[WIP] Replace kube-rbac-proxy sidecar with controller-runtime FilterProvider#502
Open
alebedev87 wants to merge 1 commit into
Open
[WIP] Replace kube-rbac-proxy sidecar with controller-runtime FilterProvider#502alebedev87 wants to merge 1 commit into
kube-rbac-proxy sidecar with controller-runtime FilterProvider#502alebedev87 wants to merge 1 commit into
Conversation
…ider` WIP — temporary commit to save progress. Co-Authored-By: Claude
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
📝 WalkthroughWalkthroughThe PR removes the Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning, 1 inconclusive)
✅ Passed checks (12 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)level=error msg="Running error: context loading failed: failed to load packages: failed to load packages: failed to load with go/packages: err: exit status 1: stderr: go: inconsistent vendoring in :\n\tgithub.com/Azure/azure-sdk-for-go@v60.1.0+incompatible: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tgithub.com/Azure/go-autorest/autorest@v0.11.27: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tgithub.com/Azure/go-autorest/autorest/adal@v0.9.20: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tgithub.com/aws/aws-sdk-go-v2@v1.41.7: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tgithub.com/aws/aws-sdk-go-v2/config@v1.32.17: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tgithub.com/aws/aws-sdk-go-v2/credentials@v1.19.16: is explicitly required in go.mod, but not marked as explicit in vendor/module ... [truncated 17324 characters] ... red in go.mod, but not marked as explicit in vendor/modules.txt\n\tsigs.k8s.io/kustomize/cmd/config@v0.14.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tsigs.k8s.io/kustomize/kyaml@v0.17.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tsigs.k8s.io/randfill@v1.0.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tsigs.k8s.io/structured-merge-diff/v4@v4.6.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tsigs.k8s.io/yaml@v1.4.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\n\tTo ignore the vendor directory, use -mod=readonly or -mod=mod.\n\tTo sync the vendor directory, run:\n\t\tgo mod vendor\n" Comment |
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@config/default/manager_insecure_tls_auth_proxy_patch.yaml`:
- Around line 1-3: The patch omits the `--metrics-tls-cert-dir` flag, causing
the operator to default to `/var/run/secrets/serving-cert` even though no cert
volume is mounted in this development/testing configuration. Add an explicit
`--metrics-tls-cert-dir` argument to the manager container args in the patch and
set it to an empty string or a temporary directory path so that self-signed
metrics certificates are generated in a writable location instead of the missing
mounted volume.
In `@go.mod`:
- Line 115: The go.opentelemetry.io/otel/sdk dependency is pinned to v1.33.0
which contains security vulnerabilities that are only fixed in v1.43.0 or later.
Update the go.opentelemetry.io/otel/sdk version from v1.33.0 to v1.43.0 in the
go.mod file. After updating, also refresh any dependent OTLP modules that
reference go.opentelemetry.io/otel/sdk to maintain version coherence across all
module dependencies.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: c21c0e2e-83b7-4804-8a26-62c854f58c6d
⛔ Files ignored due to path filters (287)
go.sumis excluded by!**/*.sumvendor/cel.dev/expr/.bazelversionis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/.gitattributesis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/CODE_OF_CONDUCT.mdis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/GOVERNANCE.mdis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/MAINTAINERS.mdis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/MODULE.bazelis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/README.mdis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/WORKSPACEis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/WORKSPACE.bzlmodis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/checked.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/cloudbuild.yamlis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/eval.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/explain.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/regen_go_proto.shis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/regen_go_proto_canonical_protos.shis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/syntax.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/value.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/antlrdoc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/atn.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/atn_config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/atn_config_set.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/atn_deserialization_options.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/atn_deserializer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/atn_simulator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/atn_state.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/atn_type.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/char_stream.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/common_token_factory.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/common_token_stream.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/comparators.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/configuration.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/dfa.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/dfa_serializer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/dfa_state.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/diagnostic_error_listener.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/error_listener.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/error_strategy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/file_stream.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/input_stream.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/int_stream.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/interval_set.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/jcollect.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/lexer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/lexer_action.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/lexer_action_executor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/lexer_atn_simulator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/ll1_analyzer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/nostatistics.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/parser.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/parser_atn_simulator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/parser_rule_context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/prediction_context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/prediction_context_cache.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/prediction_mode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/recognizer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/rule_context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/semantic_context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/statistics.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/stats_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/token.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/token_source.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/token_stream.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/tokenstream_rewriter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/trace_listener.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/transition.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/tree.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/trees.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/utils.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/backoff.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/exponential.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/retry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/ticker.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/timer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/tries.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/cel.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/decls.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/env.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/folding.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/inlining.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/io.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/library.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/macro.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/optimizer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/options.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/program.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/validator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/checker.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/cost.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/decls/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/decls/decls.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/env.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/format.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/mapping.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/options.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/printer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/scopes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/ast/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/ast/ast.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/ast/conversion.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/ast/expr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/ast/factory.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/ast/navigable.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/containers/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/containers/container.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/cost.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/debug/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/debug/debug.