chore: upgrade Go version to 1.27 and modernize idioms

.github/workflows/benchmark.yaml

@@ -40,7 +40,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.25"
+          go-version: "1.27"
 
       - name: Install Kind
         run: |

.github/workflows/bypass.yaml

@@ -26,7 +26,7 @@ jobs:
       CGO_ENABLED: 0
       GO111MODULE: "on"
       BUILD_PLATFORM: linux/amd64,linux/arm64
-      GO_VERSION: "1.25"
+      GO_VERSION: "1.27"
       REQUIRED_TESTS: ""
       FORCE: true
       COSIGN: true

.github/workflows/component-tests.yaml

@@ -168,7 +168,7 @@ jobs:
           CGO_ENABLED: 0
         uses: actions/setup-go@v4
         with:
-          go-version: "1.25"
+          go-version: "1.27"
       - name: Set unlimited memlock limit
         run: |
           sudo sh -c "ulimit -l unlimited"

.github/workflows/pr-created.yaml

@@ -15,6 +15,6 @@ jobs:
   pr-created:
     uses: ./.github/workflows/incluster-comp-pr-created.yaml
     with:
-      GO_VERSION: "1.25"
+      GO_VERSION: "1.27"
       CGO_ENABLED: 0
     secrets: inherit

.github/workflows/pr-merged.yaml

@@ -42,7 +42,7 @@ jobs:
       CGO_ENABLED: 0
       GO111MODULE: "on"
       BUILD_PLATFORM: linux/amd64,linux/arm64
-      GO_VERSION: "1.25"
+      GO_VERSION: "1.27"
       REQUIRED_TESTS: '[
         "relevantCVEs",
         "relevancy_enabled_stop_sniffing",

README.md

@@ -467,7 +467,7 @@ ls -la /sys/kernel/btf/vmlinux
 
 ### Prerequisites
 
-- Go 1.25+
+- Go 1.27+
 - Linux with kernel 5.4+ (for eBPF)
 - Docker (for building images)
 - kubectl & helm (for testing)

build/Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM golang:1.25-trixie AS builder
+FROM --platform=$BUILDPLATFORM golang:1.27-trixie AS builder
 
 ENV GO111MODULE=on CGO_ENABLED=0
 WORKDIR /work

build/Dockerfile.debug

@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM golang:1.25-trixie AS builder
+FROM --platform=$BUILDPLATFORM golang:1.27-trixie AS builder
 
 ENV GO111MODULE=on CGO_ENABLED=0
 WORKDIR /work

build/README.md

@@ -68,7 +68,7 @@ make gadgets
 
 ## Build Prerequisites
 
-- **Go 1.25+** - For building the binary
+- **Go 1.27+** - For building the binary
 - **Docker** with buildx - For building container images
 - **Linux** - Required for eBPF gadget compilation
 - **Root/sudo** - Required for running gadget builds

docs/features/network-stream-process-attribution.md

@@ -412,7 +412,7 @@ excludes darwin and is imported transitively.
 
 ```bash
 docker run --rm -v "$PWD":/src -v "$(go env GOMODCACHE)":/go/pkg/mod -w /src \
-  -e GOFLAGS=-mod=mod golang:1.25 go test ./pkg/networkstream/...
+  -e GOFLAGS=-mod=mod golang:1.27 go test ./pkg/networkstream/...
 ```
 
 `pkg/networkstream/v1` had two test functions before this change, so it carries

docs/features/process-id-reuse-hardening.md

@@ -273,7 +273,7 @@ Linux container:
 
 ```bash
 docker run --rm -v "$PWD":/src -v "$(go env GOMODCACHE)":/go/pkg/mod -w /src \
-  -e GOFLAGS=-mod=mod golang:1.25 go test -race ./pkg/processtree/...
+  -e GOFLAGS=-mod=mod golang:1.27 go test -race ./pkg/processtree/...
 ```
 
 Every reproduction and guard test lives in

docs/features/process-start-time.md

@@ -195,7 +195,7 @@ excludes darwin and everything under `pkg/processtree` imports it transitively.
 
 ```bash
 docker run --rm -v "$PWD":/src -v "$(go env GOMODCACHE)":/go/pkg/mod -w /src \
-  -e GOFLAGS=-mod=mod golang:1.25 go test ./pkg/processtree/... ./pkg/utils/...
+  -e GOFLAGS=-mod=mod golang:1.27 go test ./pkg/processtree/... ./pkg/utils/...
 ```
 
