Skip to content

upgrade to test v1 CRIOCredentialProviderConfig #31324

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
QiWang19 wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

upgrade to test v1 CRIOCredentialProviderConfig #31324

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
45 changes: 28 additions & 17 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ require (
github.com/opencontainers/go-digest v1.0.0
github.com/openshift-eng/openshift-tests-extension v0.0.0-20260127124016-0fed2b824818
github.com/openshift-kni/commatrix v0.0.5-0.20251111204857-e5a931eff73f
github.com/openshift/api v0.0.0-20260603130340-1ad2ac3eb53d
github.com/openshift/api v0.0.0-20260619095050-5346161d1bf2

@coderabbitai coderabbitai Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check for known vulnerabilities in updated dependencies

# Install osv-scanner if available, or use GitHub API to check advisories
echo "Checking for vulnerabilities in updated Go modules..."

# Check a few key updated packages for GitHub security advisories
for pkg in "spf13/pflag" "go-openapi/swag"; do
  echo "Checking $pkg..."
  gh api graphql -f query="
  {
    securityVulnerabilities(first: 5, ecosystem: GO, package: \"$pkg\") {
      nodes {
        advisory {
          summary
          severity
          publishedAt
        }
        vulnerableVersionRange
        firstPatchedVersion {
          identifier
        }
      }
    }
  }" 2>/dev/null || echo "Could not check $pkg"
done

# Check golang.org/x/crypto and golang.org/x/net specifically as they often have security updates
for module in "golang.org/x/crypto" "golang.org/x/net"; do
  echo "Checking $module..."
  curl -s "https://pkg.go.dev/vuln?q=$module" | grep -i "vulnerability" || echo "No obvious vulnerabilities found in web search"
done

Repository: openshift/origin

Length of output: 513

🏁 Script executed:

# First, let's examine the go.mod file at the specified line ranges
head -n 500 go.mod | tail -n +65 | head -n 8
echo "---"
head -n 90 go.mod | tail -n +82 | head -n 8
echo "---"
head -n 110 go.mod | tail -n +94 | head -n 16
echo "---"
head -n 135 go.mod | tail -n +115 | head -n 20
echo "---"
head -n 260 go.mod | tail -n +235 | head -n 25
echo "---"
head -n 410 go.mod | tail -n +395 | head -n 20

Repository: openshift/origin

Length of output: 4245

🏁 Script executed:

# Check the specific versions and use osv-scanner if available
# First, let's install osv-scanner and check for vulnerabilities
echo "Attempting to use osv-scanner for comprehensive vulnerability check..."

# Try to run osv-scanner on go.mod if available
if command -v osv-scanner &> /dev/null; then
  osv-scanner --lockfile=go.mod
else
  echo "osv-scanner not available. Checking specific high-risk packages..."
  # Extract the versions from go.mod for key packages that were updated
  echo "Extracting k8s.io and golang.org/x package versions..."
  rg "k8s\.io|golang\.org/x" go.mod | head -20
fi

Repository: openshift/origin

Length of output: 507

🏁 Script executed:

# Since osv-scanner was killed, let's check the OSV database directly for the key packages
# Check specific versions of packages mentioned in the review

# Extract key package versions from go.mod
echo "Key packages to check:"
rg "golang\.org/x/(crypto|net|sync|oauth2|exp|mod)|spf13/pflag|go-openapi/swag|k8s\.io" go.mod | grep -E "^\s+[a-z]" | head -30

Repository: openshift/origin

Length of output: 1150

🌐 Web query:

OSV.dev vulnerabilities golang.org/x/crypto v0.48.0 golang.org/x/net v0.50.0

💡 Result:

