Detect and clean stale kind image stamps before building

hack/test/kind/validate_stamps.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+
+# Copyright (c) 2026 Tigera, Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# validate_stamps.sh removes stale kind image marker/stamp files whose Docker
+# images no longer exist locally. Docker images can disappear (pruned, manual
+# rmi) while their stamp files remain, causing Make to skip needed rebuilds.
+#
+# Must run as a separate Make invocation BEFORE kind-build-images-run evaluates
+# its prerequisites — otherwise Make will see the stale stamps as satisfied.
+#
+# Usage: validate_stamps.sh ARCH BUILD_TAG STAMP_FILE...
+
+set -euo pipefail
+
+arch="${1:?Usage: validate_stamps.sh ARCH BUILD_TAG STAMP_FILE...}"
+build_tag="${2:?}"
+shift 2
+
+# Derive the Docker image that a stamp file tracks. Most follow a regular
+# naming pattern; the case statement handles the exceptions.
+image_for_stamp() {
+	local stamp="$1"
+	case "$stamp" in
+		*/.stamp.operator)
+			echo "tigera/operator:${build_tag}" ;;
+		*/.stamp.*)
+			local name="${stamp##*/.stamp.}"
+			echo "calico/${name}:latest-${arch}" ;;
+		*/cni-plugin/.image.created-*)
+			echo "calico/cni:latest-${arch}" ;;
+		*/pod2daemon/.image.created-*)
+			echo "calico/pod2daemon-flexvol:latest-${arch}" ;;
+		*/.image.created-*)
+			local dir="${stamp%/.image.created-*}"
+			local name="${dir##*/}"
+			echo "calico/${name}:latest-${arch}" ;;
+		*)
+			;;
+	esac
+}
+
+removed=0
+for stamp in "$@"; do
+	[ -f "$stamp" ] || continue
+
+	image=$(image_for_stamp "$stamp")
+	[ -z "$image" ] && continue
+
+	if ! docker image inspect "$image" &>/dev/null; then
+		rm -f "$stamp"
+		echo "Stale: removed $(basename "$stamp") ($image not in Docker)"
+		((removed++)) || true
+	fi
+done
+
+if [ "$removed" -gt 0 ]; then
+	echo "Cleaned $removed stale marker(s), affected images will be rebuilt."
+fi

lib.Makefile

@@ -1668,8 +1668,16 @@ $(REPO_ROOT)/.stamp.operator: $(KIND_INFRA_DIR)/calico_versions.yml
 	touch $@
 
 ## Build all component images needed for kind cluster testing, then tag them.
+## First validates that stamp files aren't stale (image pruned but stamp remains),
+## then runs the actual build in a sub-make so prerequisites are re-evaluated.
 .PHONY: kind-build-images
-kind-build-images: $(KIND_IMAGE_MARKERS) $(REPO_ROOT)/.stamp.operator
+kind-build-images:
+	@$(REPO_ROOT)/hack/test/kind/validate_stamps.sh $(ARCH) $(KIND_TEST_BUILD_TAG) \
+		$(KIND_IMAGE_MARKERS) $(REPO_ROOT)/.stamp.operator
+	$(MAKE) -j$$(nproc) kind-build-images-run
+
+.PHONY: kind-build-images-run
+kind-build-images-run: $(KIND_IMAGE_MARKERS) $(REPO_ROOT)/.stamp.operator
 	@for img in $(KIND_CALICO_IMAGES); do \
 	  base=$${img%%:*}; \
 	  docker tag $$base:latest-$(ARCH) $$img; \