chore (deps) : update controller-runtime to v0.23.1#1568
chore (deps) : update controller-runtime to v0.23.1#1568rohanKanojia wants to merge 3 commits intodevfile:mainfrom
Conversation
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: rohanKanojia The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/ok-to-test |
|
/retest |
rohanKanojia
force-pushed
the
pr/update-controller-runtime-0-22-4
branch
from
a4264d3 to
63ba147
Compare
rohanKanojia
changed the title
rohanKanojia
requested review from
akurinnoy,
dkwon17 and
ibuziuk
as code owners
rohanKanojia
force-pushed
the
pr/update-controller-runtime-0-22-4
branch
from
7f50c28 to
c5cca66
Compare
|
@rohanKanojia when you have a moment, could you please rebase? |
Signed-off-by: Rohan Kumar <rohaan@redhat.com>
…de to v0.23.1 Signed-off-by: Rohan Kumar <rohaan@redhat.com>
This method arguments were changed in controller-runtime v0.23.0.
Existing code of the form builder.WebhookManagedBy(mgr).For(&corev1.Deployment{}) has to be changed to builder.WebhookManagedBy(mgr, &appsv1.Deployment{})
Signed-off-by: Rohan Kumar <rohaan@redhat.com>
rohanKanojia
force-pushed
the
pr/update-controller-runtime-0-22-4
branch
from
c5cca66 to
d254509
Compare
📝 WalkthroughWalkthroughMultiple CRD manifest files updated with schema documentation changes: expanded taint toleration operators to include Lt/Gt comparisons, clarified container resizePolicy restrictions, removed RecoverVolumeExpansionFailure feature gate references, and added userAnnotations field to pod certificate configuration. Go dependency versions bumped. Webhook setup in main.go modified to pass DevWorkspace objects to NewWebhookManagedBy. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 99: Update the pinned vulnerable modules in go.mod: bump
go.opentelemetry.io/otel/sdk from v1.36.0 to at least v1.40.0 and
google.golang.org/grpc to at least v1.79.3 (these are the unique module names to
change), then run module resolution to refresh the go.sum (e.g., update
dependencies and run dependency tidy/resolve so the new versions are recorded
and checksums updated) and verify compilation and tests pass.
In `@main.go`:
- Around line 216-220: The webhook registration errors are currently only logged
and startup continues; change both ctrl.NewWebhookManagedBy(...).Complete()
error checks (for dwv1.DevWorkspace and dwv2.DevWorkspace using mgr) to treat
failures as fatal initialization errors: after logging the error with
setupLog.Error include a process-terminating action (consistent with other
main() setup steps), e.g. call os.Exit(1) or an equivalent fatal logger, so the
manager does not start in a degraded state when conversion webhook registration
fails.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: aefb06e4-2a5e-4ad1-b807-2739fec3e9ed
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (12)
deploy/bundle/manifests/controller.devfile.io_devworkspaceoperatorconfigs.yamldeploy/bundle/manifests/controller.devfile.io_devworkspaceroutings.yamldeploy/deployment/kubernetes/combined.yamldeploy/deployment/kubernetes/objects/devworkspaceoperatorconfigs.controller.devfile.io.CustomResourceDefinition.yamldeploy/deployment/kubernetes/objects/devworkspaceroutings.controller.devfile.io.CustomResourceDefinition.yamldeploy/deployment/openshift/combined.yamldeploy/deployment/openshift/objects/devworkspaceoperatorconfigs.controller.devfile.io.CustomResourceDefinition.yamldeploy/deployment/openshift/objects/devworkspaceroutings.controller.devfile.io.CustomResourceDefinition.yamldeploy/templates/crd/bases/controller.devfile.io_devworkspaceoperatorconfigs.yamldeploy/templates/crd/bases/controller.devfile.io_devworkspaceroutings.yamlgo.modmain.go
| go.opentelemetry.io/otel/sdk v1.34.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.35.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.36.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.36.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# 1) Confirm vulnerable versions are currently pinned in go.mod
rg -n 'go\.opentelemetry\.io/otel/sdk v1\.36\.0|google\.golang\.org/grpc v1\.72\.2' go.mod
