Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update controller-runtime to 0.17.3 #232

Merged
merged 1 commit into from
Apr 25, 2024
Merged

Update controller-runtime to 0.17.3 #232

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions controllers/configurationpolicy_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,6 @@ import (
"k8s.io/client-go/tools/record"
kubeopenapivalidation "k8s.io/kube-openapi/pkg/util/proto/validation"
"k8s.io/kubectl/pkg/util/openapi"
openapivalidation "k8s.io/kubectl/pkg/util/openapi/validation"
"k8s.io/kubectl/pkg/validation"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/client"
Expand Down Expand Up @@ -2499,7 +2498,7 @@ func (r *ConfigurationPolicyReconciler) validateObject(object *unstructured.Unst
}

schema := validation.ConjunctiveSchema{
openapivalidation.NewSchemaValidation(openAPIResources),
validation.NewSchemaValidation(openAPIResources),
validation.NoDoubleKeySchema{},
}

Expand Down
2 changes: 1 addition & 1 deletion controllers/operatorpolicy_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ func (r *OperatorPolicyReconciler) SetupWithManager(mgr ctrl.Manager, depEvents
For(
&policyv1beta1.OperatorPolicy{},
builder.WithPredicates(predicate.GenerationChangedPredicate{})).
Watches(
WatchesRawSource(
depEvents,
&handler.EnqueueRequestForObject{}).
Complete(r)
Expand Down
45 changes: 19 additions & 26 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,30 +4,30 @@ go 1.21

require (
github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32
github.com/go-logr/zapr v1.2.4
github.com/go-logr/zapr v1.3.0
github.com/google/go-cmp v0.6.0
github.com/onsi/ginkgo/v2 v2.17.1
github.com/onsi/gomega v1.30.0
github.com/operator-framework/api v0.17.6
github.com/pmezard/go-difflib v1.0.0
github.com/prometheus/client_golang v1.17.0
github.com/prometheus/client_golang v1.18.0
github.com/spf13/pflag v1.0.5
github.com/stolostron/go-log-utils v0.1.2
github.com/stolostron/go-template-utils/v4 v4.0.0
github.com/stolostron/kubernetes-dependency-watches v0.5.2
github.com/stretchr/testify v1.8.4
golang.org/x/mod v0.16.0
k8s.io/api v0.27.7
k8s.io/apiextensions-apiserver v0.27.7
k8s.io/apimachinery v0.27.7
k8s.io/client-go v0.27.7
k8s.io/api v0.29.2
k8s.io/apiextensions-apiserver v0.29.2
k8s.io/apimachinery v0.29.2
k8s.io/client-go v0.29.2
k8s.io/klog v1.0.0
k8s.io/klog/v2 v2.100.1
k8s.io/klog/v2 v2.110.1
k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00
k8s.io/kubectl v0.27.7
open-cluster-management.io/addon-framework v0.8.0
sigs.k8s.io/controller-runtime v0.14.6
sigs.k8s.io/yaml v1.3.0
sigs.k8s.io/controller-runtime v0.17.3
sigs.k8s.io/yaml v1.4.0
)

