-identity-regexp '^https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v[0-9]+.[0-9]+.[0-9]+$' \
-             $IMAGE@$DIGEST
+             --certificate-identity-regexp '^https://github.com/fission/fission/.github/workflows/release.yaml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+(?:-rc[0-9]+)?$' \
+             $IMAGE@$DIGEST
@@ -32,17 +32,17 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: "Checkout code"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - name: "Run analysis"
-        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
        with:
          results_file: results.sarif
          results_format: sarif
@@ -64,7 +64,7 @@ jobs:
      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v3.pre.node20
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v3.pre.node20
        with:
          name: SARIF file
          path: results.sarif
@@ -73,6 +73,6 @@ jobs:
      # Upload the results to GitHub's code scanning dashboard (optional).
      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
+        uses: github/codeql-action/upload-sarif@1b168cd39490f61582a9beae412bb7057a6b2c4e # v4.31.8
        with:
          sarif_file: results.sarif
@@ -22,13 +22,17 @@ on:
      - go.sum

 env:
-  HELM_VERSION: v3.16.4
-  KIND_VERSION: v0.26.0
+  HELM_VERSION: v3.19.0
+  KIND_VERSION: v0.30.0
  KIND_CLUSTER_NAME: kind

 permissions:
  contents: read

+concurrency:
+  group: fission-upgrade-test-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
  upgrade-test:
    runs-on: ${{ matrix.os }}
@@ -36,37 +40,37 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        kindversion: ["v1.28.15"]
+        kindversion: ["v1.31.12"]
        os: [ubuntu-24.04]
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout action sources
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Setup go
-        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Setup Helm
-        uses: Azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
+        uses: Azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
        with:
          version: ${{ env.HELM_VERSION }}

      - name: Setup Kind Cluster
-        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
+        uses: helm/kind-action@92086f6be054225fa813e0a4b13787fc9088faab # v1.13.0
        with:
          node_image: kindest/node:${{ matrix.kindversion }}
          version: ${{ env.KIND_VERSION }}
          cluster_name: ${{ env.KIND_CLUSTER_NAME }}

      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
        with:
          install-only: true
          version: "~> v2"
@@ -114,7 +118,7 @@ jobs:

      - name: Archive fission dump
        if: ${{ failure() || cancelled() }}
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: fission-dump-${{ github.run_id }}-${{ matrix.kindversion }}
          path: fission-dump/*.zip
@@ -122,7 +126,7 @@ jobs:

      - name: Archive kind logs
        if: ${{ always() }}
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: kind-logs-${{ github.run_id }}-${{ matrix.kindversion }}
          path: kind-logs/*
@@ -1,35 +1,51 @@
+version: "2"
 linters:
  enable:
-    # Default linter
    - errcheck
-    - gosimple
    - govet
    - ineffassign
-    - staticcheck
-    - typecheck
-    - unused
-    # Additional linters
-    - gofmt
-    - goimports
    - misspell
    - nakedret
-    - unconvert
    - promlinter
-    # Enable in future
-    # - bodyclose
-    # - dogsled
-    # - dupl
-    # - gosec
-    # - nilerr
-    # - prealloc
-    # - revive
-    # - unparam
-    # - wrapcheck
-    # - gocritic
-linters-settings:
-  errcheck:
-    ignore: go.uber.org/zap:Sync
-  goimports:
-    # put imports beginning with prefix after 3rd-party packages;
-    # it's a comma-separated list of prefixes
-    local: github.com/fission/fission
+    - unconvert
+    - unused
+    - staticcheck
+  settings:
+    errcheck:
+      exclude-functions:
+        - (*go.uber.org/zap.Logger).Sync
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+    rules:
+      - linters:
+        - staticcheck
+        text: "QF1008"
+      - linters:
+          - staticcheck
+        text: "QF1001"
+      - linters:
+          - staticcheck
+        text: "QF1003"
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/fission/fission
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
@@ -70,235 +70,100 @@ builds:
    id: reporter
    binary: reporter
    dir: ./cmd/reporter
-dockers:
-  - &docker-amd64
-    use: buildx
-    goos: linux
-    goarch: amd64
-    ids:
-      - builder
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/builder:latest-amd64"
-      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-amd64"
+dockers_v2:
+  - id: builder
+    tags:
+      - latest
+      - "{{ .Tag }}"
+    images:
+      - "{{ .Env.GHCR_REPO }}/builder"
+    labels:
+      org.opencontainers.image.description: "The builder assists in building the fission function source code for deployment."
+      org.opencontainers.image.source: "{{.GitURL}}"
+      org.opencontainers.image.created: "{{.Date}}"
+      org.opencontainers.image.revision: "{{.FullCommit}}"
+      org.opencontainers.image.version: "{{.Tag}}"
+      org.opencontainers.image.authors: "The Fission Authors https://fission.io/"
+      org.opencontainers.image.vendor: "Fission"
+      org.opencontainers.image.url: "https://fission.io/"
    dockerfile: cmd/builder/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.description=The builder assists in building the fission function source code for deployment."
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/amd64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
-      - "--label=org.opencontainers.image.vendor=Fission"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
-  - <<: *docker-amd64
-    ids:
-      - fetcher
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/fetcher:latest-amd64"
-      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-amd64"
+  - id: fetcher
+    tags:
+      - latest
+      - "{{ .Tag }}"
+    images:
+      - "{{ .Env.GHCR_REPO }}/fetcher"
+    labels:
+      org.opencontainers.image.description: "Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
+      org.opencontainers.image.source: "{{.GitURL}}"
+      org.opencontainers.image.created: "{{.Date}}"
+      org.opencontainers.image.revision: "{{.FullCommit}}"
+      org.opencontainers.image.version: "{{.Tag}}"
+      org.opencontainers.image.authors: "The Fission Authors https://fission.io/"
+      org.opencontainers.image.vendor: "Fission"
+      org.opencontainers.image.url: "https://fission.io/"
    dockerfile: cmd/fetcher/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.description=Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/amd64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
-      - "--label=org.opencontainers.image.vendor=Fission"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
-  - <<: *docker-amd64
-    ids:
-      - fission-bundle
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-amd64"
-      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-amd64"
+  - id: fission-bundle
+    tags:
+      - latest
+      - "{{ .Tag }}"
+    images:
+      - "{{ .Env.GHCR_REPO }}/fission-bundle"
+    labels:
+      org.opencontainers.image.description: "fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
+      org.opencontainers.image.source: "{{.GitURL}}"
+      org.opencontainers.image.created: "{{.Date}}"
+      org.opencontainers.image.revision: "{{.FullCommit}}"
+      org.opencontainers.image.version: "{{.Tag}}"
+      org.opencontainers.image.authors: "The Fission Authors https://fission.io/"
+      org.opencontainers.image.vendor: "Fission"
+      org.opencontainers.image.url: "https://fission.io/"
    dockerfile: cmd/fission-bundle/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.description=fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/amd64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
-      - "--label=org.opencontainers.image.vendor=Fission"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
-  - <<: *docker-amd64
-    ids:
-      - pre-upgrade-checks
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-amd64"
-      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-amd64"
+  - id: pre-upgrade-checks
+    tags:
+      - latest
+      - "{{ .Tag }}"
+    images:
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks"
+    labels:
+      org.opencontainers.image.description: "Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
+      org.opencontainers.image.source: "{{.GitURL}}"
+      org.opencontainers.image.created: "{{.Date}}"
+      org.opencontainers.image.revision: "{{.FullCommit}}"
+      org.opencontainers.image.version: "{{.Tag}}"
+      org.opencontainers.image.authors: "The Fission Authors https://fission.io/"
+      org.opencontainers.image.vendor: "Fission"
+      org.opencontainers.image.url: "https://fission.io/"
    dockerfile: cmd/preupgradechecks/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.description=Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/amd64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
-      - "--label=org.opencontainers.image.vendor=Fission"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
-  - <<: *docker-amd64
-    ids:
-      - reporter
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/reporter:latest-amd64"
-      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-amd64"
+  - id: reporter
+    tags:
+      - latest
+      - "{{ .Tag }}"
+    images:
+      - "{{ .Env.GHCR_REPO }}/reporter"
+    labels:
+      org.opencontainers.image.description: "The reporter gathers information that assists in improving fission."
+      org.opencontainers.image.source: "{{.GitURL}}"
+      org.opencontainers.image.created: "{{.Date}}"
+      org.opencontainers.image.revision: "{{.FullCommit}}"
+      org.opencontainers.image.version: "{{.Tag}}"
+      org.opencontainers.image.authors: "The Fission Authors https://fission.io/"
+      org.opencontainers.image.vendor: "Fission"
+      org.opencontainers.image.url: "https://fission.io/"
    dockerfile: cmd/reporter/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.description=The reporter gathers information that assists in improving fission."
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/amd64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
-      - "--label=org.opencontainers.image.vendor=Fission"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
-  - &docker-arm64
-    use: buildx
-    goos: linux
-    goarch: arm64
-    ids:
-      - builder
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/builder:latest-arm64"
-      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-arm64"
-    dockerfile: cmd/builder/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.description=The builder assists in building the fission function source code for deployment."
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/arm64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
-      - "--label=org.opencontainers.image.vendor=Fission"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
-  - <<: *docker-arm64
-    ids:
-      - fetcher
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/fetcher:latest-arm64"
-      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-arm64"
-    dockerfile: cmd/fetcher/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.description=Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/arm64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
-      - "--label=org.opencontainers.image.vendor=Fission"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
-  - <<: *docker-arm64
-    ids:
-      - fission-bundle
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-arm64"
-      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-arm64"
-    dockerfile: cmd/fission-bundle/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.description=fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/arm64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
-      - "--label=org.opencontainers.image.vendor=Fission"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
-  - <<: *docker-arm64
-    ids:
-      - pre-upgrade-checks
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-arm64"
-      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-arm64"
-    dockerfile: cmd/preupgradechecks/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.description=Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/arm64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
-      - "--label=org.opencontainers.image.vendor=Fission"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
-  - <<: *docker-arm64
-    ids:
-      - reporter
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/reporter:latest-arm64"
-      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-arm64"
-    dockerfile: cmd/reporter/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.description=The reporter gathers information that assists in improving fission."
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/arm64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
-      - "--label=org.opencontainers.image.vendor=Fission"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
-docker_manifests:
-  - name_template: "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-amd64"
-      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-amd64"
-      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-amd64"
-      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-amd64"
-      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-amd64"
-      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/builder:latest"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/builder:latest-amd64"
-      - "{{ .Env.GHCR_REPO }}/builder:latest-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/fetcher:latest"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/fetcher:latest-amd64"
-      - "{{ .Env.GHCR_REPO }}/fetcher:latest-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/fission-bundle:latest"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-amd64"
-      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-amd64"
-      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/reporter:latest"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/reporter:latest-amd64"
-      - "{{ .Env.GHCR_REPO }}/reporter:latest-arm64"
 changelog:
  disable: true
 archives:
  - id: fission
-    builds:
+    ids:
      - fission-cli
    name_template: "{{ .ProjectName }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}"
-    format: binary
+    formats:
+      - binary
 checksum:
  name_template: "checksums.txt"
-  algorithm: sha256
+docker_digest:
+  name_template: "docker-digests.txt"

 # signs the checksum file
 # https://goreleaser.com/customization/sign
@@ -306,13 +171,12 @@ signs:
  - id: cosign-binary
    env:
      - COSIGN_EXPERIMENTAL=1
-    certificate: "${artifact}.pem"
+    signature: "${artifact}.sig.bundle"
    cmd: cosign
-    artifacts: binary
+    artifacts: all
    args:
      - sign-blob
-      - "--output-signature=${signature}"
-      - "--output-certificate=${certificate}"
+      - "--bundle=${signature}"
      - "${artifact}"
      - "--yes" # needed for cosign 2.0.0+

@@ -61,18 +61,18 @@ install-fission-cli:
 ### Codegen
 codegen:
 	@./hack/update-codegen.sh
-	go run sigs.k8s.io/controller-tools/cmd/controller-gen object:headerFile="hack/boilerplate.txt" paths="./..."
+	go tool controller-gen object:headerFile="hack/boilerplate.txt" paths="./..."

 ### CRDs
 generate-crds:
-	go run sigs.k8s.io/controller-tools/cmd/controller-gen crd \
+	go tool controller-gen crd \
 	paths=./pkg/apis/core/v1  \
 	output:crd:artifacts:config=crds/v1

 ### Webhook generation: it generates webhook configs with help of kubebuilder:webhook tag
 generate-webhooks:
-	go run sigs.k8s.io/controller-tools/cmd/controller-gen webhook \
-	 paths=./pkg/apis/core/v1 \
+	go tool controller-gen webhook \
+	 paths=./pkg/webhook \
 	 output:dir=charts/fission-all/templates/webhook-server


@@ -98,7 +98,7 @@ generate-cli-docs:

 generate-crd-ref-docs:
 	# crd-ref-docs: https://github.com/elastic/crd-ref-docs
-	go run github.com/elastic/crd-ref-docs --source-path=pkg/apis/core/v1 --config=tools/crd-ref-docs/config.yaml --renderer markdown
+	go tool crd-ref-docs --source-path=pkg/apis/core/v1 --config=tools/crd-ref-docs/config.yaml --renderer markdown
 	cp tools/crd-ref-docs/header.md crd_docs.md
 	cat out.md >> crd_docs.md && rm out.md
 	mv crd_docs.md ../fission.io/content/en/docs/reference/crd-reference.md
@@ -112,6 +112,7 @@ skaffold-prebuild:
 	@cp -v cmd/fission-bundle/Dockerfile dist/fission-bundle_linux_amd64_v1/Dockerfile
 	@cp -v cmd/reporter/Dockerfile dist/reporter_linux_amd64_v1/Dockerfile
 	@cp -v cmd/preupgradechecks/Dockerfile dist/pre-upgrade-checks_linux_amd64_v1/Dockerfile
+	@find dist/ -name 'Dockerfile' -exec sed -i.bak 's|$$TARGETPLATFORM/||g' {} +; find dist/ -name 'Dockerfile.bak' -delete

 skaffold-deploy: skaffold-prebuild
 	skaffold run -p $(SKAFFOLD_PROFILE)
@@ -122,10 +123,3 @@ release:
 	@./hack/release.sh $(VERSION)
 	@./hack/release-tag.sh $(VERSION)
 	@./hack/changelog.sh
-
-## Envtest
-install-envtest:
-	go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
-
-setup-envtest:
-	setup-envtest -p path use 1.30.x
@@ -39,6 +39,9 @@
  <a href="https://scorecard.dev/viewer/?uri=github.com/fission/fission">
    <image alt="OpenSSF Scorecard" src="https://api.scorecard.dev/projects/github.com/fission/fission/badge">
  </a>
+  <a href="https://www.bestpractices.dev/projects/4986">
+    <img src="https://www.bestpractices.dev/projects/4986/badge">
+  </a>
 </p>

