Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependencies and enable gosec for SAST scans #116

Merged
merged 5 commits into from
Oct 28, 2024
Merged

Update dependencies and enable gosec for SAST scans #116

merged 5 commits into from
Oct 28, 2024

Conversation

vpnachev
Copy link
Member

@vpnachev vpnachev commented Oct 25, 2024 •
edited
Loading

What this PR does / why we need it:
Update dependencies and enable gosec for SAST scans

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:
gosec changes are influenced from https://github.com/gardener/gardener-extension-shoot-networking-traffic-gauger/pull/30/

Release note:

The following dependencies have been updated:
- github.com/gardener/gardener v1.103.0 -> v1.106.0
- k8s.io/api v0.29.8 -> v0.31.1
- k8s.io/apimachinery v0.29.8 -> v0.31.1
- k8s.io/client-go v0.29.8 -> v0.31.1
- k8s.io/code-generator v0.29.8 -> v0.31.1
- k8s.io/component-base v0.29.8 -> v0.31.1
- sigs.k8s.io/controller-runtime v0.17.6 -> v0.19.0

`gosec` is made available for SAST(static application security testing), it can be run with `make sast` or `make sast-report`, but is also incorporated in the `verify` and `verify-extended` makefile targets.

@vpnachev
Update 3rd party dependencies
b88d0bd 
github.com/gardener/gardener -> v1.106.0
k8s.io/* -> v0.31.1
sigs.k8s.io/controller-runtime -> v0.19.0
@vpnachev
Adapt code to updated dependencies
0bbfb06
@vpnachev vpnachev requested a review from a team as a code owner October 25, 2024 13:31
@gardener-robot gardener-robot added needs/review Needs review size/l Size of pull request is large (see gardener-robot robot/bots/size.py) needs/second-opinion Needs second review by someone else labels Oct 25, 2024
@gardener-robot-ci-3 gardener-robot-ci-3 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Oct 25, 2024
@vpnachev vpnachev force-pushed the update-dependencies branch from 32f121f to fd7301d Compare October 25, 2024 14:51
@gardener-robot-ci-1 gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Oct 25, 2024
@gardener-robot-ci-2 gardener-robot-ci-2 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Oct 25, 2024
@gardener-robot-ci-1
Copy link
Contributor

This PR proposes changes that would break the pipeline definition:

gardener-extension-shoot-lakom-service-update-dependencies: Traceback (most recent call last):
  File "/usr/lib/python3.12/site-packages/concourse/replicator.py", line 141, in render
    definition_descriptor = self._render(definition_descriptor)
                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/concourse/replicator.py", line 185, in _render
    'definition': factory.create_pipeline_definition(),
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/concourse/factory.py", line 108, in create_pipeline_definition
    validator.validate()
  File "/usr/lib/python3.12/site-packages/concourse/validator.py", line 19, in validate
    self._validate_variant(variant)
  File "/usr/lib/python3.12/site-packages/concourse/validator.py", line 24, in _validate_variant
    self._validate_element(variant)
  File "/usr/lib/python3.12/site-packages/concourse/validator.py", line 29, in _validate_element
    element.validate()
  File "/usr/lib/python3.12/site-packages/model/base.py", line 36, in validate
    self._validate_known_attributes()
  File "/usr/lib/python3.12/site-packages/model/base.py", line 65, in _validate_known_attributes
    raise ModelValidationError(
model.base.ModelValidationError: JobVariant:<unknown>: The following attributes are unknown: assets.

@gardener-robot-ci-1 gardener-robot-ci-1 added ci/broken-pipeline-definition reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Oct 25, 2024
@vpnachev vpnachev force-pushed the update-dependencies branch from 5bf01ee to 84cb107 Compare October 25, 2024 15:17
@gardener-robot-ci-1
Copy link
Contributor

