Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump controller-runtime from 0.15.0 to 0.17.0 #342

Merged

Conversation

atheo89
Copy link
Member

@atheo89 atheo89 commented Jun 5, 2024

Related to: https://issues.redhat.com/browse/RHOAIENG-1754

Description

This PR is intended to fix the CVE-2023-7104 Heap-based Buffer Overflow vulnerability introduced in go-sqlite3 v1.14.14. The go-sqlite3 package is included as an indirect dependency through controller-runtime.
It appears that by upgrading controller-runtime to version 0.17.0, this issue is resolved, as go-sqlite3 is no longer listed in the go.sum file. That version is the latest that is supported by golang 1.20.

This change brings some minor modifications on the ctrl.NewManager configuration in both odh&kf nbcs controllers.

How Has This Been Tested?

Replace the following deployments:

  1. notebook-controller: quay.io/rh_ee_atheodor/notebook-controller:fix-cve-2023-7104
  2. odh-notebook-controller: quay.io/rh_ee_atheodor/odh-notebook-controller:fix-cve-2023-7104

Ensure that everything is working like before.

Note: The upgrade of the controller-runtime removes the hashicorp package this has as result to break the docker-build image. This is addressed on this PR: #340, for more details check this thread discussion

Merge criteria:

  • The commits are squashed in a cohesive manner and have meaningful messages.
  • Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
  • The developer has manually tested the changes and verified that the changes work

@atheo89
Copy link
Member Author

atheo89 commented Jun 5, 2024

/hold till this PR get merged #340

@openshift-ci openshift-ci bot added the do-not-merge/hold Do not merge this PR label Jun 5, 2024
@atheo89
Copy link
Member Author

atheo89 commented Jun 5, 2024

Here it is an old PR that opened for the same reason. #263

Copy link
Member

@jiridanek jiridanek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks right to me, but run go fmt, i think there's something in the makefile to run it, so that lines are properly aligned

components/odh-notebook-controller/main.go Show resolved Hide resolved
@openshift-ci openshift-ci bot added the lgtm label Jun 5, 2024
@atheo89
Copy link
Member Author

atheo89 commented Jun 7, 2024

/retest

Copy link

openshift-ci bot commented Jun 7, 2024

New changes are detected. LGTM label has been removed.

@atheo89
Copy link
Member Author

atheo89 commented Jun 7, 2024

/unhold

@openshift-ci openshift-ci bot removed the do-not-merge/hold Do not merge this PR label Jun 7, 2024
@jiridanek jiridanek added the lgtm label Jun 10, 2024
Copy link

openshift-ci bot commented Jun 10, 2024

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: jiridanek

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot openshift-merge-bot bot merged commit 8a6c824 into opendatahub-io:v1.7-branch Jun 10, 2024
9 checks passed
@harshad16
Copy link
Member

/cherrypick stable

@openshift-cherrypick-robot

@harshad16: new pull request created: #351

In response to this:

/cherrypick stable

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants