Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OCPBUGS-7683 OCPBUGS-5172: Bump helm to v3.11.1 to address CVE-2023-25165 #19

Merged
merged 32 commits into from
Mar 2, 2023
Merged

OCPBUGS-7683 OCPBUGS-5172: Bump helm to v3.11.1 to address CVE-2023-25165 #19

merged 32 commits into from
Mar 2, 2023

Conversation

tmshort
Copy link
Contributor

@tmshort tmshort commented Feb 22, 2023 •
edited
Loading

Update go modules and vendor directory
Update manifests

Also addresses OCPBUGS-5172 for another helm CVE (update helm to v3.10.3)
This pulls in all changes from operator-framework/rukpak.

@openshift-ci-robot openshift-ci-robot added jira/severity-low Referenced Jira bug's severity is low for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. labels Feb 22, 2023
@openshift-ci-robot
Copy link

@tmshort: This pull request references Jira Issue OCPBUGS-7683, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.13.0) matches configured target version for branch (4.13.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @kuiwang02

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Update go modules and vendor directory
Update manifests

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tmshort tmshort marked this pull request as draft February 22, 2023 22:33
@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 22, 2023
@tmshort
Copy link
Contributor Author

tmshort commented Feb 22, 2023

/retest

Tyler Slaton and others added 19 commits February 23, 2023 14:01
@tmshort
chore: bump cert-mgr version
71e9b06 
(cherry picked from commit 0aa06ea)
Signed-off-by: Todd Short <[email protected]>
@joelanford @tmshort
bump to k8s 1.25, kind 0.15, go 1.19, golangci-lint 1.49, goreleaser …
dea1068 
…1.11

Signed-off-by: Joe Lanford <[email protected]>
(cherry picked from commit c9aec01)
Signed-off-by: Todd Short <[email protected]>
@akihikokuroda @tmshort
docs directory rearrange
a4edc1e 
Signed-off-by: akihikokuroda <[email protected]>
(cherry picked from commit ba86667)
Signed-off-by: Todd Short <[email protected]>
@tmshort
fix: update docs directory to be more condensed and update informatio…
43b3462 
…n slightly

(cherry picked from commit c0103c7)
Signed-off-by: Todd Short <[email protected]>
@joelanford @tmshort
fix: avoid bundle update errors during deletion
84eddd8 
Our finalizer code is not integrated with our updater code, which
results in two multiple update calls being made during a single reconcile
when a bundle is deleted. The first call removes the finalizer, the
second attempts to update the status. The second call fails because the
bundle has been deleted in etcd after the finalizer is removed with the
first call.

This commit fully rips out the bundle updater and refactors things to
ensure there’s never more than one status and bundle update per
reconcile.

(cherry picked from commit d60b6f0)
Signed-off-by: Todd Short <[email protected]>
@joelanford @tmshort
define constants for common defaults
7777459 
Also, start using build tags to make it easier to
change defaults for downstream builds.

Signed-off-by: Joe Lanford <[email protected]>
(cherry picked from commit 0191183)
Signed-off-by: Todd Short <[email protected]>
@joelanford @tmshort
fix: align bundle deployment update mechanism with bundles
e23b858 
This commit fully rips out the bundle deployment updater and refactors
things to ensure there’s never more than one status and bundle
deployment update per reconcile.

(cherry picked from commit 214a389)
Signed-off-by: Todd Short <[email protected]>
@tmshort
docs: combine both helm provisioner documents
09d6065 
(cherry picked from commit ed64be5)
Signed-off-by: Todd Short <[email protected]>
@tmshort
docs: remove redundant provisioner documentation and fix linkage
fecf714 
(cherry picked from commit 1c97e66)
Signed-off-by: Todd Short <[email protected]>
@tmshort
test(e2e): add ability to configure the image registry for test images
c8e4f80 
Signed-off-by: Tyler Slaton <[email protected]>
(cherry picked from commit 1bea93e)
Signed-off-by: Todd Short <[email protected]>
@akihikokuroda @tmshort
add provisioner in the print column
5fbbfa0 
Signed-off-by: akihikokuroda <[email protected]>
(cherry picked from commit 34a1338)
Signed-off-by: Todd Short <[email protected]>
@tmshort
docs: update README.md links to reference the correct locations
82cdea5 
(cherry picked from commit 1ee22ee)
Signed-off-by: Todd Short <[email protected]>
@joelanford @tmshort
Consolidate bundle and BD controller code
b2031d3 
We currently have a large amount of copy/pasted code in our various
in-tree provisioners. We have three bundle provisioners: plain,
registry, and helm. And we have two BD provisioners: plain and helm.

