OCPBUGS-105319: update kubernetes api to v0.36.3 - #704
Conversation
WalkthroughThe pull request updates the container images to OpenShift 5.0, changes the module requirement to Go 1.26, and upgrades direct and indirect Go dependencies. ChangesToolchain and dependency upgrade
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: rhdmalone The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/cc @aroyoredhat |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 92: Update the google.golang.org/grpc dependency from v1.79.3 to v1.82.1
or later through the module dependency chain, then regenerate go.mod and related
dependency metadata so the module graph consistently reflects the fixed version.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| golang.org/x/time v0.14.0 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect | ||
| google.golang.org/grpc v1.79.3 // indirect |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
go list -deps ./... | rg '^google.golang.org/grpc(/|$)' || true
go list -m -f '{{.Path}} {{.Version}}' google.golang.org/grpcRepository: openshift/cluster-samples-operator
Length of output: 2935
🌐 Web query:
OSV GO-2026-6061 google.golang.org/grpc v1.82.1 fixed
💡 Result:
OSV GO-2026-6061 is a security vulnerability affecting the google.golang.org/grpc package, specifically within the xDS RBAC authorization engine and the HTTP/2 transport server implementation [1][2]. The issue is tracked under identifier GHSA-hrxh-6v49-42gf [3][2]. It has been fixed in version 1.82.1 [2][4]. Users are advised to upgrade to version 1.82.1 or higher to mitigate the risks, which include potential authorization bypasses and denial-of-service vulnerabilities [2][5].
Citations:
- 1: https://osv.dev/vulnerability/GO-2026-6061
- 2: GHSA-hrxh-6v49-42gf
- 3: https://pkg.go.dev/vuln/GO-2026-6061
- 4: https://github.com/grpc/grpc-go/releases/tag/v1.82.1
- 5: https://psirt.com/advisory/GO-2026-6061
🌐 Web query:
GO-2026-6061 grpc http2 xds rbac
💡 Result:
GO-2026-6061 is a security advisory published on July 27, 2026, concerning multiple vulnerabilities in the google.golang.org/grpc Go package [1][2]. The advisory affects versions prior to v1.82.1 [1]. The vulnerabilities addressed in this advisory involve two primary components of gRPC-Go: 1. xDS RBAC Authorization Engine: - Authorization Bypass (Fail-Open): An issue occurred when translating xDS RBAC policies that utilized Metadata or RequestedServerName fields, potentially leading to unauthorized access [3]. - Denial of Service (Server Panic): A runtime panic could be triggered by parsing crafted xDS RBAC policies that contained NOT rules wrapping unsupported fields, such as SourcedMetadata [3]. 2. HTTP/2 Transport Server Implementation: - Denial of Service (Rapid Reset Mitigation Bypass): Earlier mitigations in gRPC-Go for HTTP/2 Rapid Reset attacks were insufficient. They only applied threshold checks to items resulting in control frames written back to the wire (like SETTINGS ACKs or server-initiated RST_STREAMs), allowing attackers to bypass these limits during client-initiated stream resets [3]. To remediate these issues, users are advised to update to gRPC-Go v1.82.1 or later [1][2]. Additional mitigations for the HTTP/2 DoS include configuring upstream reverse proxies or load balancers (e.g., Envoy) with strict HTTP/2 max_concurrent_streams limits and active rate limiting on RST_STREAM frequency [3]. For xDS RBAC, operators should ensure that upstream xDS management servers do not push policies containing the problematic fields or rule configurations until the server has been patched [3].
Citations:
- 1: https://pkg.go.dev/vuln/GO-2026-6061
- 2: https://osv.dev/vulnerability/GO-2026-6061
- 3: https://osv.dev/GHSA-hrxh-6v49-42gf
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Go module/version files =="
git ls-files | rg '(^|/)(go\.mod|go\.sum|\.go)$' | head -200
echo
echo "== imports mentioning affected xDS/HTTP/2 identifiers =="
rg -n "google\.golang\.org/grpc/internal/xds|google\.golang\.org/grpc/xds|xDS|xds|internal/xds|rbac|RBAC|Http2|HTTP/2|rapid|reset" -S . --glob '*.go' --glob 'go.mod' --glob '*.md' || true
echo
echo "== go.mod grpc entry =="
rg -n "google\.golang\.org/grpc" go.mod go.sum || trueRepository: openshift/cluster-samples-operator
Length of output: 50391
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== go.mod gRPC dependency chain =="
python3 - <<'PY'
from pathlib import Path
p=Path('go.mod')
text=p.read_text()
for line in text.splitlines():
if 'google.golang.org/grpc' in line or 'google.golang.org/grpc/internal/xds' in line or 'google.golang.org/grpc/xds' in line:
print(line)
PY
echo
echo "== non-vendor Go imports from google.golang.org/ packages =="
rg -n '^\t?import|^\t?"' --glob '*.go' . | rg 'google\.golang\.org/(grpc|protobuf|api|apis|genproto)' | head -200 || true
echo
echo "== direct source references to GRPAv0 internal/xds paths in non-vendor files =="
rg -n "google\.golang\.org/grpc/internal/xds|google\.golang\.org/grpc/xds|xDS" --glob '*.go' --glob '!vendor/**' . || true
echo
echo "== grpc serviceconfig usage in app package =="
rg -n "google\.golang\.org/grpc/serviceconfig|serviceconfig" --glob '*.go' --glob '!vendor/**' . || trueRepository: openshift/cluster-samples-operator
Length of output: 23161
Upgrade the vulnerable gRPC dependency before release.
google.golang.org/grpc v1.79.3 is below the fixed version v1.82.1 for GO-2026-6061. The dependency is still in the module graph as an indirect path, so update the dependency chain to v1.82.1 or later and regenerate go.mod/dependency metadata.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 92, Update the google.golang.org/grpc dependency from v1.79.3
to v1.82.1 or later through the module dependency chain, then regenerate go.mod
and related dependency metadata so the module graph consistently reflects the
fixed version.
Sources: Path instructions, Linters/SAST tools
|
/retitle OCPBUGS-105319: update kubernetes api to v0.36.3 |
openshift-ci
Bot
changed the title
openshift-ci-robot
added
jira/valid-reference
|
@rhdmalone: This pull request references Jira Issue OCPBUGS-105319, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (aroyo@redhat.com), skipping review request. The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/retest-required |
|
/test e2e-aws |
|
@rhdmalone: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
update kubernetes api to v0.36.3
Jira: to do
Summary by CodeRabbit