Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OCPBUGS-7676: Update helm to v3.11.1 for CVE-2023-25165 #474

Closed
wants to merge 51 commits into from

Conversation

tmshort
Copy link
Contributor

@tmshort tmshort commented Mar 15, 2023

Also syncs everything from upstream repos as of 2023-03-15.

@openshift-ci-robot openshift-ci-robot added jira/severity-low Referenced Jira bug's severity is low for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Mar 15, 2023
@openshift-ci-robot
Copy link

@tmshort: This pull request references Jira Issue OCPBUGS-7676, which is invalid:

  • expected the bug to target the "4.14.0" version, but it targets "4.13.0" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Also syncs everything from upstream repos as of 2023-03-15.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot requested review from ankitathomas and awgreene March 15, 2023 14:27
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Mar 15, 2023

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tmshort
Once this PR has been reviewed and has the lgtm label, please assign anik120 for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tmshort
Copy link
Contributor Author

tmshort commented Mar 15, 2023

/retest

@anik120
Copy link
Contributor

anik120 commented Mar 15, 2023

@tmshort the "syncing everything from upstream" part consists of a lot of bug fixes. Are we okay with asking QE to do bulk testing using a single PR?

Last I remember we were not doing bulk syncs since it's harder for QE to test, or much harder for us to quickly revert if we inadvertently break Openshift CI.

Not sure if the process/messaging/thinking around those have changed recently.

@tmshort
Copy link
Contributor Author

tmshort commented Mar 16, 2023

@tmshort the "syncing everything from upstream" part consists of a lot of bug fixes. Are we okay with asking QE to do bulk testing using a single PR?

Last I remember we were not doing bulk syncs since it's harder for QE to test, or much harder for us to quickly revert if we inadvertently break Openshift CI.

Not sure if the process/messaging/thinking around those have changed recently.

The helm CVE changes require updates to k8s 1.26, so many other changes need/should be pulled in.

@perdasilva has another bulk-sync PR #465 that this is based on, so he and I were thinking the same thing (I think!).
@kevinrizza thoughts?

@anik120
Copy link
Contributor

anik120 commented Mar 16, 2023

The helm CVE changes require updates to k8s 1.26, so many other changes need/should be pulled in.

Sounds like the ordering should then be:

  1. Pull in all previous bug fixes/commits individually
  2. Pull in k8s 1.26 changes
  3. Pull in helm CVE changes

That way we can hand QE individual pieces to test (and diagnose/dissect individual commits if problems arise)

@tmshort
Copy link
Contributor Author

tmshort commented Mar 16, 2023

The helm and 1.26 changes are already upstream as a single commit/merge (operator-framework/operator-lifecycle-manager#2933), so step 1 effectively encompasses everything (hence this PR).

Also, the CIs likely won't pass until the final step (see #465). If we're OK with that, then I can break this up, into at least 2 steps.

I could separate out the helm+1.26 changes into a separate PR after getting the rest of the upstream fixes merged.
The helm changes themselves are relatively minor (really just go.mod/go.sum), so steps 2 and 3 could be combined.

EDIT: I didn't realize that you suggested step 1 to be individual commits, see my next comment.

@tmshort
Copy link
Contributor Author

tmshort commented Mar 16, 2023

/test e2e-gcp-ovn

@tmshort
Copy link
Contributor Author

tmshort commented Mar 16, 2023

That way we can hand QE individual pieces to test (and diagnose/dissect individual commits if problems arise)

Hmm... we are very far behind, and @perdasilva was trying to get us ahead. Given the number of upstream commits, that's a lot of effort (it's really just getting PRs tested and approved, as demonstrated by this PR, all the code has been merged locally).

I'm concerned about the calendar time this will take, and getting the CI tests to behave.

@anik120
Copy link
Contributor

anik120 commented Mar 16, 2023

That way we can hand QE individual pieces to test (and diagnose/dissect individual commits if problems arise)

Hmm... we are very far behind, and @perdasilva was trying to get us ahead. Given the number of upstream commits, that's a lot of effort (it's really just getting PRs tested and approved, as demonstrated by this PR, all the code has been merged locally).