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/decls/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/decls/decls.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/error.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/functions/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/functions/functions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/location.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/operators/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/operators/operators.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/overloads/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/overloads/overloads.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/runes/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/runes/buffer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/source.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/stdlib/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/stdlib/standard.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/any_value.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/bool.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/bytes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/compare.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/double.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/duration.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/err.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/int.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/iterator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/json_value.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/list.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/map.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/null.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/object.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/optional.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/overflow.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/pb/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/pb/checked.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/pb/enum.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/pb/equal.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/pb/file.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/pb/pb.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/pb/type.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/provider.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/ref/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/ref/provider.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/ref/reference.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/string.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/timestamp.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/comparer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/container.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/field_tester.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/indexer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/iterator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/lister.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/mapper.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/matcher.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/math.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/receiver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/sizer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/traits.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/zeroer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/uint.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/unknown.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/util.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/bindings.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/comprehensions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/encoders.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/formatting.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/guards.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/lists.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/math.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/native.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/protos.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/sets.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/strings.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/activation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/attribute_patterns.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/attributes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/decorators.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/dispatcher.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/evalstate.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/functions/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/functions/functions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/interpretable.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/interpreter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/optimizations.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/planner.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/prune.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/runtimecost.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/BUILD.bazelis excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/CEL.g4is excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/CEL.interpis excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/CEL.tokensis excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/CELLexer.interpis excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/CELLexer.tokensis excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/cel_base_listener.gois excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/cel_base_visitor.gois excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/cel_lexer.gois excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/cel_listener.gois excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/cel_parser.gois excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/cel_visitor.gois excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/doc.gois excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/generate.shis excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/helper.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/input.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/macro.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/options.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/parser.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/unescape.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/unparser.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/compile.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/fuzz.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/parse.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/convert.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/fieldmask.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/handler.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_httpbodyproto.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_json.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_jsonpb.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_proto.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshaler.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshaler_registry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/pattern.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/proto2_convert.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/query.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/pattern.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/readerfactory.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/string_array_flag.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/trie.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/.golangci.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/camel.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/helper.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/kebab.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/snake.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/clients.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/exporter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/attribute.gois excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (13)
bundle/manifests/external-dns-operator.clusterserviceversion.yamlconfig/default/kustomization.yamlconfig/default/manager_auth_proxy_patch.yamlconfig/default/manager_insecure_tls_auth_proxy_patch.yamlconfig/manager/manager.yamlconfig/rbac/auth_proxy_role.yamlconfig/rbac/auth_proxy_role_binding.yamlconfig/rbac/kustomization.yamlconfig/rbac/role.yamlgo.modmain.gopkg/operator/config/config.gopkg/operator/operator.go
💤 Files with no reviewable changes (3)
- config/rbac/kustomization.yaml
- config/rbac/auth_proxy_role.yaml
- config/rbac/auth_proxy_role_binding.yaml
Comment on lines
+1
to
+3
| # This patch configures metrics with secure serving but without | ||
| # external TLS certificates (controller-runtime will generate self-signed certs). | ||
| # Use for development/testing environments only. |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Expect to see a non-empty DefaultMetricsTLSCertDir and operator wiring that assigns it to metrics CertDir.
rg -n -C3 'DefaultMetricsTLSCertDir|MetricsTLSCertDir|metrics-tls-cert-dir|SecureMetrics|CertDir' --glob '*.go' --glob '*.yaml' --glob '*.yml'
python - <<'PY'
from pathlib import Path
patch = Path("config/default/manager_insecure_tls_auth_proxy_patch.yaml").read_text()
print("insecure patch has metrics-tls-cert-dir arg:", "--metrics-tls-cert-dir" in patch)
print("insecure patch mounts serving-cert path:", "/var/run/secrets/serving-cert" in patch)
PYRepository: openshift/external-dns-operator
Length of output: 32244
Override the TLS cert dir for the self-signed metrics patch.
This patch omits --metrics-tls-cert-dir, so the operator defaults to /var/run/secrets/serving-cert even though no cert volume is mounted. For self-signed metrics in development/testing, explicitly pass an empty cert dir to use the temporary directory.