Both golang.org/x/crypto v0.48.0 and golang.org/x/net v0.50.0 contain multiple known security vulnerabilities as recorded in the OSV database as of June 23, 2026. golang.org/x/crypto v0.48.0 This version is affected by several vulnerabilities, many of which were addressed in version v0.52.0 [1][2]. Known issues include: - GO-2026-5013 (CVE-2026-46597): Byte arithmetic causing underflow and panic in SSH [3]. - GO-2026-5017 (CVE-2026-39830): Client-side resource leak/deadlock in SSH [4]. - GO-2026-5019 (CVE-2026-39831): Bypass of FIDO/U2F physical interaction requirements [5]. - GO-2026-5021 (CVE-2026-42508): Authentication bypass via unenforced @revoked status [6]. - Other advisories listed for this version include GO-2026-5005, GO-2026-5006, GO-2026-5014, GO-2026-5015, GO-2026-5016, GO-2026-5018, GO-2026-5020, GO-2026-5023, and GO-2026-5033 [1][7]. golang.org/x/net v0.50.0 This version is also subject to multiple security advisories [8], including: - GO-2026-4559 (CVE-2026-27141): HTTP/2 frame handling causing server panic (fixed in v0.51.0) [9][8]. - GO-2026-4918: Infinite loop in HTTP/2 transport when processing invalid SETTINGS frames (fixed in v0.53.0) [10]. - GO-2026-5028 (CVE-2026-25680): Denial of service during HTML parsing (fixed in v0.55.0) [11]. - GO-2026-5030 (CVE-2026-27136): XSS vulnerability via duplicate HTML attributes (fixed in v0.55.0) [12]. - Other advisories associated with this version include GO-2026-5025, GO-2026-5026, GO-2026-5027, and GO-2026-5029 [8]. Users are advised to check the OSV.dev database or the Go vulnerability database (pkg.go.dev/vuln) for the latest patching information and to upgrade to the most recent stable versions to remediate these issues [1][8].

Citations:

🌐 Web query:

osv.dev k8s.io v0.35.1 kubernetes vulnerabilities

💡 Result:

The k8s.io modules at version v0.35.1 (which correspond to the Kubernetes v1.35.1 release cycle) are associated with several security vulnerabilities, as Kubernetes libraries are part of the larger k8s.io/kubernetes repository [1][2][3][4][5]. If you are using these dependencies, please note the following: 1. Vulnerability Landscape: The k8s.io/kubernetes package (and its associated staged modules like k8s.io/api, k8s.io/apiserver, etc.) has been subject to various vulnerabilities tracked in the Open Source Vulnerability (OSV) database [1][2][3][4]. Specific examples affecting the k8s.io/kubernetes ecosystem include: - Race conditions in kube-apiserver (e.g., GO-2025-3547) [1]. - Inadvertent local repository access in GitRepo volumes (e.g., GO-2025-3521) [2]. - Command injection vulnerabilities affecting Windows nodes (e.g., GO-2025-3522) [4]. - Server-Side Request Forgery (SSRF) in kube-controller-manager (e.g., GO-2025-4240) [3]. 2. Patching and Updates: Version v0.35.1 was released on February 10, 2026, as part of the Kubernetes 1.35.1 patch [6][7]. The Kubernetes project actively releases patch versions (e.g., v1.35.x series) to address security concerns and bugs [6]. It is strongly recommended to upgrade to the latest available patch release within the 1.35.x series (e.g., v1.35.5 as of June 2026) to incorporate the latest security fixes [8][6]. 3. Verification: You can track specific CVEs and their resolution in the official Kubernetes CHANGELOG for the corresponding release version [8][6]. Additionally, tools like osv.dev and deps.dev can be used to query your specific dependency tree for known vulnerabilities associated with older k8s.io versions [1][9]. Always refer to the official Kubernetes release page for the most current information regarding supported versions and security patches [6].

Citations:

Multiple critical CVEs found in updated golang.org/x and k8s.io dependencies—upgrade required.

The following dependencies contain known security vulnerabilities:

  • golang.org/x/crypto v0.48.0: Multiple CVEs including GO-2026-5013 (SSH byte arithmetic underflow), GO-2026-5017 (SSH resource leak), GO-2026-5019 (FIDO/U2F bypass), GO-2026-5021 (authentication bypass), and others. Upgrade to v0.52.0+.
  • golang.org/x/net v0.50.0: Multiple CVEs including GO-2026-4559 (HTTP/2 panic), GO-2026-4918 (HTTP/2 infinite loop), GO-2026-5028 (HTML parsing DoS), GO-2026-5030 (XSS). Upgrade to v0.55.0+.
  • k8s.io/ v0.35.1*: Multiple vulnerabilities documented including race conditions, command injection, and SSRF issues. Upgrade to latest patch release (v1.35.5 or later as of June 2026).