I'm concerned about the calendar time this will take, and getting the CI tests to behave.

I see the point. We shouldn't however push the pain from us to QE because we're far behind though.

Also, if we can guarantee we'll not break anything in openshift with any of the commit, thereby requiring a full revert of all the PR later on, then we can say we can avoid any pain for ourselves now. But can we 100% guarantee something like that won't happen? :)

@tmshort
Copy link
Contributor Author

tmshort commented Mar 16, 2023

Also, if we can guarantee we'll not break anything in openshift with any of the commit, thereby requiring a full revert of all the PR later on, then we can say we can avoid any pain for ourselves now. But can we 100% guarantee something like that won't happen? :)

Understood. Would you be more comfortable with small groupings of commits (say two or three)? That will reduce the time/effort to a-half or a-third? There are ~50 (depending on how you count) commits to be downstreamed.

@tmshort
Copy link
Contributor Author

tmshort commented Mar 16, 2023

I was trying to bisect the PR list to figure out what broke what test, but splitting things up will make it easier to find those problems.

EDIT: Given that this uses merge commits, it should be fairly easy to identify the broken individual commit, and roll back if necessary, assuming each batch starts at the tip.

@tmshort
Copy link
Contributor Author

tmshort commented Mar 16, 2023

After speaking with @kevinrizza, I'll probably do it as individual or small batches (2 or 3) commits at a time. Are you good with that @anik120 ?

bcrochet and others added 10 commits March 16, 2023 16:08
…shift#255)

If the bundle is not present, the current bundleLoader will panic
when it gets to addChannelsFromAnnotationsFile. If the bundle is
nil, addChannelsFromAnnotationsFile should not attempt to do anything
so instead it just returns now.

Signed-off-by: Brad P. Crochet <brad@redhat.com>

Signed-off-by: Brad P. Crochet <brad@redhat.com>
Upstream-repository: api
Upstream-commit: 5f99430d4ec47d59daafa3b818229f0466531dea
Signed-off-by: Jordan <jordan@nimblewidget.com>

Signed-off-by: Jordan <jordan@nimblewidget.com>
Upstream-repository: api
Upstream-commit: 7339a22050af53df7b6f97a652b8e2d73698765a
updated

format

defs

Upstream-repository: api
Upstream-commit: ff2dbc53d3817df9b62a83dbe83cb221e7c043f4
…nshift#262)

Signed-off-by: timflannagan <timflannagan@gmail.com>
Upstream-repository: api
Upstream-commit: 72295edd2bb11d414a1db6d6643fe3f3918c5ae4
…enshift#264)

Signed-off-by: timflannagan <timflannagan@gmail.com>

Signed-off-by: timflannagan <timflannagan@gmail.com>
Upstream-repository: api
Upstream-commit: e4d13db375b88f764a953ce34925e4ad4e79e5fa
Signed-off-by: timflannagan <timflannagan@gmail.com>
Upstream-repository: api
Upstream-commit: 4d4ed5a299506cab8898036a873031e6faa4b0fd
This PR upgrades the version of yq used in the makefile from
v3@latest to v4@v4.28.1

Upstream-repository: api
Upstream-commit: b527a19c8e14e2249d5a5cdb88063cfb136fdafb
* update k8s 1.25 validation logic

to look for deprecated k8s APIs in various CSV fields

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* update validation logic

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* remove debug statements

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>
Upstream-repository: api
Upstream-commit: b611f6cef49cb8c6d621145c4e31d8ddfd4c59f4
…ng a warning (openshift#274)

* fix a bug in k8s 1.25 validation logic

to now check the apiGroup/resource to determine if an api is deprecated.

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* update warning and error checks to use a map

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>
Upstream-repository: api
Upstream-commit: f1b729684854a053f229464eb327527222188fd1
Bumps [golang.org/x/text](https://github.com/golang/text) from 0.3.7 to 0.3.8.
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.3.7...v0.3.8)

Upstream-repository: api
Upstream-commit: e8bb2e01756424cd3de5ec8521ef370623459cae

---
updated-dependencies:
- dependency-name: golang.org/x/text
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
awgreene and others added 19 commits March 16, 2023 16:08
This commit updates the goreleaser github action to install QMEU to
support emulation of multiple architectures.

