chore(cve): remove hubble cli binary bundled in image (#2641)

# Description

Remove the bundled Hubble CLI from the Linux Retina agent image.
Retina's `hubble-control-plane` command uses linked Cilium packages and
does not execute the CLI, so the production Hubble API, Relay
integration, metrics, and Unix socket behavior are unchanged.

This change also removes the CLI-only download tools, Hubble build
argument, `HUBBLE_SERVER` default, Make target, and scheduled Hubble
update workflow. The agent image is approximately 71 MiB smaller.

## Vulnerability report

Both images were built from commit `8f7374d6` for `linux/amd64` and
scanned with Trivy 0.69.3 using:

```text
trivy image --ignore-unfixed <image>
```

| Result | Before | After | Delta |
| --- | ---: | ---: | ---: |
| Fixable findings | 16 | 2 | -14 |
| Unique advisories | 15 | 1 | -14 |
| High findings | 6 | 0 | -6 |
| Medium findings | 8 | 2 | -6 |
| Unknown-severity findings | 2 | 0 | -2 |

All 14 findings removed by this PR belonged to `usr/bin/hubble`:

| Advisory | Severity | Package | Bundled version | Fixed version |
| --- | --- | --- | --- | --- |
| GHSA-gcjh-h69q-9w9g | Medium | `github.com/google/cel-go` | v0.26.1 |
0.29.0 |
| CVE-2026-2303 | Medium | `go.mongodb.org/mongo-driver` | v1.17.6 |
1.17.7 |
| CVE-2026-25681 | High | `golang.org/x/net` | v0.53.0 | 0.55.0 |
| CVE-2026-27136 | High | `golang.org/x/net` | v0.53.0 | 0.55.0 |
| CVE-2026-39821 | High | `golang.org/x/net` | v0.53.0 | 0.55.0 |
| CVE-2026-25680 | Medium | `golang.org/x/net` | v0.53.0 | 0.55.0 |
| CVE-2026-42502 | Medium | `golang.org/x/net` | v0.53.0 | 0.55.0 |
| CVE-2026-42506 | Medium | `golang.org/x/net` | v0.53.0 | 0.55.0 |
| CVE-2026-46600 | Unknown | `golang.org/x/net` | v0.53.0 | 0.56.0 |
| CVE-2026-39824 | Unknown | `golang.org/x/sys` | v0.43.0 | 0.44.0 |
| CVE-2026-56852 | High | `golang.org/x/text` | v0.36.0 | 0.39.0 |
| GHSA-hrxh-6v49-42gf | High | `google.golang.org/grpc` | v1.79.3 |
1.82.1 |
| CVE-2026-39822 | High | Go standard library | v1.26.4 | 1.25.12 /
1.26.5 |
| CVE-2026-42505 | Medium | Go standard library | v1.26.4 | 1.25.12 /
1.26.5 |

The remaining unique advisory is the pre-existing Medium
`CVE-2026-53935` in `github.com/cilium/cilium` v1.19.3. Trivy reports it
once for `retina/controller` and once for `retina/captureworkload`; it
is unrelated to the removed Hubble CLI.

## Checklist

- [ ] I have read the [contributing
documentation](https://retina.sh/docs/Contributing/overview).
- [ ] I signed and signed-off the commits (`git commit -S -s ...`).
- [ ] I have correctly attributed the author(s) of the code.
- [x] I have tested the changes locally.
- [x] I have followed the project's style guidelines.
- [x] I have updated the documentation, if necessary.
- [x] I have added tests, if applicable.

## Testing completed

- Ran the targeted controller, command, Hubble, monitor agent, and
plugin manager Go tests.
- Rendered the Hubble Helm chart and confirmed the agent still runs
`/retina/controller hubble-control-plane`.
- Built and loaded the Linux amd64 agent image.
- Confirmed `/bin/hubble` is absent and `/retina/controller` still
exposes the `hubble-control-plane` command.
- Confirmed no stale bundled-CLI build references remain.
- Ran Trivy before and after the change and recorded the results above.

## Additional notes

This removes an undocumented in-pod troubleshooting executable.
Operators who manually invoked `/bin/hubble` with `kubectl exec` should
use a separately installed Hubble CLI through the documented Relay
port-forward workflow.


## Checklist

- [ ] I have read the [contributing
documentation](https://retina.sh/docs/Contributing/overview).
- [ ] I signed and signed-off the commits (`git commit -S -s ...`). See
[this
documentation](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification)
on signing commits.
- [ ] I have correctly attributed the author(s) of the code.
- [ ] I have tested the changes locally.
- [ ] I have followed the project's style guidelines.
- [ ] I have updated the documentation, if necessary.
- [ ] I have added tests, if applicable.

## Screenshots (if applicable) or Testing Completed

Please add any relevant screenshots or GIFs to showcase the changes
made.

## Additional Notes

Add any additional notes or context about the pull request here.

---

Please refer to the [CONTRIBUTING.md](../CONTRIBUTING.md) file for more
information on how to contribute to this project.

