MCO-2244: Update MCO dependencies to Kubernetes 1.36 - #6321
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci
Bot
added
the
approved
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThe Docker build and Go dependency baselines advance to OpenShift 5.0 and Go 1.26. Controller, daemon, and operator event emissions now use explicit string format arguments without changing event conditions or control flow. ChangesPlatform and dependency updates
Estimated code review effort: 2 (Simple) | ~15 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 16: Update the final image stage based on FROM
registry.ci.openshift.org/ocp/5.0:base-rhel9 to add a HEALTHCHECK instruction
and set a non-root USER before ENTRYPOINT. Ensure the chosen user can execute
the entrypoint and that the container never runs as root.
- Line 5: Replace the broad COPY directives in both builder stages with explicit
copies of only the source files required by make install
DESTDIR=./instroot-rhel9 and make install DESTDIR=./instroot-rhel8. Update
Dockerfile lines 5-5 and 13-13 consistently, preserving each stage’s existing
build behavior while excluding sensitive and unnecessary context files.
In `@go.mod`:
- Line 222: Update the go.opentelemetry.io/otel/sdk dependency from v1.40.0 to a
patched release that invokes kenv using an absolute path, and regenerate the
vendor contents so vendor/go.opentelemetry.io/otel/sdk/resource/host_id.go
reflects the upgraded implementation.
In `@pkg/daemon/daemon.go`:
- Line 1548: Update the Eventf call in the Config Drift Monitor startup path so
ConfigDriftMonitorStarted remains the event reason, move the descriptive “Config
Drift Monitor started, watching against” text into the format argument, and
retain odc.currentConfig.Name as the formatted event detail.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.26-openshift-5.0 AS rhel9-builder | ||
| ARG TAGS="" | ||
| WORKDIR /go/src/github.com/openshift/machine-config-operator | ||
| COPY . . |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Avoid copying the entire build context.
Both builder stages copy the entire build context (COPY . .), which violates the container security path instructions. This practice can unintentionally include sensitive files or unnecessary dependencies, and it degrades layer caching.
Dockerfile#L5-L5: update toCOPYonly the specific source files needed formake install DESTDIR=./instroot-rhel9.Dockerfile#L13-L13: update toCOPYonly the specific source files needed formake install DESTDIR=./instroot-rhel8.
📍 Affects 1 file
Dockerfile#L5-L5(this comment)Dockerfile#L13-L13
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 5, Replace the broad COPY directives in both builder
stages with explicit copies of only the source files required by make install
DESTDIR=./instroot-rhel9 and make install DESTDIR=./instroot-rhel8. Update
Dockerfile lines 5-5 and 13-13 consistently, preserving each stage’s existing
build behavior while excluding sensitive and unnecessary context files.
Source: Path instructions
| RUN make install DESTDIR=./instroot-rhel8 | ||
|
|
||
| FROM registry.ci.openshift.org/ocp/4.22:base-rhel9 | ||
| FROM registry.ci.openshift.org/ocp/5.0:base-rhel9 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Apply required container security practices to the final image.
The final stage does not comply with the following container security path instructions:
- USER non-root: The final image must specify a non-root user (e.g.,
USER 1000orUSER nonroot) and never run as root. The stage inherits the default root user and does not switch users before theENTRYPOINT. - HEALTHCHECK defined: The image must define a
HEALTHCHECKinstruction to allow runtime orchestration tools to monitor the container's health.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 16, Update the final image stage based on FROM
registry.ci.openshift.org/ocp/5.0:base-rhel9 to add a HEALTHCHECK instruction
and set a non-root USER before ENTRYPOINT. Ensure the chosen user can execute
the entrypoint and that the container never runs as root.
Source: Path instructions
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.41.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.40.0 // indirect |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check if the vulnerable opentelemetry code exists in the vendor directory.
if [ -d "vendor/go.opentelemetry.io/otel/sdk" ]; then
rg -i "kenv" vendor/go.opentelemetry.io/otel/sdk || echo "kenv not found in vendored opentelemetry code."
else
echo "go.opentelemetry.io/otel/sdk is not vendored."
fiRepository: openshift/machine-config-operator
Length of output: 567
Upgrade go.opentelemetry.io/otel/sdk
vendor/go.opentelemetry.io/otel/sdk/resource/host_id.go still calls kenv without an absolute path, so go.opentelemetry.io/otel/sdk v1.40.0 remains exposed to GHSA-hfvc-g4fc-pqhx. Bump to a patched release.
🧰 Tools
🪛 OSV Scanner (2.4.0)
[HIGH] 222-222: go.opentelemetry.io/otel/sdk 1.40.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 222, Update the go.opentelemetry.io/otel/sdk dependency from
v1.40.0 to a patched release that invokes kenv using an absolute path, and
regenerate the vendor contents so
vendor/go.opentelemetry.io/otel/sdk/resource/host_id.go reflects the upgraded
implementation.