A very large majority of the code in each of these provisioners is
identical, and the only differences are in:
- how the bundle content is validated and converted before storing
- how the bundle content is validated and rendered into a helm chart
  before being applied to the cluster.

This PR introduces a few interfaces to capture these
implementation-specific differences along with generic bundle and BD
reconcilers that use these interfaces such that the copy/pasted code is
now shared and DRY-ed up.

(cherry picked from commit d9899da)
Signed-off-by: Todd Short <[email protected]>
@akihikokuroda @tmshort
add resources/requests
842bd93 
Signed-off-by: akihikokuroda <[email protected]>
(cherry picked from commit 59f2b1e)
Signed-off-by: Todd Short <[email protected]>
@akihikokuroda @tmshort
add resources to watch list
1f57011 
Signed-off-by: akihikokuroda <[email protected]>
(cherry picked from commit e430327)
Signed-off-by: Todd Short <[email protected]>
@akihikokuroda @tmshort
local git repository for e2e test
4d51979 
Signed-off-by: akihikokuroda <[email protected]>
(cherry picked from commit 549b3f0)
Signed-off-by: Todd Short <[email protected]>
@akihikokuroda @tmshort
relocate test tools
7720bdd 
Signed-off-by: akihikokuroda <[email protected]>
(cherry picked from commit 9759cb8)
Signed-off-by: Todd Short <[email protected]>
@timflannagan @tmshort
internal/convert: Fix 'webhookDefiniions' typo in error message
d13df3c 
Signed-off-by: timflannagan <[email protected]>
(cherry picked from commit 6a56409)
Signed-off-by: Todd Short <[email protected]>
@timflannagan @tmshort
internal,test: Ensure status condition message is capitalized
dab699b 
Signed-off-by: timflannagan <[email protected]>
(cherry picked from commit f4fc68d)
Signed-off-by: Todd Short <[email protected]>
@tmshort tmshort mentioned this pull request Feb 28, 2023
Merged
@openshift-ci-robot
Copy link

/retest-required

Remaining retests: 0 against base HEAD 226e743 and 2 for PR HEAD f4905f5 in total

@tmshort
Copy link
Contributor Author

tmshort commented Feb 28, 2023

/retest

@openshift-ci openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Feb 28, 2023
@tmshort
Copy link
Contributor Author

tmshort commented Feb 28, 2023

/retest

@tmshort
Copy link
Contributor Author

tmshort commented Feb 28, 2023

/retest

@kuiwang02
Copy link

I already test it with pre-merged. the details is in the https://issues.redhat.com/browse/OCPBUGS-7683
before I add qe-approve label, could you please check the failure of e2e job? thanks

@tmshort
Copy link
Contributor Author

tmshort commented Mar 1, 2023

I already test it with pre-merged. the details is in the https://issues.redhat.com/browse/OCPBUGS-7683 before I add qe-approve label, could you please check the failure of e2e job? thanks

Yes, actively looking at e2e failure; which has never passed per the job history.
It passes locally when run as make test-e2e as of right now (it used to be make e2e, but I think that's part of the issue).

@tmshort
Copy link
Contributor Author

tmshort commented Mar 1, 2023

/retest

tmshort added 2 commits March 1, 2023 14:26
@tmshort
Merge fixup: Disable an e2e test
a228eab 
Disable (via Pending) one of the e2e tests. The command is erroring,
but with an incorrect error code. This can be looked at later.