 --------------
@@ -91,7 +94,7 @@ aggregation &mdash; also helps with ops on your Fission deployment.

 ```bash
  # Add the stock NodeJS env to your Fission deployment
-  $ fission env create --name nodejs --image fission/node-env
+  $ fission env create --name nodejs --image ghcr.io/fission/node-env

  # Create a function with a javascript one-liner that prints "hello world"
  $ fission function create --name hello --env nodejs --code https://raw.githubusercontent.com/fission/examples/master/nodejs/hello.js
@@ -6,12 +6,12 @@ Please refer using [latest stable release](https://github.com/fission/fission/re

 | Version | Supported          |
 | ------- | ------------------ |
-| >=1.14.x   | :white_check_mark: |
-| < 1.14.0   | :x:                |
+| >=1.20.x   | :white_check_mark: |
+| < 1.20.0   | :x:                |

 ## Reporting a Vulnerability

 Please send the details to both of us:

- Sanket Sudake sanket@infracloud.io
- Vishal Biyani vishal@infracloud.io
+- Sanket Sudake sanket[at]infracloud.io
+- Vishal Biyani vishal[at]infracloud.io
@@ -1,9 +1,9 @@
 apiVersion: v2
 name: fission-all
-version: v1.21.0-rc1
-appVersion: v1.21.0-rc1
+version: 1.22.0
+appVersion: v1.22.0
 description: Fission is a fast serverless framework for Kubernetes.
-kubeVersion: ">=1.27.0-0"
+kubeVersion: ">=1.28.0-0"
 home: https://fission.io/
 icon: https://fission.io/images/fission-logo-white.svg
 sources:
@@ -21,7 +21,6 @@ maintainers:
    email: vishal@infracloud.io
  - name: Sanket Sudake
    email: sanket@infracloud.io
-engine: gotpl
 type: application
 annotations:
  artifacthub.io/signKey: |
@@ -4,7 +4,7 @@

 ## Prerequisites

- Kubernetes 1.23+
+- Kubernetes 1.28+
 - Helm 3+

 ## Get Repo Info
@@ -20,7 +20,7 @@ Windows:
 {{- end }}

  # Create an environment
-  $ fission env create --name nodejs --image fission/node-env --namespace {{ .Values.defaultNamespace }}
+  $ fission env create --name nodejs --image ghcr.io/fission/node-env --namespace {{ .Values.defaultNamespace }}

  # Get a hello world
  $ curl https://raw.githubusercontent.com/fission/examples/master/nodejs/hello.js > hello.js
@@ -37,38 +37,37 @@ auth:
 {{- end -}}

 {{/*
-This template generates the image name for the deployment depending on the value of "repository" field in values.yaml file.
+Helper template to construct image names with repository and tag
 */}}
-{{- define "fission-bundleImage" -}}
-{{- if .Values.repository -}}
-  {{- if eq .Values.imageTag "" -}}
-    {{ .Values.repository }}/{{ .Values.image }}
-  {{- else -}}
-    {{ .Values.repository }}/{{ .Values.image }}:{{ .Values.imageTag }}
-  {{- end }}
+{{- define "imageWithTag" -}}
+{{- $repository := index . 0 -}}
+{{- $image := index . 1 -}}
+{{- $tag := index . 2 -}}
+{{- if $repository -}}
+{{- printf "%s/%s%s" $repository $image (ne $tag "" | ternary (printf ":%s" $tag) "") -}}
 {{- else -}}
-  {{- if eq .Values.imageTag "" -}}
-    {{ .Values.image }}
-  {{- else -}}
-    {{ .Values.image }}:{{ .Values.imageTag }}
-  {{- end }}
-{{- end }}
+{{- printf "%s%s" $image (ne $tag "" | ternary (printf ":%s" $tag) "") -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "fission-bundleImage" -}}
+{{- $args := list .Values.repository .Values.image .Values.imageTag -}}
+{{- include "imageWithTag" $args -}}
 {{- end -}}

 {{- define "reporterImage" -}}
-{{- if .Values.repository -}}
-  {{- if eq .Values.imageTag "" -}}
-    {{ .Values.repository }}/{{ .Values.postInstallReportImage }}
-  {{- else -}}
-    {{ .Values.repository }}/{{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-  {{- end }}
-{{- else -}}
-  {{- if eq .Values.imageTag "" -}}
-    {{ .Values.postInstallReportImage }}
-  {{- else -}}
-    {{ .Values.postInstallReportImage }}:{{ .Values.imageTag }}
-  {{- end }}
-{{- end }}
+{{- $args := list .Values.repository .Values.postInstallReportImage .Values.imageTag -}}
+{{- include "imageWithTag" $args -}}
+{{- end -}}
+
+{{- define "fetcherImage" -}}
+{{- $args := list (.Values.fetcher.repository | default .Values.repository) .Values.fetcher.image .Values.fetcher.imageTag -}}
+{{- include "imageWithTag" $args -}}
+{{- end -}}
+
+{{- define "preUpgradeChecksImage" -}}
+{{- $args := list (.Values.preUpgradeChecks.repository | default .Values.repository) .Values.preUpgradeChecks.image .Values.preUpgradeChecks.imageTag -}}
+{{- include "imageWithTag" $args -}}
 {{- end -}}

 {{- define "opentelemtry.envs" }}
@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: {{ template "fullname" . }}-{{ .Chart.Version }}
+  name: {{ template "fullname" . }}-{{ .Chart.Version }}-post-install
  labels:
    # The "release" convention makes it easy to tie a release to all of the
    # Kubernetes resources that were created as part of that release.
@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: {{ template "fullname" . }}-{{ .Chart.Version }}
+  name: {{ template "fullname" . }}-{{ .Chart.Version }}-post-upgrade
  labels:
    # The "release" convention makes it easy to tie a release to all of the
    # Kubernetes resources that were created as part of that release.
@@ -30,11 +30,7 @@ spec:
        args: ["--builderMgr", "--storageSvcUrl", "http://storagesvc.{{ .Release.Namespace }}"]
        env:
        - name: FETCHER_IMAGE
-        {{- if eq .Values.fetcher.imageTag "" }}
-          value: "{{ .Values.fetcher.image }}"
-        {{- else }}
-          value: "{{ .Values.fetcher.image }}:{{ .Values.fetcher.imageTag }}"
-        {{- end }}
+          value: {{ include "fetcherImage" . | quote }}
        - name: FETCHER_IMAGE_PULL_POLICY
          value: "{{ .Values.pullPolicy }}"
        - name: BUILDER_IMAGE_PULL_POLICY
@@ -30,11 +30,7 @@ spec:
        args: ["--executorPort", "8888"]
        env:
        - name: FETCHER_IMAGE
-        {{- if eq .Values.fetcher.imageTag "" }}
-          value: "{{ .Values.fetcher.image }}"
-        {{- else }}
-          value: "{{ .Values.fetcher.image }}:{{ .Values.fetcher.imageTag }}"
-        {{- end }}
+          value: {{ include "fetcherImage" . | quote }}
        - name: FETCHER_IMAGE_PULL_POLICY
          value: "{{ .Values.pullPolicy }}"
        - name: RUNTIME_IMAGE_PULL_POLICY
@@ -28,11 +28,7 @@ spec:
      restartPolicy: Never
      containers:
      - name: pre-upgrade-job
-      {{- if .Values.preUpgradeChecks.imageTag }}
-        image: {{ .Values.preUpgradeChecks.image }}:{{ .Values.preUpgradeChecks.imageTag }}
-      {{- else }}
-        image: {{ .Values.preUpgradeChecks.image }}
-      {{- end }}
+        image: {{ include "preUpgradeChecksImage" . | quote }}
        imagePullPolicy: {{ .Values.pullPolicy }}
        command: [ "/pre-upgrade-checks" ]
        env:
@@ -12,6 +12,12 @@ spec:
    matchLabels:
      svc: storagesvc
      application: fission-storage
+  strategy:
+    type: {{ .Values.storagesvc.deploymentStrategy.type }}
+    {{- if eq .Values.storagesvc.deploymentStrategy.type "RollingUpdate" }}
+    rollingUpdate:
+      {{- toYaml .Values.storagesvc.deploymentStrategy.rollingUpdate | nindent 6}}
+    {{- end }}
  template:
    metadata:
      labels:
@@ -113,7 +119,7 @@ spec:
      priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
    {{- with .Values.imagePullSecrets }}
-      imagePullSecrets: 
+      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
    {{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}
@@ -25,13 +25,13 @@ image: fission/fission-bundle
 ## It is also used by the chart to identify version of the few more images apart from fission-bundle.
 ## Keep it empty for using latest tag.
 ##
-imageTag: v1.21.0-rc1
+imageTag: v1.22.0

 ## pullPolicy represents the pull policy to use for images in the chart.
 ##
 pullPolicy: IfNotPresent

-## imageppullsecrets 
+## imagepullsecrets
 imagePullSecrets: []

 ## priorityClassName represents the priority class name to use for Fission components.
@@ -80,7 +80,7 @@ builderNamespace: ""
 functionNamespace: ""

 ## Fission will watch the following namespaces along with the `defaultNamespace` for fission custom resources.
-## additionalFissionNamespaces: 
+## additionalFissionNamespaces:
 ## - namespace1
 ## - namespace2
 ## - namespace3
@@ -117,10 +117,14 @@ kubernetesClientBurst: 500
 ## fetcher helps in fetching function source code/build and uploading it when function is invoked.
 ##
 fetcher:
+  ## repository represents the repository of the fetcher component.
+  ##
+  ## By default, it is empty, which means global repository will be used.
+  repository: ""
  ## image represents the image of the fetcher component.
  image: fission/fetcher
  ## imageTag represents the tag of the image of the fetcher component.
-  imageTag: v1.21.0-rc1
+  imageTag: v1.22.0

  ## Fetcher is only for to downloading or uploading archive.
  ## Normally, you don't need to change the value here, unless necessary.
@@ -159,7 +163,7 @@ executor:
  ## This is applicable to Pool Manager executor type only.
  ##
  podReadyTimeout: 300s
-  
+
  ## Pod resources as:
  ##  resources:
  ##    limits:
@@ -332,7 +336,7 @@ router:
    runAsGroup: 10001

 ## The builder manager watches the package & environments CRD changes and manages the builds of function source code.
-## 
+##
 buildermgr:
  ## Pod resources as:
  ##  resources:
@@ -358,7 +362,7 @@ buildermgr:
    runAsGroup: 10001

 ## webhook is the component that validates API calls.
-## It contains validation and mutation for functions, triggers, environments, Kubernetes event watches, etc. 
+## It contains validation and mutation for functions, triggers, environments, Kubernetes event watches, etc.
 ##
 webhook:
  ## Pod resources as:
@@ -435,6 +439,16 @@ storagesvc:
  ##
  resources: {}

+  ## Deployment strategy defaults to RollingUpdate but use Recreate if new pods fail to
+  ## attach to the volume until the old pod has released it.
+  ## deploymentStrategy:
+  ##   type: Recreate
+  deploymentStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+
  ## Archive pruner removes archives from storage which are not referenced by any package.
  archivePruner:
    enabled: true
@@ -537,7 +551,7 @@ serviceMonitor:
  #  key: "value"

 # The following components expose Prometheus metrics and have podmonitors in this chart (disabled by default)
-# 
+#
 podMonitor:
  enabled: false
  ##namespace in which you want to deploy podmonitor
@@ -573,7 +587,7 @@ persistence:
  #   region: <awsRegion>
  ## For Minio and other s3 compatible storage systems set endPoint property
  #   endPoint: <s3StorageUrl>
-  
+
  ## A manually managed Persistent Volume Claim name
  ## Requires persistence.enabled: true
  ## If defined, PVC must be created manually before volume will be bound
@@ -683,12 +697,16 @@ preUpgradeChecks:
  ## Run pre-install/pre-upgrade checks if true
  ##
  enabled: true
+  ## Repository for pre-install/pre-upgrade checks image
+  ## By default it uses the global repository
+  ##
+  repository: ""
  ## pre-install/pre-upgrade checks live in this image
  ##
  image: fission/pre-upgrade-checks
  ## pre-install/pre-upgrade checks image version
  ##
-  imageTag: v1.21.0-rc1
+  imageTag: v1.22.0

 ## Fission post-install/post-upgrade reporting live in this image
 ##
@@ -756,12 +774,12 @@ authentication:
  ## jwtSigningKey is the signing key used for
  ## signing the JWT token
  ##
-  jwtSigningKey: 
+  jwtSigningKey:
  ## jwtExpiryTime is the JWT expiry time
  ## in seconds
  ## default '120'
  ##
-  jwtExpiryTime: 
+  jwtExpiryTime:
  ## jwtIssuer is the issuer of JWT
  ## default 'fission'
  ##
@@ -866,7 +884,7 @@ runtimePodSpec:
  ## Setting it false by default so that integration tests pass
  ##
  enabled: false
-  
+
  ## Checkout PodSpec in https://fission.io/docs/reference/crd-reference/#runtime
  ##
  podSpec:
@@ -1,3 +1,4 @@
-FROM cgr.dev/chainguard/static:latest@sha256:f96b5a60658dfee0cae426972afecad6ea6930fa28e6d8ef7096a7bdf35d6498
-COPY builder /builder
+FROM cgr.dev/chainguard/static:latest@sha256:a301031ffd4ed67f35ca7fa6cf3dad9937b5fa47d7493955a18d9b4ca5412d1a
+ARG TARGETPLATFORM
+COPY $TARGETPLATFORM/builder /builder
 ENTRYPOINT ["/builder"]
@@ -1,3 +1,4 @@
-FROM cgr.dev/chainguard/static:latest@sha256:f96b5a60658dfee0cae426972afecad6ea6930fa28e6d8ef7096a7bdf35d6498
-COPY fetcher /
+FROM cgr.dev/chainguard/static:latest@sha256:a301031ffd4ed67f35ca7fa6cf3dad9937b5fa47d7493955a18d9b4ca5412d1a
+ARG TARGETPLATFORM
+COPY $TARGETPLATFORM/fetcher /
 ENTRYPOINT ["/fetcher"]
@@ -1,3 +1,4 @@
-FROM cgr.dev/chainguard/static:latest@sha256:f96b5a60658dfee0cae426972afecad6ea6930fa28e6d8ef7096a7bdf35d6498
-COPY fission-bundle /
+FROM cgr.dev/chainguard/static:latest@sha256:a301031ffd4ed67f35ca7fa6cf3dad9937b5fa47d7493955a18d9b4ca5412d1a
+ARG TARGETPLATFORM
+COPY $TARGETPLATFORM/fission-bundle /
 ENTRYPOINT ["/fission-bundle"]
@@ -21,9 +21,7 @@ import (
 	"flag"
 	"fmt"
 	"os"
-	"strconv"

-	docopt "github.com/docopt/docopt-go"
 	"go.uber.org/zap"
 	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
 	cnwebhook "sigs.k8s.io/controller-runtime/pkg/webhook"
@@ -48,116 +46,35 @@ import (
 	"github.com/fission/fission/pkg/webhook"
 )

-// runWebhook starts admission webhook server
-func runWebhook(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, port int) error {
-	return webhook.Start(ctx, clientGen, logger, cnwebhook.Options{
-		Port: port,
-	})
+// Command line arguments
+type CommandLineArgs struct {
+	// Flags
+	canaryConfig bool
+	kubewatcher  bool
+	timer        bool
+	mqt          bool
+	mqt_keda     bool
+	builderMgr   bool
+	showVersion  bool
+	logger       bool
+
+	// Port values
+	webhookPort        int
+	routerPort         int
+	executorPort       int
+	storageServicePort int
+
+	// URL values
+	executorUrl   string
+	routerUrl     string
+	storageSvcUrl string
+
+	// Other configurations
+	storageType string
 }

-func runCanaryConfigServer(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface) error {
-	return canaryconfigmgr.StartCanaryServer(ctx, clientGen, logger, mgr, false)
-}
-
-func runRouter(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, port int, executorUrl string) error {
-	return router.Start(ctx, clientGen, logger, mgr, port, eclient.MakeClient(logger, executorUrl))
-}
-
-func runExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, port int) error {
-	return executor.StartExecutor(ctx, clientGen, logger, mgr, port)
-}
-
-func runKubeWatcher(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerUrl string) error {
-	return kubewatcher.Start(ctx, clientGen, logger, mgr, routerUrl)
-}
-
-func runTimer(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerUrl string) error {
-	return timer.Start(ctx, clientGen, logger, mgr, routerUrl)
-}
-
-func runMessageQueueMgr(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerUrl string) error {
-	return mqtrigger.Start(ctx, clientGen, logger, mgr, routerUrl)
-}
-
-// KEDA based MessageQueue Trigger Manager
-func runMQManager(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerURL string) error {
-	return mqt.StartScalerManager(ctx, clientGen, logger, mgr, routerURL)
-}
-
-func runStorageSvc(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, port int, storage storagesvc.Storage) error {
-	return storagesvc.Start(ctx, clientGen, logger, storage, mgr, port)
-}
-
-func runBuilderMgr(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, storageSvcUrl string) error {
-	return buildermgr.Start(ctx, clientGen, logger, mgr, storageSvcUrl)
-}
-
-func runLogger(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger) error {
-	return functionLogger.Start(ctx, clientGen, logger)
-}
-
-func getPort(logger *zap.Logger, portArg interface{}) int {
-	portArgStr := portArg.(string)
-	port, err := strconv.Atoi(portArgStr)
-	if err != nil {
-		logger.Fatal("invalid port number", zap.Error(err), zap.String("port", portArgStr))
-	}
-	return port
-}
-
-func getStringArgWithDefault(arg interface{}, defaultValue string) string {
-	if arg != nil {
-		return arg.(string)
-	} else {
-		return defaultValue
-	}
-}
-
-func getServiceName(arguments map[string]interface{}) string {
-	serviceName := "Fission-Unknown"
-
-	if arguments["--routerPort"] != nil {
-		serviceName = "Fission-Router"
-	} else if arguments["--executorPort"] != nil {
-		serviceName = "Fission-Executor"
-	} else if arguments["--kubewatcher"] == true {
-		serviceName = "Fission-KubeWatcher"
-	} else if arguments["--timer"] == true {
-		serviceName = "Fission-Timer"
-	} else if arguments["--mqt"] == true {
-		serviceName = "Fission-MessageQueueTrigger"
-	} else if arguments["--builderMgr"] == true {
-		serviceName = "Fission-BuilderMgr"
-	} else if arguments["--storageServicePort"] != nil {
-		serviceName = "Fission-StorageSvc"
-	} else if arguments["--mqt_keda"] == true {
-		serviceName = "Fission-Keda-MQTrigger"
-	}
-
-	return serviceName
-}
-
-func exitWithSync(logger *zap.Logger) {
-	// Ignore error, safe to ignore as per https://github.com/uber-go/zap/issues/328
-	_ = logger.Sync()
-	os.Exit(1)
-}
-
-func main() {
-	mgr := manager.New()
-	defer mgr.Wait()
-
-	var err error
-
-	// From https://github.com/containous/traefik/pull/1817/files
-	// Tell glog to log into STDERR. Otherwise, we risk
-	// certain kinds of API errors getting logged into a directory not
-	// available in a `FROM scratch` Docker container, causing glog to abort
-	// hard with an exit code > 0.
-	// TODO: fix the lint error. Error checking here is causing all components to crash with error "logtostderr not found"
-	flag.Set("logtostderr", "true") //nolint: errcheck
-
-	usage := `fission-bundle: Package of all fission microservices: router, executor.
+// Usage information
+const usageText string = `fission-bundle: Package of all fission microservices: router, executor.

 Use it to start one or more of the fission servers:

@@ -197,142 +114,231 @@ Options:
  --storageServicePort=<port>     Port that the storage service should listen on.
  --executorUrl=<url>             Executor URL. Not required if --executorPort is specified.
  --routerUrl=<url>               Router URL.
-  --etcdUrl=<etcdUrl>             Etcd URL.
  --storageSvcUrl=<url>           StorageService URL.
-  --filePath=<filePath>           Directory to store functions in.
-  --namespace=<namespace>         Kubernetes namespace in which to run function containers. Defaults to 'fission-function'.
  --kubewatcher                   Start Kubernetes events watcher.
  --timer                         Start Timer.
  --mqt                           Start message queue trigger.
  --mqt_keda					  Start message queue trigger of kind KEDA
  --builderMgr                    Start builder manager.
-  --version                       Print version information
-`
-	logger := loggerfactory.GetLogger()
-	defer exitWithSync(logger)
+  --version                       Print version information`

-	ctx := signals.SetupSignalHandler()
-	profile.ProfileIfEnabled(ctx, logger, mgr)
+func main() {
+	mgr := manager.New()
+	defer mgr.Wait()

-	version := fmt.Sprintf("Fission Bundle Version: %s", info.BuildInfo().String())
-	arguments, err := docopt.ParseArgs(usage, nil, version)
-	if err != nil {
-		logger.Error("failed to parse arguments", zap.Error(err))
-		return
+	// Set up command line parsing
+	args := setupCommandLineArgs()
+
+	// Handle version request specially - exit after printing
+	if args.showVersion {
+		fmt.Printf("Fission Bundle Version: %s\n", info.BuildInfo().String())
+		os.Exit(0)
 	}

-	shutdown, err := otel.InitProvider(ctx, logger, getServiceName(arguments))
+	// Initialize logger
+	logger := loggerfactory.GetLogger()
+	defer func() {
+		// Ignore error, safe to ignore as per https://github.com/uber-go/zap/issues/328
+		_ = logger.Sync()
+	}()
+
+	// Set up signal handling for graceful shutdown
+	ctx := signals.SetupSignalHandler()
+
+	// Enable profiling if configured
+	profile.ProfileIfEnabled(ctx, logger, mgr)
+
+	// Initialize OpenTelemetry
+	serviceName := getServiceNameFromArgs(args)
+	shutdown, err := otel.InitProvider(ctx, logger, serviceName)
 	if err != nil {
-		logger.Error("error initializing provider for OTLP", zap.Error(err), zap.Any("argument", arguments))
+		logger.Error("error initializing provider for OTLP", zap.Error(err))
 		return
 	}
 	if shutdown != nil {
 		defer shutdown(ctx)
 	}

-	executorUrl := getStringArgWithDefault(arguments["--executorUrl"], "http://executor.fission")
-	routerUrl := getStringArgWithDefault(arguments["--routerUrl"], "http://router.fission")
-	storageSvcUrl := getStringArgWithDefault(arguments["--storageSvcUrl"], "http://storagesvc.fission")
+	// Initialize client generator
 	clientGen := crd.NewClientGenerator()

-	if arguments["--webhookPort"] != nil {
-		port := getPort(logger, arguments["--webhookPort"])
-		err = runWebhook(ctx, clientGen, logger, port)
+	// Start the appropriate service based on command line arguments
+	startRequestedService(ctx, args, clientGen, logger, mgr)
+
+	<-ctx.Done()
+	logger.Error("exiting")
+}
+
+// setupCommandLineArgs parses command line arguments and returns them
+func setupCommandLineArgs() *CommandLineArgs {
+	args := &CommandLineArgs{}
+
+	// Override the default usage function
+	flag.Usage = func() {
+		fmt.Println(usageText)
+	}
+
+	// Tell glog to log into STDERR
+	flag.Set("logtostderr", "true") //nolint: errcheck
+
+	// Define flags
+	flag.BoolVar(&args.canaryConfig, "canaryConfig", false, "Start canary config server")
+	flag.BoolVar(&args.kubewatcher, "kubewatcher", false, "Start Kubernetes events watcher")
+	flag.BoolVar(&args.timer, "timer", false, "Start Timer")
+	flag.BoolVar(&args.mqt, "mqt", false, "Start message queue trigger")
+	flag.BoolVar(&args.mqt_keda, "mqt_keda", false, "Start message queue trigger of kind KEDA")
+	flag.BoolVar(&args.builderMgr, "builderMgr", false, "Start builder manager")
+	flag.BoolVar(&args.showVersion, "version", false, "Print version information")
+	flag.BoolVar(&args.logger, "logger", false, "Start logger")
+
+	// Port flags
+	flag.IntVar(&args.webhookPort, "webhookPort", 0, "Port that the webhook should listen on")
+	flag.IntVar(&args.routerPort, "routerPort", 0, "Port that the router should listen on")
+	flag.IntVar(&args.executorPort, "executorPort", 0, "Port that the executor should listen on")
+	flag.IntVar(&args.storageServicePort, "storageServicePort", 0, "Port that the storage service should listen on")
+
+	// URL flags
+	flag.StringVar(&args.executorUrl, "executorUrl", "http://executor.fission", "Executor URL")
+	flag.StringVar(&args.routerUrl, "routerUrl", "http://router.fission", "Router URL")
+	flag.StringVar(&args.storageSvcUrl, "storageSvcUrl", "http://storagesvc.fission", "StorageService URL")
+
+	// Other configuration flags
+	flag.StringVar(&args.storageType, "storageType", "", "Type of storage to use")
+
+	// Parse flags
+	flag.Parse()
+
+	return args
+}
+
+// getServiceNameFromArgs determines which service is being started based on command line args
+func getServiceNameFromArgs(args *CommandLineArgs) string {
+	serviceName := "Fission-Unknown"
+
+	if args.routerPort != 0 {
+		serviceName = "Fission-Router"
+	} else if args.executorPort != 0 {
+		serviceName = "Fission-Executor"
+	} else if args.kubewatcher {
+		serviceName = "Fission-KubeWatcher"
+	} else if args.timer {
+		serviceName = "Fission-Timer"
+	} else if args.mqt {
+		serviceName = "Fission-MessageQueueTrigger"
+	} else if args.builderMgr {
+		serviceName = "Fission-BuilderMgr"
+	} else if args.storageServicePort != 0 {
+		serviceName = "Fission-StorageSvc"
+	} else if args.mqt_keda {
+		serviceName = "Fission-Keda-MQTrigger"
+	}
+
+	return serviceName
+}
+
+// startRequestedService starts the service specified by command line arguments
+func startRequestedService(ctx context.Context, args *CommandLineArgs, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface) {
+	var err error
+
+	// Start the requested service based on command line arguments
+	if args.webhookPort != 0 {
+		err = webhook.Start(ctx, clientGen, logger, cnwebhook.Options{
+			Port: args.webhookPort,
+		})
 		logger.Error("webhook server exited:", zap.Error(err))
 		return
 	}

-	if arguments["--canaryConfig"] == true {
-		err := runCanaryConfigServer(ctx, clientGen, logger, mgr)
+	if args.canaryConfig {
+		err = canaryconfigmgr.StartCanaryServer(ctx, clientGen, logger, mgr, false)
 		if err != nil {
 			logger.Error("canary config server exited with error: ", zap.Error(err))
-			return
 		}
+		return
 	}

-	if arguments["--routerPort"] != nil {
-		port := getPort(logger, arguments["--routerPort"])
-		err = runRouter(ctx, clientGen, logger, mgr, port, executorUrl)
+	if args.routerPort != 0 {
+		err = router.Start(ctx, clientGen, logger, mgr, args.routerPort, eclient.MakeClient(logger, args.executorUrl))
 		if err != nil {
 			logger.Error("router exited", zap.Error(err))
-			return
 		}
+		return
 	}

-	if arguments["--executorPort"] != nil {
-		port := getPort(logger, arguments["--executorPort"])
-		err = runExecutor(ctx, clientGen, logger, mgr, port)
+	if args.executorPort != 0 {
+		err = executor.StartExecutor(ctx, clientGen, logger, mgr, args.executorPort)
 		if err != nil {
 			logger.Error("executor exited", zap.Error(err))
-			return
 		}
+		return
 	}

-	if arguments["--kubewatcher"] == true {
-		err = runKubeWatcher(ctx, clientGen, logger, mgr, routerUrl)
+	if args.kubewatcher {
+		err = kubewatcher.Start(ctx, clientGen, logger, mgr, args.routerUrl)
 		if err != nil {
 			logger.Error("kubewatcher exited", zap.Error(err))
-			return
 		}
+		return
 	}

-	if arguments["--timer"] == true {
-		err = runTimer(ctx, clientGen, logger, mgr, routerUrl)
+	if args.timer {
+		err = timer.Start(ctx, clientGen, logger, mgr, args.routerUrl)
 		if err != nil {
 			logger.Error("timer exited", zap.Error(err))
-			return
 		}
+		return
 	}

-	if arguments["--mqt"] == true {
-		err = runMessageQueueMgr(ctx, clientGen, logger, mgr, routerUrl)
+	if args.mqt {
+		err = mqtrigger.Start(ctx, clientGen, logger, mgr, args.routerUrl)
 		if err != nil {
 			logger.Error("message queue manager exited", zap.Error(err))
-			return
 		}
+		return
 	}

-	if arguments["--mqt_keda"] == true {
-		err = runMQManager(ctx, clientGen, logger, mgr, routerUrl)
+	if args.mqt_keda {
+		err = mqt.StartScalerManager(ctx, clientGen, logger, mgr, args.routerUrl)
 		if err != nil {
 			logger.Error("mqt scaler manager exited", zap.Error(err))
-			return
 		}
+		return
 	}

-	if arguments["--builderMgr"] == true {
-		err = runBuilderMgr(ctx, clientGen, logger, mgr, storageSvcUrl)
+	if args.builderMgr {
+		err = buildermgr.Start(ctx, clientGen, logger, mgr, args.storageSvcUrl)
 		if err != nil {
 			logger.Error("builder manager exited", zap.Error(err))
-			return
 		}
+		return
 	}

-	if arguments["--logger"] == true {
-		err = runLogger(ctx, clientGen, logger)
+	if args.logger {
+		err = functionLogger.Start(ctx, clientGen, logger)
 		if err != nil {
 			logger.Error("logger exited", zap.Error(err))
 		}
 		return
 	}

-	if arguments["--storageServicePort"] != nil {
-		port := getPort(logger, arguments["--storageServicePort"])
+	if args.storageServicePort != 0 {
+		startStorageService(ctx, args, clientGen, logger, mgr)
+		return
+	}
+}

-		var storage storagesvc.Storage
+// startStorageService initializes and starts the storage service
+func startStorageService(ctx context.Context, args *CommandLineArgs, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface) {
+	var storage storagesvc.Storage

-		if arguments["--storageType"] != nil && arguments["--storageType"] == string(storagesvc.StorageTypeS3) {
-			storage = storagesvc.NewS3Storage()
-		} else if arguments["--storageType"] == string(storagesvc.StorageTypeLocal) {
-			storage = storagesvc.NewLocalStorage("/fission")
-		}
-		err := runStorageSvc(ctx, clientGen, logger, mgr, port, storage)
-		if err != nil {
-			logger.Error("storage service exited", zap.Error(err))
-			return
-		}
+	if args.storageType == string(storagesvc.StorageTypeS3) {
+		storage = storagesvc.NewS3Storage()
+	} else if args.storageType == string(storagesvc.StorageTypeLocal) {
+		storage = storagesvc.NewLocalStorage("/fission")
 	}

-	<-ctx.Done()
-	logger.Error("exiting")
+	err := storagesvc.Start(ctx, clientGen, logger, storage, mgr, args.storageServicePort)
+	if err != nil {
+		logger.Error("storage service exited", zap.Error(err))
+	}
 }
@@ -24,7 +24,6 @@ import (
 	"strings"
 	"time"

-	"github.com/pkg/errors"
 	"go.uber.org/zap"

 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
@@ -41,12 +40,12 @@ import (
 func Start(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *zap.Logger, mgr manager.Interface, routerUrl string) error {
 	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		return errors.Wrap(err, "failed to get fission client")
+		return fmt.Errorf("failed to get fission client: %w", err)
 	}

 	err = crd.WaitForFunctionCRDs(ctx, logger, fissionClient)
 	if err != nil {
-		return errors.Wrap(err, "error waiting for CRDs")
+		return fmt.Errorf("error waiting for CRDs: %w", err)
 	}

 	mqType := (fv1.MessageQueueType)(os.Getenv("MESSAGE_QUEUE_TYPE"))
@@ -14,7 +14,8 @@ limitations under the License.
 package app

 import (
-	"github.com/pkg/errors"
+	"fmt"
+
 	"github.com/spf13/cobra"

 	"github.com/fission/fission/pkg/fission-cli/cliwrapper/cli"
@@ -65,7 +66,7 @@ func App(clientOptions cmd.ClientOptions) *cobra.Command {
 				// }
 				client, err := cmd.NewClient(clientOptions)
 				if err != nil {
-					return errors.Wrap(err, "failed to get fission client")
+					return fmt.Errorf("failed to get fission client: %w", err)
 				}
 				cmd.SetClientset(*client)
 				return nil
@@ -1,3 +1,4 @@
-FROM cgr.dev/chainguard/static:latest@sha256:f96b5a60658dfee0cae426972afecad6ea6930fa28e6d8ef7096a7bdf35d6498
-COPY pre-upgrade-checks /
+FROM cgr.dev/chainguard/static:latest@sha256:a301031ffd4ed67f35ca7fa6cf3dad9937b5fa47d7493955a18d9b4ca5412d1a
+ARG TARGETPLATFORM
+COPY $TARGETPLATFORM/pre-upgrade-checks /
 ENTRYPOINT ["/pre-upgrade-checks"]
@@ -1,7 +1,6 @@
 package main

 import (
-	"context"
 	"testing"

 	"github.com/stretchr/testify/require"
@@ -12,8 +11,7 @@ import (
 func TestPreUpgradeTaskClient(t *testing.T) {
 	f := framework.NewFramework()
 	defer f.Logger().Sync()
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()
 	err := f.Start(ctx)
 	require.NoError(t, err)

@@ -1,3 +1,4 @@
-FROM cgr.dev/chainguard/static:latest@sha256:f96b5a60658dfee0cae426972afecad6ea6930fa28e6d8ef7096a7bdf35d6498
-COPY reporter /
+FROM cgr.dev/chainguard/static:latest@sha256:a301031ffd4ed67f35ca7fa6cf3dad9937b5fa47d7493955a18d9b4ca5412d1a
+ARG TARGETPLATFORM
+COPY $TARGETPLATFORM/reporter /
 ENTRYPOINT ["/reporter"]
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.17.2
  name: canaryconfigs.fission.io
 spec:
  group: fission.io
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.17.2
  name: functions.fission.io
 spec:
  group: fission.io
@@ -93,7 +93,9 @@ spec:
                              policies:
                                description: |-
                                  policies is a list of potential scaling polices which can be used during scaling.
-                                  At least one policy must be specified, otherwise the HPAScalingRules will be discarded as invalid
+                                  If not set, use the default values:
+                                  - For scale up: allow doubling the number of pods, or an absolute change of 4 pods in a 15s window.
+                                  - For scale down: allow all pods to be removed in a 15s window.
                                items:
                                  description: HPAScalingPolicy is a single policy
                                    which must hold true for a specified past interval.
@@ -136,6 +138,24 @@ spec:
                                  - For scale down: 300 (i.e. the stabilization window is 300 seconds long).
                                format: int32
                                type: integer
+                              tolerance:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  tolerance is the tolerance on the ratio between the current and desired
+                                  metric value under which no updates are made to the desired number of
+                                  replicas (e.g. 0.01 for 1%). Must be greater than or equal to zero. If not
+                                  set, the default cluster-wide tolerance is applied (by default 10%).
+
+                                  For example, if autoscaling is configured with a memory consumption target of 100Mi,
+                                  and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be
+                                  triggered when the actual consumption falls below 95Mi or exceeds 101Mi.
+
+                                  This is an alpha field and requires enabling the HPAConfigurableTolerance
+                                  feature gate.
+                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                x-kubernetes-int-or-string: true
                            type: object
                          scaleUp:
                            description: |-
@@ -148,7 +168,9 @@ spec:
                              policies:
                                description: |-
                                  policies is a list of potential scaling polices which can be used during scaling.
-                                  At least one policy must be specified, otherwise the HPAScalingRules will be discarded as invalid
+                                  If not set, use the default values:
+                                  - For scale up: allow doubling the number of pods, or an absolute change of 4 pods in a 15s window.
+                                  - For scale down: allow all pods to be removed in a 15s window.
                                items:
                                  description: HPAScalingPolicy is a single policy
                                    which must hold true for a specified past interval.
@@ -191,6 +213,24 @@ spec:
                                  - For scale down: 300 (i.e. the stabilization window is 300 seconds long).
                                format: int32
                                type: integer
+                              tolerance:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  tolerance is the tolerance on the ratio between the current and desired
+                                  metric value under which no updates are made to the desired number of
+                                  replicas (e.g. 0.01 for 1%). Must be greater than or equal to zero. If not