Proposed fix
- --metrics-bind-address=:8443
- --secure-metrics
+ - --metrics-tls-cert-dir=
- --operator-namespace=$(OPERATOR_NAMESPACE)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@config/default/manager_insecure_tls_auth_proxy_patch.yaml` around lines 1 -
3, The patch omits the `--metrics-tls-cert-dir` flag, causing the operator to
default to `/var/run/secrets/serving-cert` even though no cert volume is mounted
in this development/testing configuration. Add an explicit
`--metrics-tls-cert-dir` argument to the manager container args in the patch and
set it to an empty string or a temporary directory path so that self-signed
metrics certificates are generated in a writable location instead of the missing
mounted volume.
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.33.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.33.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
curl -sS https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{
"package": {"ecosystem":"Go","name":"go.opentelemetry.io/otel/sdk"},
"version":"1.33.0"
}' | jq '{id: .id, aliases: .aliases, summary: .summary, affected: .affected}'Repository: openshift/external-dns-operator
Length of output: 150
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Query OSV for ALL vulnerabilities in this package (not pinned to version)
curl -sS https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{
"package": {"ecosystem":"Go","name":"go.opentelemetry.io/otel/sdk"}
}' | jq '.vulns[] | {id, aliases, summary, affected: (.affected[0] | {versions, ranges})}'Repository: openshift/external-dns-operator
Length of output: 1413
🌐 Web query:
GO-2026-4394 vulnerability go.opentelemetry.io/otel/sdk
💡 Result:
GO-2026-4394 is a security vulnerability in the go.opentelemetry.io/otel/sdk package, identified by CVE-2026-24051 and GHSA-9h8m-3fm2-qjrq [1][2]. Vulnerability Details: The vulnerability is an Untrusted Search Path issue (CWE-426) affecting the resource detection code within the SDK [3][4]. Specifically, the SDK would execute system commands using a bare name, which allowed the PATH environment variable to be manipulated to point to a malicious binary [3][4]. By placing a malicious executable earlier in the search path, an attacker with local access could achieve arbitrary code execution in the context of the application [3][4]. Affected Versions and Fixes: The vulnerability was introduced in version 1.21.0 and addressed in version 1.40.0, which updated the SDK to use absolute paths for the affected commands [1][5][4]. Note on Related Vulnerabilities: A follow-up vulnerability, CVE-2026-39883 (GHSA-hfvc-g4fc-pqhx), was identified because the fix for GO-2026-4394 only addressed the issue for macOS/Darwin systems while leaving other BSD and Solaris platforms vulnerable [6][7]. That subsequent issue was fixed in version 1.43.0 [6]. Users are advised to upgrade to the latest available version of the SDK to ensure both issues are mitigated [6][8].
Citations:
- 1: https://pkg.go.dev/vuln/GO-2026-4394
- 2: https://go.googlesource.com/vulndb/+/1ce1ea923dd2fd0db2b8e35ca60f25096e9f242c/data/reports/GO-2026-4394.yaml
- 3: https://security.snyk.io/vuln/SNYK-GOLANG-GOOPENTELEMETRYIOOTELSDKRESOURCE-15182758
- 4: https://deps.dev/advisory/osv/GHSA-9h8m-3fm2-qjrq
- 5: https://osv.dev/vulnerability/GO-2026-4394
- 6: https://nvd.nist.gov/vuln/detail/cve-2026-39883
- 7: googleapis/google-cloud-go@b4c40aa
- 8: https://pkg.go.dev/go.opentelemetry.io/otel/sdk@v1.39.0
Upgrade go.opentelemetry.io/otel/sdk to v1.43.0 or later before merge.
Line 115 pins go.opentelemetry.io/otel/sdk v1.33.0, which is vulnerable to GO-2026-4394 (CVE-2026-24051 / GHSA-9h8m-3fm2-qjrq). This PATH hijacking vulnerability enables arbitrary code execution in versions 1.21.0 through 1.39.0. While v1.40.0 fixes this issue, a follow-up vulnerability (CVE-2026-39883) was discovered in the same code path, fixed only in v1.43.0. Upgrade to v1.43.0 and refresh dependent OTLP modules to keep versions coherent.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 115-115: go.opentelemetry.io/otel/sdk 1.33.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
(GO-2026-4394)
[HIGH] 115-115: go.opentelemetry.io/otel/sdk 1.33.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
[HIGH] 115-115: go.opentelemetry.io/otel/sdk 1.33.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 115, The go.opentelemetry.io/otel/sdk dependency is pinned to
v1.33.0 which contains security vulnerabilities that are only fixed in v1.43.0
or later. Update the go.opentelemetry.io/otel/sdk version from v1.33.0 to
v1.43.0 in the go.mod file. After updating, also refresh any dependent OTLP
modules that reference go.opentelemetry.io/otel/sdk to maintain version
coherence across all module dependencies.
Sources: Coding guidelines, Linters/SAST tools
Contributor
|
@alebedev87: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.