Skip to content

[WIP] Add taints package #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Tzif-Morgen wants to merge 26 commits into from
Closed

[WIP] Add taints package #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
161165b
Add pkg/taints with common taint utilities
Tzif-Morgen Apr 23, 2026
9726e31
Upgrade k8s dependencies to v0.33.7
Tzif-Morgen Apr 23, 2026
4cd978d
Fix lease test for k8s v0.33 fake client compatibility
Tzif-Morgen Apr 26, 2026
f8e10b9
Rename DeleteTaint to FilterOutTaint
Tzif-Morgen Apr 27, 2026
f41128c
Use struct for out-of-service taint info
Tzif-Morgen Apr 27, 2026
df13559
Add comprehensive tests using Ginkgo/Gomega
Tzif-Morgen Apr 29, 2026
de8e253
Add envtest integration tests for InitOutOfServiceTaintFlagsWithRetry
Tzif-Morgen Apr 29, 2026
1caa065
Remove nested if/else in initOutOfServiceTaintFlags
Tzif-Morgen Apr 29, 2026
349ca11
Handle context cancellation in InitOutOfServiceTaintFlagsWithRetry
Tzif-Morgen Apr 29, 2026
1122f1d
Remove TimeAdded from CreateOutOfServiceTaint
Tzif-Morgen Apr 29, 2026
0aeb973
Add AppendTaintToNode and RemoveTaintFromNode with patch operations
Tzif-Morgen Apr 29, 2026
2c94c2e
Update InitOutOfServiceTaintFlagsWithRetry comment to reflect time-ba…
Tzif-Morgen Apr 29, 2026
2ab160a
Make MatchTaint call direction consistent across taint functions
Tzif-Morgen Apr 29, 2026
5fafd54
Add tests for preserving existing taints during add/remove operations
Tzif-Morgen Apr 29, 2026
83f0758
Convert taint operations tests from envtest to fake client
Tzif-Morgen Apr 29, 2026
e589b48
Merge taint operation tests into single file and remove envtest depen…
Tzif-Morgen Apr 29, 2026
5794f27
Rename taintInfo to OutOfServiceInfo and make it exported
Tzif-Morgen Apr 29, 2026
f250d22
Remove unused blang/semver dependency
Tzif-Morgen Apr 29, 2026
5e1a407
Revert Makefile changes
Tzif-Morgen Apr 29, 2026
dfd830e
Rename FilterOutTaint to Filter with slices.DeleteFunc
Tzif-Morgen Apr 30, 2026
435b9d4
Rename AppendTaintToNode to AddTaintToNode
Tzif-Morgen Apr 30, 2026
feeed66
Use StrategicMergeFrom instead of MergeFrom for node patches
Tzif-Morgen Apr 30, 2026
3af2378
Remove global variable and return OutOfServiceTaintInfo from detection
Tzif-Morgen May 3, 2026
736c9a3
Rename TaintExists to Contains, use slices.ContainsFunc
Tzif-Morgen May 5, 2026
41cfff3
Rename Filter to FilterOut
Tzif-Morgen May 7, 2026
ad7025d
Use ConsistOf in FilterOut tests for clearer assertions
Tzif-Morgen May 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
110 changes: 54 additions & 56 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,76 +1,74 @@
module github.com/medik8s/common

go 1.20
go 1.24.0

require (
github.com/go-logr/logr v1.2.3
github.com/onsi/ginkgo/v2 v2.9.1
github.com/onsi/gomega v1.27.4
github.com/go-logr/logr v1.4.2
github.com/onsi/ginkgo/v2 v2.22.0
github.com/onsi/gomega v1.36.1
github.com/pkg/errors v0.9.1
github.com/sirupsen/logrus v1.9.0
go.uber.org/zap v1.24.0
k8s.io/api v0.26.3
k8s.io/apimachinery v0.26.3
k8s.io/client-go v0.26.3
k8s.io/utils v0.0.0-20230313181309-38a27ef9d749
sigs.k8s.io/controller-runtime v0.14.5
github.com/sirupsen/logrus v1.9.3
go.uber.org/zap v1.27.0
k8s.io/api v0.33.7
k8s.io/apimachinery v0.33.7
k8s.io/client-go v0.33.7
k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
sigs.k8s.io/controller-runtime v0.21.0
)

require (
github.com/beorn7/perks v1.0.1 // indirect
github.com/cespare/xxhash/v2 v2.1.2 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/emicklei/go-restful/v3 v3.9.0 // indirect
github.com/evanphx/json-patch v4.12.0+incompatible // indirect
github.com/evanphx/json-patch/v5 v5.6.0 // indirect
github.com/fsnotify/fsnotify v1.6.0 // indirect
github.com/go-logr/zapr v1.2.3 // indirect
github.com/go-openapi/jsonpointer v0.19.5 // indirect
github.com/go-openapi/jsonreference v0.20.0 // indirect
github.com/go-openapi/swag v0.19.14 // indirect
github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 // indirect
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
github.com/fsnotify/fsnotify v1.7.0 // indirect
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
github.com/go-logr/zapr v1.3.0 // indirect
github.com/go-openapi/jsonpointer v0.21.0 // indirect
github.com/go-openapi/jsonreference v0.20.2 // indirect
github.com/go-openapi/swag v0.23.0 // indirect
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/protobuf v1.5.3 // indirect
github.com/google/gnostic v0.5.7-v3refs // indirect
github.com/google/go-cmp v0.5.9 // indirect
github.com/google/gofuzz v1.1.0 // indirect
github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 // indirect
github.com/google/uuid v1.1.2 // indirect
github.com/imdario/mergo v0.3.6 // indirect
github.com/google/btree v1.1.3 // indirect
github.com/google/gnostic-models v0.6.9 // indirect
github.com/google/go-cmp v0.7.0 // indirect
github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/mailru/easyjson v0.7.6 // indirect
github.com/matttproud/golang_protobuf_extensions v1.0.2 // indirect
github.com/moby/spdystream v0.2.0 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/moby/spdystream v0.5.0 // indirect