+                                  set, the default cluster-wide tolerance is applied (by default 10%).
+
+                                  For example, if autoscaling is configured with a memory consumption target of 100Mi,
+                                  and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be
+                                  triggered when the actual consumption falls below 95Mi or exceeds 101Mi.
+
+                                  This is an alpha field and requires enabling the HPAConfigurableTolerance
+                                  feature gate.
+                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                x-kubernetes-int-or-string: true
                            type: object
                        type: object
                      hpaMetrics:
@@ -1047,7 +1087,6 @@ spec:
                                        pod labels will be ignored. The default value is empty.
                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                      items:
                                        type: string
                                      type: array
@@ -1062,7 +1101,6 @@ spec:
                                        pod labels will be ignored. The default value is empty.
                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                      items:
                                        type: string
                                      type: array
@@ -1229,7 +1267,6 @@ spec:
                                    pod labels will be ignored. The default value is empty.
                                    The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                    Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                  items:
                                    type: string
                                  type: array
@@ -1244,7 +1281,6 @@ spec:
                                    pod labels will be ignored. The default value is empty.
                                    The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                    Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                  items:
                                    type: string
                                  type: array
@@ -1338,8 +1374,8 @@ spec:
                              most preferred is the one with the greatest sum of weights, i.e.
                              for each node that meets all of the scheduling requirements (resource
                              request, requiredDuringScheduling anti-affinity expressions, etc.),
-                              compute a sum by iterating through the elements of this field and adding
-                              "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                              compute a sum by iterating through the elements of this field and subtracting
+                              "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                              node(s) with the highest sum are the most preferred.
                            items:
                              description: The weights of all of the matched WeightedPodAffinityTerm
@@ -1409,7 +1445,6 @@ spec:
                                        pod labels will be ignored. The default value is empty.
                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                      items:
                                        type: string
                                      type: array
@@ -1424,7 +1459,6 @@ spec:
                                        pod labels will be ignored. The default value is empty.
                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                      items:
                                        type: string
                                      type: array
@@ -1591,7 +1625,6 @@ spec:
                                    pod labels will be ignored. The default value is empty.
                                    The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                    Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                  items:
                                    type: string
                                  type: array
@@ -1606,7 +1639,6 @@ spec:
                                    pod labels will be ignored. The default value is empty.
                                    The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                    Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                  items:
                                    type: string
                                  type: array
@@ -1739,8 +1771,9 @@ spec:
                              present in a Container.
                            properties:
                              name:
-                                description: Name of the environment variable. Must
-                                  be a C_IDENTIFIER.
+                                description: |-
+                                  Name of the environment variable.
+                                  May consist of any printable ASCII characters except '='.
                                type: string
                              value:
                                description: |-
@@ -1798,6 +1831,43 @@ spec:
                                    - fieldPath
                                    type: object
                                    x-kubernetes-map-type: atomic
+                                  fileKeyRef:
+                                    description: |-
+                                      FileKeyRef selects a key of the env file.
+                                      Requires the EnvFiles feature gate to be enabled.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key within the env file. An invalid key will prevent the pod from starting.
+                                          The keys defined within a source may consist of any printable ASCII characters except '='.
+                                          During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                        type: string
+                                      optional:
+                                        default: false
+                                        description: |-
+                                          Specify whether the file or its key must be defined. If the file or key
+                                          does not exist, then the env var is not published.
+                                          If optional is set to true and the specified key does not exist,
+                                          the environment variable will not be set in the Pod's containers.
+
+                                          If optional is set to false and the specified key does not exist,
+                                          an error will be returned during Pod creation.
+                                        type: boolean
+                                      path:
+                                        description: |-
+                                          The path within the volume from which to select the file.
+                                          Must be relative and may not contain the '..' path or start with '..'.
+                                        type: string
+                                      volumeName:
+                                        description: The name of the volume mount
+                                          containing the env file.
+                                        type: string
+                                    required:
+                                    - key
+                                    - path
+                                    - volumeName
+                                    type: object
+                                    x-kubernetes-map-type: atomic
                                  resourceFieldRef:
                                    description: |-
                                      Selects a resource of the container: only resources limits and requests
@@ -1858,14 +1928,14 @@ spec:
                        envFrom:
                          description: |-
                            List of sources to populate environment variables in the container.
-                            The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                            will be reported as an event when the container is starting. When a key exists in multiple
+                            The keys defined within a source may consist of any printable ASCII characters except '='.
+                            When a key exists in multiple
                            sources, the value associated with the last source will take precedence.
                            Values defined by an Env with a duplicate key will take precedence.
                            Cannot be updated.
                          items:
                            description: EnvFromSource represents the source of a
-                              set of ConfigMaps
+                              set of ConfigMaps or Secrets
                            properties:
                              configMapRef:
                                description: The ConfigMap to select from
@@ -1886,8 +1956,9 @@ spec:
                                type: object
                                x-kubernetes-map-type: atomic
                              prefix:
-                                description: An optional identifier to prepend to
-                                  each key in the ConfigMap. Must be a C_IDENTIFIER.
+                                description: |-
+                                  Optional text to prepend to the name of each environment variable.
+                                  May consist of any printable ASCII characters except '='.
                                type: string
                              secretRef:
                                description: The Secret to select from
@@ -2151,6 +2222,12 @@ spec:
                                  - port
                                  type: object
                              type: object
+                            stopSignal:
+                              description: |-
+                                StopSignal defines which signal will be sent to a container when it is being stopped.
+                                If not specified, the default is defined by the container runtime in use.
+                                StopSignal can only be set for Pods with a non-empty .spec.os.name
+                              type: string
                          type: object
                        livenessProbe:
                          description: |-
@@ -2558,7 +2635,7 @@ spec:
                                Claims lists the names of resources, defined in spec.resourceClaims,
                                that are used by this container.

-                                This is an alpha field and requires enabling the
+                                This field depends on the
                                DynamicResourceAllocation feature gate.

                                This field is immutable. It can only be set for containers.
@@ -2613,10 +2690,10 @@ spec:
                        restartPolicy:
                          description: |-
                            RestartPolicy defines the restart behavior of individual containers in a pod.
-                            This field may only be set for init containers, and the only allowed value is "Always".
-                            For non-init containers or when this field is not specified,
+                            This overrides the pod-level restart policy. When this field is not specified,
                            the restart behavior is defined by the Pod's restart policy and the container type.
-                            Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                            Additionally, setting the RestartPolicy as "Always" for the init container will
+                            have the following effect:
                            this init container will be continually restarted on
                            exit until all regular containers have terminated. Once all regular
                            containers have completed, all init containers with restartPolicy "Always"
@@ -2628,6 +2705,59 @@ spec:
                            init container is started, or after any startupProbe has successfully
                            completed.
                          type: string
+                        restartPolicyRules:
+                          description: |-
+                            Represents a list of rules to be checked to determine if the
+                            container should be restarted on exit. The rules are evaluated in
+                            order. Once a rule matches a container exit condition, the remaining
+                            rules are ignored. If no rule matches the container exit condition,
+                            the Container-level restart policy determines the whether the container
+                            is restarted or not. Constraints on the rules:
+                            - At most 20 rules are allowed.
+                            - Rules can have the same action.
+                            - Identical rules are not forbidden in validations.
+                            When rules are specified, container MUST set RestartPolicy explicitly
+                            even it if matches the Pod's RestartPolicy.
+                          items:
+                            description: ContainerRestartRule describes how a container
+                              exit is handled.
+                            properties:
+                              action:
+                                description: |-
+                                  Specifies the action taken on a container exit if the requirements
+                                  are satisfied. The only possible value is "Restart" to restart the
+                                  container.
+                                type: string
+                              exitCodes:
+                                description: Represents the exit codes to check on
+                                  container exits.
+                                properties:
+                                  operator:
+                                    description: |-
+                                      Represents the relationship between the container exit code(s) and the
+                                      specified values. Possible values are:
+                                      - In: the requirement is satisfied if the container exit code is in the
+                                        set of specified values.
+                                      - NotIn: the requirement is satisfied if the container exit code is
+                                        not in the set of specified values.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      Specifies the set of values to check for container exit codes.
+                                      At most 255 elements are allowed.
+                                    items:
+                                      format: int32
+                                      type: integer
+                                    type: array
+                                    x-kubernetes-list-type: set
+                                required:
+                                - operator
+                                type: object
+                            required:
+                            - action
+                            type: object
+                          type: array
+                          x-kubernetes-list-type: atomic
                        securityContext:
                          description: |-
                            SecurityContext defines the security options the container should be run with.
@@ -3246,8 +3376,9 @@ spec:
                              present in a Container.
                            properties:
                              name:
-                                description: Name of the environment variable. Must
-                                  be a C_IDENTIFIER.
+                                description: |-
+                                  Name of the environment variable.
+                                  May consist of any printable ASCII characters except '='.
                                type: string
                              value:
                                description: |-
@@ -3305,6 +3436,43 @@ spec:
                                    - fieldPath
                                    type: object
                                    x-kubernetes-map-type: atomic
+                                  fileKeyRef:
+                                    description: |-
+                                      FileKeyRef selects a key of the env file.
+                                      Requires the EnvFiles feature gate to be enabled.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key within the env file. An invalid key will prevent the pod from starting.
+                                          The keys defined within a source may consist of any printable ASCII characters except '='.
+                                          During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                        type: string
+                                      optional:
+                                        default: false
+                                        description: |-
+                                          Specify whether the file or its key must be defined. If the file or key
+                                          does not exist, then the env var is not published.
+                                          If optional is set to true and the specified key does not exist,
+                                          the environment variable will not be set in the Pod's containers.
+
+                                          If optional is set to false and the specified key does not exist,
+                                          an error will be returned during Pod creation.
+                                        type: boolean
+                                      path:
+                                        description: |-
+                                          The path within the volume from which to select the file.
+                                          Must be relative and may not contain the '..' path or start with '..'.
+                                        type: string
+                                      volumeName:
+                                        description: The name of the volume mount
+                                          containing the env file.
+                                        type: string
+                                    required:
+                                    - key
+                                    - path
+                                    - volumeName
+                                    type: object
+                                    x-kubernetes-map-type: atomic
                                  resourceFieldRef:
                                    description: |-
                                      Selects a resource of the container: only resources limits and requests
@@ -3365,14 +3533,14 @@ spec:
                        envFrom:
                          description: |-
                            List of sources to populate environment variables in the container.
-                            The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                            will be reported as an event when the container is starting. When a key exists in multiple
+                            The keys defined within a source may consist of any printable ASCII characters except '='.
+                            When a key exists in multiple
                            sources, the value associated with the last source will take precedence.
                            Values defined by an Env with a duplicate key will take precedence.
                            Cannot be updated.
                          items:
                            description: EnvFromSource represents the source of a
-                              set of ConfigMaps
+                              set of ConfigMaps or Secrets
                            properties:
                              configMapRef:
                                description: The ConfigMap to select from
@@ -3393,8 +3561,9 @@ spec:
                                type: object
                                x-kubernetes-map-type: atomic
                              prefix:
-                                description: An optional identifier to prepend to
-                                  each key in the ConfigMap. Must be a C_IDENTIFIER.
+                                description: |-
+                                  Optional text to prepend to the name of each environment variable.
+                                  May consist of any printable ASCII characters except '='.
                                type: string
                              secretRef:
                                description: The Secret to select from
@@ -3654,6 +3823,12 @@ spec:
                                  - port
                                  type: object
                              type: object
+                            stopSignal:
+                              description: |-
+                                StopSignal defines which signal will be sent to a container when it is being stopped.
+                                If not specified, the default is defined by the container runtime in use.
+                                StopSignal can only be set for Pods with a non-empty .spec.os.name
+                              type: string
                          type: object
                        livenessProbe:
                          description: Probes are not allowed for ephemeral containers.
@@ -4044,7 +4219,7 @@ spec:
                                Claims lists the names of resources, defined in spec.resourceClaims,
                                that are used by this container.

-                                This is an alpha field and requires enabling the
+                                This field depends on the
                                DynamicResourceAllocation feature gate.

                                This field is immutable. It can only be set for containers.
@@ -4100,9 +4275,53 @@ spec:
                          description: |-
                            Restart policy for the container to manage the restart behavior of each
                            container within a pod.
-                            This may only be set for init containers. You cannot set this field on
-                            ephemeral containers.
+                            You cannot set this field on ephemeral containers.
                          type: string
+                        restartPolicyRules:
+                          description: |-
+                            Represents a list of rules to be checked to determine if the
+                            container should be restarted on exit. You cannot set this field on
+                            ephemeral containers.
+                          items:
+                            description: ContainerRestartRule describes how a container
+                              exit is handled.
+                            properties:
+                              action:
+                                description: |-
+                                  Specifies the action taken on a container exit if the requirements
+                                  are satisfied. The only possible value is "Restart" to restart the
+                                  container.
+                                type: string
+                              exitCodes:
+                                description: Represents the exit codes to check on
+                                  container exits.
+                                properties:
+                                  operator:
+                                    description: |-
+                                      Represents the relationship between the container exit code(s) and the
+                                      specified values. Possible values are:
+                                      - In: the requirement is satisfied if the container exit code is in the
+                                        set of specified values.
+                                      - NotIn: the requirement is satisfied if the container exit code is
+                                        not in the set of specified values.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      Specifies the set of values to check for container exit codes.
+                                      At most 255 elements are allowed.
+                                    items:
+                                      format: int32
+                                      type: integer
+                                    type: array
+                                    x-kubernetes-list-type: set
+                                required:
+                                - operator
+                                type: object
+                            required:
+                            - action
+                            type: object
+                          type: array
+                          x-kubernetes-list-type: atomic
                        securityContext:
                          description: |-
                            Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4640,7 +4859,9 @@ spec:
                  hostNetwork:
                    description: |-
                      Host networking requested for this pod. Use the host's network namespace.
-                      If this option is set, the ports that will be used must be specified.
+                      When using HostNetwork you should specify ports so the scheduler is aware.
+                      When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                      and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                      Default to false.
                    type: boolean
                  hostPID:
@@ -4665,6 +4886,19 @@ spec:
                      Specifies the hostname of the Pod
                      If not specified, the pod's hostname will be set to a system-defined value.
                    type: string
+                  hostnameOverride:
+                    description: |-
+                      HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                      This field only specifies the pod's hostname and does not affect its DNS records.
+                      When this field is set to a non-empty string:
+                      - It takes precedence over the values set in `hostname` and `subdomain`.
+                      - The Pod's hostname will be set to this value.
+                      - `setHostnameAsFQDN` must be nil or set to false.
+                      - `hostNetwork` must be set to false.
+
+                      This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                      Requires the HostnameOverride feature gate to be enabled.
+                    type: string
                  imagePullSecrets:
                    description: |-
                      ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4700,7 +4934,7 @@ spec:
                      Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.
                      The resourceRequirements of an init container are taken into account during scheduling
                      by finding the highest request/limit for each resource type, and then using the max of
-                      of that value or the sum of the normal containers. Limits are applied to init containers
+                      that value or the sum of the normal containers. Limits are applied to init containers
                      in a similar fashion.
                      Init containers cannot currently be added or removed.
                      Cannot be updated.
@@ -4746,8 +4980,9 @@ spec:
                              present in a Container.
                            properties:
                              name:
-                                description: Name of the environment variable. Must
-                                  be a C_IDENTIFIER.
+                                description: |-
+                                  Name of the environment variable.
+                                  May consist of any printable ASCII characters except '='.
                                type: string
                              value:
                                description: |-
@@ -4805,6 +5040,43 @@ spec:
                                    - fieldPath
                                    type: object
                                    x-kubernetes-map-type: atomic
+                                  fileKeyRef:
+                                    description: |-
+                                      FileKeyRef selects a key of the env file.
+                                      Requires the EnvFiles feature gate to be enabled.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key within the env file. An invalid key will prevent the pod from starting.
+                                          The keys defined within a source may consist of any printable ASCII characters except '='.
+                                          During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                        type: string
+                                      optional:
+                                        default: false
+                                        description: |-
+                                          Specify whether the file or its key must be defined. If the file or key
+                                          does not exist, then the env var is not published.
+                                          If optional is set to true and the specified key does not exist,
+                                          the environment variable will not be set in the Pod's containers.
+
+                                          If optional is set to false and the specified key does not exist,
+                                          an error will be returned during Pod creation.
+                                        type: boolean
+                                      path:
+                                        description: |-
+                                          The path within the volume from which to select the file.
+                                          Must be relative and may not contain the '..' path or start with '..'.
+                                        type: string
+                                      volumeName:
+                                        description: The name of the volume mount
+                                          containing the env file.
+                                        type: string
+                                    required:
+                                    - key
+                                    - path
+                                    - volumeName
+                                    type: object
+                                    x-kubernetes-map-type: atomic
                                  resourceFieldRef:
                                    description: |-
                                      Selects a resource of the container: only resources limits and requests
@@ -4865,14 +5137,14 @@ spec:
                        envFrom:
                          description: |-
                            List of sources to populate environment variables in the container.
-                            The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                            will be reported as an event when the container is starting. When a key exists in multiple
+                            The keys defined within a source may consist of any printable ASCII characters except '='.
+                            When a key exists in multiple
                            sources, the value associated with the last source will take precedence.
                            Values defined by an Env with a duplicate key will take precedence.
                            Cannot be updated.
                          items:
                            description: EnvFromSource represents the source of a
-                              set of ConfigMaps
+                              set of ConfigMaps or Secrets
                            properties:
                              configMapRef:
                                description: The ConfigMap to select from
@@ -4893,8 +5165,9 @@ spec:
                                type: object
                                x-kubernetes-map-type: atomic
                              prefix:
-                                description: An optional identifier to prepend to
-                                  each key in the ConfigMap. Must be a C_IDENTIFIER.
+                                description: |-
+                                  Optional text to prepend to the name of each environment variable.
+                                  May consist of any printable ASCII characters except '='.
                                type: string
                              secretRef:
                                description: The Secret to select from
@@ -5158,6 +5431,12 @@ spec:
                                  - port
                                  type: object
                              type: object
+                            stopSignal:
+                              description: |-
+                                StopSignal defines which signal will be sent to a container when it is being stopped.
+                                If not specified, the default is defined by the container runtime in use.
+                                StopSignal can only be set for Pods with a non-empty .spec.os.name
+                              type: string
