fix: update git-sync to v4.2.1 to fix a pulling issue

There is a bug in git-sync v4.1.0. When branches in different remotes
are out of sync, `git-sync` fetches the commit SHA from the last line,
which may not be the latest. This leads to an issue that Config Sync
couldn't pull the latest commit from HEAD.

The issue was fixed in v4.2.0 by
kubernetes/git-sync#845.
This commit updates git-sync to v4.2.1 to include the fix.

It also bumps the debian-base to latest version for CVE fixes.

b/325341042

Makefile

@@ -39,7 +39,7 @@ GO_DIR := $(OUTPUT_DIR)/go
 # Base image used for all golang containers
 GOLANG_IMAGE := golang:1.21.5-bookworm
 # Base image used for debian containers
-DEBIAN_BASE_IMAGE := gcr.io/gke-release/debian-base:bookworm-v1.0.1-gke.0
+DEBIAN_BASE_IMAGE := gcr.io/gke-release/debian-base:bookworm-v1.0.1-gke.1
 # Base image used for gcloud install, primarily for test images.
 # We use -slim for a smaller base image where we can choose which components to install.
 # https://cloud.google.com/sdk/docs/downloads-docker#docker_image_options

e2e/testcases/git_sync_test.go

@@ -17,8 +17,8 @@ package e2e
 import (
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/types"
 	"kpt.dev/configsync/e2e/nomostest"
 	"kpt.dev/configsync/e2e/nomostest/gitproviders"
 	nomostesting "kpt.dev/configsync/e2e/nomostest/testing"
@@ -53,21 +53,27 @@ func TestMultipleRemoteBranchesOutOfSync(t *testing.T) {
 	if err := nt.Validate("hello", "", &corev1.Namespace{}); err != nil {
 		nt.T.Fatal(err)
 	}
+	rs = fake.RootSyncObjectV1Beta1(configsync.RootSyncName)
+	if err := nt.KubeClient.Get(configsync.RootSyncName, configmanagement.ControllerNamespace, rs); err != nil {
+		nt.T.Fatal(err)
+	}
+	updatedSyncCommit := rs.Status.LastSyncedCommit
+	assert.NotEqual(t, initialSyncedCommit, updatedSyncCommit)
+
+	nt.T.Logf("Verify git-sync can pull the latest commit with the default branch and revision")
+	nomostest.SetGitBranch(nt, configsync.RootSyncName, gitproviders.MainBranch)
+	if err := nt.WatchForAllSyncs(); err != nil {
+		nt.T.Fatal(err)
+	}
 	if err := nt.Validate(configsync.RootSyncName, configmanagement.ControllerNamespace,
 		&v1beta1.RootSync{}, testpredicates.RootSyncLastSyncedCommitNotEquals(initialSyncedCommit)); err != nil {
 		nt.T.Fatal(err)
 	}
 
-	// Apply the mitigation first to validate Config Sync couldn't pull the latest commit.
-	nt.T.Logf("Verify the issue exist with the default branch and revision")
-	nomostest.SetGitBranch(nt, configsync.RootSyncName, gitproviders.MainBranch)
-	if err := nt.WatchForAllSyncs(nomostest.WithRootSha1Func(
-		// DefaultRootSha1Fn returns the hash with `git rev-parse HEAD`, which is
-		// different from `git ls-remote ...`
-		// So, overwrite the root hash with the initial lastSyncedCommit.
-		func(_ *nomostest.NT, _ types.NamespacedName) (string, error) {
-			return initialSyncedCommit, nil
-		})); err != nil {
+	nt.T.Logf("Remove the test namespace to make sure git-sync can fetch new commit")
+	nt.Must(nt.RootRepos[configsync.RootSyncName].Remove("acme/namespaces/hello/ns.yaml"))
+	nt.Must(nt.RootRepos[configsync.RootSyncName].CommitAndPush("remove Namespace"))
+	if err := nt.WatchForAllSyncs(); err != nil {
 		nt.T.Fatal(err)
 	}
 	if err := nt.ValidateNotFound("hello", "", &corev1.Namespace{}); err != nil {

manifests/templates/reconciler-manager-configmap.yaml

@@ -101,7 +101,7 @@ data:
                - ALL
            imagePullPolicy: IfNotPresent
          - name: git-sync
-           image: gcr.io/config-management-release/git-sync:v4.1.0-gke.7__linux_amd64
+           image: gcr.io/config-management-release/git-sync:v4.2.1-gke.1__linux_amd64
            args: ["--root=/repo/source", "--link=rev", "--max-failures=30", "--error-file=error.json"]
            volumeMounts:
            - name: repo