CORENET-7386: Bump to kube 1.36 and go to 1.26 - #146
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
|
No actionable comments were generated in the recent review. 🎉 WalkthroughThe Docker builder and Go module now target Go 1.26. Kubernetes dependencies were upgraded from v0.34.1 to v0.36.2, with corresponding updates to ChangesToolchain and dependency refresh
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: miheer The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@miheer: This pull request references CORENET-7386 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "5.0.0" version, but no target version was set. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
miheer
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 1: Update the Dockerfile’s builder image reference from the mutable
golang:1.26 tag to the approved immutable digest for the intended Go 1.26 image,
preserving the builder stage name and image version.
- Line 1: Update the Dockerfile’s final runtime stage to create an unprivileged
user, ensure the application files and required paths are accessible to it, and
add a non-root USER declaration before the startup command. Do not leave the
final image running as root; the builder stage can remain unchanged.
In `@go.mod`:
- Line 52: Update the golang.org/x/net dependency declaration from v0.49.0 to
v0.55.0 or later in go.mod, then refresh related module checksums as needed; if
dependency analysis confirms it is unreachable, add the repository’s established
reachability/VEX exception instead.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1,4 +1,4 @@ | |||
| FROM golang:1.24 AS builder | |||
| FROM golang:1.26 AS builder | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pin the Go builder image by digest.
golang:1.26 is mutable and can change the build inputs without a Dockerfile change. Use the approved immutable digest for the intended Go 1.26 image.
As per path instructions, non-Red Hat images must be pinned by digest.
🧰 Tools
🪛 Trivy (0.72.0)
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 1, Update the Dockerfile’s builder image reference from
the mutable golang:1.26 tag to the approved immutable digest for the intended Go
1.26 image, preserving the builder stage name and image version.
Source: Path instructions
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Run the final image as a non-root user.
The Dockerfile has no non-root USER declaration according to Trivy DS-0002, so the runtime container defaults to root. Add an unprivileged user in the final stage and switch to it before startup.
As per path instructions, containers must use USER non-root and never run as root.
🧰 Tools
🪛 Trivy (0.72.0)
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 1, Update the Dockerfile’s final runtime stage to create
an unprivileged user, ensure the application files and required paths are
accessible to it, and add a non-root USER declaration before the startup
command. Do not leave the final image running as root; the builder stage can
remain unchanged.
Sources: Path instructions, Linters/SAST tools
| golang.org/x/tools v0.26.0 // indirect | ||
| google.golang.org/protobuf v1.36.5 // indirect | ||
| gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect | ||
| golang.org/x/net v0.49.0 // indirect |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the surrounding go.mod context and search for golang.org/x/net references.
sed -n '1,120p' go.mod | cat -n
printf '\n---\n'
rg -n 'golang\.org/x/net|golang\.org/x/' go.mod go.sumRepository: openshift/network-metrics-daemon
Length of output: 15200
🌐 Web query:
osv.dev CVE-2026-39821 golang.org/x/net v0.49.0 v0.55.0
💡 Result:
CVE-2026-39821 is a critical security vulnerability identified in the golang.org/x/net package, specifically within the idna sub-package [1][2]. The vulnerability is caused by a failure to correctly reject ASCII-only Punycode-encoded labels in the ToASCII and ToUnicode functions [1][2]. This flaw allows the functions to incorrectly accept Punycode-encoded labels that decode to ASCII-only labels (e.g., "xn--example-.com" being treated as "example.com" instead of throwing an error) [1][2]. This behavior can lead to privilege escalation, as programs that perform privilege checks on ASCII hostnames may reject "example.com" but permit "xn--example-.com"; if the hostname is subsequently converted to Unicode, the program might inadvertently permit access to the sensitive Unicode name [1][2]. The vulnerability was addressed in version v0.55.0 of golang.org/x/net [1][2]. Users are advised to upgrade to v0.55.0 or later to remediate this issue [1][2]. The fix implements an updated specification from UTS 46 (revision 33), which resolves the underlying issue where multiple ASCII labels could decode to the same Unicode label [2]. Top results: [1], [2]
Citations:
- 1: https://osv.dev/vulnerability/CVE-2026-39821
- 2: https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
p = Path("go.mod")
text = p.read_text()
lines = text.splitlines()
for i,l in enumerate(lines,1):
if "golang.org/x/net" in l:
start=max(1,i-5); end=min(len(lines),i+5)
for j in range(start,end+1):
print(f"{j:4}: {lines[j-1]}")
break
PYRepository: openshift/network-metrics-daemon
Length of output: 684
🌐 Web query:
site:osv.dev/vulnerability golang.org/x/net v0.49.0 CVE-2026-39821 v0.55.0
💡 Result:
CVE-2026-39821 is a security vulnerability in the idna package of golang.org/x/net [1][2]. The issue arises because the ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label, which can lead to privilege escalation by bypassing hostname-based access restrictions [1][2]. This vulnerability was fixed in version v0.55.0 of golang.org/x/net [1][2]. Users are advised to update their dependency to v0.55.0 or later to mitigate this risk [1][2].
Citations:
Upgrade golang.org/x/net from v0.49.0.
go.mod:52 pins a version affected by CVE-2026-39821; move to v0.55.0 or later, or add a reachability/VEX exception if this dependency is not actually used.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 52, Update the golang.org/x/net dependency declaration from
v0.49.0 to v0.55.0 or later in go.mod, then refresh related module checksums as
needed; if dependency analysis confirms it is unreachable, add the repository’s
established reachability/VEX exception instead.
Source: Path instructions
Update Kubernetes dependencies to v0.36.2 and Go to 1.26. Regenerate go.sum and vendor, including golang.org/x/net v0.55.0 to address CVE-2026-39821. Pin Dockerfile base images by digest and run the final image as a non-root user. Signed-off-by: Miheer Salunke <miheer.salunke@gmail.com>
|
@miheer: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
@bpickard22 PTAL |
2 participants
Update Kubernetes dependencies to v0.36.2 and Go to 1.26.
Regenerate go.sum and vendor.
Summary by CodeRabbit