Sources: Path instructions, Learnings, Linters/SAST tools
|
/test unit |
|
/lgtm |
|
/lgtm please! |
|
Scheduling tests matching the |
|
/test e2e-aws-ovn |
|
/jira refresh |
|
@proietfb: No Jira issue is referenced in the title of this pull request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/test e2e-aws-ovn |
|
/retitle MCO-2244: Update MCO dependencies to Kubernetes 1.36 |
openshift-ci
Bot
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@proietfb: This pull request references MCO-2244 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
|
@proietfb: This pull request references MCO-2244 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/test e2e-aws-ovn |
2 similar comments
|
/test e2e-aws-ovn |
|
/test e2e-aws-ovn |
|
Caution Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted. Error details |
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
go.mod (1)
222-222: 🔒 Security & Privacy | 🟠 MajorDuplicate: upgrade
go.opentelemetry.io/otel/sdk.
v1.40.0remains affected by the BSDkenvPATH-hijacking vulnerability; the advisory listsv1.43.0as fixed. This is the same unresolved finding from the previous review—bump the SDK and regeneratevendor/. (osv.dev)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` at line 222, Upgrade the go.opentelemetry.io/otel/sdk dependency from v1.40.0 to at least the fixed v1.43.0 release, then regenerate the vendor directory so vendored sources and module metadata match the updated dependency.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 59: Update the google.golang.org/grpc dependency from v1.79.3 to a
version later than v1.82.1, then refresh the corresponding go.sum entries and
vendored dependencies.
---
Duplicate comments:
In `@go.mod`:
- Line 222: Upgrade the go.opentelemetry.io/otel/sdk dependency from v1.40.0 to
at least the fixed v1.43.0 release, then regenerate the vendor directory so
vendored sources and module metadata match the updated dependency.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| golang.org/x/time v0.11.0 | ||
| golang.org/x/net v0.57.0 | ||
| golang.org/x/time v0.15.0 | ||
| google.golang.org/grpc v1.79.3 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
curl -fsSL https://api.osv.dev/v1/query \
-H 'content-type: application/json' \
-d '{"package":{"ecosystem":"Go","name":"google.golang.org/grpc"},"version":"1.79.3"}' |
jq '.vulns[] | {id,summary,affected}'Repository: openshift/machine-config-operator
Length of output: 869
Upgrade google.golang.org/grpc past v1.82.1. v1.79.3 is affected by GHSA-hrxh-6v49-42gf; bump the pin and refresh go.sum/vendor/.
🧰 Tools
🪛 OSV Scanner (2.4.0)
[HIGH] 59-59: google.golang.org/grpc 1.79.3: gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 59, Update the google.golang.org/grpc dependency from v1.79.3
to a version later than v1.82.1, then refresh the corresponding go.sum entries
and vendored dependencies.
Source: Linters/SAST tools
openshift-ci
Bot
added
the
needs-rebase
|
/payload-job periodic-ci-openshift-release-main-ci-5.0-e2e-aws-upgrade-ovn-single-node periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-serial-1of2 periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview-serial-2of3 periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-ipv4 |
|
@proietfb: trigger 5 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/20333e40-8a97-11f1-82ae-5048d714fd97-0 |
|
/pipeline required |
|
Scheduling tests matching the |
|
/pipeline required |
|
Scheduling tests matching the |
|
/test e2e-aws-ovn-upgrade |
|
/payload-job periodic-ci-openshift-release-main-ci-5.0-e2e-aws-upgrade-ovn-single-node periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-serial-1of2 periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview-serial-2of3 periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-ipv4 periodic-ci-openshift-machine-config-operator-release-5.0-periodics-e2e-aws-mco-disruptive-techpreview-1of3 periodic-ci-openshift-machine-config-operator-release-5.0-periodics-e2e-aws-mco-disruptive-techpreview-2of3 periodic-ci-openshift-machine-config-operator-release-5.0-periodics-e2e-aws-mco-disruptive-techpreview-3of3 |
|
@proietfb: trigger 8 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/b6df6d70-8b26-11f1-86fe-bb8aa57890dc-0 |
|
/payload-job periodic-ci-openshift-machine-config-operator-release-5.0-periodics-e2e-aws-mco-disruptive-techpreview-1of3 |
|
@proietfb: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/9e029220-8b4c-11f1-8dc5-578e0d2ed6e6-0 |
openshift-ci
Bot
added
the
needs-rebase
openshift-ci
Bot
removed
the
needs-rebase
|
Scheduling tests matching the |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dkhater-redhat, isabella-janssen, proietfb The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/test unit |
|
/test e2e-hypershift |
|
@proietfb: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/verified by CI |
openshift-ci-robot
added
the
verified
|
@proietfb: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
4 participants
- What I did
k8s.io/kubernetesdependency to1.36.21.36.2k8s.io/cri-streamingandk8s.io/streamingnewopenshift/kubernetesdepsgithub.com/openshift/onsi-ginkgo/v2DockerfileandDockerfile.rhel7to be consistent with5.0refs- How to verify it
rg -e "1\.26\.0" go.modrg -ce "github\.com\/openshift\/kubernetes" go.mod==33rg -e "20260716191900-78acd4d422b2" go.mod -c==33- Description for the changelog
MCO-2244
Summary by CodeRabbit
Bug Fixes
%characters.Chores