                          type: object
                        livenessProbe:
                          description: |-
@@ -5565,7 +5844,7 @@ spec:
                                Claims lists the names of resources, defined in spec.resourceClaims,
                                that are used by this container.

-                                This is an alpha field and requires enabling the
+                                This field depends on the
                                DynamicResourceAllocation feature gate.

                                This field is immutable. It can only be set for containers.
@@ -5620,10 +5899,10 @@ spec:
                        restartPolicy:
                          description: |-
                            RestartPolicy defines the restart behavior of individual containers in a pod.
-                            This field may only be set for init containers, and the only allowed value is "Always".
-                            For non-init containers or when this field is not specified,
+                            This overrides the pod-level restart policy. When this field is not specified,
                            the restart behavior is defined by the Pod's restart policy and the container type.
-                            Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                            Additionally, setting the RestartPolicy as "Always" for the init container will
+                            have the following effect:
                            this init container will be continually restarted on
                            exit until all regular containers have terminated. Once all regular
                            containers have completed, all init containers with restartPolicy "Always"
@@ -5635,6 +5914,59 @@ spec:
                            init container is started, or after any startupProbe has successfully
                            completed.
                          type: string
+                        restartPolicyRules:
+                          description: |-
+                            Represents a list of rules to be checked to determine if the
+                            container should be restarted on exit. The rules are evaluated in
+                            order. Once a rule matches a container exit condition, the remaining
+                            rules are ignored. If no rule matches the container exit condition,
+                            the Container-level restart policy determines the whether the container
+                            is restarted or not. Constraints on the rules:
+                            - At most 20 rules are allowed.
+                            - Rules can have the same action.
+                            - Identical rules are not forbidden in validations.
+                            When rules are specified, container MUST set RestartPolicy explicitly
+                            even it if matches the Pod's RestartPolicy.
+                          items:
+                            description: ContainerRestartRule describes how a container
+                              exit is handled.
+                            properties:
+                              action:
+                                description: |-
+                                  Specifies the action taken on a container exit if the requirements
+                                  are satisfied. The only possible value is "Restart" to restart the
+                                  container.
+                                type: string
+                              exitCodes:
+                                description: Represents the exit codes to check on
+                                  container exits.
+                                properties:
+                                  operator:
+                                    description: |-
+                                      Represents the relationship between the container exit code(s) and the
+                                      specified values. Possible values are:
+                                      - In: the requirement is satisfied if the container exit code is in the
+                                        set of specified values.
+                                      - NotIn: the requirement is satisfied if the container exit code is
+                                        not in the set of specified values.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      Specifies the set of values to check for container exit codes.
+                                      At most 255 elements are allowed.
+                                    items:
+                                      format: int32
+                                      type: integer
+                                    type: array
+                                    x-kubernetes-list-type: set
+                                required:
+                                - operator
+                                type: object
+                            required:
+                            - action
+                            type: object
+                          type: array
+                          x-kubernetes-list-type: atomic
                        securityContext:
                          description: |-
                            SecurityContext defines the security options the container should be run with.
@@ -6167,6 +6499,7 @@ spec:
                      - spec.hostPID
                      - spec.hostIPC
                      - spec.hostUsers
+                      - spec.resources
                      - spec.securityContext.appArmorProfile
                      - spec.securityContext.seLinuxOptions
                      - spec.securityContext.seccompProfile
@@ -6320,7 +6653,7 @@ spec:
                    description: |-
                      Resources is the total amount of CPU and Memory resources required by all
                      containers in the pod. It supports specifying Requests and Limits for
-                      "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                      "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.

                      This field enables fine-grained control over resource allocation for the
                      entire pod, allowing resource sharing among containers in a pod.
@@ -6333,7 +6666,7 @@ spec:
                          Claims lists the names of resources, defined in spec.resourceClaims,
                          that are used by this container.

-                          This is an alpha field and requires enabling the
+                          This field depends on the
                          DynamicResourceAllocation feature gate.

                          This field is immutable. It can only be set for containers.
@@ -6870,7 +7203,6 @@ spec:
                            - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.

                            If this value is nil, the behavior is equivalent to the Honor policy.
-                            This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                          type: string
                        nodeTaintsPolicy:
                          description: |-
@@ -6881,7 +7213,6 @@ spec:
                            - Ignore: node taints are ignored. All nodes are included.

                            If this value is nil, the behavior is equivalent to the Ignore policy.
-                            This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                          type: string
                        topologyKey:
                          description: |-
@@ -7606,15 +7937,13 @@ spec:
                                        volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                        If specified, the CSI driver will create or update the volume with the attributes defined
                                        in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                        it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                        will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                        If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                        will be set by the persistentvolume controller if it exists.
+                                        it can be changed after the claim is created. An empty string or nil value indicates that no
+                                        VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                        this field can be reset to its previous value (including nil) to cancel the modification.
                                        If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                        set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                        exists.
                                        More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                        (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                      type: string
                                    volumeMode:
                                      description: |-
@@ -7796,12 +8125,10 @@ spec:
                          description: |-
                            glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                            Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                            More info: https://examples.k8s.io/volumes/glusterfs/README.md
                          properties:
                            endpoints:
-                              description: |-
-                                endpoints is the endpoint name that details Glusterfs topology.
-                                More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                              description: endpoints is the endpoint name that details
+                                Glusterfs topology.
                              type: string
                            path:
                              description: |-
@@ -7855,7 +8182,7 @@ spec:
                            The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                            The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                            The volume will be mounted read-only (ro) and non-executable files (noexec).
-                            Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
+                            Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
                            The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                          properties:
                            pullPolicy:
@@ -7880,7 +8207,7 @@ spec:
                          description: |-
                            iscsi represents an ISCSI Disk resource that is attached to a
                            kubelet's host machine and then exposed to the pod.
-                            More info: https://examples.k8s.io/volumes/iscsi/README.md
+                            More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                          properties:
                            chapAuthDiscovery:
                              description: chapAuthDiscovery defines whether support
@@ -8302,6 +8629,111 @@ spec:
                                        type: array
                                        x-kubernetes-list-type: atomic
                                    type: object
+                                  podCertificate:
+                                    description: |-
+                                      Projects an auto-rotating credential bundle (private key and certificate
+                                      chain) that the pod can use either as a TLS client or server.
+
+                                      Kubelet generates a private key and uses it to send a
+                                      PodCertificateRequest to the named signer.  Once the signer approves the
+                                      request and issues a certificate chain, Kubelet writes the key and
+                                      certificate chain to the pod filesystem.  The pod does not start until
+                                      certificates have been issued for each podCertificate projected volume
+                                      source in its spec.
+
+                                      Kubelet will begin trying to rotate the certificate at the time indicated
+                                      by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                      timestamp.
+
+                                      Kubelet can write a single file, indicated by the credentialBundlePath
+                                      field, or separate files, indicated by the keyPath and
+                                      certificateChainPath fields.
+
+                                      The credential bundle is a single file in PEM format.  The first PEM
+                                      entry is the private key (in PKCS#8 format), and the remaining PEM
+                                      entries are the certificate chain issued by the signer (typically,
+                                      signers will return their certificate chain in leaf-to-root order).
+
+                                      Prefer using the credential bundle format, since your application code
+                                      can read it atomically.  If you use keyPath and certificateChainPath,
+                                      your application must make two separate file reads. If these coincide
+                                      with a certificate rotation, it is possible that the private key and leaf
+                                      certificate you read may not correspond to each other.  Your application
+                                      will need to check for this condition, and re-read until they are
+                                      consistent.
+
+                                      The named signer controls chooses the format of the certificate it
+                                      issues; consult the signer implementation's documentation to learn how to
+                                      use the certificates it issues.
+                                    properties:
+                                      certificateChainPath:
+                                        description: |-
+                                          Write the certificate chain at this path in the projected volume.
+
+                                          Most applications should use credentialBundlePath.  When using keyPath
+                                          and certificateChainPath, your application needs to check that the key
+                                          and leaf certificate are consistent, because it is possible to read the
+                                          files mid-rotation.
+                                        type: string
+                                      credentialBundlePath:
+                                        description: |-
+                                          Write the credential bundle at this path in the projected volume.
+
+                                          The credential bundle is a single file that contains multiple PEM blocks.
+                                          The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                          key.
+
+                                          The remaining blocks are CERTIFICATE blocks, containing the issued
+                                          certificate chain from the signer (leaf and any intermediates).
+
+                                          Using credentialBundlePath lets your Pod's application code make a single
+                                          atomic read that retrieves a consistent key and certificate chain.  If you
+                                          project them to separate files, your application code will need to
+                                          additionally check that the leaf certificate was issued to the key.
+                                        type: string
+                                      keyPath:
+                                        description: |-
+                                          Write the key at this path in the projected volume.
+
+                                          Most applications should use credentialBundlePath.  When using keyPath
+                                          and certificateChainPath, your application needs to check that the key
+                                          and leaf certificate are consistent, because it is possible to read the
+                                          files mid-rotation.
+                                        type: string
+                                      keyType:
+                                        description: |-
+                                          The type of keypair Kubelet will generate for the pod.
+
+                                          Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                          "ECDSAP521", and "ED25519".
+                                        type: string
+                                      maxExpirationSeconds:
+                                        description: |-
+                                          maxExpirationSeconds is the maximum lifetime permitted for the
+                                          certificate.
+
+                                          Kubelet copies this value verbatim into the PodCertificateRequests it
+                                          generates for this projection.
+
+                                          If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                          will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                          value is 7862400 (91 days).
+
+                                          The signer implementation is then free to issue a certificate with any
+                                          lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                          seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                          `kubernetes.io` signers will never issue certificates with a lifetime
+                                          longer than 24 hours.
+                                        format: int32
+                                        type: integer
+                                      signerName:
+                                        description: Kubelet's generated CSRs will
+                                          be addressed to this signer.
+                                        type: string
+                                    required:
+                                    - keyType
+                                    - signerName
+                                    type: object
                                  secret:
                                    description: secret information about the secret
                                      data to project
@@ -8436,7 +8868,6 @@ spec:
                          description: |-
                            rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                            Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                            More info: https://examples.k8s.io/volumes/rbd/README.md
                          properties:
                            fsType:
                              description: |-
@@ -8742,7 +9173,7 @@ spec:
                      Claims lists the names of resources, defined in spec.resourceClaims,
                      that are used by this container.

-                      This is an alpha field and requires enabling the
+                      This field depends on the
                      DynamicResourceAllocation feature gate.

                      This field is immutable. It can only be set for containers.
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.17.2
  name: httptriggers.fission.io
 spec:
  group: fission.io
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.17.2
  name: kuberneteswatchtriggers.fission.io
 spec:
  group: fission.io
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.17.2
  name: messagequeuetriggers.fission.io
 spec:
  group: fission.io
@@ -412,7 +412,6 @@ spec:
                                        pod labels will be ignored. The default value is empty.
                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                      items:
                                        type: string
                                      type: array
@@ -427,7 +426,6 @@ spec:
                                        pod labels will be ignored. The default value is empty.
                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                      items:
                                        type: string
                                      type: array
@@ -594,7 +592,6 @@ spec:
                                    pod labels will be ignored. The default value is empty.
                                    The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                    Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                  items:
                                    type: string
                                  type: array
@@ -609,7 +606,6 @@ spec:
                                    pod labels will be ignored. The default value is empty.
                                    The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                    Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                  items:
                                    type: string
                                  type: array
@@ -703,8 +699,8 @@ spec:
                              most preferred is the one with the greatest sum of weights, i.e.
                              for each node that meets all of the scheduling requirements (resource
                              request, requiredDuringScheduling anti-affinity expressions, etc.),
-                              compute a sum by iterating through the elements of this field and adding
-                              "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                              compute a sum by iterating through the elements of this field and subtracting
+                              "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                              node(s) with the highest sum are the most preferred.
                            items:
                              description: The weights of all of the matched WeightedPodAffinityTerm
@@ -774,7 +770,6 @@ spec:
                                        pod labels will be ignored. The default value is empty.
                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                      items:
                                        type: string
                                      type: array
@@ -789,7 +784,6 @@ spec:
                                        pod labels will be ignored. The default value is empty.
                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                      items:
                                        type: string
                                      type: array
@@ -956,7 +950,6 @@ spec:
                                    pod labels will be ignored. The default value is empty.
                                    The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                    Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                  items:
                                    type: string
                                  type: array
@@ -971,7 +964,6 @@ spec:
                                    pod labels will be ignored. The default value is empty.
                                    The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                    Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                  items:
                                    type: string
                                  type: array
@@ -1104,8 +1096,9 @@ spec:
                              present in a Container.
                            properties:
                              name:
-                                description: Name of the environment variable. Must
-                                  be a C_IDENTIFIER.
+                                description: |-
+                                  Name of the environment variable.
+                                  May consist of any printable ASCII characters except '='.
                                type: string
                              value:
                                description: |-
@@ -1163,6 +1156,43 @@ spec:
                                    - fieldPath
                                    type: object
                                    x-kubernetes-map-type: atomic
+                                  fileKeyRef:
+                                    description: |-
+                                      FileKeyRef selects a key of the env file.
+                                      Requires the EnvFiles feature gate to be enabled.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key within the env file. An invalid key will prevent the pod from starting.
+                                          The keys defined within a source may consist of any printable ASCII characters except '='.
+                                          During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                        type: string
+                                      optional:
+                                        default: false
+                                        description: |-
+                                          Specify whether the file or its key must be defined. If the file or key
+                                          does not exist, then the env var is not published.
+                                          If optional is set to true and the specified key does not exist,
+                                          the environment variable will not be set in the Pod's containers.
+
+                                          If optional is set to false and the specified key does not exist,
+                                          an error will be returned during Pod creation.
+                                        type: boolean
+                                      path:
+                                        description: |-
+                                          The path within the volume from which to select the file.
+                                          Must be relative and may not contain the '..' path or start with '..'.
+                                        type: string
+                                      volumeName:
+                                        description: The name of the volume mount
+                                          containing the env file.
+                                        type: string
+                                    required:
+                                    - key
+                                    - path
+                                    - volumeName
+                                    type: object
+                                    x-kubernetes-map-type: atomic
                                  resourceFieldRef:
                                    description: |-
                                      Selects a resource of the container: only resources limits and requests
@@ -1223,14 +1253,14 @@ spec:
                        envFrom:
                          description: |-
                            List of sources to populate environment variables in the container.
-                            The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                            will be reported as an event when the container is starting. When a key exists in multiple
+                            The keys defined within a source may consist of any printable ASCII characters except '='.
+                            When a key exists in multiple
                            sources, the value associated with the last source will take precedence.
                            Values defined by an Env with a duplicate key will take precedence.
                            Cannot be updated.
                          items:
                            description: EnvFromSource represents the source of a
-                              set of ConfigMaps
+                              set of ConfigMaps or Secrets
                            properties:
                              configMapRef:
                                description: The ConfigMap to select from
@@ -1251,8 +1281,9 @@ spec:
                                type: object
                                x-kubernetes-map-type: atomic
                              prefix:
-                                description: An optional identifier to prepend to
-                                  each key in the ConfigMap. Must be a C_IDENTIFIER.
+                                description: |-
+                                  Optional text to prepend to the name of each environment variable.
+                                  May consist of any printable ASCII characters except '='.
                                type: string
                              secretRef:
                                description: The Secret to select from
@@ -1516,6 +1547,12 @@ spec:
                                  - port
                                  type: object
                              type: object
+                            stopSignal:
+                              description: |-
+                                StopSignal defines which signal will be sent to a container when it is being stopped.
+                                If not specified, the default is defined by the container runtime in use.
+                                StopSignal can only be set for Pods with a non-empty .spec.os.name
+                              type: string
                          type: object
                        livenessProbe:
                          description: |-
@@ -1923,7 +1960,7 @@ spec:
                                Claims lists the names of resources, defined in spec.resourceClaims,
                                that are used by this container.

-                                This is an alpha field and requires enabling the
+                                This field depends on the
                                DynamicResourceAllocation feature gate.

                                This field is immutable. It can only be set for containers.
@@ -1978,10 +2015,10 @@ spec:
                        restartPolicy:
                          description: |-
                            RestartPolicy defines the restart behavior of individual containers in a pod.
-                            This field may only be set for init containers, and the only allowed value is "Always".
-                            For non-init containers or when this field is not specified,
+                            This overrides the pod-level restart policy. When this field is not specified,
                            the restart behavior is defined by the Pod's restart policy and the container type.
-                            Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                            Additionally, setting the RestartPolicy as "Always" for the init container will
+                            have the following effect:
                            this init container will be continually restarted on
                            exit until all regular containers have terminated. Once all regular
                            containers have completed, all init containers with restartPolicy "Always"
@@ -1993,6 +2030,59 @@ spec:
                            init container is started, or after any startupProbe has successfully
                            completed.
                          type: string
+                        restartPolicyRules:
+                          description: |-
+                            Represents a list of rules to be checked to determine if the
+                            container should be restarted on exit. The rules are evaluated in
+                            order. Once a rule matches a container exit condition, the remaining
+                            rules are ignored. If no rule matches the container exit condition,
+                            the Container-level restart policy determines the whether the container
+                            is restarted or not. Constraints on the rules:
+                            - At most 20 rules are allowed.
+                            - Rules can have the same action.
+                            - Identical rules are not forbidden in validations.
+                            When rules are specified, container MUST set RestartPolicy explicitly
+                            even it if matches the Pod's RestartPolicy.
+                          items:
+                            description: ContainerRestartRule describes how a container
+                              exit is handled.
+                            properties:
+                              action:
+                                description: |-
+                                  Specifies the action taken on a container exit if the requirements
+                                  are satisfied. The only possible value is "Restart" to restart the
+                                  container.
+                                type: string
+                              exitCodes:
+                                description: Represents the exit codes to check on
+                                  container exits.
+                                properties:
+                                  operator:
+                                    description: |-
+                                      Represents the relationship between the container exit code(s) and the
+                                      specified values. Possible values are:
+                                      - In: the requirement is satisfied if the container exit code is in the
