diff --git a/.ci/check b/.ci/check
index dddad79c..bd35037d 100755
--- a/.ci/check
+++ b/.ci/check
@@ -24,7 +24,7 @@ export PATH="${GOBIN}:${PATH}"
###############################################################################
# Install golangci-lint (linting tool).
if [[ -z "${GOLANGCI_LINT_VERSION}" ]]; then
- export GOLANGCI_LINT_VERSION=v1.57.1
+ export GOLANGCI_LINT_VERSION=v1.60.3
fi
echo "Fetching golangci-lint tool"
go install github.com/golangci/golangci-lint/cmd/golangci-lint@"${GOLANGCI_LINT_VERSION}"
@@ -49,4 +49,7 @@ echo "Executing golangci-lint..."
# golangci-lint can't be run from outside the directory
(cd ${SOURCE_PATH} && golangci-lint run -c .golangci.yaml --timeout 10m)
+# Run Static Application Security Testing (SAST) using gosec
+make sast-report
+
echo "Check script has passed successfully"
diff --git a/.ci/pipeline_definitions b/.ci/pipeline_definitions
index 768ab1c1..890cf7b0 100644
--- a/.ci/pipeline_definitions
+++ b/.ci/pipeline_definitions
@@ -9,9 +9,9 @@ machine-controller-manager-provider-gcp:
steps_template: &steps_anchor
steps:
check:
- image: 'golang:1.22.5'
+ image: 'golang:1.23.3'
build:
- image: 'golang:1.22.5'
+ image: 'golang:1.23.3'
output_dir: 'binary'
test:
image: 'europe-docker.pkg.dev/gardener-project/releases/testmachinery/base-step:stable'
@@ -57,7 +57,7 @@ machine-controller-manager-provider-gcp:
interval: '24h'
update_component_deps:
set_dependency_version_script_container_image:
- image_reference: 'golang:1.22.5'
+ image_reference: 'golang:1.23.3'
release:
<<: *steps_anchor
traits:
diff --git a/.gitignore b/.gitignore
index f15286cf..24112694 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,3 +28,6 @@ kubectl
yq_linux*
main
cmi-plugin
+
+# gosec
+gosec-report.sarif
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index f0afa6bc..598c35fd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
############# builder #############
-FROM golang:1.22.5 AS builder
+FROM golang:1.23.3 AS builder
WORKDIR /go/src/github.com/gardener/machine-controller-manager-provider-gcp
COPY . .
diff --git a/MCM_VERSION b/MCM_VERSION
index 60110ff9..8b31ea51 100644
--- a/MCM_VERSION
+++ b/MCM_VERSION
@@ -1 +1 @@
-v0.54.0
\ No newline at end of file
+v0.55.1
\ No newline at end of file
diff --git a/Makefile b/Makefile
index a6b8ffea..143f3a34 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,9 @@
# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Gardener contributors
#
# SPDX-License-Identifier: Apache-2.0
-
+MCM_DIR := $(shell go list -m -f "{{.Dir}}" github.com/gardener/machine-controller-manager)
+TOOLS_DIR := hack/tools
+include $(MCM_DIR)/hack/tools.mk
-include .env
export
@@ -96,3 +98,15 @@ clean:
generate:
@./hack/api-reference/generate-spec-doc.sh
+
+.PHONY: add-license-headers
+add-license-headers: $(GO_ADD_LICENSE)
+ @./hack/add_license_headers.sh ${YEAR}
+
+.PHONY: sast
+sast: $(GOSEC)
+ @./hack/sast.sh
+
+.PHONY: sast-report
+sast-report: $(GOSEC)
+ @./hack/sast.sh --gosec-report true
\ No newline at end of file
diff --git a/docs/index.html b/docs/index.html
index 04dd4a72..ca48d26d 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -1,4 +1,10 @@
+
+
diff --git a/go.mod b/go.mod
index 390ee673..349eb3bd 100644
--- a/go.mod
+++ b/go.mod
@@ -1,11 +1,11 @@
module github.com/gardener/machine-controller-manager-provider-gcp
-go 1.22.0
+go 1.23.0
-toolchain go1.22.5
+toolchain go1.23.3
require (
- github.com/gardener/machine-controller-manager v0.54.0
+ github.com/gardener/machine-controller-manager v0.55.1
github.com/onsi/ginkgo/v2 v2.19.0
github.com/onsi/gomega v1.33.1
github.com/pkg/errors v0.9.1
diff --git a/go.sum b/go.sum
index d6efa111..0c5c3f5f 100644
--- a/go.sum
+++ b/go.sum
@@ -37,8 +37,8 @@ github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.
