Description

Go 1.27.1 is out, and the Microsoft Go 1.27 images ship it. This PR moves every build to Go 1.27.1 and keeps the go.mod compatibility floor at go 1.26.0:

• go.mod: add toolchain go1.27.1. setup-go and the default GOTOOLCHAIN=auto use it. The Microsoft Go images set GOTOOLCHAIN=local, so they build with their own Go.
• ADO: .azure-pipelines/steps/setup-go.yml reads the toolchain line first, then the go line. setup-go applies the same rule.
• Dockerfiles: the golang builder images move from 1.26 → 1.27 (12 FROM lines in 10 Dockerfiles). The stale 1.26 comments in the Windows Dockerfiles are fixed too.
• systemcrypto: Microsoft Go 1.27 removed GOEXPERIMENT=ms_nocgo_opensslcrypto, and a build that sets it fails:

  go: GOEXPERIMENT=ms_nocgo_opensslcrypto has been removed; system crypto supports CGO_ENABLED=0 automatically on platforms with a cgo-less OpenSSL implementation since Go 1.27
  

  The cli, operator, and controller builds drop it. With CGO_ENABLED=0, systemcrypto now selects the cgo-less OpenSSL backend by itself.
• pwru: shell/Dockerfile built pwru with GOEXPERIMENT=none to turn off systemcrypto. On Go 1.27 that setting no longer turns it off, and it turns off the upstream default experiments instead. The opt-out is removed, so pwru uses OpenSSL like the other binaries and can run in FIPS mode.
• Dependabot: ignore minor updates of oss/go/microsoft/golang. A Go minor version moves together with the toolchain line, so maintainers bump it by hand.

The go line stays at 1.26.0. The runtime GODEBUG defaults therefore stay at Go 1.26, and the stdversion check in go test reports any Go 1.27-only API.

Related Issue

Stacked on #2827. golangci-lint v2.11.4 panics on Go 1.27, so this PR needs v2.14.0 from #2827 first.

Checklist

• I have read the contributing documentation.
• I signed and signed-off the commits (git commit -S -s ...). See this documentation on signing commits.
• I have correctly attributed the author(s) of the code.
• I have tested the changes locally.
• I have followed the project's style guidelines.
• I have updated the documentation, if necessary. (N/A — build change)
• I have added tests, if applicable. (N/A — build change)

Screenshots (if applicable) or Testing Completed

Local, on Go 1.27.1

Built every Linux image for linux/amd64. All binaries report go1.27.1 and microsoft_systemcrypto=1, with no GOEXPERIMENT:

Each binary starts normally and with GOFIPS=1 OPENSSL_FORCE_FIPS_MODE=1. As a control, GOFIPS=1 with OPENSSL_CONF=/nonexistent panics, as expected:

panic: opensslcrypto: FIPS mode requested (environment variable GOFIPS=1) but not available: OpenSSL 3.3.7 7 Apr 2026

• golangci-lint v2.14.0, run as CI runs it, reports 0 issues for linux and windows on amd64 and arm64.
• go build ./... (linux, windows) and the generate-check flow (amd64) pass, with no change to generated code.
• make build-windows-binaries in the Microsoft Go 1.27 image produces go1.27.1 binaries with microsoft_systemcrypto=1 (CNG).
• The unit tests in the test/image container pass (57 packages, 0 failures).
• The kapinger and toolbox images build.

CI

A manual run of the CI pipeline with e2e validation enabled built all images, arm64 included, and passed the full e2e suite with 0 issues. PR builds post a placeholder e2e status, so this run is the real one.

Canary on an existing cluster

AKS cluster with four Azure Linux 3.0 node pools: amd64, arm64, FIPS amd64, FIPS arm64. The kernel flag /proc/sys/crypto/fips_enabled reads 1 on the FIPS pools. A curl loop on every node kept 400–1,400 flows/s per node. Baseline: v1.2.9 from MCR with the v1.2.9 charts.

Standard chart. helm upgrade --reuse-values to this build took 219 s. Over a 30-minute watch: 0 restarts in 47 observations, 0 error lines, go_info go1.27.1 on every agent, CPU and memory equal to the baseline (45–50 Mi vs 41–50 Mi), and forward_count +1.2 M to +2.8 M per node per 20 minutes. helm rollback to v1.2.9 took 124 s and was clean.

Hubble chart with its TLS defaults (certgen; CI runs this chart with TLS off). The same upgrade took 124 s. The relay reconnected to all four agents with tls=true within 5 s. hubble list nodes showed all four peers Connected at 411–1,404 flows/s, FIPS nodes included. 0 agent restarts in 20 observations. Rollback was clean.

Crypto backend. On all four nodes, the agent process maps libcrypto.so.3.3.7, libsymcrypt, and ossl-modules/symcryptprovider.so (read from /proc/<pid>/maps). The OpenSSL/SymCrypt backend is in use on amd64 and arm64, FIPS and non-FIPS.

Two observations apply to both versions and are not caused by this change. The relay restarts once per agent rollout, from a probe failure while all agents restart. The agent working set varies by up to about 170 Mi between nodes, from page-cache attribution of the image files.