+                                        set of specified values.
+                                      - NotIn: the requirement is satisfied if the container exit code is
+                                        not in the set of specified values.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      Specifies the set of values to check for container exit codes.
+                                      At most 255 elements are allowed.
+                                    items:
+                                      format: int32
+                                      type: integer
+                                    type: array
+                                    x-kubernetes-list-type: set
+                                required:
+                                - operator
+                                type: object
+                            required:
+                            - action
+                            type: object
+                          type: array
+                          x-kubernetes-list-type: atomic
                        securityContext:
                          description: |-
                            SecurityContext defines the security options the container should be run with.
@@ -2611,8 +2701,9 @@ spec:
                              present in a Container.
                            properties:
                              name:
-                                description: Name of the environment variable. Must
-                                  be a C_IDENTIFIER.
+                                description: |-
+                                  Name of the environment variable.
+                                  May consist of any printable ASCII characters except '='.
                                type: string
                              value:
                                description: |-
@@ -2670,6 +2761,43 @@ spec:
                                    - fieldPath
                                    type: object
                                    x-kubernetes-map-type: atomic
+                                  fileKeyRef:
+                                    description: |-
+                                      FileKeyRef selects a key of the env file.
+                                      Requires the EnvFiles feature gate to be enabled.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key within the env file. An invalid key will prevent the pod from starting.
+                                          The keys defined within a source may consist of any printable ASCII characters except '='.
+                                          During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                        type: string
+                                      optional:
+                                        default: false
+                                        description: |-
+                                          Specify whether the file or its key must be defined. If the file or key
+                                          does not exist, then the env var is not published.
+                                          If optional is set to true and the specified key does not exist,
+                                          the environment variable will not be set in the Pod's containers.
+
+                                          If optional is set to false and the specified key does not exist,
+                                          an error will be returned during Pod creation.
+                                        type: boolean
+                                      path:
+                                        description: |-
+                                          The path within the volume from which to select the file.
+                                          Must be relative and may not contain the '..' path or start with '..'.
+                                        type: string
+                                      volumeName:
+                                        description: The name of the volume mount
+                                          containing the env file.
+                                        type: string
+                                    required:
+                                    - key
+                                    - path
+                                    - volumeName
+                                    type: object
+                                    x-kubernetes-map-type: atomic
                                  resourceFieldRef:
                                    description: |-
                                      Selects a resource of the container: only resources limits and requests
@@ -2730,14 +2858,14 @@ spec:
                        envFrom:
                          description: |-
                            List of sources to populate environment variables in the container.
-                            The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                            will be reported as an event when the container is starting. When a key exists in multiple
+                            The keys defined within a source may consist of any printable ASCII characters except '='.
+                            When a key exists in multiple
                            sources, the value associated with the last source will take precedence.
                            Values defined by an Env with a duplicate key will take precedence.
                            Cannot be updated.
                          items:
                            description: EnvFromSource represents the source of a
-                              set of ConfigMaps
+                              set of ConfigMaps or Secrets
                            properties:
                              configMapRef:
                                description: The ConfigMap to select from
@@ -2758,8 +2886,9 @@ spec:
                                type: object
                                x-kubernetes-map-type: atomic
                              prefix:
-                                description: An optional identifier to prepend to
-                                  each key in the ConfigMap. Must be a C_IDENTIFIER.
+                                description: |-
+                                  Optional text to prepend to the name of each environment variable.
+                                  May consist of any printable ASCII characters except '='.
                                type: string
                              secretRef:
                                description: The Secret to select from
@@ -3019,6 +3148,12 @@ spec:
                                  - port
                                  type: object
                              type: object
+                            stopSignal:
+                              description: |-
+                                StopSignal defines which signal will be sent to a container when it is being stopped.
+                                If not specified, the default is defined by the container runtime in use.
+                                StopSignal can only be set for Pods with a non-empty .spec.os.name
+                              type: string
                          type: object
                        livenessProbe:
                          description: Probes are not allowed for ephemeral containers.
@@ -3409,7 +3544,7 @@ spec:
                                Claims lists the names of resources, defined in spec.resourceClaims,
                                that are used by this container.

-                                This is an alpha field and requires enabling the
+                                This field depends on the
                                DynamicResourceAllocation feature gate.

                                This field is immutable. It can only be set for containers.
@@ -3465,9 +3600,53 @@ spec:
                          description: |-
                            Restart policy for the container to manage the restart behavior of each
                            container within a pod.
-                            This may only be set for init containers. You cannot set this field on
-                            ephemeral containers.
+                            You cannot set this field on ephemeral containers.
                          type: string
+                        restartPolicyRules:
+                          description: |-
+                            Represents a list of rules to be checked to determine if the
+                            container should be restarted on exit. You cannot set this field on
+                            ephemeral containers.
+                          items:
+                            description: ContainerRestartRule describes how a container
+                              exit is handled.
+                            properties:
+                              action:
+                                description: |-
+                                  Specifies the action taken on a container exit if the requirements
+                                  are satisfied. The only possible value is "Restart" to restart the
+                                  container.
+                                type: string
+                              exitCodes:
+                                description: Represents the exit codes to check on
+                                  container exits.
+                                properties:
+                                  operator:
+                                    description: |-
+                                      Represents the relationship between the container exit code(s) and the
+                                      specified values. Possible values are:
+                                      - In: the requirement is satisfied if the container exit code is in the
+                                        set of specified values.
+                                      - NotIn: the requirement is satisfied if the container exit code is
+                                        not in the set of specified values.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      Specifies the set of values to check for container exit codes.
+                                      At most 255 elements are allowed.
+                                    items:
+                                      format: int32
+                                      type: integer
+                                    type: array
+                                    x-kubernetes-list-type: set
+                                required:
+                                - operator
+                                type: object
+                            required:
+                            - action
+                            type: object
+                          type: array
+                          x-kubernetes-list-type: atomic
                        securityContext:
                          description: |-
                            Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4005,7 +4184,9 @@ spec:
                  hostNetwork:
                    description: |-
                      Host networking requested for this pod. Use the host's network namespace.
-                      If this option is set, the ports that will be used must be specified.
+                      When using HostNetwork you should specify ports so the scheduler is aware.
+                      When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                      and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                      Default to false.
                    type: boolean
                  hostPID:
@@ -4030,6 +4211,19 @@ spec:
                      Specifies the hostname of the Pod
                      If not specified, the pod's hostname will be set to a system-defined value.
                    type: string
+                  hostnameOverride:
+                    description: |-
+                      HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                      This field only specifies the pod's hostname and does not affect its DNS records.
+                      When this field is set to a non-empty string:
+                      - It takes precedence over the values set in `hostname` and `subdomain`.
+                      - The Pod's hostname will be set to this value.
+                      - `setHostnameAsFQDN` must be nil or set to false.
+                      - `hostNetwork` must be set to false.
+
+                      This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                      Requires the HostnameOverride feature gate to be enabled.
+                    type: string
                  imagePullSecrets:
                    description: |-
                      ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4065,7 +4259,7 @@ spec:
                      Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.
                      The resourceRequirements of an init container are taken into account during scheduling
                      by finding the highest request/limit for each resource type, and then using the max of
-                      of that value or the sum of the normal containers. Limits are applied to init containers
+                      that value or the sum of the normal containers. Limits are applied to init containers
                      in a similar fashion.
                      Init containers cannot currently be added or removed.
                      Cannot be updated.
@@ -4111,8 +4305,9 @@ spec:
                              present in a Container.
                            properties:
                              name:
-                                description: Name of the environment variable. Must
-                                  be a C_IDENTIFIER.
+                                description: |-
+                                  Name of the environment variable.
+                                  May consist of any printable ASCII characters except '='.
                                type: string
                              value:
                                description: |-
@@ -4170,6 +4365,43 @@ spec:
                                    - fieldPath
                                    type: object
                                    x-kubernetes-map-type: atomic
+                                  fileKeyRef:
+                                    description: |-
+                                      FileKeyRef selects a key of the env file.
+                                      Requires the EnvFiles feature gate to be enabled.
+                                    properties:
+                                      key:
+                                        description: |-
+                                          The key within the env file. An invalid key will prevent the pod from starting.
+                                          The keys defined within a source may consist of any printable ASCII characters except '='.
+                                          During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                        type: string
+                                      optional:
+                                        default: false
+                                        description: |-
+                                          Specify whether the file or its key must be defined. If the file or key
+                                          does not exist, then the env var is not published.
+                                          If optional is set to true and the specified key does not exist,
+                                          the environment variable will not be set in the Pod's containers.
+
+                                          If optional is set to false and the specified key does not exist,
+                                          an error will be returned during Pod creation.
+                                        type: boolean
+                                      path:
+                                        description: |-
+                                          The path within the volume from which to select the file.
+                                          Must be relative and may not contain the '..' path or start with '..'.
+                                        type: string
+                                      volumeName:
+                                        description: The name of the volume mount
+                                          containing the env file.
+                                        type: string
+                                    required:
+                                    - key
+                                    - path
+                                    - volumeName
+                                    type: object
+                                    x-kubernetes-map-type: atomic
                                  resourceFieldRef:
                                    description: |-
                                      Selects a resource of the container: only resources limits and requests
@@ -4230,14 +4462,14 @@ spec:
                        envFrom:
                          description: |-
                            List of sources to populate environment variables in the container.
-                            The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                            will be reported as an event when the container is starting. When a key exists in multiple
+                            The keys defined within a source may consist of any printable ASCII characters except '='.
+                            When a key exists in multiple
                            sources, the value associated with the last source will take precedence.
                            Values defined by an Env with a duplicate key will take precedence.
                            Cannot be updated.
                          items:
                            description: EnvFromSource represents the source of a
-                              set of ConfigMaps
+                              set of ConfigMaps or Secrets
                            properties:
                              configMapRef:
                                description: The ConfigMap to select from
@@ -4258,8 +4490,9 @@ spec:
                                type: object
                                x-kubernetes-map-type: atomic
                              prefix:
-                                description: An optional identifier to prepend to
-                                  each key in the ConfigMap. Must be a C_IDENTIFIER.
+                                description: |-
+                                  Optional text to prepend to the name of each environment variable.
+                                  May consist of any printable ASCII characters except '='.
                                type: string
                              secretRef:
                                description: The Secret to select from
@@ -4523,6 +4756,12 @@ spec:
                                  - port
                                  type: object
                              type: object
+                            stopSignal:
+                              description: |-
+                                StopSignal defines which signal will be sent to a container when it is being stopped.
+                                If not specified, the default is defined by the container runtime in use.
+                                StopSignal can only be set for Pods with a non-empty .spec.os.name
+                              type: string
                          type: object
                        livenessProbe:
                          description: |-
@@ -4930,7 +5169,7 @@ spec:
                                Claims lists the names of resources, defined in spec.resourceClaims,
                                that are used by this container.

-                                This is an alpha field and requires enabling the
+                                This field depends on the
                                DynamicResourceAllocation feature gate.

                                This field is immutable. It can only be set for containers.
@@ -4985,10 +5224,10 @@ spec:
                        restartPolicy:
                          description: |-
                            RestartPolicy defines the restart behavior of individual containers in a pod.
-                            This field may only be set for init containers, and the only allowed value is "Always".
-                            For non-init containers or when this field is not specified,
+                            This overrides the pod-level restart policy. When this field is not specified,
                            the restart behavior is defined by the Pod's restart policy and the container type.
-                            Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                            Additionally, setting the RestartPolicy as "Always" for the init container will
+                            have the following effect:
                            this init container will be continually restarted on
                            exit until all regular containers have terminated. Once all regular
                            containers have completed, all init containers with restartPolicy "Always"
@@ -5000,6 +5239,59 @@ spec:
                            init container is started, or after any startupProbe has successfully
                            completed.
                          type: string
+                        restartPolicyRules:
+                          description: |-
+                            Represents a list of rules to be checked to determine if the
+                            container should be restarted on exit. The rules are evaluated in
+                            order. Once a rule matches a container exit condition, the remaining
+                            rules are ignored. If no rule matches the container exit condition,
+                            the Container-level restart policy determines the whether the container
+                            is restarted or not. Constraints on the rules:
+                            - At most 20 rules are allowed.
+                            - Rules can have the same action.
+                            - Identical rules are not forbidden in validations.
+                            When rules are specified, container MUST set RestartPolicy explicitly
+                            even it if matches the Pod's RestartPolicy.
+                          items:
+                            description: ContainerRestartRule describes how a container
+                              exit is handled.
+                            properties:
+                              action:
+                                description: |-
+                                  Specifies the action taken on a container exit if the requirements
+                                  are satisfied. The only possible value is "Restart" to restart the
+                                  container.
+                                type: string
+                              exitCodes:
+                                description: Represents the exit codes to check on
+                                  container exits.
+                                properties:
+                                  operator:
+                                    description: |-
+                                      Represents the relationship between the container exit code(s) and the
+                                      specified values. Possible values are:
+                                      - In: the requirement is satisfied if the container exit code is in the
+                                        set of specified values.
+                                      - NotIn: the requirement is satisfied if the container exit code is
+                                        not in the set of specified values.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      Specifies the set of values to check for container exit codes.
+                                      At most 255 elements are allowed.
+                                    items:
+                                      format: int32
+                                      type: integer
+                                    type: array
+                                    x-kubernetes-list-type: set
+                                required:
+                                - operator
+                                type: object
+                            required:
+                            - action
+                            type: object
+                          type: array
+                          x-kubernetes-list-type: atomic
                        securityContext:
                          description: |-
                            SecurityContext defines the security options the container should be run with.
@@ -5532,6 +5824,7 @@ spec:
                      - spec.hostPID
                      - spec.hostIPC
                      - spec.hostUsers
+                      - spec.resources
                      - spec.securityContext.appArmorProfile
                      - spec.securityContext.seLinuxOptions
                      - spec.securityContext.seccompProfile
@@ -5685,7 +5978,7 @@ spec:
                    description: |-
                      Resources is the total amount of CPU and Memory resources required by all
                      containers in the pod. It supports specifying Requests and Limits for
-                      "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                      "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.

                      This field enables fine-grained control over resource allocation for the
                      entire pod, allowing resource sharing among containers in a pod.
@@ -5698,7 +5991,7 @@ spec:
                          Claims lists the names of resources, defined in spec.resourceClaims,
                          that are used by this container.

-                          This is an alpha field and requires enabling the
+                          This field depends on the
                          DynamicResourceAllocation feature gate.

                          This field is immutable. It can only be set for containers.
@@ -6235,7 +6528,6 @@ spec:
                            - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.

                            If this value is nil, the behavior is equivalent to the Honor policy.
-                            This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                          type: string
                        nodeTaintsPolicy:
                          description: |-
@@ -6246,7 +6538,6 @@ spec:
                            - Ignore: node taints are ignored. All nodes are included.

                            If this value is nil, the behavior is equivalent to the Ignore policy.
-                            This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                          type: string
                        topologyKey:
                          description: |-
@@ -6971,15 +7262,13 @@ spec:
                                        volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                        If specified, the CSI driver will create or update the volume with the attributes defined
                                        in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                        it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                        will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                        If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                        will be set by the persistentvolume controller if it exists.
+                                        it can be changed after the claim is created. An empty string or nil value indicates that no
+                                        VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                        this field can be reset to its previous value (including nil) to cancel the modification.
                                        If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                        set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                        exists.
                                        More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                        (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                      type: string
                                    volumeMode:
                                      description: |-
@@ -7161,12 +7450,10 @@ spec:
                          description: |-
                            glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                            Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                            More info: https://examples.k8s.io/volumes/glusterfs/README.md
                          properties:
                            endpoints:
-                              description: |-
-                                endpoints is the endpoint name that details Glusterfs topology.
-                                More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                              description: endpoints is the endpoint name that details
+                                Glusterfs topology.
                              type: string
                            path:
                              description: |-
@@ -7220,7 +7507,7 @@ spec:
                            The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                            The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                            The volume will be mounted read-only (ro) and non-executable files (noexec).
-                            Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
+                            Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
                            The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                          properties:
                            pullPolicy:
@@ -7245,7 +7532,7 @@ spec:
                          description: |-
                            iscsi represents an ISCSI Disk resource that is attached to a
                            kubelet's host machine and then exposed to the pod.
-                            More info: https://examples.k8s.io/volumes/iscsi/README.md
+                            More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                          properties:
                            chapAuthDiscovery:
                              description: chapAuthDiscovery defines whether support
@@ -7667,6 +7954,111 @@ spec:
                                        type: array
                                        x-kubernetes-list-type: atomic
                                    type: object
+                                  podCertificate:
+                                    description: |-
+                                      Projects an auto-rotating credential bundle (private key and certificate
+                                      chain) that the pod can use either as a TLS client or server.
+
+                                      Kubelet generates a private key and uses it to send a
+                                      PodCertificateRequest to the named signer.  Once the signer approves the
+                                      request and issues a certificate chain, Kubelet writes the key and
+                                      certificate chain to the pod filesystem.  The pod does not start until
+                                      certificates have been issued for each podCertificate projected volume
+                                      source in its spec.
+
+                                      Kubelet will begin trying to rotate the certificate at the time indicated
+                                      by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                      timestamp.
+
+                                      Kubelet can write a single file, indicated by the credentialBundlePath
+                                      field, or separate files, indicated by the keyPath and
+                                      certificateChainPath fields.
+
+                                      The credential bundle is a single file in PEM format.  The first PEM
+                                      entry is the private key (in PKCS#8 format), and the remaining PEM
+                                      entries are the certificate chain issued by the signer (typically,
+                                      signers will return their certificate chain in leaf-to-root order).
+
+                                      Prefer using the credential bundle format, since your application code
+                                      can read it atomically.  If you use keyPath and certificateChainPath,
+                                      your application must make two separate file reads. If these coincide
+                                      with a certificate rotation, it is possible that the private key and leaf
+                                      certificate you read may not correspond to each other.  Your application
+                                      will need to check for this condition, and re-read until they are
+                                      consistent.
+
+                                      The named signer controls chooses the format of the certificate it
+                                      issues; consult the signer implementation's documentation to learn how to
+                                      use the certificates it issues.
+                                    properties:
+                                      certificateChainPath:
+                                        description: |-
+                                          Write the certificate chain at this path in the projected volume.