github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
-github.com/gardener/machine-controller-manager v0.54.0 h1:V7EOODiaBO9VesskdCgxMvo5vgMAmtmUTdb9Y9Nwp50=
-github.com/gardener/machine-controller-manager v0.54.0/go.mod h1:RPpnU8gmTrhDAd79+iKqKlbANiXCRkXoJW+z+5zSTME=
+github.com/gardener/machine-controller-manager v0.55.1 h1:d6mTnuYko+jWeIi7tAFWgWnL1nR5hGcI6pRCDcH0TGY=
+github.com/gardener/machine-controller-manager v0.55.1/go.mod h1:eCng7De6OE15rndmMm6Q1fwMQI39esASCd3WKZ/lLmY=
github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
diff --git a/hack/add_license_headers.sh b/hack/add_license_headers.sh
new file mode 100755
index 00000000..2e095dd2
--- /dev/null
+++ b/hack/add_license_headers.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Gardener contributors
+#
+# SPDX-License-Identifier: Apache-2.0
+
+set -e
+
+echo "> Adding Apache License header to all go files where it is not present"
+
+YEAR=$1
+if [[ -z "$1" ]]; then
+ cat << EOF
+Unspecified 'YEAR' argument.
+Usage: add_licence_headers.sh
+EOF
+ exit 1
+fi
+
+temp_file=$(mktemp)
+trap "rm -f $temp_file" EXIT
+sed "s/{YEAR}/${YEAR}/g" hack/license_boilerplate.txt > $temp_file
+
+# Uses the tool https://github.com/google/addlicense
+addlicense \
+ -f $temp_file \
+ -ignore ".idea/**" \
+ -ignore ".vscode/**" \
+ -ignore "**/*.md" \
+ -ignore "**/*.yaml" \
+ -ignore "**/Dockerfile" \
+ .
diff --git a/hack/api-reference/generate-spec-doc.sh b/hack/api-reference/generate-spec-doc.sh
index 9f4a76fc..1222963e 100755
--- a/hack/api-reference/generate-spec-doc.sh
+++ b/hack/api-reference/generate-spec-doc.sh
@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Gardener contributors
+#
+# SPDX-License-Identifier: Apache-2.0
+
cd ./hack/api-reference
./gen-crd-api-reference-docs -config "providerspec-config.json" -api-dir "../../pkg/api/v1alpha1" -out-file="../../docs/docs/provider-spec.md"
sed 's/?id=//g' ../../docs/docs/provider-spec.md > ../../docs/docs/provider-spec-1.md
diff --git a/hack/license_boilerplate.txt b/hack/license_boilerplate.txt
new file mode 100644
index 00000000..9266b594
--- /dev/null
+++ b/hack/license_boilerplate.txt
@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: {YEAR} SAP SE or an SAP affiliate company and Gardener contributors
+
+SPDX-License-Identifier: Apache-2.0
\ No newline at end of file
diff --git a/hack/sast.sh b/hack/sast.sh
new file mode 100755
index 00000000..5cc71087
--- /dev/null
+++ b/hack/sast.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+#
+# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Gardener contributors
+#
+# SPDX-License-Identifier: Apache-2.0
+
+set -e
+
+root_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )/.." &> /dev/null && pwd )"
+gosec_report="false"
+gosec_report_parse_flags=""
+
+parse_flags() {
+ while test $# -gt 1; do
+ case "$1" in
+ --gosec-report)
+ shift; gosec_report="$1"
+ ;;
+ *)
+ echo "Unknown argument: $1"
+ exit 1
+ ;;
+ esac
+ shift
+ done
+}
+
+parse_flags "$@"
+
+echo "> Running gosec"
+gosec --version
+if [[ "$gosec_report" != "false" ]]; then
+ echo "Exporting report to $root_dir/gosec-report.sarif"
+ gosec_report_parse_flags="-track-suppressions -fmt=sarif -out=gosec-report.sarif -stdout"
+fi
+
+# MCM uses code-generators https://github.com/kubernetes/code-generator which create lots of G103 (CWE-242:
+# Use of unsafe calls should be audited) & G104 (CWE-703: Errors unhandled) errors.