@coderabbitai coderabbitai Bot Apr 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

Is github.com/moby/spdystream v0.5.0 affected by GHSA-pc3f-x583-g7j2, and which k8s.io/client-go or sigs.k8s.io/controller-runtime release removes or patches that transitive dependency?

💡 Result:

Yes, github.com/moby/spdystream v0.5.0 is affected by GHSA-pc3f-x583-g7j2, as affected versions are <= v0.5.0 and v0.5.1 patches it. k8s.io/client-go versions prior to v0.36.0 depend on spdystream v0.5.0 transitively (via k8s.io/apimachinery/pkg/util/httpstream/spdy or k8s.io/streaming), so they are affected. k8s.io/client-go v0.36.0 uses spdystream v0.5.1. sigs.k8s.io/controller-runtime depends on k8s.io/client-go; versions aligned with client-go v0.36.0+ (likely v0.17.0+, check compatibility table) will patch it transitively. No direct spdystream dep in controller-runtime go.mod; fix comes via client-go upgrade.

Citations:

Address known-vulnerable moby/spdystream v0.5.0 in the transitive dependency graph.

This version is affected by GHSA-pc3f-x583-g7j2 (DoS advisory). The fix is available in spdystream v0.5.1, which is included in k8s.io/client-go v0.36.0+. Upgrade sigs.k8s.io/controller-runtime to a version aligned with k8s.io/client-go v0.36.0 or later (likely v0.17.0+) to transitively pull the patched version. Alternatively, verify that the affected code path in spdystream is unreachable in your application before merge.

🧰 Tools
🪛 OSV Scanner (2.3.5)

[HIGH] 43-43: github.com/moby/spdystream 0.5.0: SpdyStream: DOS on CRI

(GHSA-pc3f-x583-g7j2)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@go.mod` at line 43, The project currently pulls vulnerable
github.com/moby/spdystream v0.5.0 transitively; update the dependency graph by
bumping sigs.k8s.io/controller-runtime to a release that depends on
k8s.io/client-go v0.36.0+ (e.g., set sigs.k8s.io/controller-runtime to v0.17.0
or later in go.mod), then run go get/sync (e.g., `go get
sigs.k8s.io/controller-runtime@v0.17.0`), followed by go mod tidy and verify
go.sum to ensure spdystream is now v0.5.1; alternatively, if you choose not to
upgrade, add a note and tests proving the spdystream code path is unreachable.

github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/prometheus/client_golang v1.14.0 // indirect
github.com/prometheus/client_model v0.3.0 // indirect
github.com/prometheus/common v0.37.0 // indirect
github.com/prometheus/procfs v0.8.0 // indirect
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
github.com/prometheus/client_golang v1.22.0 // indirect
github.com/prometheus/client_model v0.6.1 // indirect
github.com/prometheus/common v0.62.0 // indirect
github.com/prometheus/procfs v0.15.1 // indirect
github.com/spf13/pflag v1.0.5 // indirect
go.uber.org/atomic v1.7.0 // indirect
go.uber.org/multierr v1.6.0 // indirect
golang.org/x/net v0.8.0 // indirect
golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b // indirect
golang.org/x/sys v0.6.0 // indirect
golang.org/x/term v0.6.0 // indirect
golang.org/x/text v0.8.0 // indirect
golang.org/x/time v0.3.0 // indirect
golang.org/x/tools v0.7.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/protobuf v1.28.1 // indirect
github.com/x448/float16 v0.8.4 // indirect
go.uber.org/multierr v1.11.0 // indirect
golang.org/x/net v0.38.0 // indirect
golang.org/x/oauth2 v0.27.0 // indirect
golang.org/x/sync v0.12.0 // indirect
golang.org/x/sys v0.31.0 // indirect
golang.org/x/term v0.30.0 // indirect
golang.org/x/text v0.23.0 // indirect
golang.org/x/time v0.9.0 // indirect
golang.org/x/tools v0.26.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/protobuf v1.36.5 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/apiextensions-apiserver v0.26.1 // indirect
k8s.io/component-base v0.26.1 // indirect
k8s.io/klog/v2 v2.80.1 // indirect
k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect
sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
sigs.k8s.io/yaml v1.3.0 // indirect
k8s.io/apiextensions-apiserver v0.33.0 // indirect
k8s.io/klog/v2 v2.130.1 // indirect
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
sigs.k8s.io/yaml v1.4.0 // indirect
)
Loading