No CVEs found in spf13/pflag v1.0.10 or go-openapi/swag v0.25.4.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 68, Multiple critical security vulnerabilities have been
identified in the golang.org/x and k8s.io dependencies in the go.mod file.
Update golang.org/x/crypto from v0.48.0 to v0.52.0 or later, upgrade
golang.org/x/net from v0.50.0 to v0.55.0 or later, and upgrade all k8s.io/*
dependencies from v0.35.1 to v1.35.5 or later. Use go get to fetch these updated
versions and ensure the go.mod and go.sum files are properly updated with the
new versions.

Source: Path instructions

github.com/openshift/apiserver-library-go v0.0.0-20260303173613-cd3676268d31
github.com/openshift/build-machinery-go v0.0.0-20250530140348-dc5b2804eeee
github.com/openshift/client-go v0.0.0-20260603140539-6892dc3e1ffc
Expand All @@ -81,7 +81,7 @@ require (
github.com/rs/zerolog v1.34.0
github.com/sirupsen/logrus v1.9.3
github.com/spf13/cobra v1.10.1
github.com/spf13/pflag v1.0.9
github.com/spf13/pflag v1.0.10
github.com/spf13/viper v1.8.1
github.com/stretchr/objx v0.5.2
github.com/stretchr/testify v1.11.1
Expand All @@ -93,12 +93,12 @@ require (
go.etcd.io/etcd/api/v3 v3.6.5
go.etcd.io/etcd/client/pkg/v3 v3.6.5
go.etcd.io/etcd/client/v3 v3.6.5
golang.org/x/crypto v0.45.0
golang.org/x/crypto v0.48.0
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
golang.org/x/mod v0.29.0
golang.org/x/net v0.47.0
golang.org/x/mod v0.33.0
golang.org/x/net v0.50.0
golang.org/x/oauth2 v0.30.0
golang.org/x/sync v0.18.0
golang.org/x/sync v0.19.0
gonum.org/v1/plot v0.14.0
google.golang.org/api v0.247.0
google.golang.org/grpc v1.75.1
Expand All @@ -115,19 +115,19 @@ require (
k8s.io/component-base v0.35.1
k8s.io/component-helpers v0.35.1
k8s.io/klog v1.0.0
k8s.io/klog/v2 v2.130.1
k8s.io/klog/v2 v2.140.0
k8s.io/kube-aggregator v0.35.1
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
k8s.io/kube-openapi v0.0.0-20260519202549-bbf5c5577288
k8s.io/kubectl v0.35.1
k8s.io/kubelet v0.31.1
k8s.io/kubernetes v1.35.1
k8s.io/pod-security-admission v0.35.1
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2
sigs.k8s.io/cloud-provider-azure v1.30.4
sigs.k8s.io/controller-runtime v0.22.3
sigs.k8s.io/gateway-api v1.4.0
sigs.k8s.io/kustomize/kyaml v0.20.1
sigs.k8s.io/structured-merge-diff/v6 v6.3.0
sigs.k8s.io/structured-merge-diff/v6 v6.3.2
sigs.k8s.io/yaml v1.6.0
)