# 2) Query OSV for each module@version
python - <<'PY'
import json
import urllib.request
targets = [
("go.opentelemetry.io/otel/sdk", "1.36.0"),
("google.golang.org/grpc", "1.72.2"),
]
for mod, ver in targets:
payload = json.dumps({
"package": {"ecosystem": "Go", "name": mod},
"version": ver
}).encode("utf-8")
req = urllib.request.Request(
"https://api.osv.dev/v1/query",
data=payload,
headers={"Content-Type": "application/json"},
)
with urllib.request.urlopen(req, timeout=20) as resp:
data = json.load(resp)
vulns = data.get("vulns", [])
print(f"\n{mod}@{ver}: {len(vulns)} vulnerability record(s)")
for v in vulns:
aliases = ",".join(v.get("aliases", []))
print(f"- {v.get('id')} aliases=[{aliases}]")
for a in v.get("affected", []):
for r in a.get("ranges", []):
for e in r.get("events", []):
if "fixed" in e:
print(f" fixed: {e['fixed']}")
PYRepository: devfile/devworkspace-operator
Length of output: 2773
🌐 Web query:
go.opentelemetry.io/otel/sdk v1.36.0 vulnerability CVE advisory
💡 Result:
The go.opentelemetry.io/otel/sdk v1.36.0 is vulnerable to CVE-2026-24051 (also known as GHSA-9h8m-3fm2-qjrq and GO-2026-4394). This is a high-severity vulnerability (CVSS 7.0-7.3) involving arbitrary code execution via PATH hijacking on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the 'ioreg' command without a secure PATH, allowing local attackers who can modify the PATH environment variable to execute malicious code in the application's context. Affected versions: v1.20.0 through v1.39.0 (specifically >=1.21.0, <1.40.0 in some reports). Fixed in v1.40.0 via commit d45961bcda453fcbdb6469c22d6e88a1f9970a53. Official advisory: GHSA-9h8m-3fm2-qjrq. Update to v1.40.0 or later. Only exploitable on macOS/Darwin with local PATH modification access.
Citations:
- 1: https://vulert.com/vuln-db/opentelemetry-go-sdk-vulnerable-to-arbitrary-code-execution-via-path-hijacking-in-go-opentelemetry-i-
- 2: https://opentelemetry.io/docs/security/cve/
- 3: https://scout.docker.com/vulnerabilities/id/CVE-2026-24051?n=sdk&ns=go.opentelemetry.io%2Fotel&s=github&t=golang&vr=%3E%3D1.21.0%2C%3C1.40.0
- 4: GHSA-9h8m-3fm2-qjrq
- 5: https://pkg.go.dev/vuln/GO-2026-4394
- 6: https://osv.dev/vulnerability/GO-2026-4394
- 7: https://vulert.com/vuln-db/CVE-2026-24051
- 8: https://nvd.nist.gov/vuln/detail/cve-2026-24051
🌐 Web query:
google.golang.org/grpc v1.72.2 vulnerability CVE advisory
💡 Result:
Yes, google.golang.org/grpc v1.72.2 is vulnerable to CVE-2026-33186, a critical authorization bypass vulnerability (CVSS 9.1). CVE-2026-33186 affects google.golang.org/grpc versions prior to 1.79.3. The issue is an authorization bypass in gRPC-Go servers due to improper validation of the HTTP/2 :path pseudo-header. The server accepts requests missing the leading slash in :path (e.g., "Service/Method" instead of "/Service/Method"). While routing succeeds, path-based authorization interceptors (like grpc/authz) evaluate the non-canonical path, bypassing "deny" rules that expect canonical paths with leading slashes if a fallback "allow" exists. This impacts servers using path-based auth interceptors with deny rules for canonical paths and a default allow. v1.72.2, released around early March 2026, is before the fixed v1.79.3 (March 17, 2026). Fix: Upgrade to v1.79.3 or later. Mitigations: Add unary interceptor to reject paths without leading slash; use reverse proxy to enforce HTTP/2 compliance; harden auth policies to avoid fallback allows. Official advisory: GHSA-p77j-4mvh-x3m3
Citations:
- 1: https://security.snyk.io/vuln/SNYK-GOLANG-GOOGLEGOLANGORGGRPC-15691172
- 2: GHSA-p77j-4mvh-x3m3
- 3: https://dbugs.ptsecurity.com/vulnerability/PT-2026-26207
- 4: https://app.opencve.io/cve/?product=grpc-go&vendor=grpc
- 5: Security: google.golang.org/grpc Incorrect Authorization (SNYK-GOLANG-GOOGLEGOLANGORGGRPC-15691172) argoproj/argo-events#3955
- 6: https://security.snyk.io/package/golang/google.golang.org%2Fgrpc
- 7: https://pkg.go.dev/google.golang.org/grpc@v1.72.2
- 8: https://pkg.go.dev/google.golang.org/grpc@v1.72.0
- 9: https://nvd.nist.gov/vuln/detail/CVE-2026-33186
Upgrade vulnerable dependencies to patch critical security issues.
