Skip to content

OCPBUGS-105319: update kubernetes api to v0.36.3 #704

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rhdmalone wants to merge 1 commit into
base: main
Choose a base branch
from
Open

OCPBUGS-105319: update kubernetes api to v0.36.3 #704

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
4 changes: 2 additions & 2 deletions Dockerfile.okd
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22 AS builder
FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.26-openshift-5.0 AS builder
WORKDIR /go/src/github.com/openshift/cluster-samples-operator
COPY . .
RUN make build

FROM registry.ci.openshift.org/ocp/builder:rhel-9-base-openshift-4.22
FROM registry.ci.openshift.org/ocp/5.0:base-rhel9
COPY --from=builder /go/src/github.com/openshift/cluster-samples-operator/cluster-samples-operator /usr/bin/
RUN ln -f /usr/bin/cluster-samples-operator /usr/bin/cluster-samples-operator-watch
COPY manifests/image-references manifests/0* /manifests/
Expand Down
96 changes: 49 additions & 47 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/openshift/cluster-samples-operator

go 1.25.0
go 1.26.0

require (
github.com/openshift/api v0.0.0-20260317165824-54a3998d81eb
Expand All @@ -9,29 +9,29 @@ require (
github.com/openshift/library-go v0.0.0-20260326200317-12d8376369b7
github.com/prometheus/client_golang v1.23.2
github.com/prometheus/client_model v0.6.2
github.com/prometheus/common v0.66.1
github.com/prometheus/common v0.67.5
github.com/sirupsen/logrus v1.9.3
github.com/spf13/cobra v1.10.0
k8s.io/api v0.35.2
k8s.io/apimachinery v0.35.2
k8s.io/apiserver v0.35.2 // indirect
k8s.io/client-go v0.35.2
github.com/spf13/cobra v1.10.2
k8s.io/api v0.36.3
k8s.io/apimachinery v0.36.3
k8s.io/apiserver v0.36.3 // indirect
k8s.io/client-go v0.36.3
)

require github.com/google/go-cmp v0.7.0

require (
cel.dev/expr v0.24.0 // indirect
cel.dev/expr v0.25.1 // indirect
github.com/NYTimes/gziphandler v1.1.1 // indirect
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/blang/semver/v4 v4.0.0 // indirect
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/coreos/go-semver v0.3.1 // indirect
github.com/coreos/go-systemd/v22 v22.5.0 // indirect
github.com/coreos/go-systemd/v22 v22.7.0 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/emicklei/go-restful/v3 v3.12.2 // indirect
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/fsnotify/fsnotify v1.9.0 // indirect
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
Expand All @@ -45,8 +45,9 @@ require (
github.com/google/cel-go v0.26.0 // indirect
github.com/google/gnostic-models v0.7.0 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
Expand All @@ -56,50 +57,51 @@ require (
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/procfs v0.16.1 // indirect
github.com/prometheus/procfs v0.19.2 // indirect
github.com/spf13/pflag v1.0.9 // indirect
github.com/stoewer/go-strcase v1.3.0 // indirect
github.com/x448/float16 v0.8.4 // indirect
go.etcd.io/etcd/api/v3 v3.6.5 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.6.5 // indirect
go.etcd.io/etcd/client/v3 v3.6.5 // indirect
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
go.opentelemetry.io/otel v1.36.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 // indirect
go.opentelemetry.io/otel/metric v1.36.0 // indirect
go.opentelemetry.io/otel/sdk v1.36.0 // indirect
go.opentelemetry.io/otel/trace v1.36.0 // indirect
go.opentelemetry.io/proto/otlp v1.5.0 // indirect
go.etcd.io/etcd/api/v3 v3.6.8 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.6.8 // indirect
go.etcd.io/etcd/client/v3 v3.6.8 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.65.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
go.opentelemetry.io/otel v1.41.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 // indirect
go.opentelemetry.io/otel/metric v1.41.0 // indirect
go.opentelemetry.io/otel/sdk v1.40.0 // indirect
go.opentelemetry.io/otel/trace v1.41.0 // indirect
go.opentelemetry.io/proto/otlp v1.9.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
go.uber.org/zap v1.27.1 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/crypto v0.45.0 // indirect
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
golang.org/x/net v0.47.0 // indirect
golang.org/x/oauth2 v0.30.0 // indirect
golang.org/x/sync v0.18.0 // indirect
golang.org/x/sys v0.38.0 // indirect
golang.org/x/term v0.37.0 // indirect
golang.org/x/text v0.31.0 // indirect
golang.org/x/time v0.9.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a // indirect
google.golang.org/grpc v1.72.2 // indirect
google.golang.org/protobuf v1.36.8 // indirect
golang.org/x/crypto v0.47.0 // indirect
golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
golang.org/x/net v0.49.0 // indirect
golang.org/x/oauth2 v0.34.0 // indirect
golang.org/x/sync v0.19.0 // indirect
golang.org/x/sys v0.40.0 // indirect
golang.org/x/term v0.39.0 // indirect
golang.org/x/text v0.33.0 // indirect
golang.org/x/time v0.14.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
google.golang.org/grpc v1.79.3 // indirect