+# However, those generators are best-pratice in Kubernetes environment and their results are tested well.
+# Thus, generated code is excluded from gosec scan.
+# Nested go modules are not supported by gosec (see https://github.com/securego/gosec/issues/501), so the ./hack folder
+# is excluded too. It does not contain productive code anyway.
+gosec -exclude-generated -exclude-dir=hack $gosec_report_parse_flags ./...
\ No newline at end of file
diff --git a/hack/tools/bin/.gitkeep b/hack/tools/bin/.gitkeep
new file mode 100644
index 00000000..e69de29b
diff --git a/pkg/gcp/fake/mockserver.go b/pkg/gcp/fake/mockserver.go
index 1db45136..a33b3b25 100644
--- a/pkg/gcp/fake/mockserver.go
+++ b/pkg/gcp/fake/mockserver.go
@@ -42,7 +42,7 @@ func (h *httpHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
// NewMockServer creates an http server to mock the gcp compute api
func NewMockServer() {
- var srv = http.Server{
+ var srv = http.Server{ // #nosec G112 (CWE-400) -- Only used for testing
Addr: ":6666",
Handler: new(httpHandler),
}
diff --git a/pkg/gcp/machine_controller_util.go b/pkg/gcp/machine_controller_util.go
index 029c2414..0fa78d34 100644
--- a/pkg/gcp/machine_controller_util.go
+++ b/pkg/gcp/machine_controller_util.go
@@ -373,7 +373,7 @@ func prepareErrorf(err error, format string, args ...interface{}) error {
code = codes.Internal
wrapped = errors.Wrap(err, fmt.Sprintf(format, args...))
}
- klog.V(2).Infof(wrapped.Error())
+ klog.V(2).Infof("%s", wrapped.Error())
return status.Error(code, wrapped.Error())
}
@@ -450,5 +450,5 @@ func checkIfResourceExhaustedError(opErr *compute.OperationErrorErrors, errorMes
if opErr.Code == "RESOURCE_POOL_EXHAUSTED" || opErr.Code == "ZONE_RESOURCE_POOL_EXHAUSTED" || opErr.Code == "ZONE_RESOURCE_POOL_EXHAUSTED_WITH_DETAILS" || strings.Contains(opErr.Code, "QUOTA") {
return &errors2.MachineResourceExhaustedError{Msg: combinedErrMsg}
}
- return fmt.Errorf(combinedErrMsg)
+ return fmt.Errorf("%s", combinedErrMsg)
}
diff --git a/test/integration/controller/controller_suite_test.go b/test/integration/controller/controller_suite_test.go
index ff9b1c1a..254a02c8 100644
--- a/test/integration/controller/controller_suite_test.go
+++ b/test/integration/controller/controller_suite_test.go
@@ -1,3 +1,7 @@
+// SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Gardener contributors
+//
+// SPDX-License-Identifier: Apache-2.0
+
package controller_test
import (
diff --git a/test/integration/controller/controller_test.go b/test/integration/controller/controller_test.go
index c76168a8..5f206d59 100644
--- a/test/integration/controller/controller_test.go
+++ b/test/integration/controller/controller_test.go
@@ -1,3 +1,7 @@
+// SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Gardener contributors
+//
+// SPDX-License-Identifier: Apache-2.0
+
/**
Overview
- Tests the provider specific Machine Controller
diff --git a/test/integration/provider/gcp.go b/test/integration/provider/gcp.go
index ddaf502c..e5b52407 100644
--- a/test/integration/provider/gcp.go
+++ b/test/integration/provider/gcp.go
@@ -1,3 +1,7 @@
+// SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Gardener contributors
+//
+// SPDX-License-Identifier: Apache-2.0
+
package provider
import (
diff --git a/test/integration/provider/rti.go b/test/integration/provider/rti.go
index 6d62e407..a96b9668 100644
--- a/test/integration/provider/rti.go
+++ b/test/integration/provider/rti.go
@@ -1,3 +1,7 @@
+// SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Gardener contributors
+//
+// SPDX-License-Identifier: Apache-2.0
+
package provider
import (