Bump otelhttp to fix CVE-2023-45142

[jsafrane]

Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc to fix CVE-2023-47108.

See GHSA-8pgv-569h-w5rw for details.

I had to rework how OpenTelemetry is used by the CSI driver gRPC connection. I was not able to test it though.

[github-actions]

Code Coverage Diff

File	Old Coverage	New Coverage	Delta
github.com/kubernetes-sigs/aws-ebs-csi-driver/pkg/driver/driver.go	31.9%	32.4%	0.5

[torredil]

Hi @jsafrane thank you for this

make verify needs fixing, otherwise lgtm:

pkg/driver/driver.go:158:56: SA1019: otelgrpc.UnaryServerInterceptor is deprecated: Use [NewServerHandler] instead. (staticcheck)
		grpcInterceptor = grpc.ChainUnaryInterceptor(logErr, otelgrpc.UnaryServerInterceptor())

[jsafrane]

@torredil I just pushed a second commit reworking how OpenTelemetry is injected into gRPC, however, I have no means to test it.

[jsafrane]

/test pull-aws-ebs-csi-driver-test-helm-chart
I did not touch these parts

[jsafrane]

/retest

Did I break anything?

An error occurred (InvalidIdentityToken) when calling the AssumeRoleWithWebIdentity operation: No OpenIDConnect provider found in your account for https://oidc.eks.us-east-2.amazonaws.com/id

[torredil]

@jsafrane This is related to #1856 (comment)
@dims looks like OIDC provider used by helm job got cleaned up

[dims]

@dims looks like OIDC provider used by helm job got cleaned up

@torredil can you create it again? (and let me know the ID/arn or something?)

[torredil]

@dims The failure here is coming from IRSA on the CI cluster failing to get the role for the CI job. All jobs referencing serviceAccountName: aws-shared-testing-role are affected: https://github.com/kubernetes/test-infra/blob/2d18966d141e46d2508c9f414bfcba015a95f8e4/config/jobs/kubernetes-sigs/aws-ebs-csi-driver/aws-ebs-csi-driver-presubmits.yaml#L46

Same issue observed for the cloud-provider-aws-e2e periodic: https://testgrid.k8s.io/provider-aws-periodics#ci-cloud-provider-aws-e2e:

An error occurred (InvalidIdentityToken) when calling the AssumeRoleWithWebIdentity operation: No OpenIDConnect provider found in your account for https://oidc.eks.us-east-2.amazonaws.com/id/F8B73554FE6FBAF9B19569183FB39762
make: *** [Makefile:245: test-helm-chart] Error 255

[torredil]

Relevant OIDC uri is defined here: https://github.com/kubernetes/k8s.io/blob/fbd00807fdc12dcd2ec0d222cc6c4056974ac7a4/infra/gcp/terraform/k8s-infra-prow-build/iam.tf#L37

[torredil]

/retest

[torredil]

/retest

[ConnorJC3]

/lgtm
/approve

approving so this merges as soon as CI fixes

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ConnorJC3

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [ConnorJC3]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[torredil]

/retest

[AndrewSirenko]

/retest