v1.29.0 dry-run: flip switch-on feature flags to default

[mzihlmann]

Do not merge. Dry-run to surface v1.29.0 regressions in CI ahead of the release, since last time issues only showed up just before cutting the release.

Graduates the feature flags due in v1.29.0 per the lifecycle in docs/releases.md. Activated flags default to true now and are slated for removal in v1.30.0. The v1.28.0-activated flags are removed and their behavior is now unconditional. No golden plan data changes on this branch, the cases that assert legacy plans pin the graduated flags off instead.

Flag	Change
FF_KANIKO_SKIP_WRITE_WHITEOUTS	activate
FF_KANIKO_INFER_CROSS_STAGE_CACHE_KEY	activate
FF_KANIKO_REPRODUCIBLE_PRESERVE_BASE_LAYERS	activate
FF_KANIKO_RESOLVE_CACHE_KEY	activate
FF_KANIKO_SKIP_RELABEL_RECOMPRESS	activate
FF_KANIKO_UNTAR_SKIP_ROOT	activate
FF_KANIKO_EXPAND_HEREDOC	activate
FF_KANIKO_HASH_DIR_FRAMING	activate
FF_KANIKO_PRECOMPILE_DOCKERIGNORE	activate
FF_KANIKO_ROLLING_CACHE_KEY	activate
FF_KANIKO_RUN_HONOR_GROUP	activate
FF_KANIKO_SHARED_BASE_CACHE	activate
FF_KANIKO_SKIP_CACHED_STAGES	activate
FF_KANIKO_CROSS_REPO_MOUNT	activate
FF_KANIKO_PATH_SCOPED_REGISTRY_AUTH	activate
FF_KANIKO_RUN_MOUNT_BIND	remove, behavior now unconditional
FF_KANIKO_NO_PROPAGATE_ANNOTATIONS	remove, behavior now unconditional
FF_KANIKO_VOLUME_SKIP_MKDIR	remove, behavior now unconditional
FF_KANIKO_PRESERVE_HARDLINKS	remove, behavior now unconditional
FF_KANIKO_BUILDKIT_ARG_ENV_PRECEDENCE	remove, behavior now unconditional
FF_KANIKO_PRESERVE_MOUNTED_PATHS	remove, behavior now unconditional
FF_KANIKO_DEPRECATE_INTER_STAGE_RESTORE	remove, behavior now unconditional
FF_KANIKO_SECUREJOIN_EXTRACTION	remove, behavior now unconditional
FF_KANIKO_WARMER_CACHE_LOCK	remove, behavior now unconditional
FF_KANIKO_CLEAN_KANIKO_DIR	remove, behavior now unconditional
FF_KANIKO_OCI_WARMER	remove, ocilayout warmer now unconditional, tarball path deleted
FF_KANIKO_IGNORE_CACHED_MANIFEST	remove, obsoleted by the ocilayout warmer
FF_KANIKO_RUN_VIA_TINI	defer to v1.30.0, once the tini binary ships for RISC-V
FF_KANIKO_RELATIVE_LINK_TARGETS	keep, the docs schedule removal for v1.29.0 but the flag only shipped in v1.28.2

FF_KANIKO_RUN_VIA_TINI stays default off, held back until the tini binary ships for RISC-V. It is the only switch-on flag not flipped here. The --image-format=oci default flip lives in #850 and is not on main yet, so it is out of scope for this branch.

FF_KANIKO_NO_PROPAGATE_ANNOTATIONS is fully retired. Base image annotations are already stripped unconditionally by WithoutAnnotations before a stage is built, so the mz507 base-annotation workaround in newStageBuilder is now redundant and dropped. baseImageDigest is unchanged, since Manifest.Annotations is omitempty and the stripped image already carries none.

FF_KANIKO_OCI_WARMER removal deletes the legacy tarball Warmer path, its unit tests, and the .json manifest sidecar cleanup. The warmer now always writes an ocilayout. FF_KANIKO_IGNORE_CACHED_MANIFEST was only a workaround for the tarball writer rewriting the manifest mediatype, which the ocilayout format fixes at the root, so it goes too.

FF_KANIKO_CROSS_REPO_MOUNT and FF_KANIKO_PATH_SCOPED_REGISTRY_AUTH landed after this branch was first opened and are activated here too, both were documented as becoming default in v1.29.0. Cross-repo mount changes what a push sends, path-scoped auth changes which credential a repository is offered, so both are worth a CI pass before the release.

FF_KANIKO_RELATIVE_LINK_TARGETS is the one flag whose documented v1.29.0 removal is not carried out here. It shipped default true in v1.28.2, so removing it now would give users weeks rather than a full minor cycle to react.

[codecov]

Codecov Report

❌ Patch coverage is 70.83333% with 14 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/util/fs_util.go	42.85%	8 Missing and 4 partials ⚠️
pkg/cache/cache.go	0.00%	1 Missing ⚠️
pkg/executor/build.go	75.00%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f150f2b8-daae-4c94-a2f6-e1233538e44e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch v1.29.0-dry-run

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}