cluster-autoscaler: update otelgrpc to v0.46.0 for SVM

[grosser]

https://nvd.nist.gov/vuln/detail/CVE-2023-47108

Which component are you using?:

cluster-autoscaler

What version of the component are you using?:

master

HIGH	CVE-2023-47108	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	0.45.0	0.46.0	GHSA-8pgv-569h-w5rw	COPY /go/autosc

updating to 0.45 works, but 0.46 breaks the build

[grosser]

this seems to do the trick:

go mod edit -replace go.opentelemetry.io/otel/metric=go.opentelemetry.io/otel/[email protected]
go mod edit -replace go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc=go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/[email protected]
go get go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected]

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[Shubham82]

/remove-lifecycle stale

[gjtempleton]

We're largely dependent on this being resolved upstream as it's a dependency we pull in when vendoring k/k: kubernetes/kubernetes#121842

In addition, my reading of this is that we're at low/no risk of it being exploited as we only use the UnaryServerInterceptor in the externalgrpc cloudprovider implementation, and we don't appear to have a metrics pipeline configured for it? Or am I missing something?

[grosser]

just our vuln scanner complaining and I would like to shut it up :D
... so yeah can wait until upstream fixes it, but would like to have it resolved eventually

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[Shubham82]

The vulnerability CVE-2023-47108 is resolved now, related package otelgrpc is updated to v0.53.0. I checked the vulnerability for the k8s/autoscaler repository and there is no CVE-2023-47108 (used trivy for scanning)

autoscaler/cluster-autoscaler/go.mod

Line 171 in c8e4721

go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0 // indirect

PR which resolved this issue: #7066

[Shubham82]

closing this issue, please reopen if there is any concern.

/close

[k8s-ci-robot]

@Shubham82: Closing this issue.

In response to this:

closing this issue, please reopen if there is any concern.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.