Signed-off-by: Alex Castilio dos Santos <alexsantos@microsoft.com>

Author: alexcastilio

.github/workflows/update-hubble.yaml

@@ -41,8 +41,6 @@ PLATFORM		?= $(OS)/$(ARCH)
 PLATFORMS		?= linux/amd64 linux/arm64 windows/amd64
 OS_VERSION		?= ltsc2022
 
-HUBBLE_VERSION ?= v1.19.4
-
 CONTAINER_BUILDER ?= docker
 CONTAINER_RUNTIME ?= docker
 YEAR 			  ?= 2022
@@ -233,7 +231,6 @@ container-docker: buildx # util target to build container images using docker bu
 		--build-arg GOARCH=$$arch \
 		--build-arg GOOS=$$os \
 		--build-arg OS_VERSION=$(OS_VERSION) \
-		--build-arg HUBBLE_VERSION=$(HUBBLE_VERSION) \
 		--build-arg VERSION=$(VERSION) $(EXTRA_BUILD_ARGS) \
 		--target=$(TARGET) \
 		-t $(IMAGE_REGISTRY)/$(IMAGE):$(TAG) \
@@ -254,7 +251,6 @@ container-docker-windows: # util target to build Windows container images withou
 		--build-arg GOARCH=$$arch \
 		--build-arg GOOS=$$os \
 		--build-arg OS_VERSION=$(OS_VERSION) \
-		--build-arg HUBBLE_VERSION=$(HUBBLE_VERSION) \
 		--build-arg VERSION=$(VERSION) \
 		--build-arg REPO_PATH=$(REPO_PATH) \
 		--build-arg BINARIES_PATH=$(BINARIES_PATH) \
@@ -646,25 +642,3 @@ run-perf-test:
 
 run-e2e-test:
 	go test -v ./test/e2e/ -timeout 1h -tags=e2e -count=1  -args -image-tag=${TAG} -image-registry=${IMAGE_REGISTRY} -image-namespace=${IMAGE_NAMESPACE}
-
-.PHONY: update-hubble
-update-hubble:
-	@echo "Checking for Hubble updates..."
-	@latest_version=$$(curl -s https://api.github.com/repos/cilium/hubble/releases/latest | jq -r .tag_name); \
-    echo "Latest Hubble version: $$latest_version"; \
-    current_version=$$(grep -oP '(?<=ARG HUBBLE_VERSION=).*' controller/Dockerfile); \
-    echo "Current Hubble version: $$current_version"; \
-    if [ "$$latest_version" = "$$current_version" ]; then \
-        echo "Hubble version is up to date. No update needed."; \
-    else \
-        echo "Updating Hubble version from $$current_version to $$latest_version"; \
-        sed -i "s/^ARG HUBBLE_VERSION=.*/ARG HUBBLE_VERSION=$$latest_version/" controller/Dockerfile; \
-        sed -i "s/^HUBBLE_VERSION ?=.*/HUBBLE_VERSION ?= $$latest_version/" Makefile; \
-        echo ""; \
-        echo "Updated Hubble version in controller/Dockerfile and Makefile."; \
-        echo "Please create a branch and commit these changes:"; \
-        echo "  git checkout -b deps/update-hubble-to-$$latest_version"; \
-        echo "  git commit -am \"deps: bump Hubble version from $$current_version to $$latest_version\""; \
-        echo "  git push origin deps/update-hubble-to-$$latest_version"; \
-        echo "Then create a pull request on GitHub."; \
-    fi

Makefile

@@ -101,29 +101,14 @@ RUN tdnf install -y \
     iptables \
     tcpdump \
     which \
-    wget \
-    gnupg2 \
-    ca-certificates \
-    tar
+    ca-certificates
 RUN mkdir -p /tmp/bin
 RUN arr="clang tcpdump ip ss iptables-legacy iptables-legacy-save iptables-nft iptables-nft-save cp uname" ;\
     for i in $arr; do    \
     cp $(which $i) /tmp/bin;   \
     done
 RUN mkdir -p /tmp/init-bin
 RUN cp $(which bpftool) /tmp/init-bin
-# Download Hubble
-ARG GOARCH=amd64
-ENV HUBBLE_ARCH=${GOARCH}
-# ARG HUBBLE_VERSION may be modified via the update-hubble GitHub Action
-ARG HUBBLE_VERSION=v1.19.4
-ENV HUBBLE_VERSION=${HUBBLE_VERSION}
-RUN echo "Hubble version: $HUBBLE_VERSION" && \
-    wget --no-check-certificate https://github.com/cilium/hubble/releases/download/$HUBBLE_VERSION/hubble-linux-${HUBBLE_ARCH}.tar.gz && \
-    wget --no-check-certificate https://github.com/cilium/hubble/releases/download/$HUBBLE_VERSION/hubble-linux-${HUBBLE_ARCH}.tar.gz.sha256sum && \
-    sha256sum --check hubble-linux-${HUBBLE_ARCH}.tar.gz.sha256sum && \
-    tar xzvfC hubble-linux-${HUBBLE_ARCH}.tar.gz /usr/local && \
-    rm hubble-linux-${HUBBLE_ARCH}.tar.gz && rm hubble-linux-${HUBBLE_ARCH}.tar.gz.sha256sum
 
 # init final image
 FROM azurelinux-distroless AS init
@@ -145,8 +130,4 @@ COPY --from=tools /tmp/bin/ /bin
 COPY --from=controller-bin /go/bin/retina/controller /retina/controller
 COPY --from=controller-bin /go/src/github.com/microsoft/retina/pkg/plugin /go/src/github.com/microsoft/retina/pkg/plugin
 COPY --from=capture-bin /go/bin/retina/captureworkload /retina/captureworkload
-# Copy Hubble.
-COPY --from=tools /usr/local/hubble /bin/hubble
-# Set Hubble server.
-ENV HUBBLE_SERVER=unix:///var/run/cilium/hubble.sock
 ENTRYPOINT ["./retina/controller"]