@coderabbitai coderabbitai Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

go list -deps ./... | rg '^google.golang.org/grpc(/|$)' || true
go list -m -f '{{.Path}} {{.Version}}' google.golang.org/grpc

Repository: openshift/cluster-samples-operator

Length of output: 2935

🌐 Web query:

OSV GO-2026-6061 google.golang.org/grpc v1.82.1 fixed

💡 Result:

OSV GO-2026-6061 is a security vulnerability affecting the google.golang.org/grpc package, specifically within the xDS RBAC authorization engine and the HTTP/2 transport server implementation [1][2]. The issue is tracked under identifier GHSA-hrxh-6v49-42gf [3][2]. It has been fixed in version 1.82.1 [2][4]. Users are advised to upgrade to version 1.82.1 or higher to mitigate the risks, which include potential authorization bypasses and denial-of-service vulnerabilities [2][5].

Citations:

🌐 Web query:

GO-2026-6061 grpc http2 xds rbac

💡 Result:

GO-2026-6061 is a security advisory published on July 27, 2026, concerning multiple vulnerabilities in the google.golang.org/grpc Go package [1][2]. The advisory affects versions prior to v1.82.1 [1]. The vulnerabilities addressed in this advisory involve two primary components of gRPC-Go: 1. xDS RBAC Authorization Engine: - Authorization Bypass (Fail-Open): An issue occurred when translating xDS RBAC policies that utilized Metadata or RequestedServerName fields, potentially leading to unauthorized access [3]. - Denial of Service (Server Panic): A runtime panic could be triggered by parsing crafted xDS RBAC policies that contained NOT rules wrapping unsupported fields, such as SourcedMetadata [3]. 2. HTTP/2 Transport Server Implementation: - Denial of Service (Rapid Reset Mitigation Bypass): Earlier mitigations in gRPC-Go for HTTP/2 Rapid Reset attacks were insufficient. They only applied threshold checks to items resulting in control frames written back to the wire (like SETTINGS ACKs or server-initiated RST_STREAMs), allowing attackers to bypass these limits during client-initiated stream resets [3]. To remediate these issues, users are advised to update to gRPC-Go v1.82.1 or later [1][2]. Additional mitigations for the HTTP/2 DoS include configuring upstream reverse proxies or load balancers (e.g., Envoy) with strict HTTP/2 max_concurrent_streams limits and active rate limiting on RST_STREAM frequency [3]. For xDS RBAC, operators should ensure that upstream xDS management servers do not push policies containing the problematic fields or rule configurations until the server has been patched [3].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Go module/version files =="
git ls-files | rg '(^|/)(go\.mod|go\.sum|\.go)$' | head -200

echo
echo "== imports mentioning affected xDS/HTTP/2 identifiers =="
rg -n "google\.golang\.org/grpc/internal/xds|google\.golang\.org/grpc/xds|xDS|xds|internal/xds|rbac|RBAC|Http2|HTTP/2|rapid|reset" -S . --glob '*.go' --glob 'go.mod' --glob '*.md' || true

echo
echo "== go.mod grpc entry =="
rg -n "google\.golang\.org/grpc" go.mod go.sum || true

Repository: openshift/cluster-samples-operator

Length of output: 50391

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== go.mod gRPC dependency chain =="
python3 - <<'PY'
from pathlib import Path
p=Path('go.mod')
text=p.read_text()
for line in text.splitlines():
    if 'google.golang.org/grpc' in line or 'google.golang.org/grpc/internal/xds' in line or 'google.golang.org/grpc/xds' in line:
        print(line)
PY

echo
echo "== non-vendor Go imports from google.golang.org/ packages =="
rg -n '^\t?import|^\t?"' --glob '*.go' . | rg 'google\.golang\.org/(grpc|protobuf|api|apis|genproto)' | head -200 || true

echo
echo "== direct source references to GRPAv0 internal/xds paths in non-vendor files =="
rg -n "google\.golang\.org/grpc/internal/xds|google\.golang\.org/grpc/xds|xDS" --glob '*.go' --glob '!vendor/**' . || true

echo
echo "== grpc serviceconfig usage in app package =="
rg -n "google\.golang\.org/grpc/serviceconfig|serviceconfig" --glob '*.go' --glob '!vendor/**' . || true

Repository: openshift/cluster-samples-operator

Length of output: 23161

Upgrade the vulnerable gRPC dependency before release.

google.golang.org/grpc v1.79.3 is below the fixed version v1.82.1 for GO-2026-6061. The dependency is still in the module graph as an indirect path, so update the dependency chain to v1.82.1 or later and regenerate go.mod/dependency metadata.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 92, Update the google.golang.org/grpc dependency from v1.79.3
to v1.82.1 or later through the module dependency chain, then regenerate go.mod
and related dependency metadata so the module graph consistently reflects the
fixed version.

Sources: Path instructions, Linters/SAST tools

google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/component-base v0.35.2 // indirect
k8s.io/klog/v2 v2.130.1 // indirect
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
k8s.io/component-base v0.36.3 // indirect
k8s.io/klog/v2 v2.140.0 // indirect
k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
k8s.io/streaming v0.36.3 // indirect
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.3 // indirect
sigs.k8s.io/yaml v1.6.0 // indirect
)
Loading