Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Helm dependencies in Installer #15568

Merged
merged 5 commits into from
Jan 5, 2023
Merged

Update Helm dependencies in Installer #15568

merged 5 commits into from
Jan 5, 2023

Conversation

mrsimonemms
Copy link
Contributor

@mrsimonemms mrsimonemms commented Jan 4, 2023 •
edited
Loading

Description

This updates all Helm dependencies in the Installer (Docker registry, Minio, MySQL, RabbitMQ) to the latest versions. This PR has more commits than is strictly necessary, but have done it like this to ensure that the changes to the golden files are human-readable.

All of these dependency upgrade change the major version of the Helm chart. The Bitnami charts change how the image block works, so the previous way of defining the custom pull registry no longer works - in retrospect, I wish I'd done the original definition in the way I've done it here. The first two commits (1 and 2) address this by adding a new golden file to handle a custom pull repo and change the image block in the Helm dependencies.

The third commit exists because the Docker registry introduced a checksum on the secret.yaml in the template. This uses the Helm randAlphaNum function, which breaks the random seed - 64 bits wasn't enough random data, so increased to 128 bits.

The fourth commit is the actual update of the Helm dependencies and the associated golden files.

Finally, there is an update made to go-gorp as warning "Versions prior to 3.0.4 had a vulnerability in the dependency graph" reported (this could be a separate PR, but it's all part of the same area so I've put it in here).

Related Issue(s)

Fixes https://github.com/gitpod-io/security/issues/95

How to test

Use preview environment/self-hosted instance and do normal smoke-tests:

  • build image
  • start workspace
  • use gp stop
  • ensure that backups are saved to storage

Release Notes

Update Helm dependencies in Installer

Documentation

Werft options:

  • /werft with-local-preview
    If enabled this will build install/preview
  • /werft with-preview
  • /werft with-large-vm
  • /werft with-integration-tests=all
    Valid options are all, workspace, webapp, ide, jetbrains, vscode, ssh

@mrsimonemms mrsimonemms force-pushed the sje/installer-deps-update branch from e85d54b to e604cd7 Compare January 5, 2023 08:52
@gitguardian
Copy link