This PR proposes changes that would break the pipeline definition:

gardener-extension-shoot-lakom-service-update-dependencies: Traceback (most recent call last):
  File "/usr/lib/python3.12/site-packages/concourse/replicator.py", line 141, in render
    definition_descriptor = self._render(definition_descriptor)
                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/concourse/replicator.py", line 185, in _render
    'definition': factory.create_pipeline_definition(),
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/concourse/factory.py", line 88, in create_pipeline_definition
    self._apply_traits(variant)
  File "/usr/lib/python3.12/site-packages/concourse/factory.py", line 177, in _apply_traits
    transformer.process_pipeline_args(pipeline_def)
  File "/usr/lib/python3.12/site-packages/concourse/model/traits/release.py", line 505, in process_pipeline_args
    raise ValueError(f'{asset=}\'s step_name refers to an absent build-step')
ValueError: asset=BuildstepLogAsset(ocm_labels=[{'name': 'gardener.cloud/purposes', 'value': ['lint', 'sast', 'gosec']}, {'name': 'gardener.cloud/comment', 'value': 'We use gosec (linter) for SAST scans, see: https://github.com/securego/gosec.\nEnabled by https://github.com/gardener/gardener-extension-shoot-lakom-service/pull/116\n'}], type='build-step-log', name='verify-build-step-log', step_name='verify', artefact_type='application/data', artefact_extra_id={}, purposes=['lint', 'sast', 'gosec'], comment='We use gosec (linter) for SAST scans, see: https://github.com/securego/gosec.\nEnabled by https://github.com/gardener/gardener-extension-shoot-lakom-service/pull/116\n')'s step_name refers to an absent build-step

@gardener-robot-ci-1 gardener-robot-ci-1 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Oct 25, 2024
@vpnachev vpnachev force-pushed the update-dependencies branch from 84cb107 to 61d3bd1 Compare October 25, 2024 19:44
@gardener-robot-ci-3
Copy link
Contributor

This PR proposes changes that would break the pipeline definition:

gardener-extension-shoot-lakom-service-update-dependencies: Traceback (most recent call last):
  File "/usr/lib/python3.12/site-packages/concourse/replicator.py", line 141, in render
    definition_descriptor = self._render(definition_descriptor)
                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/concourse/replicator.py", line 185, in _render
    'definition': factory.create_pipeline_definition(),
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/concourse/factory.py", line 88, in create_pipeline_definition
    self._apply_traits(variant)
  File "/usr/lib/python3.12/site-packages/concourse/factory.py", line 177, in _apply_traits
    transformer.process_pipeline_args(pipeline_def)
  File "/usr/lib/python3.12/site-packages/concourse/model/traits/release.py", line 505, in process_pipeline_args
    raise ValueError(f'{asset=}\'s step_name refers to an absent build-step')
ValueError: asset=BuildstepLogAsset(ocm_labels=[{'name': 'gardener.cloud/purposes', 'value': ['lint', 'sast', 'gosec']}, {'name': 'gardener.cloud/comment', 'value': 'We use gosec (linter) for SAST scans, see: https://github.com/securego/gosec.\nEnabled by https://github.com/gardener/gardener-extension-shoot-lakom-service/pull/116\n'}], type='build-step-log', name='verify-build-step-log', step_name='verify', artefact_type='application/data', artefact_extra_id={}, purposes=['lint', 'sast', 'gosec'], comment='We use gosec (linter) for SAST scans, see: https://github.com/securego/gosec.\nEnabled by https://github.com/gardener/gardener-extension-shoot-lakom-service/pull/116\n')'s step_name refers to an absent build-step

@gardener-robot-ci-3 gardener-robot-ci-3 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Oct 25, 2024
dimityrmirchev
dimityrmirchev approved these changes Oct 28, 2024
View reviewed changes
Copy link
Member

@dimityrmirchev dimityrmirchev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@gardener-robot gardener-robot added reviewed/lgtm Has approval for merging and removed needs/review Needs review labels Oct 28, 2024
@gardener-robot gardener-robot removed the needs/second-opinion Needs second review by someone else label Oct 28, 2024
@dimityrmirchev dimityrmirchev merged commit 9ee7121 into gardener:main Oct 28, 2024
12 checks passed
@gardener-robot-ci-1 gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Oct 28, 2024
@gardener-robot gardener-robot added the status/closed Issue is closed (either delivered or triaged) label Oct 28, 2024
@dimityrmirchev dimityrmirchev mentioned this pull request Oct 28, 2024
Closed
@vpnachev vpnachev deleted the update-dependencies branch October 30, 2024 07:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dimityrmirchev dimityrmirchev dimityrmirchev approved these changes

Assignees
No one assigned
Labels
ci/broken-pipeline-definition needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) reviewed/lgtm Has approval for merging reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) size/l Size of pull request is large (see gardener-robot robot/bots/size.py) status/closed Issue is closed (either delivered or triaged)
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@vpnachev @gardener-robot-ci-1 @gardener-robot-ci-3 @dimityrmirchev @gardener-robot-ci-2 @gardener-robot