Signed-off-by: Alexander Greene <greene.al1991@gmail.com>
Upstream-repository: operator-lifecycle-manager
Upstream-commit: dac8182eb62acc1cb489d17ccc34f243f43d4f94
* opm serve: use pre-existing cache, if set and up-to-date

Signed-off-by: Joe Lanford <joe.lanford@gmail.com>

* refactor to leave NewQuerier function untouched

Signed-off-by: Joe Lanford <joe.lanford@gmail.com>

Signed-off-by: Joe Lanford <joe.lanford@gmail.com>
Upstream-repository: operator-registry
Upstream-commit: 494b68e62a814a891821aeb2bd28f33abc1624ff
Signed-off-by: Jordan Keister <jordan@nimblewidget.com>

Signed-off-by: Jordan Keister <jordan@nimblewidget.com>
Upstream-repository: operator-registry
Upstream-commit: bd3c80489dbf6942005c345a33733fb782e952fe
Signed-off-by: Austin Macdonald <austin@redhat.com>

Signed-off-by: Austin Macdonald <austin@redhat.com>
Upstream-repository: operator-registry
Upstream-commit: 6d762ada58dfd90f41cc002d8f34c01811312f6f
Signed-off-by: Jordan Keister <jordan@nimblewidget.com>

Signed-off-by: Jordan Keister <jordan@nimblewidget.com>
Upstream-repository: operator-registry
Upstream-commit: 979865370ec633e0f6b711be50a93dccf6d4fbe5
Signed-off-by: jcho02 <jason.cho2@ibm.com>

Signed-off-by: jcho02 <jason.cho2@ibm.com>
Upstream-repository: operator-registry
Upstream-commit: 0271e7847d0b71cd969a2426f5532a4cb1cddd40
…be empty in error scenario (#1032)

Signed-off-by: Adam D. Cornett <adc@redhat.com>

Signed-off-by: Adam D. Cornett <adc@redhat.com>
Upstream-repository: operator-registry
Upstream-commit: d888b725a43440428800c3eea06adaafe1110a56
Signed-off-by: Jordan Keister <jordan@nimblewidget.com>

Signed-off-by: Jordan Keister <jordan@nimblewidget.com>
Upstream-repository: operator-registry
Upstream-commit: 89594183c5c9ea38c183d2f38c2644dba0f37024
…e (#1043)

Signed-off-by: Joe Lanford <joe.lanford@gmail.com>

Signed-off-by: Joe Lanford <joe.lanford@gmail.com>
Upstream-repository: operator-registry
Upstream-commit: 0080ea0a938fdb91662a6ca36387aa71d3a52b28
* update render unmarshal failures

Signed-off-by: Jordan Keister <jordan@nimblewidget.com>

* revamp for pretty format, error.As approach

Signed-off-by: Jordan Keister <jordan@nimblewidget.com>

Signed-off-by: Jordan Keister <jordan@nimblewidget.com>
Upstream-repository: operator-registry
Upstream-commit: 249ae621bb8fa6fc8a8e4a5ae26355577393f127
* initial implementation pass

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* initial implementation pass

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* update implementation

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* add unit tests

and any changes necessary in relation to adding unit tests.

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* verify schemas and fail if they don't match

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* add better validations and decrease some code duplication

as well as add the necessary additional test cases

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* remove some TODO comments and hardcode containerTool as 'docker'

as per review comments

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

* update the custom veneer builder

to work like the other veneer builders by reading a full FBC from STDOUT
and writing it to the output destination in the custom veneer config.
Also adds additional test cases to cover the new changes.