+
+                                          Most applications should use credentialBundlePath.  When using keyPath
+                                          and certificateChainPath, your application needs to check that the key
+                                          and leaf certificate are consistent, because it is possible to read the
+                                          files mid-rotation.
+                                        type: string
+                                      credentialBundlePath:
+                                        description: |-
+                                          Write the credential bundle at this path in the projected volume.
+
+                                          The credential bundle is a single file that contains multiple PEM blocks.
+                                          The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                          key.
+
+                                          The remaining blocks are CERTIFICATE blocks, containing the issued
+                                          certificate chain from the signer (leaf and any intermediates).
+
+                                          Using credentialBundlePath lets your Pod's application code make a single
+                                          atomic read that retrieves a consistent key and certificate chain.  If you
+                                          project them to separate files, your application code will need to
+                                          additionally check that the leaf certificate was issued to the key.
+                                        type: string
+                                      keyPath:
+                                        description: |-
+                                          Write the key at this path in the projected volume.
+
+                                          Most applications should use credentialBundlePath.  When using keyPath
+                                          and certificateChainPath, your application needs to check that the key
+                                          and leaf certificate are consistent, because it is possible to read the
+                                          files mid-rotation.
+                                        type: string
+                                      keyType:
+                                        description: |-
+                                          The type of keypair Kubelet will generate for the pod.
+
+                                          Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                          "ECDSAP521", and "ED25519".
+                                        type: string
+                                      maxExpirationSeconds:
+                                        description: |-
+                                          maxExpirationSeconds is the maximum lifetime permitted for the
+                                          certificate.
+
+                                          Kubelet copies this value verbatim into the PodCertificateRequests it
+                                          generates for this projection.
+
+                                          If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                          will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                          value is 7862400 (91 days).
+
+                                          The signer implementation is then free to issue a certificate with any
+                                          lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                          seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                          `kubernetes.io` signers will never issue certificates with a lifetime
+                                          longer than 24 hours.
+                                        format: int32
+                                        type: integer
+                                      signerName:
+                                        description: Kubelet's generated CSRs will
+                                          be addressed to this signer.
+                                        type: string
+                                    required:
+                                    - keyType
+                                    - signerName
+                                    type: object
                                  secret:
                                    description: secret information about the secret
                                      data to project
@@ -7801,7 +8193,6 @@ spec:
                          description: |-
                            rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                            Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                            More info: https://examples.k8s.io/volumes/rbd/README.md
                          properties:
                            fsType:
                              description: |-
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.17.2
  name: packages.fission.io
 spec:
  group: fission.io
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.17.2
  name: timetriggers.fission.io
 spec:
  group: fission.io
@@ -1,13 +1,15 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-commonLabels:
-  group: fission.io
 resources:
-  - fission.io_canaryconfigs.yaml
-  - fission.io_environments.yaml
-  - fission.io_functions.yaml
-  - fission.io_httptriggers.yaml
-  - fission.io_kuberneteswatchtriggers.yaml
-  - fission.io_messagequeuetriggers.yaml
-  - fission.io_packages.yaml
-  - fission.io_timetriggers.yaml
+- fission.io_canaryconfigs.yaml
+- fission.io_environments.yaml
+- fission.io_functions.yaml
+- fission.io_httptriggers.yaml
+- fission.io_kuberneteswatchtriggers.yaml
+- fission.io_messagequeuetriggers.yaml
+- fission.io_packages.yaml
+- fission.io_timetriggers.yaml
+labels:
+- includeSelectors: true
+  pairs:
+    group: fission.io
@@ -1,60 +1,55 @@
 module github.com/fission/fission

-go 1.23.4
+go 1.25.5

 require (
-	dario.cat/mergo v1.0.1
-	github.com/IBM/sarama v1.45.0
+	dario.cat/mergo v1.0.2
+	github.com/IBM/sarama v1.46.3
 	github.com/bep/debounce v1.2.1
 	github.com/dchest/uniuri v1.2.0
-	github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815
 	github.com/dustin/go-humanize v1.0.1
-	github.com/elastic/crd-ref-docs v0.1.0
 	github.com/fatih/color v1.18.0
-	github.com/fsnotify/fsnotify v1.8.0
-	github.com/go-git/go-git/v5 v5.13.1
+	github.com/fsnotify/fsnotify v1.9.0
+	github.com/go-git/go-git/v5 v5.16.4
 	github.com/go-logr/zapr v1.3.0
-	github.com/golang-jwt/jwt/v4 v4.5.1
-	github.com/google/go-cmp v0.6.0
+	github.com/golang-jwt/jwt/v4 v4.5.2
+	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
 	github.com/graymeta/stow v0.2.8
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/hashicorp/go-retryablehttp v0.7.7
-	github.com/influxdata/influxdb v1.11.8
-	github.com/kedacore/keda/v2 v2.16.1
-	github.com/mholt/archives v0.1.0
-	github.com/minio/minio-go v6.0.14+incompatible
-	github.com/ory/dockertest v3.3.5+incompatible
-	github.com/pkg/errors v0.9.1
-	github.com/prometheus/client_golang v1.20.5
-	github.com/prometheus/common v0.61.0
+	github.com/hashicorp/go-retryablehttp v0.7.8
+	github.com/influxdata/influxdb v1.12.2
+	github.com/kedacore/keda/v2 v2.18.2
+	github.com/mholt/archives v0.1.5
+	github.com/minio/minio-go/v7 v7.0.97
+	github.com/ory/dockertest/v3 v3.12.0
+	github.com/prometheus/client_golang v1.23.2
+	github.com/prometheus/common v0.67.4
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06
-	github.com/spf13/cobra v1.8.1
-	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.10.0
+	github.com/spf13/cobra v1.10.2
+	github.com/spf13/pflag v1.0.10
+	github.com/stretchr/testify v1.11.1
 	github.com/wcharczuk/go-chart v2.0.1+incompatible
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0
-	go.opentelemetry.io/contrib/propagators/autoprop v0.58.0
-	go.opentelemetry.io/otel v1.33.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0
-	go.opentelemetry.io/otel/sdk v1.33.0
-	go.opentelemetry.io/otel/trace v1.33.0
-	go.uber.org/zap v1.27.0
-	golang.org/x/net v0.34.0
-	google.golang.org/grpc v1.69.2
-	k8s.io/api v0.32.0
-	k8s.io/apiextensions-apiserver v0.32.0
-	k8s.io/apimachinery v0.32.0
-	k8s.io/client-go v0.32.0
-	k8s.io/code-generator v0.32.0
-	k8s.io/metrics v0.32.0
-	sigs.k8s.io/controller-runtime v0.19.4
-	sigs.k8s.io/controller-tools v0.17.0
-	sigs.k8s.io/structured-merge-diff/v4 v4.5.0
-	sigs.k8s.io/yaml v1.4.0
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0
+	go.opentelemetry.io/contrib/propagators/autoprop v0.64.0
+	go.opentelemetry.io/otel v1.39.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.39.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0
+	go.opentelemetry.io/otel/sdk v1.39.0
+	go.opentelemetry.io/otel/trace v1.39.0
+	go.uber.org/zap v1.27.1
+	golang.org/x/net v0.48.0
+	google.golang.org/grpc v1.77.0
+	k8s.io/api v0.34.3
+	k8s.io/apiextensions-apiserver v0.34.3
+	k8s.io/apimachinery v0.34.3
+	k8s.io/client-go v0.34.3
+	k8s.io/metrics v0.34.3
+	sigs.k8s.io/controller-runtime v0.22.4
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.1
+	sigs.k8s.io/yaml v1.6.0
 )

 require (
@@ -62,62 +57,65 @@ require (
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver v1.5.0 // indirect
 	github.com/Masterminds/sprig v2.22.0+incompatible // indirect
-	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
-	github.com/ProtonMail/go-crypto v1.1.3 // indirect
-	github.com/STARRY-S/zip v0.2.1 // indirect
-	github.com/andybalholm/brotli v1.1.1 // indirect
-	github.com/aws/aws-sdk-go v1.42.34 // indirect
+	github.com/ProtonMail/go-crypto v1.1.6 // indirect
+	github.com/STARRY-S/zip v0.2.3 // indirect
+	github.com/andybalholm/brotli v1.2.0 // indirect
+	github.com/aws/aws-sdk-go v1.55.7 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blend/go-sdk v1.20220112.5 // indirect
 	github.com/bodgit/plumbing v1.3.0 // indirect
-	github.com/bodgit/sevenzip v1.6.0 // indirect
+	github.com/bodgit/sevenzip v1.6.1 // indirect
 	github.com/bodgit/windows v1.0.1 // indirect
-	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/cloudflare/circl v1.3.7 // indirect
-	github.com/containerd/continuity v0.2.2 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
-	github.com/cyphar/filepath-securejoin v0.3.6 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
+	github.com/containerd/continuity v0.4.5 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
+	github.com/cyphar/filepath-securejoin v0.5.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-units v0.4.0 // indirect
+	github.com/docker/cli v27.4.1+incompatible // indirect
+	github.com/docker/docker v28.1.1+incompatible // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
 	github.com/eapache/go-resiliency v1.7.0 // indirect
 	github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3 // indirect
 	github.com/eapache/queue v1.1.0 // indirect
-	github.com/emicklei/go-restful/v3 v3.12.1 // indirect
+	github.com/elastic/crd-ref-docs v0.2.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
-	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
-	github.com/expr-lang/expr v1.16.9 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
+	github.com/expr-lang/expr v1.17.6 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.6.1 // indirect
-	github.com/go-ini/ini v1.66.4 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-git/go-billy/v5 v5.6.2 // indirect
+	github.com/go-ini/ini v1.67.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/gobuffalo/flect v1.0.3 // indirect
-	github.com/goccy/go-yaml v1.11.3 // indirect
+	github.com/goccy/go-yaml v1.18.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/gorilla/websocket v1.5.1 // indirect
-	github.com/gotestyourself/gotestyourself v2.2.0+incompatible // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/golang/snappy v1.0.0 // indirect
+	github.com/google/btree v1.1.3 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
+	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
+	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
-	github.com/huandu/xstrings v1.3.3 // indirect
+	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
@@ -130,74 +128,100 @@ require (
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/klauspost/compress v1.18.1 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
-	github.com/lib/pq v1.10.4 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mikelolasagasti/xz v1.0.1 // indirect
+	github.com/minio/crc64nvme v1.1.0 // indirect
+	github.com/minio/md5-simd v1.1.2 // indirect
+	github.com/minio/minlz v1.0.1 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
-	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/spdystream v0.5.0 // indirect
+	github.com/moby/sys/user v0.3.0 // indirect
+	github.com/moby/term v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
-	github.com/nwaples/rardecode/v2 v2.0.0-beta.4.0.20241112120701-034e449c6e78 // indirect
+	github.com/nwaples/rardecode/v2 v2.2.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runc v1.1.14 // indirect
+	github.com/opencontainers/image-spec v1.1.0 // indirect
+	github.com/opencontainers/runc v1.2.8 // indirect
+	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pierrec/lz4/v4 v4.1.22 // indirect
-	github.com/pjbgf/sha1cd v0.3.0 // indirect
+	github.com/pjbgf/sha1cd v0.3.2 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/procfs v0.17.0 // indirect
+	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
+	github.com/rs/xid v1.6.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
+	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/skeema/knownhosts v1.3.0 // indirect
-	github.com/sorairolake/lzip-go v0.3.5 // indirect
-	github.com/therootcompany/xz v1.0.1 // indirect
-	github.com/ulikunitz/xz v0.5.12 // indirect
+	github.com/skeema/knownhosts v1.3.1 // indirect
+	github.com/sorairolake/lzip-go v0.3.8 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/tinylib/msgp v1.3.0 // indirect
+	github.com/ulikunitz/xz v0.5.15 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/propagators/aws v1.33.0 // indirect
-	go.opentelemetry.io/contrib/propagators/b3 v1.33.0 // indirect
-	go.opentelemetry.io/contrib/propagators/jaeger v1.33.0 // indirect
-	go.opentelemetry.io/contrib/propagators/ot v1.33.0 // indirect
-	go.opentelemetry.io/otel/metric v1.33.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.4.0 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/propagators/aws v1.39.0 // indirect
+	go.opentelemetry.io/contrib/propagators/b3 v1.39.0 // indirect
+	go.opentelemetry.io/contrib/propagators/jaeger v1.39.0 // indirect
+	go.opentelemetry.io/contrib/propagators/ot v1.39.0 // indirect
+	go.opentelemetry.io/otel/metric v1.39.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
-	golang.org/x/crypto v0.32.0 // indirect
-	golang.org/x/exp v0.0.0-20240808152545-0cdaa3abc0fa // indirect
+	golang.org/x/crypto v0.46.0 // indirect
 	golang.org/x/image v0.18.0 // indirect
-	golang.org/x/mod v0.22.0 // indirect
-	golang.org/x/oauth2 v0.24.0 // indirect
-	golang.org/x/sync v0.10.0 // indirect
-	golang.org/x/sys v0.29.0 // indirect
-	golang.org/x/term v0.28.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
-	golang.org/x/time v0.8.0 // indirect
-	golang.org/x/tools v0.28.0 // indirect
-	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
-	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
-	google.golang.org/protobuf v1.36.0 // indirect
+	golang.org/x/mod v0.30.0 // indirect
+	golang.org/x/oauth2 v0.33.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/term v0.38.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	golang.org/x/tools v0.39.0 // indirect
+	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	gotest.tools v2.2.0+incompatible // indirect
-	k8s.io/gengo/v2 v2.0.0-20240911193312-2b36238f13e9 // indirect
+	k8s.io/code-generator v0.34.3 // indirect
+	k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
-	knative.dev/pkg v0.0.0-20241218051509-40afb7c5436e // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
+	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
+	knative.dev/pkg v0.0.0-20250326102644-9f3e60a9244c // indirect
+	sigs.k8s.io/controller-runtime/tools/setup-envtest v0.0.0-20250211091558-894df3a7e664 // indirect
+	sigs.k8s.io/controller-tools v0.19.0 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
 )
+
+tool (
+	github.com/elastic/crd-ref-docs
+	k8s.io/code-generator
+	sigs.k8s.io/controller-runtime/tools/setup-envtest
+	sigs.k8s.io/controller-tools/cmd/controller-gen
+)
+
+replace k8s.io/code-generator => github.com/fission/code-generator v0.18.0-alpha.1.0.20250914164041-5cd640227cd4
@@ -1,5 +1,7 @@
 if ! command -v dashboard-linter >/dev/null 2>&1; then
    echo "dashboard-linter is not installed"
+    echo "Installing dashboard-linter..."
+    go install github.com/grafana/dashboard-linter@latest
    exit 1;
 fi
 BASE_PATH=$(pwd)
@@ -28,8 +28,7 @@ set +x
 # for codecov
 echo "" > coverage.txt

-make install-envtest
-KUBEBUILDER_ASSETS=$(setup-envtest -p path use 1.30.x)
+KUBEBUILDER_ASSETS=$(go tool setup-envtest -p path use 1.30.x)
 export KUBEBUILDER_ASSETS

 # The executor unit test only works with NodePort-type services for
@@ -3,11 +3,18 @@ set -o errexit
 set -o nounset
 set -o pipefail

+CODEGEN_PKG_VERSION=$(go list -m -f '{{.Replace.Version}}' k8s.io/code-generator)
+if [ -z "$CODEGEN_PKG_VERSION" ]; then
+	echo "Error: could not determine code-generator version from go.mod"
+	echo "Received output: '$CODEGEN_PKG_VERSION'"
+	exit 1
+fi
 GOPATH=$(go env GOPATH)
+GOMODCACHEPATH=$(go env GOMODCACHE)
 SCRIPT_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 CODEGEN_PKG=${CODEGEN_PKG:-$(
 	cd "${SCRIPT_ROOT}"
-	ls -d -1 ${SCRIPT_ROOT}/../code-generator 2>/dev/null || echo $GOPATH/pkg/mod/k8s.io/code-generator@v0.32.0
+	echo ${GOMODCACHEPATH}/github.com/fission/code-generator@${CODEGEN_PKG_VERSION}
 )}
 OUTDIR="${SCRIPT_ROOT}/pkg/generated"

@@ -1,73 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var environmentlog = loggerfactory.GetLogger().Named("environment-resource")
-
-func (r *Environment) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-environment,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=environments,verbs=create;update,versions=v1,name=menvironment.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &Environment{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *Environment) Default() {
-	environmentlog.Debug("default", zap.String("name", r.Name))
-}
-
-// user: change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-environment,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=environments,verbs=create,versions=v1,name=venvironment.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &Environment{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (r *Environment) ValidateCreate() (admission.Warnings, error) {
-	environmentlog.Debug("validate create", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("Environment", err)
-		return nil, err
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *Environment) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	environmentlog.Debug("validate update", zap.String("name", r.Name))
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *Environment) ValidateDelete() (admission.Warnings, error) {
-	environmentlog.Debug("validate delete", zap.String("name", r.Name))
-	return nil, nil
-}
@@ -1,105 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"fmt"
-
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var functionlog = loggerfactory.GetLogger().Named("function-resource")
-
-func (r *Function) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-function,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=functions,verbs=create;update,versions=v1,name=mfunction.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &Function{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *Function) Default() {
-}
-
-// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-function,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=functions,verbs=create;update,versions=v1,name=vfunction.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &Function{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (r *Function) ValidateCreate() (admission.Warnings, error) {
-	functionlog.Debug("validate create", zap.String("name", r.Name))
-
-	for _, cnfMap := range r.Spec.ConfigMaps {
-		if cnfMap.Namespace != r.ObjectMeta.Namespace {
-			err := fmt.Errorf("ConfigMap's [%s] and function's Namespace [%s] are different. ConfigMap needs to be present in the same namespace as function", cnfMap.Namespace, r.ObjectMeta.Namespace)
-			return nil, AggregateValidationErrors("Function", err)
-		}
-	}
-	for _, secret := range r.Spec.Secrets {
-		if secret.Namespace != r.ObjectMeta.Namespace {
-			err := fmt.Errorf("secret  [%s] and function's Namespace [%s] are different. Secret needs to be present in the same namespace as function", secret.Namespace, r.ObjectMeta.Namespace)
-			return nil, AggregateValidationErrors("Function", err)
-		}
-	}
-
-	err := r.Validate()
-	if err != nil {
-		return nil, AggregateValidationErrors("Function", err)
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *Function) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	functionlog.Debug("validate update", zap.String("name", r.Name))
-
-	for _, cnfMap := range r.Spec.ConfigMaps {
-		if cnfMap.Namespace != r.ObjectMeta.Namespace {
-			err := fmt.Errorf("ConfigMap's [%s] and function's Namespace [%s] are different. ConfigMap needs to be present in the same namespace as function", cnfMap.Namespace, r.ObjectMeta.Namespace)
-			return nil, AggregateValidationErrors("Function", err)
-		}
-	}
-	for _, secret := range r.Spec.Secrets {
-		if secret.Namespace != r.ObjectMeta.Namespace {
-			err := fmt.Errorf("secret  [%s] and function's Namespace [%s] are different. Secret needs to be present in the same namespace as function", secret.Namespace, r.ObjectMeta.Namespace)
-			return nil, AggregateValidationErrors("Function", err)
-		}
-	}
-
-	err := r.Validate()
-	if err != nil {
-		return nil, AggregateValidationErrors("Function", err)
-	}
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *Function) ValidateDelete() (admission.Warnings, error) {
-	functionlog.Debug("validate delete", zap.String("name", r.Name))
-	return nil, nil
-}
@@ -1,80 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var httptriggerlog = loggerfactory.GetLogger().Named("httptrigger-resource")
-
-func (r *HTTPTrigger) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-httptrigger,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=httptriggers,verbs=create;update,versions=v1,name=mhttptrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &HTTPTrigger{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *HTTPTrigger) Default() {
-	httptriggerlog.Debug("default", zap.String("name", r.Name))
-}
-
-// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-httptrigger,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=httptriggers,verbs=create;update,versions=v1,name=vhttptrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &HTTPTrigger{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (t *HTTPTrigger) ValidateCreate() (admission.Warnings, error) {
-	httptriggerlog.Debug("validate create", zap.String("name", t.Name))
-	err := t.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("HTTPTrigger", err)
-		return nil, err
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *HTTPTrigger) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	httptriggerlog.Debug("validate update", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("HTTPTrigger", err)
-		return nil, err
-	}
-
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *HTTPTrigger) ValidateDelete() (admission.Warnings, error) {
-	httptriggerlog.Debug("validate delete", zap.String("name", r.Name))
-
-	return nil, nil
-}
@@ -1,73 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var kuberneteswatchtriggerlog = loggerfactory.GetLogger().Named("kuberneteswatchtrigger-resource")
-
-func (r *KubernetesWatchTrigger) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-kuberneteswatchtrigger,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=kuberneteswatchtriggers,verbs=create;update,versions=v1,name=mkuberneteswatchtrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &KubernetesWatchTrigger{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *KubernetesWatchTrigger) Default() {
-	kuberneteswatchtriggerlog.Debug("default", zap.String("name", r.Name))
-}
-
-// user: change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-kuberneteswatchtrigger,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=kuberneteswatchtriggers,verbs=create,versions=v1,name=vkuberneteswatchtrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &KubernetesWatchTrigger{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (r *KubernetesWatchTrigger) ValidateCreate() (admission.Warnings, error) {
-	kuberneteswatchtriggerlog.Debug("validate create", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("Watch", err)
-		return nil, err
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *KubernetesWatchTrigger) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	// WATCH UPDATE NOT IMPLEMENTED
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *KubernetesWatchTrigger) ValidateDelete() (admission.Warnings, error) {
-	kuberneteswatchtriggerlog.Debug("validate delete", zap.String("name", r.Name))
-	return nil, nil
-}
@@ -1,108 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"fmt"
-
-	"github.com/dustin/go-humanize"
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	ferror "github.com/fission/fission/pkg/error"
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var packagelog = loggerfactory.GetLogger().Named("package-resource")
-
-func (r *Package) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-//+kubebuilder:webhook:path=/mutate-fission-io-v1-package,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=packages,verbs=create;update,versions=v1,name=mpackage.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &Package{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *Package) Default() {
-	packagelog.Debug("default", zap.String("name", r.Name))
-	if r.Status.BuildStatus == "" {
-		if !r.Spec.Deployment.IsEmpty() {
-			// deployment package exists
-			r.Status.BuildStatus = BuildStatusNone
-		} else if !r.Spec.Source.IsEmpty() {
-			// source package with no deployment is a pending build
-			r.Status.BuildStatus = BuildStatusPending
-		} else {
-			r.Status.BuildStatus = BuildStatusFailed // empty package
-			r.Status.BuildLog = "Both source and deployment are empty"
-		}
-	}
-}
-
-// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-package,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=packages,verbs=create;update,versions=v1,name=vpackage.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &Package{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (r *Package) ValidateCreate() (admission.Warnings, error) {
-	packagelog.Debug("validate create", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("Package", err)
-		return nil, err
-	}
-
-	// Ensure size limits
-	if len(r.Spec.Source.Literal) > int(ArchiveLiteralSizeLimit) {
-		err := ferror.MakeError(ferror.ErrorInvalidArgument,
-			fmt.Sprintf("Package literal larger than %s", humanize.Bytes(uint64(ArchiveLiteralSizeLimit))))
-		return nil, err
-	}
-	if len(r.Spec.Deployment.Literal) > int(ArchiveLiteralSizeLimit) {
-		err := ferror.MakeError(ferror.ErrorInvalidArgument,
-			fmt.Sprintf("Package literal larger than %s", humanize.Bytes(uint64(ArchiveLiteralSizeLimit))))
-		return nil, err
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *Package) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	packagelog.Debug("validate update", zap.String("name", r.Name))
-	err := r.Validate()
-
-	if err != nil {
-		err = AggregateValidationErrors("Package", err)
-		return nil, err
-	}
-
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *Package) ValidateDelete() (admission.Warnings, error) {
-	packagelog.Debug("validate delete", zap.String("name", r.Name))
-	return nil, nil
-}
@@ -1,92 +0,0 @@
-/*
-Copyright 2022.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1
-
-import (
-	"go.uber.org/zap"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	ferror "github.com/fission/fission/pkg/error"
-	"github.com/fission/fission/pkg/utils/loggerfactory"
-)
-
-// log is for logging in this package.
-var timetriggerlog = loggerfactory.GetLogger().Named("timetrigger-resource")
-
-func (r *TimeTrigger) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-timetrigger,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=timetriggers,verbs=create;update,versions=v1,name=mtimetrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &TimeTrigger{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (r *TimeTrigger) Default() {
-	timetriggerlog.Debug("default", zap.String("name", r.Name))
-}
-
-// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-fission-io-v1-timetrigger,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=timetriggers,verbs=create;update,versions=v1,name=vtimetrigger.fission.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &TimeTrigger{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (r *TimeTrigger) ValidateCreate() (admission.Warnings, error) {
-	timetriggerlog.Debug("validate create", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("TimeTrigger", err)
-		return nil, err
-	}
-
-	err = IsValidCronSpec(r.Spec.Cron)
-	if err != nil {
-		err = ferror.MakeError(ferror.ErrorInvalidArgument, "TimeTrigger cron spec is not valid")
-		return nil, err
-	}
-	return nil, nil
-}
-
-// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (r *TimeTrigger) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	timetriggerlog.Debug("validate update", zap.String("name", r.Name))
-	err := r.Validate()
-	if err != nil {
-		err = AggregateValidationErrors("TimeTrigger", err)
-		return nil, err
-	}
-
-	err = IsValidCronSpec(r.Spec.Cron)
-	if err != nil {
-		err = ferror.MakeError(ferror.ErrorInvalidArgument, "TimeTrigger cron spec is not valid")
-		return nil, err
-	}
-
-	return nil, nil
-}
-
-// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (r *TimeTrigger) ValidateDelete() (admission.Warnings, error) {
-	timetriggerlog.Debug("validate delete", zap.String("name", r.Name))
-	return nil, nil
-}
@@ -599,7 +599,7 @@ func (e *Environment) Validate() error {

 	if e.Spec.Runtime.PodSpec != nil {
 		for _, container := range e.Spec.Runtime.PodSpec.Containers {
-			if container.Command == nil && container.Image == e.Spec.Runtime.Image && container.Name != e.ObjectMeta.Name {
+			if container.Command == nil && container.Image == e.Spec.Runtime.Image && container.Name != e.Name {
 				result = multierror.Append(result, errors.New("container with image same as runtime image in podspec, must have name same as environment name"))
 			}
 		}
@@ -23,7 +23,7 @@ package v1
 import (
 	"k8s.io/api/autoscaling/v2"
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/runtime"
+	runtime "k8s.io/apimachinery/pkg/runtime"
 )

 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
@@ -31,7 +31,6 @@ import (
 	"time"

 	"github.com/dchest/uniuri"
-	"github.com/pkg/errors"
 	"go.uber.org/zap"

 	"github.com/fission/fission/pkg/info"
@@ -206,7 +205,7 @@ func (builder *Builder) reply(ctx context.Context, w http.ResponseWriter, pkgFil

 	rBody, err := json.Marshal(resp)
 	if err != nil {
-		e := errors.Wrap(err, "error encoding response body")
+		e := fmt.Errorf("error encoding response body: %w", err)
 		rBody = []byte(fmt.Sprintf(`{"buildLogs": "%s"}`, e.Error()))
 		statusCode = http.StatusInternalServerError
 	}
@@ -247,12 +246,12 @@ func (builder *Builder) build(ctx context.Context, command string, args []string

 	stdout, err := cmd.StdoutPipe()
 	if err != nil {
-		return "", errors.Wrap(err, "error creating stdout pipe for cmd")
+		return "", fmt.Errorf("error creating stdout pipe for cmd: %w", err)
 	}

 	stderr, err := cmd.StderrPipe()
 	if err != nil {
-		return "", errors.Wrap(err, "error creating stderr pipe for cmd")
+		return "", fmt.Errorf("error creating stderr pipe for cmd: %w", err)
 	}

 	// Init logs
@@ -263,7 +262,7 @@ func (builder *Builder) build(ctx context.Context, command string, args []string

 	err = cmd.Start()
 	if err != nil {
-		return "", errors.Wrap(err, "error starting cmd")
+		return "", fmt.Errorf("error starting cmd: %w", err)
 	}
 	fmt.Printf("========= START =========\n")
 	defer fmt.Printf("========= END ===========\n")
@@ -276,14 +275,14 @@ func (builder *Builder) build(ctx context.Context, command string, args []string
 	}

 	if err := scanner.Err(); err != nil {
-		scanErr := errors.Wrap(err, "error reading cmd output")
+		scanErr := fmt.Errorf("error reading cmd output: %w", err)
 		fmt.Println(scanErr)
 		return buildLogs, scanErr
 	}

 	err = cmd.Wait()
 	if err != nil {
-		cmdErr := errors.Wrapf(err, "error waiting for cmd %q", command)
+		cmdErr := fmt.Errorf("error waiting for cmd %q: %w", command, err)
 		fmt.Println(cmdErr)
 		return buildLogs, cmdErr
 	}
@@ -20,12 +20,12 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"strings"

 	"github.com/hashicorp/go-retryablehttp"
-	"github.com/pkg/errors"
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
 	"go.uber.org/zap"
 	"golang.org/x/net/context/ctxhttp"
@@ -68,26 +68,26 @@ func (c *client) Build(ctx context.Context, req *builder.PackageBuildRequest) (*

 	body, err := json.Marshal(req)
 	if err != nil {
-		return nil, errors.Wrap(err, "error marshaling json")
+		return nil, fmt.Errorf("error marshaling json: %w", err)
 	}

 	resp, err := ctxhttp.Post(ctx, c.httpClient.StandardClient(), c.url, "application/json", bytes.NewReader(body))
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("error sending request: %w", err)
 	}
 	defer resp.Body.Close()

 	rBody, err := io.ReadAll(resp.Body)
 	if err != nil {
 		logger.Error("error reading resp body", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error reading response body: %w", err)
 	}

 	pkgBuildResp := builder.PackageBuildResponse{}
 	err = json.Unmarshal(rBody, &pkgBuildResp)
 	if err != nil {
 		logger.Error("error parsing resp body", zap.Error(err))
-		return nil, err
+		return nil, fmt.Errorf("error parsing response body: %w", err)
 	}

 	return &pkgBuildResp, ferror.MakeErrorFromHTTP(resp)