 The tick conversion is defined once per package (feeder and creator). Both are

docs/features/process-tree-exit-manager-lifecycle.md

@@ -100,5 +100,5 @@ locally:
 
 ```bash
 docker run --rm -v "$PWD":/src -v "$(go env GOMODCACHE)":/go/pkg/mod -w /src \
-  -e GOFLAGS=-mod=mod golang:1.25 go test -race ./pkg/processtree/...
+  -e GOFLAGS=-mod=mod golang:1.27 go test -race ./pkg/processtree/...
 ```

go.mod

@@ -1,6 +1,6 @@
 module github.com/kubescape/node-agent
 
-go 1.25.8
+go 1.27
 
 require (
 	github.com/DmitriyVTitov/size v1.5.0

pkg/cloudmetadata/metadata.go

@@ -83,11 +83,11 @@ func parseAzureResourceGroup(providerID string) string {
 	}
 	start := idx + len(marker)
 	rest := providerID[start:]
-	end := strings.Index(rest, "/")
-	if end == -1 {
+	before, _, ok := strings.Cut(rest, "/")
+	if !ok {
 		return rest
 	}
-	return rest[:end]
+	return before
 }
 
 // GetCloudMetadataWithIMDS retrieves cloud metadata for a given node using IMDS

pkg/config/config_test.go

@@ -720,12 +720,12 @@ func TestLoadConfig_BypassSkipsSlotsExponentValidation(t *testing.T) {
 
 func TestConfig_IsMetricsEnabled(t *testing.T) {
 	tests := []struct {
-		name                   string
-		enableMetricsExporter  bool
-		otelMetricsExporter    string
-		otelOtlpEndpoint       string
+		name                    string
+		enableMetricsExporter   bool
+		otelMetricsExporter     string
+		otelOtlpEndpoint        string
 		otelOtlpMetricsEndpoint string
-		want                   bool
+		want                    bool
 	}{
 		{
 			name:                  "default disabled",

pkg/containerprofilemanager/v1/container_data_test.go

@@ -58,39 +58,39 @@ func (c *servicePortTestClient) GetDynamicClient() dynamic.Interface {
 	return nil
 }
 
-func newServiceWorkload(name string, selector map[string]interface{}, ports ...map[string]interface{}) k8sinterface.IWorkload {
-	portEntries := make([]interface{}, 0, len(ports))
+func newServiceWorkload(name string, selector map[string]any, ports ...map[string]any) k8sinterface.IWorkload {
+	portEntries := make([]any, 0, len(ports))
 	for _, port := range ports {
 		portEntries = append(portEntries, port)
 	}
-	return workloadinterface.NewWorkloadObj(map[string]interface{}{
+	return workloadinterface.NewWorkloadObj(map[string]any{
 		"apiVersion": "v1",
 		"kind":       "Service",
-		"metadata": map[string]interface{}{
+		"metadata": map[string]any{
 			"name":      name,
 			"namespace": "default",
 		},
-		"spec": map[string]interface{}{
+		"spec": map[string]any{
 			"selector": selector,
 			"ports":    portEntries,
 		},
 	})
 }
 
-func newEndpointsWorkload(name string, ports ...map[string]interface{}) k8sinterface.IWorkload {
-	portEntries := make([]interface{}, 0, len(ports))
+func newEndpointsWorkload(name string, ports ...map[string]any) k8sinterface.IWorkload {
+	portEntries := make([]any, 0, len(ports))
 	for _, port := range ports {
 		portEntries = append(portEntries, port)
 	}
-	return workloadinterface.NewWorkloadObj(map[string]interface{}{
+	return workloadinterface.NewWorkloadObj(map[string]any{
 		"apiVersion": "v1",
 		"kind":       "Endpoints",
-		"metadata": map[string]interface{}{
+		"metadata": map[string]any{
 			"name":      name,
 			"namespace": "default",
 		},
-		"subsets": []interface{}{
-			map[string]interface{}{
+		"subsets": []any{
+			map[string]any{
 				"ports": portEntries,
 			},
 		},
@@ -99,12 +99,10 @@ func newEndpointsWorkload(name string, ports ...map[string]interface{}) k8sinter
 