gitguardian bot commented Jan 5, 2023 •
edited
Loading

⚠️ GitGuardian has uncovered 87 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request
GitGuardian id Secret Commit Filename
5404275 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/customization/output.golden View secret
5404275 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/gcp-setup/output.golden View secret
5404275 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/http-proxy/output.golden View secret
5404275 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/kind-meta/output.golden View secret
5404275 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/kind-webapp/output.golden View secret
5404275 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/minimal/output.golden View secret
5404275 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/shortname/output.golden View secret
5404275 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/statefulset-customization/output.golden View secret
5404275 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/use-pod-security-policies/output.golden View secret
5404275 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/vsxproxy-pvc/output.golden View secret
5404275 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/workspace-requests-limits/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/customization/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/customization/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/external-registry/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/external-registry/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/http-proxy/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/http-proxy/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/kind-workspace/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/kind-workspace/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/minimal/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/minimal/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/shortname/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/shortname/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/statefulset-customization/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/statefulset-customization/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/use-pod-security-policies/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/use-pod-security-policies/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/vsxproxy-pvc/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/vsxproxy-pvc/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/workspace-requests-limits/output.golden View secret
5404276 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/workspace-requests-limits/output.golden View secret
5404279 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/customization/output.golden View secret
5404279 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/external-registry/output.golden View secret
5404279 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/http-proxy/output.golden View secret
5404279 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/kind-meta/output.golden View secret
5404279 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/kind-webapp/output.golden View secret
5404279 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/minimal/output.golden View secret
5404279 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/shortname/output.golden View secret
5404279 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/statefulset-customization/output.golden View secret
5404279 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/use-pod-security-policies/output.golden View secret
5404279 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/vsxproxy-pvc/output.golden View secret
5404279 Generic High Entropy Secret 09068b8 install/installer/cmd/testdata/render/workspace-requests-limits/output.golden View secret
5404279 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/customization/output.golden View secret
5404279 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/external-registry/output.golden View secret
5404279 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/http-proxy/output.golden View secret
5404279 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/kind-meta/output.golden View secret
5404279 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/kind-webapp/output.golden View secret
5404279 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/minimal/output.golden View secret
5404279 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/shortname/output.golden View secret
5404279 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/statefulset-customization/output.golden View secret
5404279 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/use-pod-security-policies/output.golden View secret
5404279 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/vsxproxy-pvc/output.golden View secret
5404279 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/workspace-requests-limits/output.golden View secret
5404281 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/customization/output.golden View secret
5404281 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/external-registry/output.golden View secret
5404281 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/gcp-setup/output.golden View secret
5404281 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/http-proxy/output.golden View secret
5404281 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/kind-meta/output.golden View secret
5404281 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/kind-webapp/output.golden View secret
5404281 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/minimal/output.golden View secret
5404281 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/shortname/output.golden View secret
5404281 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/statefulset-customization/output.golden View secret
5404281 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/use-pod-security-policies/output.golden View secret
5404281 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/vsxproxy-pvc/output.golden View secret
5404281 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/workspace-requests-limits/output.golden View secret
5404283 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/customization/output.golden View secret
5404283 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/external-registry/output.golden View secret
5404283 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/http-proxy/output.golden View secret
5404283 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/kind-meta/output.golden View secret
5404283 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/kind-webapp/output.golden View secret
5404283 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/minimal/output.golden View secret
5404283 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/shortname/output.golden View secret
5404283 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/statefulset-customization/output.golden View secret
5404283 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/use-pod-security-policies/output.golden View secret
5404283 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/vsxproxy-pvc/output.golden View secret
5404283 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/workspace-requests-limits/output.golden View secret
5404284 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/customization/output.golden View secret
5404284 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/http-proxy/output.golden View secret
5404284 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/kind-meta/output.golden View secret
5404284 Generic High Entropy Secret 631f0e5 install/installer/cmd/testdata/render/kind-webapp/output.golden View secret

and 7 others.

🛠 Guidelines to remediate hardcoded secrets
  1. Understand the implications of revoking this secret by investigating where it is used in your code.
  2. Replace and store your secret safely. Learn here the best practices.
  3. Revoke and rotate this secret.
  4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

Our GitHub checks need improvements? Share your feedbacks!

@mrsimonemms mrsimonemms changed the title Sje/installer deps update Update Helm dependencies in Installer Jan 5, 2023
@mrsimonemms mrsimonemms added the aspect: security Anything related to preventing vulnerabilities label Jan 5, 2023
@mrsimonemms mrsimonemms force-pushed the sje/installer-deps-update branch from e604cd7 to dc4f917 Compare January 5, 2023 09:20
Simon Emms added 4 commits January 5, 2023 09:42
[installer]: specify the desired registry domain in image.registry
853b6fd 
The Bitnami charts have changed in the past year and they now require
the "registry" to be populated. Upon reconsideration, specifying the
registry is probably the better way of doing it.
[installer]: increase random string length for seeded randoms
09068b8 
The updated Docker registry uses the Helm randAlphaNum function, which
requires a longer data string than the 64 characters we had previously.
[installer]: update helm dependencies to latest versions
631f0e5
[installer]: update go-gorp to remove vulnerability
c995035
@mrsimonemms mrsimonemms force-pushed the sje/installer-deps-update branch from dc4f917 to c995035 Compare January 5, 2023 09:45
@mrsimonemms mrsimonemms marked this pull request as ready for review January 5, 2023 09:55
@mrsimonemms mrsimonemms requested a review from a team January 5, 2023 09:55
@werft-gitpod-dev-com
Copy link

started the job as gitpod-build-sje-installer-deps-update.4 because the annotations in the pull request description changed
(with .werft/ from main)

@roboquat roboquat merged commit 0eaa3f5 into main Jan 5, 2023
@roboquat roboquat deleted the sje/installer-deps-update branch January 5, 2023 11:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ArthurSens ArthurSens ArthurSens approved these changes

Assignees
No one assigned
Labels
aspect: security Anything related to preventing vulnerabilities release-note size/M team: SID
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@mrsimonemms @ArthurSens @roboquat