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>

Signed-off-by: Bryce Palmer <bpalmer@redhat.com>
Upstream-repository: operator-registry
Upstream-commit: 104e0276e46d4aae6d4d8b364c03576893229e71
Signed-off-by: Joe Lanford <joe.lanford@gmail.com>

Signed-off-by: Joe Lanford <joe.lanford@gmail.com>
Upstream-repository: operator-registry
Upstream-commit: b7307b57c5f67b296098e66bfe38458e762c99aa
…st on generated files (#1060)

Signed-off-by: Jordan <jordan@nimblewidget.com>

Signed-off-by: Jordan <jordan@nimblewidget.com>
Upstream-repository: operator-registry
Upstream-commit: 67e6777b5f5f9d337b94da98b8c550c231a8b47c
…ring (#1063)

* exclude bundles with `olm.deprecated` property when rendering

Signed-off-by: Rashmi Gottipati <chowdary.grashmi@gmail.com>

* Exclude bundles based on the property type and not value

Signed-off-by: Rashmi Gottipati <chowdary.grashmi@gmail.com>

---------

Signed-off-by: Rashmi Gottipati <chowdary.grashmi@gmail.com>
Upstream-repository: operator-registry
Upstream-commit: 0aeffa3f44f5e36bd2c0bcc63a94eda000a5f257
* rename template to veneer

Signed-off-by: Jordan Keister <jordan@nimblewidget.com>

* fixing some utest

Signed-off-by: Jordan Keister <jordan@nimblewidget.com>

* adding cobra exit-status consistency through command hierarchy, adding temp skips of failing utests until we get the new release

Signed-off-by: Jordan Keister <jordan@nimblewidget.com>

---------

Signed-off-by: Jordan Keister <jordan@nimblewidget.com>
Upstream-repository: operator-registry
Upstream-commit: 57a959da1177335976c5efcc592cc423ff90e2cd
Signed-off-by: Jordan Keister <jordan@nimblewidget.com>
Upstream-repository: operator-registry
Upstream-commit: 1446d7be762d9eb3c88dddb2828a61debdcd6cd6
Signed-off-by: Jordan Keister <jordan@nimblewidget.com>
Upstream-repository: operator-registry
Upstream-commit: 0a7ff74f9fc6c92be12a48a0f8e67ecfb6a8e60e
Signed-off-by: perdasilva <perdasilva@redhat.com>
Update go.mod, go.sum and vendor directory via go mod tidy|vendor

Signed-off-by: Todd Short <todd.short@me.com>
Don't update pkg/manifests/csv.yaml

Signed-off-by: Todd Short <todd.short@me.com>
@anik120
Copy link
Contributor

anik120 commented Mar 20, 2023

After speaking with @kevinrizza, I'll probably do it as individual or small batches (2 or 3) commits at a time. Are you good with that @anik120 ?

Yup sounds good to me, thanks Todd!

I'm going to close #473 with a comment in https://issues.redhat.com/browse/OCPBUGS-7910 that a batch PR will pick this up and move the ticket to post.

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 28, 2023
@openshift-merge-robot
Copy link
Contributor

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Mar 28, 2023

@tmshort: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/images bac11fa link true /test images
ci/prow/unit-psm bac11fa link true /test unit-psm
ci/prow/e2e-gcp-ovn bac11fa link true /test e2e-gcp-ovn
ci/prow/verify bac11fa link true /test verify
ci/prow/unit-olm bac11fa link true /test unit-olm
ci/prow/e2e-gcp-olm bac11fa link true /test e2e-gcp-olm
ci/prow/e2e-upgrade bac11fa link true /test e2e-upgrade
ci/prow/unit-registry bac11fa link true /test unit-registry
ci/prow/unit-api bac11fa link true /test unit-api
ci/prow/e2e-gcp-olm-flaky bac11fa link false /test e2e-gcp-olm-flaky
ci/prow/e2e-gcp-console-olm bac11fa link true /test e2e-gcp-console-olm

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@openshift-bot
Copy link
Contributor

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

@openshift-ci openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 27, 2023
@tmshort tmshort closed this Jun 29, 2023
@openshift-ci-robot
Copy link

@tmshort: This pull request references Jira Issue OCPBUGS-7676. The bug has been updated to no longer refer to the pull request using the external bug tracker.

In response to this:

Also syncs everything from upstream repos as of 2023-03-15.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tmshort tmshort deleted the sync-2023-03-15 branch October 23, 2023 13:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. jira/severity-low Referenced Jira bug's severity is low for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD.
Projects
None yet
Development

Successfully merging this pull request may close these issues.