 func newEndpointSlice(name, serviceName string, ports ...discoveryv1.EndpointPort) *discoveryv1.EndpointSlice {
 	return &discoveryv1.EndpointSlice{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      name,
-			Namespace: "default",
-			Labels: map[string]string{
-				discoveryv1.LabelServiceName: serviceName,
-			},
+		Name:      name,
+		Namespace: "default",
+		Labels: map[string]string{
+			discoveryv1.LabelServiceName: serviceName,
 		},
 		Ports: ports,
 	}
@@ -134,69 +132,69 @@ func TestCreateNetworkNeighbor_ServiceTargetPortMatrix(t *testing.T) {
 	}{
 		{
 			name: "numeric remap",
-			service: newServiceWorkload("api", map[string]interface{}{"app": "api"}, map[string]interface{}{
+			service: newServiceWorkload("api", map[string]any{"app": "api"}, map[string]any{
 				"port": 80, "targetPort": 8080, "protocol": "TCP",
 			}),
 			event:     serviceNetworkEvent(80, "tcp"),
 			wantPorts: []int32{8080},
 		},
 		{
 			name: "unchanged when port equals targetPort",
-			service: newServiceWorkload("api", map[string]interface{}{"app": "api"}, map[string]interface{}{
+			service: newServiceWorkload("api", map[string]any{"app": "api"}, map[string]any{
 				"port": 8080, "targetPort": 8080, "protocol": "TCP",
 			}),
 			event:     serviceNetworkEvent(8080, "tcp"),
 			wantPorts: []int32{8080},
 		},
 		{
 			name: "omitted targetPort defaults to service port",
-			service: newServiceWorkload("api", map[string]interface{}{"app": "api"}, map[string]interface{}{
+			service: newServiceWorkload("api", map[string]any{"app": "api"}, map[string]any{
 				"port": 80, "protocol": "TCP",
 			}),
 			event:     serviceNetworkEvent(80, "tcp"),
 			wantPorts: []int32{80},
 		},
 		{
 			name: "udp remap",
-			service: newServiceWorkload("api", map[string]interface{}{"app": "api"}, map[string]interface{}{
+			service: newServiceWorkload("api", map[string]any{"app": "api"}, map[string]any{
 				"port": 53, "targetPort": 5353, "protocol": "UDP",
 			}),
 			event:     serviceNetworkEvent(53, "udp"),
 			wantPorts: []int32{5353},
 		},
 		{
 			name: "multi-port service selects matching service port",
-			service: newServiceWorkload("api", map[string]interface{}{"app": "api"},
-				map[string]interface{}{"port": 80, "targetPort": 8080, "protocol": "TCP"},
-				map[string]interface{}{"port": 443, "targetPort": 8443, "protocol": "TCP"},
+			service: newServiceWorkload("api", map[string]any{"app": "api"},
+				map[string]any{"port": 80, "targetPort": 8080, "protocol": "TCP"},
+				map[string]any{"port": 443, "targetPort": 8443, "protocol": "TCP"},
 			),
 			event:     serviceNetworkEvent(443, "tcp"),
 			wantPorts: []int32{8443},
 		},
 		{
 			name: "protocol mismatch keeps observed port",
-			service: newServiceWorkload("api", map[string]interface{}{"app": "api"}, map[string]interface{}{
+			service: newServiceWorkload("api", map[string]any{"app": "api"}, map[string]any{
 				"port": 80, "targetPort": 8080, "protocol": "TCP",
 			}),
 			event:     serviceNetworkEvent(80, "udp"),
 			wantPorts: []int32{80},
 		},
 		{
 			name: "unknown observed port falls back",
-			service: newServiceWorkload("api", map[string]interface{}{"app": "api"}, map[string]interface{}{
+			service: newServiceWorkload("api", map[string]any{"app": "api"}, map[string]any{
 				"port": 80, "targetPort": 8080, "protocol": "TCP",
 			}),
 			event:     serviceNetworkEvent(9999, "tcp"),
 			wantPorts: []int32{9999},
 		},
 		{
 			name: "malformed service falls back safely",
-			service: workloadinterface.NewWorkloadObj(map[string]interface{}{
+			service: workloadinterface.NewWorkloadObj(map[string]any{
 				"apiVersion": "v1",
 				"kind":       "Service",
-				"metadata":   map[string]interface{}{"name": "api", "namespace": "default"},
-				"spec": map[string]interface{}{
-					"selector": map[string]interface{}{"app": "api"},
+				"metadata":   map[string]any{"name": "api", "namespace": "default"},
+				"spec": map[string]any{
+					"selector": map[string]any{"app": "api"},
 					"ports":    "invalid",
 				},
 			}),
@@ -205,13 +203,13 @@ func TestCreateNetworkNeighbor_ServiceTargetPortMatrix(t *testing.T) {
 		},
 		{
 			name: "named targetPort resolves via endpointslice on service port name",
-			service: newServiceWorkload("api", map[string]interface{}{"app": "api"}, map[string]interface{}{
+			service: newServiceWorkload("api", map[string]any{"app": "api"}, map[string]any{
 				"name": "web", "port": 80, "targetPort": "http", "protocol": "TCP",
 			}),
 			endpointSlice: []*discoveryv1.EndpointSlice{
 				newEndpointSlice("api-a", "api", discoveryv1.EndpointPort{
-					Name:     ptr.To("web"),
-					Port:     ptr.To(int32(8080)),
+					Name:     new("web"),
+					Port:     new(int32(8080)),
 					Protocol: ptr.To(corev1.ProtocolTCP),
 				}),
 			},
@@ -220,18 +218,18 @@ func TestCreateNetworkNeighbor_ServiceTargetPortMatrix(t *testing.T) {
 		},
 		{
 			name: "heterogeneous named targetPort collects all endpoint ports",
-			service: newServiceWorkload("api", map[string]interface{}{"app": "api"}, map[string]interface{}{
+			service: newServiceWorkload("api", map[string]any{"app": "api"}, map[string]any{
 				"name": "web", "port": 80, "targetPort": "http", "protocol": "TCP",
 			}),
 			endpointSlice: []*discoveryv1.EndpointSlice{
 				newEndpointSlice("api-a", "api", discoveryv1.EndpointPort{
-					Name:     ptr.To("web"),
-					Port:     ptr.To(int32(8080)),
+					Name:     new("web"),
+					Port:     new(int32(8080)),
 					Protocol: ptr.To(corev1.ProtocolTCP),
 				}),
 				newEndpointSlice("api-b", "api", discoveryv1.EndpointPort{
-					Name:     ptr.To("web"),
-					Port:     ptr.To(int32(9090)),
+					Name:     new("web"),
+					Port:     new(int32(9090)),
 					Protocol: ptr.To(corev1.ProtocolTCP),
 				}),
 			},
@@ -240,18 +238,18 @@ func TestCreateNetworkNeighbor_ServiceTargetPortMatrix(t *testing.T) {
 		},
 		{
 			name: "nil endpoints after empty endpointslice lookup keeps observed port",
-			service: newServiceWorkload("api", map[string]interface{}{"app": "api"}, map[string]interface{}{
+			service: newServiceWorkload("api", map[string]any{"app": "api"}, map[string]any{
 				"name": "web", "port": 80, "targetPort": "http", "protocol": "TCP",
 			}),
 			event:     serviceNetworkEvent(80, "tcp"),
 			wantPorts: []int32{80},
 		},
 		{
 			name: "endpoints fallback when no endpointslice",
-			service: newServiceWorkload("api", map[string]interface{}{"app": "api"}, map[string]interface{}{
+			service: newServiceWorkload("api", map[string]any{"app": "api"}, map[string]any{
 				"name": "web", "port": 80, "targetPort": "http", "protocol": "TCP",
 			}),
-			endpoints: newEndpointsWorkload("api", map[string]interface{}{
+			endpoints: newEndpointsWorkload("api", map[string]any{
 				"name": "web", "port": 8080, "protocol": "TCP",
 			}),
 			event:     serviceNetworkEvent(80, "tcp"),
@@ -318,7 +316,7 @@ func TestCreateNetworkNeighbor_NonServiceDestinationsUnchanged(t *testing.T) {
 }
 