Line 99 pins go.opentelemetry.io/otel/sdk v1.36.0 (CVE-2026-24051, CVSS 7.0–7.3: PATH hijacking on macOS) and line 117 pins google.golang.org/grpc v1.72.2 (CVE-2026-33186, CVSS 9.1: authorization bypass via HTTP/2 :path validation). Upgrade to v1.40.0+ and v1.79.3+ respectively before release.
🧰 Tools
🪛 OSV Scanner (2.3.5)
[HIGH] 99-99: go.opentelemetry.io/otel/sdk 1.36.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
(GO-2026-4394)
[HIGH] 99-99: go.opentelemetry.io/otel/sdk 1.36.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 99, Update the pinned vulnerable modules in go.mod: bump
go.opentelemetry.io/otel/sdk from v1.36.0 to at least v1.40.0 and
google.golang.org/grpc to at least v1.79.3 (these are the unique module names to
change), then run module resolution to refresh the go.sum (e.g., update
dependencies and run dependency tidy/resolve so the new versions are recorded
and checksums updated) and verify compilation and tests pass.
| if err := ctrl.NewWebhookManagedBy(mgr, &dwv1.DevWorkspace{}).Complete(); err != nil { | ||
| setupLog.Error(err, "failed creating conversion webhook for DevWorkspaces v1alpha1") | ||
| } | ||
| if err := ctrl.NewWebhookManagedBy(mgr).For(&dwv2.DevWorkspace{}).Complete(); err != nil { | ||
| if err := ctrl.NewWebhookManagedBy(mgr, &dwv2.DevWorkspace{}).Complete(); err != nil { | ||
| setupLog.Error(err, "failed creating conversion webhook for DevWorkspaces v1alpha2") |
There was a problem hiding this comment.
Fail fast if conversion webhook registration fails.
Line 216 and Line 219 only log .Complete() errors and continue startup. If conversion webhook registration fails, the manager can start in a degraded state where version conversions break at runtime. Please treat these as fatal initialization errors (consistent with other setup steps in main()).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@main.go` around lines 216 - 220, The webhook registration errors are
currently only logged and startup continues; change both
ctrl.NewWebhookManagedBy(...).Complete() error checks (for dwv1.DevWorkspace and
dwv2.DevWorkspace using mgr) to treat failures as fatal initialization errors:
after logging the error with setupLog.Error include a process-terminating action
(consistent with other main() setup steps), e.g. call os.Exit(1) or an
equivalent fatal logger, so the manager does not start in a degraded state when
conversion webhook registration fails.
2 participants
What does this PR do?
This PR updates
sigs.k8s.io/controller-runtimefrom v0.22.1 to v0.23.1, along with corresponding Kubernetes API dependencies tov0.35.0. This is a routine dependency update to ensure the DevWorkspace Operator stays current with the latest stable controller-runtime releases.What issues does this PR fix or reference?
N/A - This is a routine dependency update for maintenance purposes.
Is it tested? How?
go.modandgo.sumfiles with dependency version changesbuilder.WebhookManagedBy(mgr).For(&corev1.Deployment{})has to be changed tobuilder.WebhookManagedBy(mgr, &appsv1.Deployment{})PR Checklist
/test v8-devworkspace-operator-e2e, v8-che-happy-pathto trigger)v8-devworkspace-operator-e2e: DevWorkspace e2e testv8-che-happy-path: Happy path for verification integration with CheSummary by CodeRabbit
New Features
Documentation
Chores