@@ -98,7 +98,7 @@ func (c *client) Clean(ctx context.Context, srcPkgFilename string) error {

 	req, err := http.NewRequest(http.MethodDelete, c.getCleanUrl(srcPkgFilename), http.NoBody)
 	if err != nil {
-		return errors.Wrap(err, "failed to create http request for clean api")
+		return fmt.Errorf("error creating http request: %w", err)
 	}

 	resp, err := ctxhttp.Do(ctx, c.httpClient.StandardClient(), req)
@@ -18,10 +18,10 @@ package buildermgr

 import (
 	"context"
+	"fmt"
 	"os"
 	"time"

-	"github.com/pkg/errors"
 	"go.uber.org/zap"

 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
@@ -38,21 +38,21 @@ func Start(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *

 	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		return errors.Wrap(err, "failed to get fission client")
+		return fmt.Errorf("failed to get fission client: %w", err)
 	}
 	kubernetesClient, err := clientGen.GetKubernetesClient()
 	if err != nil {
-		return errors.Wrap(err, "failed to get kubernetes client")
+		return fmt.Errorf("failed to get kubernetes client: %w", err)
 	}

 	err = crd.WaitForFunctionCRDs(ctx, logger, fissionClient)
 	if err != nil {
-		return errors.Wrap(err, "error waiting for CRDs")
+		return fmt.Errorf("error waiting for CRDs: %w", err)
 	}

 	fetcherConfig, err := fetcherConfig.MakeFetcherConfig("/packages")
 	if err != nil {
-		return errors.Wrap(err, "error making fetcher config")
+		return fmt.Errorf("error making fetcher config: %w", err)
 	}

 	podSpecPatch, err := util.GetSpecFromConfigMap(fv1.BuilderPodSpecPath)
@@ -24,7 +24,6 @@ import (
 	"time"

 	"github.com/dchest/uniuri"
-	"github.com/pkg/errors"
 	"go.uber.org/zap"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

@@ -55,10 +54,10 @@ func buildPackage(ctx context.Context, logger *zap.Logger, fissionClient version
 		return nil, e, ferror.MakeError(http.StatusInternalServerError, e)
 	}

-	svcName := fmt.Sprintf("%v-%v.%v", env.ObjectMeta.Name, env.ObjectMeta.ResourceVersion, envBuilderNamespace)
-	srcPkgFilename := fmt.Sprintf("%v-%v", pkg.ObjectMeta.Name, strings.ToLower(uniuri.NewLen(6)))
-	fetcherC := fetcherClient.MakeClient(logger, fmt.Sprintf("http://%v:8000", svcName))
-	builderC := builderClient.MakeClient(logger, fmt.Sprintf("http://%v:8001", svcName))
+	svcName := fmt.Sprintf("%s-%s.%s", env.Name, env.ResourceVersion, envBuilderNamespace)
+	srcPkgFilename := fmt.Sprintf("%s-%s", pkg.Name, strings.ToLower(uniuri.NewLen(6)))
+	fetcherC := fetcherClient.MakeClient(logger, fmt.Sprintf("http://%s:8000", svcName))
+	builderC := builderClient.MakeClient(logger, fmt.Sprintf("http://%s:8001", svcName))

 	defer func() {
 		logger.Info("cleaning src pkg from builder storage", zap.String("source_package", srcPkgFilename))
@@ -162,7 +161,7 @@ func updatePackage(ctx context.Context, logger *zap.Logger, fissionClient versio
 	if err != nil {
 		e := "error updating package"
 		logger.Error(e, zap.Error(err))
-		return nil, errors.Wrap(err, e)
+		return nil, fmt.Errorf("%s: %w", e, err)
 	}

 	// return resource version for function to update function package ref
@@ -461,7 +461,7 @@ func (canaryCfgMgr *canaryConfigMgr) rollback(ctx context.Context, canaryConfig
 	functionWeights[canaryConfig.Spec.NewFunction] = 0
 	functionWeights[canaryConfig.Spec.OldFunction] = 100

-	err := canaryCfgMgr.updateHttpTriggerWithRetries(ctx, trigger.ObjectMeta.Name, trigger.ObjectMeta.Namespace, functionWeights)
+	err := canaryCfgMgr.updateHttpTriggerWithRetries(ctx, trigger.Name, trigger.ObjectMeta.Namespace, functionWeights)
 	if err != nil {
 		return err
 	}
@@ -494,7 +494,7 @@ func (canaryCfgMgr *canaryConfigMgr) rollForward(ctx context.Context, canaryConf
 		zap.String("namespace", canaryConfig.ObjectMeta.Namespace),
 		zap.Any("function_weights", functionWeights))

-	err := canaryCfgMgr.updateHttpTriggerWithRetries(ctx, trigger.ObjectMeta.Name, trigger.ObjectMeta.Namespace, functionWeights)
+	err := canaryCfgMgr.updateHttpTriggerWithRetries(ctx, trigger.Name, trigger.ObjectMeta.Namespace, functionWeights)
 	return doneProcessingCanaryConfig, err
 }

@@ -18,8 +18,8 @@ package canaryconfigmgr

 import (
 	"context"
+	"fmt"

-	"github.com/pkg/errors"
 	"go.uber.org/zap"
 	"k8s.io/client-go/kubernetes"

@@ -47,7 +47,7 @@ func ConfigureFeatures(ctx context.Context, logger *zap.Logger, unitTestMode boo
 	// in the future when new optional features are added, we need to add corresponding feature handlers and invoke them here
 	canaryCfgMgr, err := MakeCanaryConfigMgr(ctx, logger, fissionClient, kubeClient, featureConfig.CanaryConfig.PrometheusSvc)
 	if err != nil {
-		return errors.Wrap(err, "failed to start canary config manager")
+		return fmt.Errorf("failed to start canary config manager: %w", err)
 	}
 	canaryCfgMgr.Run(ctx, mgr)

@@ -21,7 +21,6 @@ import (
 	"fmt"
 	"time"

-	"github.com/pkg/errors"
 	prometheus "github.com/prometheus/client_golang/api"
 	prometheusv1 "github.com/prometheus/client_golang/api/prometheus/v1"
 	"github.com/prometheus/common/model"
@@ -40,7 +39,7 @@ func MakePrometheusClient(logger *zap.Logger, prometheusSvc string) (*Prometheus

 	promApiClient, err := prometheus.NewClient(promApiConfig)
 	if err != nil {
-		return nil, errors.Wrapf(err, "error creating prometheus api client for svc: %s", prometheusSvc)
+		return nil, fmt.Errorf("error creating prometheus api client for svc: %s: %w", prometheusSvc, err)
 	}

 	apiQueryClient := prometheusv1.NewAPI(promApiClient)
@@ -91,14 +90,14 @@ func (promApiClient *PrometheusApiClient) GetRequestsToFuncInWindow(ctx context.

 	reqs, err := promApiClient.executeQuery(ctx, queryString)
 	if err != nil {
-		return 0, errors.Wrapf(err, "error executing query: %s", queryString)
+		return 0, fmt.Errorf("error executing query %s: %w", queryString, err)
 	}

 	queryString = fmt.Sprintf("fission_function_calls_total{%s} offset %v", queryLabels, window)

 	reqsInPrevWindow, err := promApiClient.executeQuery(ctx, queryString)
 	if err != nil {
-		return 0, errors.Wrapf(err, "error executing query: %s", queryString)
+		return 0, fmt.Errorf("error executing query %s: %w", queryString, err)
 	}

 	reqsInCurrentWindow := reqs - reqsInPrevWindow
@@ -117,14 +116,14 @@ func (promApiClient *PrometheusApiClient) GetTotalFailedRequestsToFuncInWindow(c

 	failedRequests, err := promApiClient.executeQuery(ctx, queryString)
 	if err != nil {
-		return 0, errors.Wrapf(err, "error executing query: %s", queryString)
+		return 0, fmt.Errorf("error executing query %s: %w", queryString, err)
 	}

 	queryString = fmt.Sprintf("fission_function_errors_total{%s} offset %v", queryLabels, window)

 	failedReqsInPrevWindow, err := promApiClient.executeQuery(ctx, queryString)
 	if err != nil {
-		return 0, errors.Wrapf(err, "error executing query: %s", queryString)
+		return 0, fmt.Errorf("error executing query %s: %w", queryString, err)
 	}

 	failedReqsInCurrentWindow := failedRequests - failedReqsInPrevWindow
@@ -142,7 +141,7 @@ func (promApiClient *PrometheusApiClient) executeQuery(ctx context.Context, quer

 	val, warn, err := promApiClient.client.Query(ctx, queryString, time.Now())
 	if err != nil {
-		return 0, errors.Wrapf(err, "error querying prometheus")
+		return 0, fmt.Errorf("error querying prometheus: %w", err)
 	}

 	if warn != nil {
@@ -21,6 +21,7 @@ import (
 	"fmt"
 	"time"

+	kedaClient "github.com/kedacore/keda/v2/pkg/generated/clientset/versioned"
 	"go.uber.org/zap"
 	apiextensionsclient "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -32,7 +33,6 @@ import (

 	"github.com/fission/fission/pkg/generated/clientset/versioned"
 	"github.com/fission/fission/pkg/utils"
-	kedaClient "github.com/kedacore/keda/v2/pkg/generated/clientset/versioned"
 )

 const (
@@ -1,20 +1,20 @@
 package error

 import (
+	"fmt"
 	"net/http"
 	"testing"

-	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
 )

 func TestIsNotFound(t *testing.T) {
 	errs := map[error]bool{
 		nil: false,
-		MakeError(ErrorNotFound, "someone not found"):                                          true,
-		MakeError(ErrorTooManyRequests, "too many requests"):                                   false,
-		errors.Wrap(MakeError(ErrorNotFound, "someone not found"), "other information"):        true,
-		errors.Wrap(MakeError(ErrorTooManyRequests, "too many requests"), "other information"): false,
+		MakeError(ErrorNotFound, "someone not found"):                                             true,
+		MakeError(ErrorTooManyRequests, "too many requests"):                                      false,
+		fmt.Errorf("other information: %w", MakeError(ErrorNotFound, "someone not found")):        true,
+		fmt.Errorf("other information: %w", MakeError(ErrorTooManyRequests, "too many requests")): false,
 	}

 	for err, want := range errs {
@@ -25,9 +25,9 @@ func TestIsNotFound(t *testing.T) {
 func TestGetHTTPError(t *testing.T) {
 	errs := map[int]error{
 		http.StatusBadRequest:      MakeError(ErrorInvalidArgument, ""),
-		http.StatusConflict:        errors.Wrap(MakeError(ErrorNameExists, ""), ""),
-		http.StatusNotFound:        errors.Wrap(MakeError(ErrorNotFound, ""), ""),
-		http.StatusTooManyRequests: errors.Wrap(MakeError(ErrorTooManyRequests, "too many requests"), "other information"),
+		http.StatusConflict:        fmt.Errorf("%w", MakeError(ErrorNameExists, "")),
+		http.StatusNotFound:        fmt.Errorf("%w", MakeError(ErrorNotFound, "")),
+		http.StatusTooManyRequests: fmt.Errorf("other information: %w", MakeError(ErrorTooManyRequests, "too many requests")),
 	}
 	for want, err := range errs {
 		code, _ := GetHTTPError(err)
@@ -20,13 +20,13 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/url"
 	"strings"
 	"time"

 	"github.com/hashicorp/go-retryablehttp"
-	"github.com/pkg/errors"
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
 	"go.uber.org/zap"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -80,18 +80,18 @@ func (c *client) GetServiceForFunction(ctx context.Context, fn *fv1.Function) (s

 	body, err := json.Marshal(fn)
 	if err != nil {
-		return "", errors.Wrap(err, "could not marshal request body for getting service for function")
+		return "", fmt.Errorf("could not marshal request body for getting service for function: %w", err)
 	}

 	req, err := retryablehttp.NewRequestWithContext(ctx, "POST", executorURL, bytes.NewReader(body))
 	if err != nil {
-		return "", errors.Wrap(err, "could not create request for getting service for function")
+		return "", fmt.Errorf("could not create request for getting service for function: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")

 	resp, err := c.httpClient.Do(req)
 	if err != nil {
-		return "", errors.Wrap(err, "error posting to getting service for function")
+		return "", fmt.Errorf("error posting to getting service for function: %w", err)
 	}
 	defer resp.Body.Close()

@@ -101,7 +101,7 @@ func (c *client) GetServiceForFunction(ctx context.Context, fn *fv1.Function) (s

 	svcName, err := io.ReadAll(resp.Body)
 	if err != nil {
-		return "", errors.Wrap(err, "error reading response body from getting service for function")
+		return "", fmt.Errorf("error reading response body from getting service for function: %w", err)
 	}

 	return string(svcName), nil
@@ -118,17 +118,17 @@ func (c *client) UnTapService(ctx context.Context, fnMeta metav1.ObjectMeta, exe

 	body, err := json.Marshal(tapSvc)
 	if err != nil {
-		return errors.Wrap(err, "could not marshal request body for getting service for function")
+		return fmt.Errorf("could not marshal request body for getting service for function: %w", err)
 	}
 	req, err := retryablehttp.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(body))
 	if err != nil {
-		return errors.Wrap(err, "could not create request for untap service for function")
+		return fmt.Errorf("could not create request for untap service for function: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")

 	resp, err := c.httpClient.Do(req)
 	if err != nil {
-		return errors.Wrap(err, "error posting to getting service for function")
+		return fmt.Errorf("error posting to getting service for function: %w", err)
 	}
 	defer resp.Body.Close()

@@ -194,7 +194,7 @@ func (c *client) _tapService(ctx context.Context, tapSvcReqs []TapServiceRequest

 	req, err := retryablehttp.NewRequestWithContext(ctx, "POST", executorURL, bytes.NewReader(body))
 	if err != nil {
-		return errors.Wrap(err, "could not create request for tap service request")
+		return fmt.Errorf("could not create request for tap service request: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")

@@ -18,8 +18,8 @@ package cms

 import (
 	"context"
+	"fmt"

-	"github.com/pkg/errors"
 	"go.uber.org/zap"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/tools/cache"
@@ -72,7 +72,7 @@ func refreshPods(ctx context.Context, logger *zap.Logger, funcs []fv1.Function,
 		if exists {
 			err = et.RefreshFuncPods(ctx, logger, f)
 		} else {
-			err = errors.Errorf("Unknown executor type '%s'", f.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType)
+			err = fmt.Errorf("unknown executor type '%s'", f.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType)
 		}

 		if err != nil {
@@ -26,7 +26,6 @@ import (
 	"time"

 	"github.com/dchest/uniuri"
-	"github.com/pkg/errors"
 	"go.uber.org/zap"
 	k8sCache "k8s.io/client-go/tools/cache"

@@ -155,12 +154,11 @@ func (executor *Executor) serveCreateFuncServices(ctx context.Context) {
 			// create a waitgroup for other requests for
 			// the same function to wait on
 			wg := &sync.WaitGroup{}
-			wg.Add(1)
 			executor.fsCreateWg.Store(fnkeyUR, wg)

 			// launch a goroutine for each request, to parallelize
 			// the specialization of different functions
-			go func() {
+			wg.Go(func() {
 				// Control overall specialization time by setting function
 				// specialization time to context. The reason not to use
 				// context from router requests is because a request maybe
@@ -189,8 +187,7 @@ func (executor *Executor) serveCreateFuncServices(ctx context.Context) {
 					err:     err,
 				}
 				executor.fsCreateWg.Delete(fnkeyUR)
-				wg.Done()
-			}()
+			})
 		} else {
 			// There's an existing request for this function, wait for it to finish
 			go func() {
@@ -213,7 +210,7 @@ func (executor *Executor) serveCreateFuncServices(ctx context.Context) {
 				// It normally happened if there are multiple requests are
 				// waiting for the same function and executor failed to cre-
 				// ate service for function.
-				err = errors.Wrapf(err, "error getting service for function %s", fnName)
+				err = fmt.Errorf("error getting service for function %s: %w", fnName, err)
 				req.respChan <- &createFuncServiceResponse{
 					funcSvc: fsvc,
 					err:     err,
@@ -233,7 +230,7 @@ func (executor *Executor) createServiceForFunction(ctx context.Context, fn *fv1.
 	t := fn.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType
 	e, ok := executor.executorTypes[t]
 	if !ok {
-		return nil, errors.Errorf("Unknown executor type '%s'", t)
+		return nil, fmt.Errorf("unknown executor type '%s'", t)
 	}

 	fsvc, fsvcErr := e.GetFuncSvc(ctx, fn)
@@ -243,7 +240,7 @@ func (executor *Executor) createServiceForFunction(ctx context.Context, fn *fv1.
 			zap.Error(fsvcErr),
 			zap.String("function_name", fn.ObjectMeta.Name),
 			zap.String("function_namespace", fn.ObjectMeta.Namespace))
-		fsvcErr = errors.Wrap(fsvcErr, fmt.Sprintf("[%s] %s", fn.ObjectMeta.Name, e))
+		fsvcErr = fmt.Errorf("[%s] %s: %w", fn.ObjectMeta.Name, e, fsvcErr)
 	}

 	return fsvc, fsvcErr
@@ -254,7 +251,7 @@ func (executor *Executor) getFunctionServiceFromCache(ctx context.Context, fn *f
 	t := fn.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType
 	e, ok := executor.executorTypes[t]
 	if !ok {
-		return nil, errors.Errorf("Unknown executor type '%s'", t)
+		return nil, fmt.Errorf("unknown executor type '%s'", t)
 	}
 	return e.GetFuncSvcFromCache(ctx, fn)
 }
@@ -265,11 +262,11 @@ func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface,

 	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		return errors.Wrap(err, "error making the fission client")
+		return fmt.Errorf("error making the fission client: %w", err)
 	}
 	kubernetesClient, err := clientGen.GetKubernetesClient()
 	if err != nil {
-		return errors.Wrap(err, "error making the kube client")
+		return fmt.Errorf("error making the kube client: %w", err)
 	}
 	metricsClient, err := clientGen.GetMetricsClient()
 	if err != nil {
@@ -278,12 +275,12 @@ func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface,

 	err = crd.WaitForFunctionCRDs(ctx, logger, fissionClient)
 	if err != nil {
-		return errors.Wrap(err, "error waiting for CRDs")
+		return fmt.Errorf("error waiting for CRDs: %w", err)
 	}

 	fetcherConfig, err := fetcherConfig.MakeFetcherConfig("/userfunc")
 	if err != nil {
-		return errors.Wrap(err, "Error making fetcher config")
+		return fmt.Errorf("error making fetcher config: %w", err)
 	}

 	executorInstanceID := strings.ToLower(uniuri.NewLen(8))
@@ -312,7 +309,7 @@ func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface,
 		finformerFactory,
 		gpmInformerFactory, podSpecPatch)
 	if err != nil {
-		return errors.Wrap(err, "pool manager creation failed")
+		return fmt.Errorf("pool manager creation failed: %w", err)
 	}

 	executorLabel, err = utils.GetInformerLabelByExecutor(fv1.ExecutorTypeNewdeploy)
@@ -327,7 +324,7 @@ func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface,
 		finformerFactory,
 		ndmInformerFactory, podSpecPatch)
 	if err != nil {
-		return errors.Wrap(err, "new deploy manager creation failed")
+		return fmt.Errorf("new deploy manager creation failed: %w", err)
 	}

 	executorLabel, err = utils.GetInformerLabelByExecutor(fv1.ExecutorTypeContainer)
@@ -341,7 +338,7 @@ func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface,
 		executorInstanceID, finformerFactory,
 		cnmInformerFactory)
 	if err != nil {
-		return errors.Wrap(err, "container manager creation failed")
+		return fmt.Errorf("container manager creation failed: %w", err)
 	}

 	executorTypes := make(map[fv1.ExecutorType]executortype.ExecutorType)
@@ -353,14 +350,14 @@ func StartExecutor(ctx context.Context, clientGen crd.ClientGeneratorInterface,

 	wg := &sync.WaitGroup{}
 	for _, et := range executorTypes {
-		wg.Add(1)
-		go func(et executortype.ExecutorType) {
-			defer wg.Done()
-			if adoptExistingResources {
-				et.AdoptExistingResources(ctx)
-			}
-			et.CleanupOldExecutorObjects(ctx)
-		}(et)
+		wg.Go(func() {
+			func(et executortype.ExecutorType) {
+				if adoptExistingResources {
+					et.AdoptExistingResources(ctx)
+				}
+				et.CleanupOldExecutorObjects(ctx)
+			}(et)
+		})
 	}
 	// set hard timeout for resource adoption
 	// TODO: use context to control the waiting time once kubernetes client supports it.
@@ -302,17 +302,14 @@ func (caaf *Container) AdoptExistingResources(ctx context.Context) {
 		for i := range fnList.Items {
 			fn := &fnList.Items[i]
 			if fn.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType == fv1.ExecutorTypeContainer {
-				wg.Add(1)
-				go func() {
-					defer wg.Done()
-
+				wg.Go(func() {
 					_, err = caaf.fnCreate(ctx, fn)
 					if err != nil {
 						caaf.logger.Warn("failed to adopt resources for function", zap.Error(err))
 						return
 					}
 					caaf.logger.Info("adopt resources for function", zap.String("function", fn.ObjectMeta.Name))
-				}()
+				})
 			}
 		}
 	}
@@ -436,27 +433,27 @@ func (caaf *Container) fnCreate(ctx context.Context, fn *fv1.Function) (*fscache
 		{
 			// obj.TypeMeta.Kind does not work hence this, needs investigation and a fix
 			Kind:            "deployment",
-			Name:            depl.ObjectMeta.Name,
-			APIVersion:      depl.TypeMeta.APIVersion,
-			Namespace:       depl.ObjectMeta.Namespace,
-			ResourceVersion: depl.ObjectMeta.ResourceVersion,
-			UID:             depl.ObjectMeta.UID,
+			Name:            depl.Name,
+			APIVersion:      depl.APIVersion,
+			Namespace:       depl.Namespace,
+			ResourceVersion: depl.ResourceVersion,
+			UID:             depl.UID,
 		},
 		{
 			Kind:            "service",
-			Name:            svc.ObjectMeta.Name,
-			APIVersion:      svc.TypeMeta.APIVersion,
-			Namespace:       svc.ObjectMeta.Namespace,
-			ResourceVersion: svc.ObjectMeta.ResourceVersion,
-			UID:             svc.ObjectMeta.UID,
+			Name:            svc.Name,
+			APIVersion:      svc.APIVersion,
+			Namespace:       svc.Namespace,
+			ResourceVersion: svc.ResourceVersion,
+			UID:             svc.UID,
 		},
 		{
 			Kind:            "horizontalpodautoscaler",
-			Name:            hpa.ObjectMeta.Name,
-			APIVersion:      hpa.TypeMeta.APIVersion,
-			Namespace:       hpa.ObjectMeta.Namespace,
-			ResourceVersion: hpa.ObjectMeta.ResourceVersion,
-			UID:             hpa.ObjectMeta.UID,
+			Name:            hpa.Name,
+			APIVersion:      hpa.APIVersion,
+			Namespace:       hpa.Namespace,
+			ResourceVersion: hpa.ResourceVersion,
+			UID:             hpa.UID,
 		},
 	}

@@ -471,18 +468,18 @@ func (caaf *Container) fnCreate(ctx context.Context, fn *fv1.Function) (*fscache
 	_, err = caaf.fsCache.Add(*fsvc)
 	if err != nil {
 		caaf.logger.Error("error adding function to cache", zap.Error(err), zap.Any("function", fsvc.Function))
-		metrics.ColdStartsError.WithLabelValues(fn.ObjectMeta.Name, fn.ObjectMeta.Namespace).Inc()
+		metrics.ColdStartsError.WithLabelValues(fn.Name, fn.Namespace).Inc()
 		return fsvc, err
 	}

-	metrics.ColdStarts.WithLabelValues(fn.ObjectMeta.Name, fn.ObjectMeta.Namespace).Inc()
+	metrics.ColdStarts.WithLabelValues(fn.Name, fn.Namespace).Inc()

 	return fsvc, nil
 }

 func (caaf *Container) updateFunction(ctx context.Context, oldFn *fv1.Function, newFn *fv1.Function) error {

-	if oldFn.ObjectMeta.ResourceVersion == newFn.ObjectMeta.ResourceVersion {
+	if oldFn.ResourceVersion == newFn.ResourceVersion {
 		return nil
 	}

@@ -281,10 +281,20 @@ func (deploy *NewDeploy) getDeploymentSpec(ctx context.Context, fn *fv1.Function
 		},
 	}

+	// If custom runtime container name - default env name
+	mainContainerName := env.ObjectMeta.Name
+	if env.Spec.Runtime.Container != nil && env.Spec.Runtime.Container.Name != "" && env.Spec.Runtime.PodSpec != nil {
+		if util.DoesContainerExistInPodSpec(env.Spec.Runtime.Container.Name, env.Spec.Runtime.PodSpec) {
+			mainContainerName = env.Spec.Runtime.Container.Name
+		} else {
+			return nil, fmt.Errorf("runtime container %s not found in pod spec", env.Spec.Runtime.Container.Name)
+		}
+	}
+
 	// Order of merging is important here - first fetcher, then containers and lastly pod spec
 	err = deploy.fetcherConfig.AddSpecializingFetcherToPodSpec(
 		&deployment.Spec.Template.Spec,
-		env.ObjectMeta.Name,
+		mainContainerName,
 		fn,
 		env,
 	)
@@ -322,17 +322,14 @@ func (deploy *NewDeploy) AdoptExistingResources(ctx context.Context) {
 		for i := range fnList.Items {
 			fn := &fnList.Items[i]
 			if fn.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType == fv1.ExecutorTypeNewdeploy {
-				wg.Add(1)
-				go func() {
-					defer wg.Done()
-
+				wg.Go(func() {
 					_, err = deploy.fnCreate(ctx, fn)
 					if err != nil {
 						deploy.logger.Warn("failed to adopt resources for function", zap.Error(err))
 						return
 					}
 					deploy.logger.Info("adopt resources for function", zap.String("function", fn.ObjectMeta.Name))
-				}()
+				})
 			}
 		}
 	}
@@ -482,7 +479,7 @@ func (deploy *NewDeploy) fnCreate(ctx context.Context, fn *fv1.Function) (*fscac
 			// obj.TypeMeta.Kind does not work hence this, needs investigation and a fix
 			Kind:            "deployment",
 			Name:            depl.ObjectMeta.Name,
-			APIVersion:      depl.TypeMeta.APIVersion,
+			APIVersion:      depl.APIVersion,
 			Namespace:       depl.ObjectMeta.Namespace,
 			ResourceVersion: depl.ObjectMeta.ResourceVersion,
 			UID:             depl.ObjectMeta.UID,
@@ -490,7 +487,7 @@ func (deploy *NewDeploy) fnCreate(ctx context.Context, fn *fv1.Function) (*fscac
 		{
 			Kind:            "service",
 			Name:            svc.ObjectMeta.Name,
-			APIVersion:      svc.TypeMeta.APIVersion,
+			APIVersion:      svc.APIVersion,
 			Namespace:       svc.ObjectMeta.Namespace,
 			ResourceVersion: svc.ObjectMeta.ResourceVersion,
 			UID:             svc.ObjectMeta.UID,
@@ -498,7 +495,7 @@ func (deploy *NewDeploy) fnCreate(ctx context.Context, fn *fv1.Function) (*fscac
 		{
 			Kind:            "horizontalpodautoscaler",
 			Name:            hpa.ObjectMeta.Name,
-			APIVersion:      hpa.TypeMeta.APIVersion,
+			APIVersion:      hpa.APIVersion,
 			Namespace:       hpa.ObjectMeta.Namespace,
 			ResourceVersion: hpa.ObjectMeta.ResourceVersion,
 			UID:             hpa.ObjectMeta.UID,
@@ -37,7 +37,7 @@ const (
 func TestRefreshFuncPods(t *testing.T) {
 	os.Setenv("DEBUG_ENV", "true")
 	mgr := manager.New()
-	defer mgr.Wait()
+	t.Cleanup(mgr.Wait)
 	logger := loggerfactory.GetLogger()
 	kubernetesClient := fake.NewSimpleClientset()
 	fissionClient := fClient.NewSimpleClientset()
@@ -50,8 +50,7 @@ func TestRefreshFuncPods(t *testing.T) {
 	}
 	ndmInformerFactory := utils.GetInformerFactoryByExecutor(kubernetesClient, executorLabel, time.Minute*30)

-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()

 	fetcherConfig, err := fetcherConfig.MakeFetcherConfig("/userfunc")
 	if err != nil {
@@ -19,6 +19,7 @@ package poolmgr
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"math"
 	"net"
@@ -28,7 +29,6 @@ import (
 	"time"

 	"github.com/dchest/uniuri"
-	"github.com/pkg/errors"
 	"go.uber.org/zap"
 	appsv1 "k8s.io/api/apps/v1"
 	apiv1 "k8s.io/api/core/v1"
@@ -320,7 +320,7 @@ func (gp *GenericPool) choosePod(ctx context.Context, newLabels map[string]strin
 				// ending retry loop when the request canceled
 				gp.readyPodQueue.Done(key)
 				gp.readyPodQueue.AddAfter(key, expoDelay)
-				return "", nil, errors.Errorf("failed to relabel pod: %s", err)
+				return "", nil, fmt.Errorf("failed to relabel pod: %s", err)
 			} else if err != nil {
 				logger.Error("failed to relabel pod", zap.Error(err), zap.String("pod", chosenPod.Name), zap.Duration("delay", expoDelay))
 				gp.readyPodQueue.Done(key)
@@ -335,13 +335,13 @@ func (gp *GenericPool) choosePod(ctx context.Context, newLabels map[string]strin
 			// So we have to check both of them to ensure the patch success.
 			for k, v := range newLabels {
 				if newPod.Labels[k] != v {
-					return "", nil, errors.Errorf("value of necessary labels '%s' mismatch: want '%s', get '%v'",
+					return "", nil, fmt.Errorf("value of necessary labels '%s' mismatch: want '%s', get '%v'",
 						k, v, newPod.Labels[k])
 				}
 			}
 			for k, v := range annotations {
 				if newPod.Annotations[k] != v {
-					return "", nil, errors.Errorf("value of necessary annotations '%s' mismatch: want '%s', get '%v'",
+					return "", nil, fmt.Errorf("value of necessary annotations '%s' mismatch: want '%s', get '%v'",
 						k, v, newPod.Annotations[k])
 				}
 			}
@@ -415,7 +415,7 @@ func (gp *GenericPool) specializePod(ctx context.Context, pod *apiv1.Pod, fn *fv
 	// for fetcher we don't need to create a service, just talk to the pod directly
 	podIP := pod.Status.PodIP
 	if len(podIP) == 0 {
-		return errors.Errorf("Pod %s in namespace %s has no IP", pod.ObjectMeta.Name, pod.ObjectMeta.Namespace)
+		return fmt.Errorf("pod %s in namespace %s has no IP", pod.ObjectMeta.Name, pod.ObjectMeta.Namespace)
 	}
 	for _, cm := range fn.Spec.ConfigMaps {
 		_, err := gp.kubernetesClient.CoreV1().ConfigMaps(gp.fnNamespace).Get(ctx, cm.Name, metav1.GetOptions{})
@@ -571,7 +571,7 @@ func (gp *GenericPool) getFuncSvc(ctx context.Context, fn *fv1.Function) (*fscac
 		}
 		if svc.ObjectMeta.Name != svcName {
 			go gp.scheduleDeletePod(context.Background(), pod.ObjectMeta.Name)
-			return nil, errors.Errorf("sanity check failed for svc %s", svc.ObjectMeta.Name)
+			return nil, fmt.Errorf("sanity check failed for svc %s", svc.ObjectMeta.Name)
 		}

 		// the fission router isn't in the same namespace, so return a
@@ -601,7 +601,7 @@ func (gp *GenericPool) getFuncSvc(ctx context.Context, fn *fv1.Function) (*fscac
 		{
 			Kind:            "pod",
 			Name:            pod.ObjectMeta.Name,
-			APIVersion:      pod.TypeMeta.APIVersion,
+			APIVersion:      pod.APIVersion,
 			Namespace:       pod.ObjectMeta.Namespace,
 			ResourceVersion: pod.ObjectMeta.ResourceVersion,
 			UID:             pod.ObjectMeta.UID,
@@ -189,8 +189,18 @@ func (gp *GenericPool) genDeploymentSpec(env *fv1.Environment) (*appsv1.Deployme
 		Template: pod,
 	}

+	// If custom runtime container name - default env name
+	mainContainerName := env.ObjectMeta.Name
+	if env.Spec.Runtime.Container != nil && env.Spec.Runtime.Container.Name != "" && env.Spec.Runtime.PodSpec != nil {
+		if util.DoesContainerExistInPodSpec(env.Spec.Runtime.Container.Name, env.Spec.Runtime.PodSpec) {
+			mainContainerName = env.Spec.Runtime.Container.Name
+		} else {
+			return nil, fmt.Errorf("runtime container %s not found in pod spec", env.Spec.Runtime.Container.Name)
+		}
+	}
+
 	// Order of merging is important here - first fetcher, then containers and lastly pod spec
-	err = gp.fetcherConfig.AddFetcherToPodSpec(&deploymentSpec.Template.Spec, env.ObjectMeta.Name)
+	err = gp.fetcherConfig.AddFetcherToPodSpec(&deploymentSpec.Template.Spec, mainContainerName)
 	if err != nil {
 		return nil, err
 	}
@@ -27,7 +27,6 @@ import (
 	"sync"
 	"time"

-	"github.com/fission/fission/pkg/executor/metrics"
 	"go.opentelemetry.io/otel/attribute"
 	"go.uber.org/zap"
 	apiv1 "k8s.io/api/core/v1"
@@ -47,6 +46,7 @@ import (
 	"github.com/fission/fission/pkg/crd"
 	"github.com/fission/fission/pkg/executor/executortype"
 	"github.com/fission/fission/pkg/executor/fscache"
+	"github.com/fission/fission/pkg/executor/metrics"
 	"github.com/fission/fission/pkg/executor/reaper"
 	executorUtils "github.com/fission/fission/pkg/executor/util"
 	fetcherConfig "github.com/fission/fission/pkg/fetcher/config"
@@ -368,9 +368,7 @@ func (gpm *GenericPoolManager) AdoptExistingResources(ctx context.Context) {
 			env := envs.Items[i]

 			if getEnvPoolSize(&env) > 0 {
-				wg.Add(1)
-				go func() {
-					defer wg.Done()
+				wg.Go(func() {
 					_, created, err := gpm.getPool(ctx, &env)
 					if err != nil {
 						gpm.logger.Error("adopt pool failed", zap.Error(err))
@@ -378,11 +376,11 @@ func (gpm *GenericPoolManager) AdoptExistingResources(ctx context.Context) {
 					if created {
 						gpm.logger.Info("created pool for the environment", zap.String("env", env.ObjectMeta.Name), zap.String("namespace", gpm.nsResolver.ResolveNamespace(gpm.nsResolver.FunctionNamespace)))
 					}
-				}()
+				})
 			}

 			// create environment map for later use
-			key := fmt.Sprintf("%s/%s", env.ObjectMeta.Namespace, env.ObjectMeta.Name)
+			key := k8sCache.MetaObjectToName(&env.ObjectMeta).String()
 			envMap[key] = env
 		}
 	}
@@ -407,10 +405,7 @@ func (gpm *GenericPoolManager) AdoptExistingResources(ctx context.Context) {
 				continue
 			}

-			wg.Add(1)
-			go func() {
-				defer wg.Done()
-
+			wg.Go(func() {
 				// avoid too many requests arrive Kubernetes API server at the same time.
 				time.Sleep(time.Duration(rand.Intn(30)) * time.Millisecond)

@@ -458,7 +453,7 @@ func (gpm *GenericPoolManager) AdoptExistingResources(ctx context.Context) {
 						{
 							Kind:            "pod",
 							Name:            pod.Name,
-							APIVersion:      pod.TypeMeta.APIVersion,
+							APIVersion:      pod.APIVersion,
 							Namespace:       pod.ObjectMeta.Namespace,
 							ResourceVersion: pod.ObjectMeta.ResourceVersion,
 							UID:             pod.ObjectMeta.UID,
@@ -482,7 +477,7 @@ func (gpm *GenericPoolManager) AdoptExistingResources(ctx context.Context) {

 				gpm.logger.Info("adopt function pod",
 					zap.String("pod", pod.Name), zap.Any("labels", pod.Labels), zap.Any("annotations", pod.Annotations))
-			}()
+			})
 		}
 	}

@@ -16,7 +16,6 @@ limitations under the License.
 package poolmgr

 import (
-	"context"
 	"strings"
 	"testing"
 	"time"
@@ -39,9 +38,8 @@ import (

 func TestPoolPodControllerPodCleanup(t *testing.T) {
 	mgr := manager.New()
-	defer mgr.Wait()
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	t.Cleanup(mgr.Wait)
+	ctx := t.Context()
 	logger := loggerfactory.GetLogger()
 	kubernetesClient := fake.NewSimpleClientset()
 	fissionClient := fClient.NewSimpleClientset()
@@ -22,7 +22,6 @@ import (
 	"sync"
 	"time"

-	"github.com/pkg/errors"
 	"go.opentelemetry.io/otel/attribute"
 	"go.uber.org/zap"
 	apiv1 "k8s.io/api/core/v1"
@@ -292,7 +291,7 @@ func (fsc *FunctionServiceCache) Add(fsvc FuncSvc) (*FuncSvc, error) {
 		if IsNameExistError(err) {
 			err = nil
 		} else {
-			err = errors.Wrap(err, "error caching fsvc")
+			err = fmt.Errorf("error caching fsvc: %w", err)
 		}
 		return nil, err
 	}
@@ -304,7 +303,7 @@ func (fsc *FunctionServiceCache) Add(fsvc FuncSvc) (*FuncSvc, error) {
 		if IsNameExistError(err) {
 			err = nil
 		} else {
-			err = errors.Wrap(err, "error caching fsvc by function uid")
+			err = fmt.Errorf("error caching fsvc by function uid: %w", err)
 		}
 		return nil, err
 	}
@@ -383,10 +382,6 @@ func (fsc *FunctionServiceCache) DeleteFunctionSvc(ctx context.Context, fsvc *Fu
 	}
 }

-func (fsc *FunctionServiceCache) SetCPUUtilization(key crd.CacheKeyURG, svcHost string, cpuUsage resource.Quantity) {
-	fsc.connFunctionCache.SetCPUUtilization(key, svcHost, cpuUsage)
-}
-
 // DeleteOld deletes aged function service entries from cache.
 func (fsc *FunctionServiceCache) DeleteOld(fsvc *FuncSvc, minAge time.Duration) (bool, error) {
 	if time.Since(fsvc.Atime) < minAge {
@@ -1,7 +1,6 @@
 package fscache

 import (
-	"context"
 	"log"
 	"testing"
 	"time"
@@ -157,8 +156,7 @@ func TestFunctionServiceNewCache(t *testing.T) {
 		},
 	}

-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()

 	fsc.AddFunc(ctx, *fsvc, 10, fn.GetRetainPods())
 	concurrency := 10
@@ -306,7 +306,7 @@ func (c *PoolCache) service() {
 			datawriter := bufio.NewWriter(req.dumpWriter)

 			writefnSvcGrp := func(svcGrp *funcSvcGroup) error {
-				_, err := datawriter.WriteString(fmt.Sprintf("svc_waiting:%d\tqueue_len:%d", svcGrp.svcWaiting, svcGrp.queue.Len()))
+				_, err := fmt.Fprintf(datawriter, "svc_waiting:%d\tqueue_len:%d", svcGrp.svcWaiting, svcGrp.queue.Len())
 				if err != nil {
 					return err
 				}
@@ -319,8 +319,8 @@ func (c *PoolCache) service() {
 				}

 				for addr, fnSvc := range svcGrp.svcs {
-					_, err := datawriter.WriteString(fmt.Sprintf("\tfunction_name:%s\tfn_svc_address:%s\tactive_req:%d\tcurrent_cpu_usage:%v\tcpu_limit:%v\n",
-						fnSvc.val.Function.Name, addr, fnSvc.activeRequests, fnSvc.currentCPUUsage, fnSvc.cpuLimit))
