Upgrade `k8s.io/{apimachinery,api,client-go}` to `v0.26.2`

[a-hilaly]

I attempted to update k8s.io/{apimachinery,api,client-go} to v0.26.2 to address several security issues present in the current version we use (v0.23.0). Pasting the compilation errors below:

go test  ./...
# sigs.k8s.io/controller-runtime/pkg/cache
../../../../go/pkg/mod/sigs.k8s.io/controller-runtime@v0.11.0/pkg/cache/informer_cache.go:144:9: cannot use i.Informer (variable of type "k8s.io/client-go/tools/cache".SharedIndexInformer) as Informer value in return statement: "k8s.io/client-go/tools/cache".SharedIndexInformer does not implement Informer (wrong type for method AddEventHandler)
		have AddEventHandler("k8s.io/client-go/tools/cache".ResourceEventHandler) ("k8s.io/client-go/tools/cache".ResourceEventHandlerRegistration, error)
		want AddEventHandler("k8s.io/client-go/tools/cache".ResourceEventHandler)
../../../../go/pkg/mod/sigs.k8s.io/controller-runtime@v0.11.0/pkg/cache/informer_cache.go:158:9: cannot use i.Informer (variable of type "k8s.io/client-go/tools/cache".SharedIndexInformer) as Informer value in return statement: "k8s.io/client-go/tools/cache".SharedIndexInformer does not implement Informer (wrong type for method AddEventHandler)
		have AddEventHandler("k8s.io/client-go/tools/cache".ResourceEventHandler) ("k8s.io/client-go/tools/cache".ResourceEventHandlerRegistration, error)
		want AddEventHandler("k8s.io/client-go/tools/cache".ResourceEventHandler)
?   	github.com/aws-controllers-k8s/runtime/apis/core/v1alpha1	[no test files]
?   	github.com/aws-controllers-k8s/runtime/mocks/apimachinery/pkg/apis/meta/v1	[no test files]
?   	github.com/aws-controllers-k8s/runtime/mocks/apimachinery/pkg/runtime	[no test files]
?   	github.com/aws-controllers-k8s/runtime/mocks/apimachinery/pkg/runtime/schema	[no test files]
?   	github.com/aws-controllers-k8s/runtime/mocks/controller-runtime/pkg/client	[no test files]
# github.com/aws-controllers-k8s/runtime/pkg/compare_test [github.com/aws-controllers-k8s/runtime/pkg/compare.test]
pkg/compare/meta_test.go:49:6: ob1.SetClusterName undefined (type *unstructured.Unstructured has no field or method SetClusterName)
pkg/compare/meta_test.go:51:6: ob2.SetClusterName undefined (type *unstructured.Unstructured has no field or method SetClusterName)
pkg/compare/meta_test.go:55:6: ob2.SetClusterName undefined (type *unstructured.Unstructured has no field or method SetClusterName)
FAIL	github.com/aws-controllers-k8s/runtime/pkg/compare [build failed]
FAIL	github.com/aws-controllers-k8s/runtime/pkg/condition [build failed]
?   	github.com/aws-controllers-k8s/runtime/pkg/errors	[no test files]
?   	github.com/aws-controllers-k8s/runtime/pkg/metrics	[no test files]
FAIL	github.com/aws-controllers-k8s/runtime/pkg/config [build failed]
ok  	github.com/aws-controllers-k8s/runtime/pkg/requeue	1.203s
FAIL	github.com/aws-controllers-k8s/runtime/pkg/runtime [build failed]
ok  	github.com/aws-controllers-k8s/runtime/pkg/runtime/cache	8.935s
ok  	github.com/aws-controllers-k8s/runtime/pkg/tags	1.083s
ok  	github.com/aws-controllers-k8s/runtime/pkg/util	0.939s
FAIL
make: *** [test] Error 1

[a-hilaly]

We'll probably need to pin to v0.26.1 instead since that's what controller-runtime is using

[a-hilaly]

/cc @jaypipes @jljaco @RedbackThomson

[jljaco]

Can you please include a pointer to a description of the several security issues present in the current version in the issue description here?

[a-hilaly]

Can you please include a pointer to a description of the several security issues present in the current version in the issue description here?

@jljaco For matter of time, I can't really dig into what are the addressed CVEs and their details - but i'm pretty sure they are low severity ones :)

However here are the dependabot PRs we're addressing:

• Bump golang.org/x/text from 0.3.7 to 0.3.8 runtime#115
• Bump golang.org/x/sys from 0.0.0-20211216021012-1d35b9e2eb4e to 0.1.0 runtime#116
• Bump golang.org/x/net from 0.0.0-20220127200216-cd36cc0744dd to 0.7.0 runtime#118

/close

[ack-prow]

@a-hilaly: Closing this issue.

In response to this:

Can you please include a pointer to a description of the several security issues present in the current version in the issue description here?

@jljaco For matter of time, I can't really dig into what are the addressed CVEs and their details - but i'm pretty sure they are low severity ones :)

However here are the dependabot PRs we're addressing:

• Bump golang.org/x/text from 0.3.7 to 0.3.8 runtime#115
• Bump golang.org/x/sys from 0.0.0-20211216021012-1d35b9e2eb4e to 0.1.0 runtime#116
• Bump golang.org/x/net from 0.0.0-20220127200216-cd36cc0744dd to 0.7.0 runtime#118

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.