-
Notifications
You must be signed in to change notification settings - Fork 35
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Bump controller-runtime from 0.15.0 to 0.17.0 #342
Bump controller-runtime from 0.15.0 to 0.17.0 #342
Conversation
/hold till this PR get merged #340 |
Here it is an old PR that opened for the same reason. #263 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
looks right to me, but run go fmt
, i think there's something in the makefile to run it, so that lines are properly aligned
/retest |
New changes are detected. LGTM label has been removed. |
/unhold |
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: jiridanek The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
8a6c824
into
opendatahub-io:v1.7-branch
/cherrypick stable |
@harshad16: new pull request created: #351 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Related to: https://issues.redhat.com/browse/RHOAIENG-1754
Description
This PR is intended to fix the
CVE-2023-7104 Heap-based Buffer Overflow
vulnerability introduced ingo-sqlite3 v1.14.14
. The go-sqlite3 package is included as an indirect dependency through controller-runtime.It appears that by upgrading controller-runtime to version 0.17.0, this issue is resolved, as go-sqlite3 is no longer listed in the go.sum file. That version is the latest that is supported by golang 1.20.
This change brings some minor modifications on the
ctrl.NewManager
configuration in both odh&kf nbcs controllers.How Has This Been Tested?
Replace the following deployments:
quay.io/rh_ee_atheodor/notebook-controller:fix-cve-2023-7104
quay.io/rh_ee_atheodor/odh-notebook-controller:fix-cve-2023-7104
Ensure that everything is working like before.
Note: The upgrade of the controller-runtime removes the
hashicorp
package this has as result to break the docker-build image. This is addressed on this PR: #340, for more details check this thread discussionMerge criteria: