Detect and clean stale kind image stamps before building

hack/test/kind/validate_stamps.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+
+# Copyright (c) 2026 Tigera, Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# validate_stamps.sh removes stale kind image marker/stamp files whose Docker
+# images no longer exist locally. Docker images can disappear (pruned, manual
+# rmi) while their stamp files remain, causing Make to skip needed rebuilds.
+#
+# Each stamp file contains the Docker image name it tracks (written by the
+# Makefile rule that creates it). This script reads that name and checks
+# whether the image still exists in Docker.
+#
+# Must run as a separate Make invocation BEFORE kind-build-images-run evaluates
+# its prerequisites — otherwise Make will see the stale stamps as satisfied.
+#
+# Usage: validate_stamps.sh STAMP_FILE...
+
+set -euo pipefail
+
+removed=0
+for stamp in "$@"; do
+	[ -f "$stamp" ] || continue
+
+	image=$(<"$stamp")
+	[ -z "$image" ] && continue
+
+	if ! docker image inspect "$image" &>/dev/null; then
+		rm -f "$stamp"
+		echo "Stale: removed $(basename "$stamp") ($image not in Docker)"
+		((removed++)) || true
+	fi
+done
+
+if [ "$removed" -gt 0 ]; then
+	echo "Cleaned $removed stale marker(s), affected images will be rebuilt."
+fi

lib.Makefile

@@ -1618,58 +1618,66 @@ KIND_IMAGE_MARKERS = \
 
 $(REPO_ROOT)/node/.image.created-$(ARCH): $(call local-deps-go-files,node)
 	$(MAKE) -C $(REPO_ROOT)/node image
-	touch $@
+	echo "calico/node:latest-$(ARCH)" > $@
 
 $(REPO_ROOT)/typha/.image.created-$(ARCH): $(call local-deps-go-files,typha)
 	$(MAKE) -C $(REPO_ROOT)/typha image
-	touch $@
+	echo "calico/typha:latest-$(ARCH)" > $@
 
 $(REPO_ROOT)/apiserver/.image.created-$(ARCH): $(call local-deps-go-files,apiserver)
 	$(MAKE) -C $(REPO_ROOT)/apiserver image
-	touch $@
+	echo "calico/apiserver:latest-$(ARCH)" > $@
 
 $(REPO_ROOT)/cni-plugin/.image.created-$(ARCH): $(call local-deps-go-files,cni-plugin)
 	$(MAKE) -C $(REPO_ROOT)/cni-plugin image
-	touch $@
+	echo "calico/cni:latest-$(ARCH)" > $@
 
 $(REPO_ROOT)/pod2daemon/.image.created-$(ARCH): $(call local-deps-go-files,pod2daemon)
 	$(MAKE) -C $(REPO_ROOT)/pod2daemon image
-	touch $@
+	echo "calico/pod2daemon-flexvol:latest-$(ARCH)" > $@
 
 $(REPO_ROOT)/calicoctl/.image.created-$(ARCH): $(call local-deps-go-files,calicoctl)
 	$(MAKE) -C $(REPO_ROOT)/calicoctl image
-	touch $@
+	echo "calico/ctl:latest-$(ARCH)" > $@
 
 $(REPO_ROOT)/kube-controllers/.image.created-$(ARCH): $(call local-deps-go-files,kube-controllers)
 	$(MAKE) -C $(REPO_ROOT)/kube-controllers image
-	touch $@
+	echo "calico/kube-controllers:latest-$(ARCH)" > $@
 
 $(REPO_ROOT)/goldmane/.image.created-$(ARCH): $(call local-deps-go-files,goldmane)
 	$(MAKE) -C $(REPO_ROOT)/goldmane image
-	touch $@
+	echo "calico/goldmane:latest-$(ARCH)" > $@
 
 $(REPO_ROOT)/webhooks/.image.created-$(ARCH): $(call local-deps-go-files,webhooks)
 	$(MAKE) -C $(REPO_ROOT)/webhooks image
-	touch $@
+	echo "calico/webhooks:latest-$(ARCH)" > $@
 
 $(REPO_ROOT)/whisker/.image.created-$(ARCH):
 	$(MAKE) -C $(REPO_ROOT)/whisker image
-	touch $@
+	echo "calico/whisker:latest-$(ARCH)" > $@
 
 $(REPO_ROOT)/whisker-backend/.image.created-$(ARCH): $(call local-deps-go-files,whisker-backend)
 	$(MAKE) -C $(REPO_ROOT)/whisker-backend image
-	touch $@
+	echo "calico/whisker-backend:latest-$(ARCH)" > $@
 
 # Operator is built from a separate repo/branch. It only needs
 # calico_versions.yml (a static file with version strings), not the
 # actual built images, so it can run in parallel with component builds.
 $(REPO_ROOT)/.stamp.operator: $(KIND_INFRA_DIR)/calico_versions.yml
 	cd $(KIND_INFRA_DIR) && BRANCH=$(OPERATOR_BRANCH) ./build-operator.sh
-	touch $@
+	echo "tigera/operator:$(KIND_TEST_BUILD_TAG)" > $@
 
 ## Build all component images needed for kind cluster testing, then tag them.
+## First validates that stamp files aren't stale (image pruned but stamp remains),
+## then runs the actual build in a sub-make so prerequisites are re-evaluated.
 .PHONY: kind-build-images
-kind-build-images: $(KIND_IMAGE_MARKERS) $(REPO_ROOT)/.stamp.operator
+kind-build-images:
+	@$(REPO_ROOT)/hack/test/kind/validate_stamps.sh \
+		$(KIND_IMAGE_MARKERS) $(REPO_ROOT)/.stamp.operator
+	$(MAKE) kind-build-images-run
+
+.PHONY: kind-build-images-run
+kind-build-images-run: $(KIND_IMAGE_MARKERS) $(REPO_ROOT)/.stamp.operator
 	@for img in $(KIND_CALICO_IMAGES); do \
 	  base=$${img%%:*}; \
 	  docker tag $$base:latest-$(ARCH) $$img; \