require (
Expand All @@ -40,7 +40,7 @@ require (
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
github.com/evanphx/json-patch v5.7.0+incompatible // indirect
github.com/evanphx/json-patch/v5 v5.7.0 // indirect
github.com/evanphx/json-patch/v5 v5.8.0 // indirect
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
github.com/fsnotify/fsnotify v1.7.0 // indirect
github.com/go-errors/errors v1.5.1 // indirect
Expand All @@ -52,7 +52,7 @@ require (
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/protobuf v1.5.3 // indirect
github.com/google/gnostic v0.6.9 // indirect
github.com/google/gnostic-models v0.6.8 // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/google/pprof v0.0.0-20240402174815-29b9bb013b0f // indirect
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
Expand Down Expand Up @@ -80,40 +80,33 @@ require (
go.starlark.net v0.0.0-20231016134836-22325403fcb3 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.26.0 // indirect
golang.org/x/crypto v0.14.0 // indirect
golang.org/x/crypto v0.21.0 // indirect
golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
golang.org/x/net v0.22.0 // indirect
golang.org/x/oauth2 v0.13.0 // indirect
golang.org/x/sync v0.6.0 // indirect
golang.org/x/sys v0.18.0 // indirect
golang.org/x/term v0.13.0 // indirect
golang.org/x/term v0.18.0 // indirect
golang.org/x/text v0.14.0 // indirect
golang.org/x/time v0.3.0 // indirect
golang.org/x/tools v0.19.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/appengine v1.6.8 // indirect
google.golang.org/protobuf v1.31.0 // indirect
gopkg.in/evanphx/json-patch.v5 v5.6.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/cli-runtime v0.26.10 // indirect
k8s.io/component-base v0.27.7 // indirect
k8s.io/cli-runtime v0.28.0 // indirect
k8s.io/component-base v0.29.2 // indirect
k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
sigs.k8s.io/kustomize/api v0.15.0 // indirect
sigs.k8s.io/kustomize/kyaml v0.15.0 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.3.0 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
)

replace (
github.com/imdario/mergo => github.com/imdario/mergo v0.3.16 // Replaced so that 'go get -u' works. Remove/bump when upgrading.
golang.org/x/crypto => golang.org/x/crypto v0.14.0 // CVE-2021-43565
golang.org/x/net => golang.org/x/net v0.17.0 // CVE-2023-39325
golang.org/x/text => golang.org/x/text v0.13.0 // CVE-2022-32149
gopkg.in/yaml.v2 => gopkg.in/yaml.v2 v2.4.0 // CVE-2022-3064
Comment on lines -109 to -112
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have concerns that removing this block re-introduced affected versions of these packages in go.sum. Is updating the indirects sufficient to resolve the CVEs?

Copy link
Member

@JustinKuli JustinKuli Apr 25, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We might be ok - from what I'm reading in https://go.dev/ref/mod#go-sum-files, I think that the <module> <version>/go.mod entries that are now in the go.sum file and refer to older (possibly affected) versions are not actually being used. But I'm going to research this some more because it would be really nice to get rid of some of these directives

Copy link
Member

@mprahl mprahl Apr 25, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Before approving the PR, I researched this and my understanding is that what is actually used is in go.mod but go.sum has all the entries of the Go modules that the minimal version selection algorithm looked at to come up with the go.mod result.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, I think go list -m <module> gives a less ambiguous answer to what version of the dependency is being used, and shows that these are good:

❯ go list -m golang.org/x/crypto
golang.org/x/crypto v0.21.0

❯ go list -m golang.org/x/net
golang.org/x/net v0.22.0

❯ go list -m golang.org/x/text                                                                                                                              
golang.org/x/text v0.14.0

❯ go list -m gopkg.in/yaml.v2
gopkg.in/yaml.v2 v2.4.0

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice--if that's the case, then we can stop using replace for CVEs!

k8s.io/api => k8s.io/api v0.26.10 // Replaced so that 'go get -u' works. Remove/bump when upgrading.
k8s.io/client-go => k8s.io/client-go v0.26.10 // Replaced so that 'go get -u' works. Remove/bump when upgrading.
k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // Replaced so that 'go get -u' works. Remove/bump when upgrading.
k8s.io/kubectl => k8s.io/kubectl v0.26.10 // Replaced so that 'go get -u' works. Remove/bump when upgrading.
sigs.k8s.io/kustomize/api => sigs.k8s.io/kustomize/api v0.12.1 // Replaced so that 'go get -u' works. Remove/bump when upgrading.
sigs.k8s.io/kustomize/kyaml => sigs.k8s.io/kustomize/kyaml v0.13.9 // Replaced so that 'go get -u' works. Remove/bump when upgrading.
k8s.io/kubectl => k8s.io/kubectl v0.28.0 // Replaced so that 'go get -u' works. Remove/bump when upgrading.
)
Loading