+					_, err := fmt.Fprintf(datawriter, "\tfunction_name:%s\tfn_svc_address:%s\tactive_req:%d\tcurrent_cpu_usage:%v\tcpu_limit:%v\n",
+						fnSvc.val.Function.Name, addr, fnSvc.activeRequests, fnSvc.currentCPUUsage, fnSvc.cpuLimit)
 					if err != nil {
 						return err
 					}
@@ -24,8 +24,7 @@ func checkErr(err error) {
 }

 func TestPoolCache(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()
 	logger := loggerfactory.GetLogger()
 	concurrency := 5
 	requestsPerPod := 2
@@ -225,32 +224,33 @@ func TestPoolCacheRequests(t *testing.T) {
 			}
 			for i := 1; i <= tt.requests; i++ {
 				reqno := i
-				wg.Add(1)
-				go func(reqno int) {
-					defer wg.Done()
-					svc, err := p.GetSvcValue(context.Background(), key, tt.rpp, tt.concurrency)
-					if err != nil {
-						code, _ := ferror.GetHTTPError(err)
-						if code == http.StatusNotFound {
-							atomic.AddUint64(&svcCounter, 1)
-							address := fmt.Sprintf("svc-%d", atomic.LoadUint64(&svcCounter))
-							p.SetSvcValue(context.Background(), key, address, &FuncSvc{
-								Name: address,
-							}, resource.MustParse("45m"), tt.rpp, tt.retainPods)
+				wg.Go(func() {
+					func(reqno int) {
+						svc, err := p.GetSvcValue(context.Background(), key, tt.rpp, tt.concurrency)
+						if err != nil {
+							code, _ := ferror.GetHTTPError(err)
+							if code == http.StatusNotFound {
+								atomic.AddUint64(&svcCounter, 1)
+								address := fmt.Sprintf("svc-%d", atomic.LoadUint64(&svcCounter))
+								p.SetSvcValue(context.Background(), key, address, &FuncSvc{
+									Name: address,
+								}, resource.MustParse("45m"), tt.rpp, tt.retainPods)
+							} else {
+								t.Log(reqno, "=>", err)
+								atomic.AddUint64(&failedRequests, 1)
+							}
 						} else {
-							t.Log(reqno, "=>", err)
-							atomic.AddUint64(&failedRequests, 1)
+							if svc == nil {
+								t.Log(reqno, "=>", "svc is nil")
+								atomic.AddUint64(&failedRequests, 1)
+							}
+							// } else {
+							// 	t.Log(reqno, "=>", svc.Name)
+							// }
 						}
-					} else {
-						if svc == nil {
-							t.Log(reqno, "=>", "svc is nil")
-							atomic.AddUint64(&failedRequests, 1)
-						}
-						// } else {
-						// 	t.Log(reqno, "=>", svc.Name)
-						// }
-					}
-				}(reqno)
+					}(reqno)
+				})
+
 				if reqno%simultaneous == 0 {
 					wg.Wait()
 				}
@@ -262,12 +262,12 @@ func TestPoolCacheRequests(t *testing.T) {

 			for i := 0; i < tt.concurrency; i++ {
 				for j := 0; j < tt.rpp; j++ {
-					wg.Add(1)
 					svcno := i
-					go func(svcno int) {
-						defer wg.Done()
-						p.MarkAvailable(key, fmt.Sprintf("svc-%d", svcno+1))
-					}(svcno)
+					wg.Go(func() {
+						func(svcno int) {
+							p.MarkAvailable(key, fmt.Sprintf("svc-%d", svcno+1))
+						}(svcno)
+					})
 				}
 			}
 			wg.Wait()
@@ -48,16 +48,14 @@ func TestQueuePushWithConcurrentRequest(t *testing.T) {
 	q := NewQueue()
 	noOfRequests := 20
 	var wg sync.WaitGroup
-	wg.Add(noOfRequests)
 	for i := 0; i < noOfRequests; i++ {
-		go func() {
-			defer wg.Done()
+		wg.Go(func() {
 			item := &svcWait{
 				svcChannel: make(chan *FuncSvc),
 				ctx:        nil,
 			}
 			q.Push(item)
-		}()
+		})
 	}

 	wg.Wait()
@@ -17,8 +17,9 @@ limitations under the License.
 package metrics

 import (
-	"github.com/fission/fission/pkg/utils/metrics"
 	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/fission/fission/pkg/utils/metrics"
 )

 var (
@@ -16,7 +16,6 @@ limitations under the License.
 package hpa

 import (
-	"context"
 	"strings"
 	"testing"

@@ -58,8 +57,7 @@ func TestHpaOps(t *testing.T) {
 		t.Errorf("Expected instanceID to be %v, got %v", instanceID, hpaops.instanceID)
 	}

-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()

 	deployLabels := map[string]string{
 		"test-label": "test-label-value",
@@ -168,3 +168,13 @@ func CreateDumpFile(logger *zap.Logger) (*os.File, error) {

 	return os.Create(fmt.Sprintf("%s/%s-%d.txt", dumpPath, dumpFileName, time.Now().Unix()))
 }
+
+// DoesContainerExistInPodSpec checks if the container with the given name exists in the pod spec
+func DoesContainerExistInPodSpec(containerName string, podSpec *apiv1.PodSpec) bool {
+	for _, container := range podSpec.Containers {
+		if container.Name == containerName {
+			return true
+		}
+	}
+	return false
+}
@@ -23,10 +23,10 @@ import (
 	"testing"

 	"github.com/google/go-cmp/cmp"
+	apiv1 "k8s.io/api/core/v1"

 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
 	"github.com/fission/fission/pkg/utils/loggerfactory"
-	apiv1 "k8s.io/api/core/v1"
 )

 func TestGetSpecFromConfigMap(t *testing.T) {
@@ -55,7 +55,7 @@ securityContext:
 	}

 	var permissionNum int64 = 10001
-	var runAsNonRoot bool = true
+	var runAsNonRoot = true

 	testSpecPatch := apiv1.PodSpec{
 		SecurityContext: &apiv1.PodSecurityContext{
@@ -4,12 +4,12 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"strings"
 	"time"

-	"github.com/pkg/errors"
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
 	"go.uber.org/zap"
 	"golang.org/x/net/context/ctxhttp"
@@ -104,7 +104,7 @@ func sendRequest(logger *zap.Logger, ctx context.Context, httpClient *http.Clien
 		// skip retry and return directly due to context deadline exceeded
 		if err == context.DeadlineExceeded {
 			msg := "error specializing function pod, either increase the specialization timeout for function or check function pod log would help."
-			err = errors.Wrap(err, msg)
+			err = fmt.Errorf("%s: %w", msg, err)
 			logger.Error(msg, zap.Error(err), zap.String("url", url))
 			return nil, err
 		}
@@ -7,7 +7,6 @@ import (
 	"path/filepath"

 	"github.com/hashicorp/go-multierror"
-	"github.com/pkg/errors"
 	apiv1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -69,7 +68,7 @@ func MakeFetcherConfig(sharedMountPath string) (*Config, error) {

 	fetcherImage := os.Getenv("FETCHER_IMAGE")
 	if len(fetcherImage) == 0 {
-		fetcherImage = "fission/fetcher"
+		fetcherImage = "ghcr.io/fission/fetcher"
 	}

 	fetcherImagePullPolicy := os.Getenv("FETCHER_IMAGE_PULL_POLICY")
@@ -305,7 +304,7 @@ func (cfg *Config) addFetcherToPodSpecWithCommand(podSpec *apiv1.PodSpec, mainCo
 		for _, existingContainer := range podSpec.Containers {
 			existingContainerNames = append(existingContainerNames, existingContainer.Name)
 		}
-		return errors.Errorf("could not find main container '%s' in given PodSpec. Found: %v",
+		return fmt.Errorf("could not find main container '%s' in given PodSpec. Found: %v",
 			mainContainerName,
 			existingContainerNames)
 	}
@@ -20,6 +20,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -29,7 +30,6 @@ import (
 	"time"

 	"github.com/google/uuid"
-	"github.com/pkg/errors"
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
 	"go.uber.org/zap"
 	"golang.org/x/net/context/ctxhttp"
@@ -92,21 +92,21 @@ func MakeFetcher(logger *zap.Logger, clientGen crd.ClientGeneratorInterface, sha

 	fissionClient, err := clientGen.GetFissionClient()
 	if err != nil {
-		return nil, errors.Wrap(err, "error making the fission client")
+		return nil, fmt.Errorf("error making the fission client: %w", err)
 	}
 	kubeClient, err := clientGen.GetKubernetesClient()
 	if err != nil {
-		return nil, errors.Wrap(err, "error making the kube client")
+		return nil, fmt.Errorf("error making the kube client: %w", err)
 	}

 	name, err := os.ReadFile(podInfoMountDir + "/name")
 	if err != nil {
-		return nil, errors.Wrap(err, "error reading pod name from downward volume")
+		return nil, fmt.Errorf("error reading pod name from downward volume: %w", err)
 	}

 	namespace, err := os.ReadFile(podInfoMountDir + "/namespace")
 	if err != nil {
-		return nil, errors.Wrap(err, "error reading pod namespace from downward volume")
+		return nil, fmt.Errorf("error reading pod namespace from downward volume: %w", err)
 	}

 	hc := &http.Client{Transport: otelhttp.NewTransport(http.DefaultTransport)}
@@ -140,7 +140,7 @@ func writeSecretOrConfigMap(dataMap map[string][]byte, dirPath string) error {
 		writeFilePath := filepath.Join(dirPath, key)
 		err := os.WriteFile(writeFilePath, val, 0750)
 		if err != nil {
-			return errors.Wrapf(err, "Failed to write file %s", writeFilePath)
+			return fmt.Errorf("failed to write file %s: %w", writeFilePath, err)
 		}
 	}
 	return nil
@@ -255,7 +255,7 @@ func (fetcher *Fetcher) Fetch(ctx context.Context, pkg *fv1.Package, req Functio
 	storePath, err := utils.SanitizeFilePath(filepath.Join(fetcher.sharedVolumePath, req.Filename), fetcher.sharedVolumePath)
 	if err != nil {
 		logger.Error(err.Error(), zap.String("filename", req.Filename))
-		return http.StatusBadRequest, errors.New(fmt.Sprintf("%s, request: %v", err, req))
+		return http.StatusBadRequest, fmt.Errorf("%s, request: %v", err, req)
 	}

 	// verify first if the file already exists.
@@ -270,7 +270,7 @@ func (fetcher *Fetcher) Fetch(ctx context.Context, pkg *fv1.Package, req Functio
 	tmpPath, err := utils.SanitizeFilePath(storePath+".tmp", fetcher.sharedVolumePath)
 	if err != nil {
 		logger.Error(err.Error(), zap.String("filename", req.Filename))
-		return http.StatusBadRequest, errors.New(fmt.Sprintf("%s, request: %v", err, req))
+		return http.StatusBadRequest, fmt.Errorf("%s, request: %v", err, req)
 	}

 	if req.FetchType == fv1.FETCH_URL {
@@ -284,7 +284,7 @@ func (fetcher *Fetcher) Fetch(ctx context.Context, pkg *fv1.Package, req Functio
 		if err != nil {
 			e := "failed to download url"
 			logger.Error(e, zap.Error(err), zap.String("url", req.Url))
-			return http.StatusBadRequest, errors.Wrapf(err, "%s: %s", e, req.Url)
+			return http.StatusBadRequest, fmt.Errorf("%s: %s: %w", e, req.Url, err)
 		}
 	} else {
 		var archive *fv1.Archive
@@ -298,10 +298,10 @@ func (fetcher *Fetcher) Fetch(ctx context.Context, pkg *fv1.Package, req Functio
 			if pkg.Status.BuildStatus != fv1.BuildStatusSucceeded && pkg.Status.BuildStatus != fv1.BuildStatusNone {
 				e := fmt.Sprintf("cannot fetch deployment: package build status was not %q", fv1.BuildStatusSucceeded)
 				logger.Error(e,
-					zap.String("package_name", pkg.ObjectMeta.Name),
-					zap.String("package_namespace", pkg.ObjectMeta.Namespace),
+					zap.String("package_name", pkg.Name),
+					zap.String("package_namespace", pkg.Namespace),
 					zap.Any("package_build_status", pkg.Status.BuildStatus))
-				return http.StatusInternalServerError, errors.New(fmt.Sprintf("%s: pkg %s.%s has a status of %s", e, pkg.ObjectMeta.Name, pkg.ObjectMeta.Namespace, pkg.Status.BuildStatus))
+				return http.StatusInternalServerError, fmt.Errorf("%s: pkg %s.%s has a status of %s", e, pkg.Name, pkg.Namespace, pkg.Status.BuildStatus)
 			}
 			archive = &pkg.Spec.Deployment
 		} else {
@@ -315,7 +315,7 @@ func (fetcher *Fetcher) Fetch(ctx context.Context, pkg *fv1.Package, req Functio
 			if err != nil {
 				e := "failed to write file"
 				logger.Error(e, zap.Error(err), zap.String("location", tmpPath))
-				return http.StatusInternalServerError, errors.Wrapf(err, "%s %s", e, tmpPath)
+				return http.StatusInternalServerError, fmt.Errorf("%s %s: %w", e, tmpPath, err)
 			}
 			otelUtils.SpanTrackEvent(ctx, "archiveLiteral", otelUtils.GetAttributesForPackage(pkg)...)
 		} else {
@@ -329,7 +329,7 @@ func (fetcher *Fetcher) Fetch(ctx context.Context, pkg *fv1.Package, req Functio
 			if err != nil {
 				e := "failed to download url"
 				logger.Error(e, zap.Error(err), zap.String("url", req.Url))
-				return http.StatusBadRequest, errors.Wrapf(err, "%s %s", e, req.Url)
+				return http.StatusBadRequest, fmt.Errorf("%s %s: %w", e, req.Url, err)
 			}

 			// check file integrity only if checksum is not empty.
@@ -338,13 +338,13 @@ func (fetcher *Fetcher) Fetch(ctx context.Context, pkg *fv1.Package, req Functio
 				if err != nil {
 					e := "failed to get checksum"
 					logger.Error(e, zap.Error(err))
-					return http.StatusBadRequest, errors.Wrap(err, e)
+					return http.StatusBadRequest, fmt.Errorf("%s: %w", e, err)
 				}
 				err = verifyChecksum(checksum, &archive.Checksum)
 				if err != nil {
 					e := "failed to verify checksum"
 					logger.Error(e, zap.Error(err))
-					return http.StatusBadRequest, errors.Wrap(err, e)
+					return http.StatusBadRequest, fmt.Errorf("%s: %w", e, err)
 				}
 			}
 		}
@@ -373,7 +373,7 @@ func (fetcher *Fetcher) Fetch(ctx context.Context, pkg *fv1.Package, req Functio
 			zap.Error(err),
 			zap.String("original_path", tmpPath),
 			zap.String("rename_path", storePath))
-		return http.StatusInternalServerError, err
+		return http.StatusInternalServerError, fmt.Errorf("error renaming file: %w", err)
 	}

 	otelUtils.SpanTrackEvent(ctx, "packageFetched", otelUtils.GetAttributesForPackage(pkg)...)
@@ -409,7 +409,7 @@ func (fetcher *Fetcher) FetchSecretsAndCfgMaps(ctx context.Context, secrets []fv
 			secretDir, err := utils.SanitizeFilePath(filepath.Join(fetcher.sharedSecretPath, secret.Namespace, secret.Name), fetcher.sharedSecretPath)
 			if err != nil {
 				logger.Error(err.Error(), zap.String("directory", secretDir), zap.String("secret_name", secret.Name), zap.String("secret_namespace", secret.Namespace))
-				return http.StatusBadRequest, errors.New(fmt.Sprintf("%s, request: %v", err, secret))
+				return http.StatusBadRequest, fmt.Errorf("%s, request: %v", err, secret)
 			}

 			err = os.MkdirAll(secretDir, os.ModeDir|0750)
@@ -420,7 +420,7 @@ func (fetcher *Fetcher) FetchSecretsAndCfgMaps(ctx context.Context, secrets []fv
 					zap.String("directory", secretDir),
 					zap.String("secret_name", secret.Name),
 					zap.String("secret_namespace", secret.Namespace))
-				return http.StatusInternalServerError, errors.Wrapf(err, "%s: %s", e, secretDir)
+				return http.StatusInternalServerError, fmt.Errorf("%s: %s: %w", e, secretDir, err)
 			}
 			err = writeSecretOrConfigMap(data.Data, secretDir)
 			if err != nil {
@@ -461,8 +461,8 @@ func (fetcher *Fetcher) FetchSecretsAndCfgMaps(ctx context.Context, secrets []fv
 			configDir, err := utils.SanitizeFilePath(filepath.Join(fetcher.sharedConfigPath, config.Namespace, config.Name), fetcher.sharedConfigPath)
 			if err != nil {
 				logger.Error(err.Error(), zap.String("directory", configDir), zap.String("config_map_name", config.Name), zap.String("config_map_namespace", config.Namespace))
-				return http.StatusBadRequest, errors.New(fmt.Sprintf("%s, request: %v", err,
-					config))
+				return http.StatusBadRequest, fmt.Errorf("%s, request: %v", err,
+					config)
 			}

 			err = os.MkdirAll(configDir, os.ModeDir|0750)
@@ -473,7 +473,7 @@ func (fetcher *Fetcher) FetchSecretsAndCfgMaps(ctx context.Context, secrets []fv
 					zap.String("directory", configDir),
 					zap.String("config_map_name", config.Name),
 					zap.String("config_map_namespace", config.Namespace))
-				return http.StatusInternalServerError, errors.Wrapf(err, "%s: %s", e, configDir)
+				return http.StatusInternalServerError, fmt.Errorf("%s: %s: %w", e, configDir, err)
 			}
 			configMap := make(map[string][]byte)
 			for key, val := range data.Data {
@@ -617,7 +617,7 @@ func (fetcher *Fetcher) UploadHandler(w http.ResponseWriter, r *http.Request) {
 func (fetcher *Fetcher) rename(src string, dst string) error {
 	err := os.Rename(src, dst)
 	if err != nil {
-		return errors.Wrap(err, "failed to move file")
+		return fmt.Errorf("failed to move file: %w", err)
 	}
 	return nil
 }
@@ -673,17 +673,17 @@ func (fetcher *Fetcher) SpecializePod(ctx context.Context, fetchReq FunctionFetc

 	pkg, err := fetcher.getPkgInformation(ctx, fetchReq)
 	if err != nil {
-		return errors.Wrap(err, "error getting package information")
+		return fmt.Errorf("error getting package information: %w", err)
 	}

 	_, err = fetcher.Fetch(ctx, pkg, fetchReq)
 	if err != nil {
-		return errors.Wrap(err, "error fetching deploy package")
+		return fmt.Errorf("error fetching deploy package: %w", err)
 	}

 	_, err = fetcher.FetchSecretsAndCfgMaps(ctx, fetchReq.Secrets, fetchReq.ConfigMaps)
 	if err != nil {
-		return errors.Wrap(err, "error fetching secrets/configs")
+		return fmt.Errorf("error fetching secrets/configs: %w", err)
 	}

 	// Specialize the pod
@@ -695,7 +695,7 @@ func (fetcher *Fetcher) SpecializePod(ctx context.Context, fetchReq FunctionFetc

 	loadPayload, err := json.Marshal(loadReq)
 	if err != nil {
-		return errors.Wrap(err, "error encoding load request")
+		return fmt.Errorf("error encoding load request: %w", err)
 	}

 	// Instead of using "localhost", here we use "127.0.0.1" for
@@ -739,10 +739,10 @@ func (fetcher *Fetcher) SpecializePod(ctx context.Context, fetchReq FunctionFetc
 			err = ferror.MakeErrorFromHTTP(resp)
 		}

-		return errors.Wrap(err, "error specializing function pod")
+		return fmt.Errorf("error specializing function pod: %w", err)
 	}

-	return errors.Wrapf(err, "error specializing function pod after %v times", maxRetries)
+	return fmt.Errorf("error specializing function pod after %v times: %w", maxRetries, err)
 }

 // WsStartHandler is used to generate websocket events in Kubernetes
@@ -17,10 +17,10 @@ limitations under the License.
 package canaryconfig

 import (
+	"errors"
 	"fmt"
 	"time"

-	"github.com/pkg/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
@@ -57,7 +57,7 @@ func (opts *CreateSubCommand) complete(input cli.Input) (err error) {

 	_, fnNs, err := opts.GetResourceNamespace(input, flagkey.NamespaceFunction)
 	if err != nil {
-		return errors.Wrap(err, "error in creating canaryconfig")
+		return fmt.Errorf("error in creating canaryconfig: %w", err)
 	}
 	incrementStep := input.Int(flagkey.CanaryWeightIncrement)
 	failureThreshold := input.Int(flagkey.CanaryFailureThreshold)
@@ -66,13 +66,13 @@ func (opts *CreateSubCommand) complete(input cli.Input) (err error) {
 	// check for time parsing
 	_, err = time.ParseDuration(incrementInterval)
 	if err != nil {
-		return errors.Wrap(err, "error parsing time duration")
+		return fmt.Errorf("error parsing time duration: %w", err)
 	}

 	// check that the trigger exists in the same namespace.
 	htTrigger, err := opts.Client().FissionClientSet.CoreV1().HTTPTriggers(fnNs).Get(input.Context(), ht, metav1.GetOptions{})
 	if err != nil {
-		return errors.Wrap(err, "error finding http trigger referenced in the canary config")
+		return fmt.Errorf("error finding http trigger referenced in the canary config: %w", err)
 	}

 	// check that the trigger has function reference type function weights
@@ -95,7 +95,7 @@ func (opts *CreateSubCommand) complete(input cli.Input) (err error) {
 	fnList := []string{newFunc, oldFunc}
 	err = util.CheckFunctionExistence(input.Context(), opts.Client(), fnList, fnNs)
 	if err != nil {
-		return errors.Wrap(err, "error checking functions existence")
+		return fmt.Errorf("error checking functions existence: %w", err)
 	}

 	// finally create canaryCfg in the same namespace as the functions referenced
@@ -124,7 +124,7 @@ func (opts *CreateSubCommand) complete(input cli.Input) (err error) {
 func (opts *CreateSubCommand) run(input cli.Input) error {
 	_, err := opts.Client().FissionClientSet.CoreV1().CanaryConfigs(opts.canary.ObjectMeta.Namespace).Create(input.Context(), opts.canary, metav1.CreateOptions{})
 	if err != nil {
-		return errors.Wrap(err, "error creating canary config")
+		return fmt.Errorf("error creating canary config: %w", err)
 	}

 	fmt.Printf("canary config '%s' created\n", opts.canary.ObjectMeta.Name)
@@ -19,7 +19,6 @@ package canaryconfig
 import (
 	"fmt"

-	"github.com/pkg/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

 	"github.com/fission/fission/pkg/fission-cli/cliwrapper/cli"
@@ -39,7 +38,7 @@ func Delete(input cli.Input) error {
 func (opts *DeleteSubCommand) run(input cli.Input) (err error) {
 	_, namespace, err := opts.GetResourceNamespace(input, flagkey.NamespaceCanary)
 	if err != nil {
-		return errors.Wrap(err, "error in deleting canaryConfig ")
+		return fmt.Errorf("error in deleting canaryConfig: %w", err)
 	}

 	err = opts.Client().FissionClientSet.CoreV1().CanaryConfigs(namespace).Delete(input.Context(), input.String(flagkey.CanaryName), metav1.DeleteOptions{})
@@ -47,7 +46,7 @@ func (opts *DeleteSubCommand) run(input cli.Input) (err error) {
 		if input.Bool(flagkey.IgnoreNotFound) && util.IsNotFound(err) {
 			return nil
 		}
-		return errors.Wrap(err, "error deleting canary config")
+		return fmt.Errorf("error deleting canary config: %w", err)
 	}

 	fmt.Printf("canaryconfig '%v.%v' deleted\n", input.String(flagkey.CanaryName), namespace)
@@ -21,7 +21,6 @@ import (
 	"os"
 	"text/tabwriter"

-	"github.com/pkg/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

 	"github.com/fission/fission/pkg/fission-cli/cliwrapper/cli"
@@ -41,12 +40,12 @@ func (opts *GetSubCommand) run(input cli.Input) (err error) {

 	_, namespace, err := opts.GetResourceNamespace(input, flagkey.NamespaceCanary)
 	if err != nil {
-		return errors.Wrap(err, "error getting canary config")
+		return fmt.Errorf("error getting canary config: %w", err)
 	}

 	canaryCfg, err := opts.Client().FissionClientSet.CoreV1().CanaryConfigs(namespace).Get(input.Context(), input.String(flagkey.CanaryName), metav1.GetOptions{})
 	if err != nil {
-		return errors.Wrap(err, "error getting canary config")
+		return fmt.Errorf("error getting canary config: %w", err)
 	}

 	w := tabwriter.NewWriter(os.Stdout, 0, 0, 1, ' ', 0)
@@ -21,7 +21,6 @@ import (
 	"os"
 	"text/tabwriter"

-	"github.com/pkg/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

 	"github.com/fission/fission/pkg/fission-cli/cliwrapper/cli"
@@ -49,7 +48,7 @@ func (opts *ListSubCommand) do(input cli.Input) error {
 func (opts *ListSubCommand) complete(input cli.Input) (err error) {
 	_, opts.namespace, err = opts.GetResourceNamespace(input, flagkey.NamespaceCanary)
 	if err != nil {
-		return errors.Wrap(err, "error in listing canary config ")
+		return fmt.Errorf("error in listing canary config: %w", err)
 	}
 	return nil
 }
@@ -62,7 +61,7 @@ func (opts *ListSubCommand) run(input cli.Input) (err error) {
 	canaryCfgs, err := opts.Client().FissionClientSet.CoreV1().CanaryConfigs(opts.namespace).List(input.Context(), metav1.ListOptions{})

 	if err != nil {
-		return errors.Wrap(err, "error listing canary config")
+		return fmt.Errorf("error listing canary config: %w", err)
 	}

 	w := tabwriter.NewWriter(os.Stdout, 0, 0, 1, ' ', 0)
@@ -20,7 +20,6 @@ import (
 	"fmt"
 	"time"

-	"github.com/pkg/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

 	fv1 "github.com/fission/fission/pkg/apis/core/v1"
@@ -50,7 +49,7 @@ func (opts *UpdateSubCommand) complete(input cli.Input) (err error) {
 	// get the current config
 	_, ns, err := opts.GetResourceNamespace(input, flagkey.NamespaceCanary)
 	if err != nil {
-		return errors.Wrap(err, "error updating canary config")
+		return fmt.Errorf("error updating canary config: %w", err)
 	}
 	incrementStep := input.Int(flagkey.CanaryWeightIncrement)
 	failureThreshold := input.Int(flagkey.CanaryFailureThreshold)
@@ -59,12 +58,12 @@ func (opts *UpdateSubCommand) complete(input cli.Input) (err error) {
 	// check for time parsing
 	_, err = time.ParseDuration(incrementInterval)
 	if err != nil {
-		return errors.Wrap(err, "error parsing time duration")
+		return fmt.Errorf("error parsing time duration: %w", err)
 	}

 	canaryCfg, err := opts.Client().FissionClientSet.CoreV1().CanaryConfigs(ns).Get(input.Context(), input.String(flagkey.CanaryName), metav1.GetOptions{})
 	if err != nil {
-		return errors.Wrap(err, "error getting canary config")
+		return fmt.Errorf("error getting canary config: %w", err)
 	}

 	var updateNeeded bool
@@ -93,7 +92,7 @@ func (opts *UpdateSubCommand) complete(input cli.Input) (err error) {
 func (opts *UpdateSubCommand) run(input cli.Input) error {
 	_, err := opts.Client().FissionClientSet.CoreV1().CanaryConfigs(opts.canary.ObjectMeta.Namespace).Update(input.Context(), opts.canary, metav1.UpdateOptions{})
 	if err != nil {
-		return errors.Wrap(err, "error updating canary config")
+		return fmt.Errorf("error updating canary config: %w", err)
 	}
 	fmt.Printf("canary config '%v' updated\n", opts.canary.ObjectMeta.Name)
 	return nil
@@ -75,7 +75,7 @@ func getLoadingRules() (loadingRules *clientcmd.ClientConfigLoadingRules, err er

 		if _, err := os.Stat(kubeConfigPath); os.IsNotExist(err) {
 			return nil, errors.New("couldn't find kubeconfig file. " +
-				"Set the KUBECONFIG environment variable to your kubeconfig's path.")
+				"Set the KUBECONFIG environment variable to your kubeconfig's path")
 		}
 		loadingRules.ExplicitPath = kubeConfigPath
 		console.Verbose(2, "Using kubeconfig from %q", kubeConfigPath)
@@ -20,7 +20,6 @@ import (
 	"fmt"

 	"github.com/hashicorp/go-multierror"
-	"github.com/pkg/errors"
 	apiv1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

@@ -101,7 +100,7 @@ func (opts *CreateSubCommand) run(input cli.Input) (err error) {
 		specFile := fmt.Sprintf("env-%v.yaml", opts.env.ObjectMeta.Name)
 		err = spec.SpecSave(*opts.env, specFile, false)
 		if err != nil {
-			return errors.Wrap(err, "error saving environment spec")
+			return fmt.Errorf("error saving environment spec: %w", err)
 		}
 		return nil
 	}
@@ -110,7 +109,7 @@ func (opts *CreateSubCommand) run(input cli.Input) (err error) {

 	_, err = opts.Client().FissionClientSet.CoreV1().Environments(opts.env.Namespace).Create(input.Context(), opts.env, metav1.CreateOptions{})
 	if err != nil {
-		return errors.Wrap(err, "error creating resource")
+		return fmt.Errorf("error creating resource: %w", err)
 	}

 	fmt.Printf("environment '%v' created\n", opts.env.ObjectMeta.Name)
@@ -17,9 +17,9 @@ limitations under the License.
 package environment

 import (
+	"errors"
 	"fmt"

-	"github.com/pkg/errors"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

@@ -41,7 +41,7 @@ func (opts *DeleteSubCommand) do(input cli.Input) (err error) {

 	_, currentContextNS, err := opts.GetResourceNamespace(input, flagkey.NamespaceEnvironment)
 	if err != nil {
-		return errors.Wrap(err, "error creating environment")
+		return fmt.Errorf("error creating environment: %w", err)
 	}
 	console.Verbose(2, "Searching for resource in  %s Namespace", currentContextNS)
 	envName := input.String(flagkey.EnvName)
@@ -49,13 +49,13 @@ func (opts *DeleteSubCommand) do(input cli.Input) (err error) {
 	if !input.Bool(flagkey.EnvForce) {
 		fns, err := opts.Client().FissionClientSet.CoreV1().Functions(metav1.NamespaceAll).List(input.Context(), metav1.ListOptions{})
 		if err != nil {
-			return errors.Wrap(err, "Error getting functions wrt environment.")
+			return fmt.Errorf("error getting functions wrt environment: %w", err)
 		}

 		for _, fn := range fns.Items {
 			if fn.Spec.Environment.Name == envName &&
 				fn.Spec.Environment.Namespace == currentContextNS {
-				return errors.New("Environment is used by at least one function.")
+				return errors.New("environment is used by at least one function")
 			}
 		}
 	}
@@ -65,7 +65,7 @@ func (opts *DeleteSubCommand) do(input cli.Input) (err error) {
 		if input.Bool(flagkey.IgnoreNotFound) && kerrors.IsNotFound(err) {
 			return nil
 		}
-		return errors.Wrap(err, "error deleting environment")
+		return fmt.Errorf("error deleting environment: %w", err)
 	}

 	fmt.Printf("environment '%s' deleted\n", envName)
@@ -21,7 +21,6 @@ import (
 	"os"
 	"text/tabwriter"

-	"github.com/pkg/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

 	"github.com/fission/fission/pkg/fission-cli/cliwrapper/cli"
@@ -41,12 +40,12 @@ func (opts *GetSubCommand) do(input cli.Input) (err error) {

 	_, currentNS, err := opts.GetResourceNamespace(input, flagkey.NamespaceEnvironment)
 	if err != nil {
-		return errors.Wrap(err, "error creating environment")
+		return fmt.Errorf("error creating environment: %w", err)
 	}

 	env, err := opts.Client().FissionClientSet.CoreV1().Environments(currentNS).Get(input.Context(), input.String(flagkey.EnvName), metav1.GetOptions{})
 	if err != nil {
-		return errors.Wrap(err, "error getting environment")
+		return fmt.Errorf("error getting environment: %w", err)
 	}

 	w := tabwriter.NewWriter(os.Stdout, 0, 0, 1, ' ', 0)
@@ -21,7 +21,6 @@ import (
 	"os"
 	"text/tabwriter"

-	"github.com/pkg/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

 	"github.com/fission/fission/pkg/fission-cli/cliwrapper/cli"
@@ -41,7 +40,7 @@ func (opts *ListSubCommand) do(input cli.Input) (err error) {

 	_, currentNS, err := opts.GetResourceNamespace(input, flagkey.NamespaceEnvironment)
 	if err != nil {
-		return errors.Wrap(err, "error creating environment")
+		return fmt.Errorf("error creating environment: %w", err)
 	}

 	if input.Bool(flagkey.AllNamespaces) {
@@ -50,7 +49,7 @@ func (opts *ListSubCommand) do(input cli.Input) (err error) {

 	response, err := opts.Client().FissionClientSet.CoreV1().Environments(currentNS).List(input.Context(), metav1.ListOptions{})
 	if err != nil {
-		return errors.Wrap(err, "error listing environments")
+		return fmt.Errorf("error listing environments: %w", err)
 	}

 	envs := response.Items
@@ -21,7 +21,6 @@ import (
 	"os"
 	"text/tabwriter"

-	"github.com/pkg/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"

@@ -44,12 +43,12 @@ func (opts *ListPodsSubCommand) do(input cli.Input) (err error) {

 	_, currentNS, err := opts.GetResourceNamespace(input, flagkey.NamespaceEnvironment)
 	if err != nil {
-		return errors.Wrap(err, "error creating environment")
+		return fmt.Errorf("error creating environment: %w", err)
 	}

 	_, err = opts.Client().FissionClientSet.CoreV1().Environments(currentNS).Get(input.Context(), input.String(flagkey.EnvName), metav1.GetOptions{})
 	if err != nil {
-		return errors.Wrap(err, "error getting environment")
+		return fmt.Errorf("error getting environment: %w", err)
 	}

 	// label selector
@@ -65,7 +64,7 @@ func (opts *ListPodsSubCommand) do(input cli.Input) (err error) {
 		LabelSelector: labels.Set(selector).AsSelector().String(),
 	})
 	if err != nil {
-		return errors.Wrap(err, "error listing environments")
+		return fmt.Errorf("error listing environments: %w", err)
 	}

 	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
@@ -17,11 +17,12 @@ limitations under the License.
 package environment

 import (
+	"errors"
 	"fmt"
 	"strconv"

 	"github.com/hashicorp/go-multierror"
-	"github.com/pkg/errors"
+
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -57,11 +58,11 @@ func (opts *UpdateSubCommand) complete(input cli.Input) (err error) {

 	_, currentContextNS, err := opts.GetResourceNamespace(input, flagkey.NamespaceEnvironment)
 	if err != nil {
-		return errors.Wrap(err, "error creating environment")
+		return fmt.Errorf("error creating environment: %w", err)
 	}
 	env, err := opts.Client().FissionClientSet.CoreV1().Environments(currentContextNS).Get(input.Context(), input.String(flagkey.EnvName), metav1.GetOptions{})
 	if err != nil {
-		return errors.Wrap(err, "error finding environment")
+		return fmt.Errorf("error finding environment: %w", err)
 	}

 	env, err = updateExistingEnvironmentWithCmd(env, input)
@@ -89,16 +90,16 @@ func (opts *UpdateSubCommand) run(input cli.Input) error {
 		specFile := fmt.Sprintf("env-%s.yaml", m.Name)
 		err = spec.SpecSave(*opts.env, specFile, true)
 		if err != nil {
-			return errors.Wrap(err, "error saving environment spec")
+			return fmt.Errorf("error saving environment spec: %w", err)
 		}
 		return nil
 	}
 	enew, err := opts.Client().FissionClientSet.CoreV1().Environments(opts.env.ObjectMeta.Namespace).Update(input.Context(), opts.env, metav1.UpdateOptions{})
 	if err != nil {
-		return errors.Wrap(err, "error updating environment")
+		return fmt.Errorf("error updating environment: %w", err)
 	}

-	fmt.Printf("environment '%v' updated\n", enew.ObjectMeta.Name)
+	fmt.Printf("environment '%v' updated\n", enew.Name)
 	return nil
 }

@@ -151,7 +152,7 @@ func updateExistingEnvironmentWithCmd(env *fv1.Environment, input cli.Input) (*f
 		mincpu := input.Int(flagkey.RuntimeMincpu)
 		cpuRequest, err := resource.ParseQuantity(strconv.Itoa(mincpu) + "m")
 		if err != nil {
-			e = multierror.Append(e, errors.Wrap(err, "Failed to parse mincpu"))
+			e = multierror.Append(e, fmt.Errorf("failed to parse mincpu: %w", err))
 		}
 		env.Spec.Resources.Requests[v1.ResourceCPU] = cpuRequest
 	}
@@ -160,7 +161,7 @@ func updateExistingEnvironmentWithCmd(env *fv1.Environment, input cli.Input) (*f
 		maxcpu := input.Int(flagkey.RuntimeMaxcpu)
 		cpuLimit, err := resource.ParseQuantity(strconv.Itoa(maxcpu) + "m")
 		if err != nil {
-			e = multierror.Append(e, errors.Wrap(err, "Failed to parse maxcpu"))
+			e = multierror.Append(e, fmt.Errorf("failed to parse maxcpu: %w", err))
 		}
 		env.Spec.Resources.Limits[v1.ResourceCPU] = cpuLimit
 	}
@@ -169,7 +170,7 @@ func updateExistingEnvironmentWithCmd(env *fv1.Environment, input cli.Input) (*f
 		minmem := input.Int(flagkey.RuntimeMinmemory)
 		memRequest, err := resource.ParseQuantity(strconv.Itoa(minmem) + "Mi")
 		if err != nil {
-			e = multierror.Append(e, errors.Wrap(err, "Failed to parse minmemory"))
+			e = multierror.Append(e, fmt.Errorf("failed to parse minmemory: %w", err))
 		}
 		env.Spec.Resources.Requests[v1.ResourceMemory] = memRequest
 	}
@@ -178,7 +179,7 @@ func updateExistingEnvironmentWithCmd(env *fv1.Environment, input cli.Input) (*f
 		maxmem := input.Int(flagkey.RuntimeMaxmemory)
 		memLimit, err := resource.ParseQuantity(strconv.Itoa(maxmem) + "Mi")
 		if err != nil {
-			e = multierror.Append(e, errors.Wrap(err, "Failed to parse maxmemory"))
+			e = multierror.Append(e, fmt.Errorf("failed to parse maxmemory: %w", err))
 		}
 		env.Spec.Resources.Limits[v1.ResourceMemory] = memLimit
 	}
@@ -195,7 +196,7 @@ func updateExistingEnvironmentWithCmd(env *fv1.Environment, input cli.Input) (*f
 	if limitCPU.IsZero() && !requestCPU.IsZero() {
 		env.Spec.Resources.Limits[v1.ResourceCPU] = requestCPU
 	} else if limitCPU.Cmp(requestCPU) < 0 {
-		e = multierror.Append(e, fmt.Errorf("MinCPU (%v) cannot be greater than MaxCPU (%v)", requestCPU.String(), limitCPU.String()))
+		e = multierror.Append(e, fmt.Errorf("minCPU (%v) cannot be greater than MaxCPU (%v)", requestCPU.String(), limitCPU.String()))
 	}

 	limitMem := env.Spec.Resources.Limits[v1.ResourceMemory]
@@ -204,7 +205,7 @@ func updateExistingEnvironmentWithCmd(env *fv1.Environment, input cli.Input) (*f
 	if limitMem.IsZero() && !requestMem.IsZero() {
 		env.Spec.Resources.Limits[v1.ResourceMemory] = requestMem
 	} else if limitMem.Cmp(requestMem) < 0 {
-		e = multierror.Append(e, fmt.Errorf("MinMemory (%v) cannot be greater than MaxMemory (%v)", requestMem.String(), limitMem.String()))
+		e = multierror.Append(e, fmt.Errorf("minMemory (%v) cannot be greater than MaxMemory (%v)", requestMem.String(), limitMem.String()))
 	}

 	if e.ErrorOrNil() != nil {
--- a/Show More
+++ b/Show More