 func TestGenerateNetworkPolicy_ServiceTargetPortRoundTrip(t *testing.T) {
-	service := newServiceWorkload("api", map[string]interface{}{"app.kubernetes.io/name": "api"}, map[string]interface{}{
+	service := newServiceWorkload("api", map[string]any{"app.kubernetes.io/name": "api"}, map[string]any{
 		"port": 80, "targetPort": 8080, "protocol": "TCP",
 	})
 	client := &servicePortTestClient{
@@ -341,16 +339,14 @@ func TestGenerateNetworkPolicy_ServiceTargetPortRoundTrip(t *testing.T) {
 	}
 
 	cp := &softwarecomposition.ContainerProfile{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "deployment-client",
-			Namespace: "default",
-			Labels: map[string]string{
-				helpersv1.RelatedKindMetadataKey: "Deployment",
-				helpersv1.RelatedNameMetadataKey: "client",
-			},
-			Annotations: map[string]string{
-				helpersv1.StatusMetadataKey: helpersv1.Completed,
-			},
+		Name:      "deployment-client",
+		Namespace: "default",
+		Labels: map[string]string{
+			helpersv1.RelatedKindMetadataKey: "Deployment",
+			helpersv1.RelatedNameMetadataKey: "client",
+		},
+		Annotations: map[string]string{
+			helpersv1.StatusMetadataKey: helpersv1.Completed,
 		},
 		Spec: softwarecomposition.ContainerProfileSpec{
 			LabelSelector: metav1.LabelSelector{