Signed-off-by: Todd Short <[email protected]>
@tmshort
Merge fixup: update from operator-framework/rukpak
efe2744 
This copies everything from operator-framework/rukpak, which really ends
up being just the `Makefile` and `Dockerfile`. Both the `Dockerfile` and
the `Makefile` have been tweaked to work with upstream changes.

Versions of the locally built components previously in `/bin`, now in
`hack/tools/bin`, are based on the `go.mod` in the new location rather
than versions in the `Makefile`.

CI Fixes:
* Swap test-e2e and e2e and disable e2e
* Add -mod=mod to local builds of tools

Signed-off-by: Todd Short <[email protected]>
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Mar 1, 2023

@tmshort: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@tmshort
Copy link
Contributor Author

tmshort commented Mar 1, 2023

The e2e tests are disabled in the repo; this repo was never configured properly to run the ci/prow/e2e tests, and it's beyond the scope of this PR, which is mostly a merge from upstream. Adding those tests would be a project on its own.
@perdasilva and @kuiwang02, can I get another LGTM/test?

@kuiwang02
Copy link

/label qe-approved

@openshift-ci openshift-ci bot added the qe-approved Signifies that QE has signed off on this PR label Mar 2, 2023
@perdasilva
Copy link

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Mar 2, 2023
@openshift-merge-robot openshift-merge-robot merged commit 66b3e55 into openshift:main Mar 2, 2023
@openshift-ci-robot
Copy link

@tmshort: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-7683 has been moved to the MODIFIED state.

In response to this:

Update go modules and vendor directory
Update manifests

Also addresses OCPBUGS-5172 for another helm CVE (update helm to v3.10.3)
This pulls in all changes from operator-framework/rukpak.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tmshort tmshort changed the title OCPBUGS-7683: Bump helm to v3.11.1 to address CVE-2023-25165 OCPBUGS-7683 OCPBUGS-5172: Bump helm to v3.11.1 to address CVE-2023-25165 Mar 2, 2023
@openshift-ci-robot
Copy link

@tmshort: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-5172 has been moved to the MODIFIED state.

In response to this:

Update go modules and vendor directory
Update manifests

Also addresses OCPBUGS-5172 for another helm CVE (update helm to v3.10.3)
This pulls in all changes from operator-framework/rukpak.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tmshort
Copy link
Contributor Author

tmshort commented Mar 2, 2023

/jira refresh

@openshift-ci-robot
Copy link

@tmshort: Jira Issue OCPBUGS-5172 is in an unrecognized state (MODIFIED) and will not be moved to the MODIFIED state.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tmshort
Copy link
Contributor Author

tmshort commented Mar 3, 2023

/cherry-pick release-4.12

@tmshort tmshort deleted the CVE-2023-25165 branch March 3, 2023 14:36
@openshift-cherrypick-robot
Copy link

@tmshort: #19 failed to apply on top of branch "release-4.12":

Applying: chore: bump cert-mgr version
Applying: bump to k8s 1.25, kind 0.15, go 1.19, golangci-lint 1.49, goreleaser 1.11
Using index info to reconstruct a base tree...
M	go.mod
M	go.sum
Falling back to patching base and 3-way merge...
Auto-merging go.sum
CONFLICT (content): Merge conflict in go.sum
Auto-merging go.mod
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0002 bump to k8s 1.25, kind 0.15, go 1.19, golangci-lint 1.49, goreleaser 1.11
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-4.12

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kuiwang02 kuiwang02 Awaiting requested review from kuiwang02

@awgreene awgreene Awaiting requested review from awgreene

@perdasilva perdasilva Awaiting requested review from perdasilva

@ankitathomas ankitathomas Awaiting requested review from ankitathomas

Assignees

@perdasilva perdasilva

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. jira/severity-low Referenced Jira bug's severity is low for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. qe-approved Signifies that QE has signed off on this PR
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.