chore(cve): remove hubble cli binary bundled in image

[Alex Castilio (alexcastilio)]

Description

Remove the bundled Hubble CLI from the Linux Retina agent image. Retina's hubble-control-plane command uses linked Cilium packages and does not execute the CLI, so the production Hubble API, Relay integration, metrics, and Unix socket behavior are unchanged.

This change also removes the CLI-only download tools, Hubble build argument, HUBBLE_SERVER default, Make target, and scheduled Hubble update workflow. The agent image is approximately 71 MiB smaller.

Vulnerability report

Both images were built from commit 8f7374d6 for linux/amd64 and scanned with Trivy 0.69.3 using:

trivy image --ignore-unfixed <image>

Result	Before	After	Delta
Fixable findings	16	2	-14
Unique advisories	15	1	-14
High findings	6	0	-6
Medium findings	8	2	-6
Unknown-severity findings	2	0	-2

All 14 findings removed by this PR belonged to usr/bin/hubble:

Advisory	Severity	Package	Bundled version	Fixed version
GHSA-gcjh-h69q-9w9g	Medium	github.com/google/cel-go	v0.26.1	0.29.0
CVE-2026-2303	Medium	go.mongodb.org/mongo-driver	v1.17.6	1.17.7
CVE-2026-25681	High	golang.org/x/net	v0.53.0	0.55.0
CVE-2026-27136	High	golang.org/x/net	v0.53.0	0.55.0
CVE-2026-39821	High	golang.org/x/net	v0.53.0	0.55.0
CVE-2026-25680	Medium	golang.org/x/net	v0.53.0	0.55.0
CVE-2026-42502	Medium	golang.org/x/net	v0.53.0	0.55.0
CVE-2026-42506	Medium	golang.org/x/net	v0.53.0	0.55.0
CVE-2026-46600	Unknown	golang.org/x/net	v0.53.0	0.56.0
CVE-2026-39824	Unknown	golang.org/x/sys	v0.43.0	0.44.0
CVE-2026-56852	High	golang.org/x/text	v0.36.0	0.39.0
GHSA-hrxh-6v49-42gf	High	google.golang.org/grpc	v1.79.3	1.82.1
CVE-2026-39822	High	Go standard library	v1.26.4	1.25.12 / 1.26.5
CVE-2026-42505	Medium	Go standard library	v1.26.4	1.25.12 / 1.26.5

The remaining unique advisory is the pre-existing Medium CVE-2026-53935 in github.com/cilium/cilium v1.19.3. Trivy reports it once for retina/controller and once for retina/captureworkload; it is unrelated to the removed Hubble CLI.

Checklist

• I have read the contributing documentation.
• I signed and signed-off the commits (git commit -S -s ...).
• I have correctly attributed the author(s) of the code.
• I have tested the changes locally.
• I have followed the project's style guidelines.
• I have updated the documentation, if necessary.
• I have added tests, if applicable.

Testing completed

• Ran the targeted controller, command, Hubble, monitor agent, and plugin manager Go tests.
• Rendered the Hubble Helm chart and confirmed the agent still runs /retina/controller hubble-control-plane.
• Built and loaded the Linux amd64 agent image.
• Confirmed /bin/hubble is absent and /retina/controller still exposes the hubble-control-plane command.
• Confirmed no stale bundled-CLI build references remain.
• Ran Trivy before and after the change and recorded the results above.

Additional notes

This removes an undocumented in-pod troubleshooting executable. Operators who manually invoked /bin/hubble with kubectl exec should use a separately installed Hubble CLI through the documented Relay port-forward workflow.

Checklist

• I have read the contributing documentation.
• I signed and signed-off the commits (git commit -S -s ...). See this documentation on signing commits.
• I have correctly attributed the author(s) of the code.
• I have tested the changes locally.
• I have followed the project's style guidelines.
• I have updated the documentation, if necessary.
• I have added tests, if applicable.

Screenshots (if applicable) or Testing Completed

Please add any relevant screenshots or GIFs to showcase the changes made.

Additional Notes

Add any additional notes or context about the pull request here.

---

Please refer to the CONTRIBUTING.md file for more information on how to contribute to this project.

[github-actions]

Retina Code Coverage Report

Total coverage no change

Increased diff

Impacted Files	Coverage
pkg/controllers/operator/retinaendpoint/retinaendpoint_controller.go	82.25% ... 83.28% (1.03%)	⬆️
pkg/controllers/daemon/namespace/namespace_controller.go	76.24% ... 78.46% (2.22%)	⬆️