Expand Down Expand Up @@ -237,7 +237,18 @@ require (
github.com/go-openapi/runtime v0.28.0 // indirect
github.com/go-openapi/spec v0.21.0 // indirect
github.com/go-openapi/strfmt v0.23.0 // indirect
github.com/go-openapi/swag v0.23.1 // indirect
github.com/go-openapi/swag v0.25.4 // indirect
github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
github.com/go-openapi/swag/conv v0.25.4 // indirect
github.com/go-openapi/swag/fileutils v0.25.4 // indirect
github.com/go-openapi/swag/jsonname v0.25.4 // indirect
github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
github.com/go-openapi/swag/loading v0.25.4 // indirect
github.com/go-openapi/swag/mangling v0.25.4 // indirect
github.com/go-openapi/swag/netutils v0.25.4 // indirect
github.com/go-openapi/swag/stringutils v0.25.4 // indirect
github.com/go-openapi/swag/typeutils v0.25.4 // indirect
github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
github.com/go-openapi/validate v0.24.0 // indirect
github.com/go-pdf/fpdf v0.8.0 // indirect
github.com/go-playground/locales v0.14.1 // indirect
Expand Down Expand Up @@ -278,7 +289,6 @@ require (
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
github.com/jmespath/go-jmespath v0.4.0 // indirect
github.com/jonboulle/clockwork v0.5.0 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/karrick/godirwalk v1.17.0 // indirect
github.com/kevinburke/ssh_config v1.2.0 // indirect
Expand All @@ -294,7 +304,6 @@ require (
github.com/libopenstorage/openstorage v1.0.0 // indirect
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
github.com/magiconair/properties v1.8.5 // indirect
github.com/mailru/easyjson v0.9.0 // indirect
github.com/mattn/go-colorable v0.1.13 // indirect
github.com/mattn/go-ieproxy v0.0.11 // indirect
github.com/mattn/go-isatty v0.0.20 // indirect
Expand Down Expand Up @@ -389,11 +398,11 @@ require (
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/image v0.11.0 // indirect
golang.org/x/sys v0.38.0 // indirect
golang.org/x/term v0.37.0 // indirect
golang.org/x/text v0.31.0 // indirect
golang.org/x/sys v0.41.0 // indirect
golang.org/x/term v0.40.0 // indirect
golang.org/x/text v0.34.0 // indirect
golang.org/x/time v0.12.0 // indirect
golang.org/x/tools v0.38.0 // indirect
golang.org/x/tools v0.42.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect
Expand Down Expand Up @@ -432,6 +441,8 @@ require (

replace (
github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20260303184444-1cc650aa0565
github.com/openshift/api => github.com/QiWang19/api v0.0.0-20260622144140-c85beac32742
github.com/openshift/client-go => github.com/QiWang19/client-go v0.0.0-20260623024724-64bcee5935da
Comment on lines +444 to +445

@coderabbitai coderabbitai Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify if the fork versions have corresponding upstream commits

echo "Checking QiWang19/api fork version..."
curl -s "https://api.github.com/repos/QiWang19/api/commits/c85beac32742" | jq -r '.sha // "Not found"'

echo "Checking QiWang19/client-go fork version..."
curl -s "https://api.github.com/repos/QiWang19/client-go/commits/64bcee5935da" | jq -r '.sha // "Not found"'

echo "Checking if openshift/api has the changes..."
git log --oneline --all | grep -i "criocredentialprovider" | head -20 || echo "Need to search upstream"

Repository: openshift/origin

Length of output: 467

🏁 Script executed:

cd /tmp && find . -name "go.mod" -type f 2>/dev/null | head -5

Repository: openshift/origin

Length of output: 154

🏁 Script executed:

# Find and examine the go.mod file
find . -name "go.mod" -type f | head -1 | xargs head -100

Repository: openshift/origin

Length of output: 223

🏁 Script executed:

# Get the exact go.mod content around the replace directives
sed -n '440,450p' go.mod

Repository: openshift/origin

Length of output: 1112

🏁 Script executed:

# Check what upstream versions of openshift/api and openshift/client-go are referenced
rg "github.com/openshift/api|github.com/openshift/client-go" go.mod | head -20

Repository: openshift/origin

Length of output: 548

🌐 Web query:

CVE vulnerabilities openshift/api openshift/client-go 2026

💡 Result:

As of June 23, 2026, several CVE vulnerabilities have been identified and addressed within the Red Hat OpenShift ecosystem. There is no single master list for vulnerabilities specific to openshift/api or openshift/client-go; rather, these components often inherit vulnerabilities from their upstream dependencies (e.g., Go standard library, Kubernetes libraries, or Moby components) [1][2][3][4]. Key vulnerabilities and security updates relevant to OpenShift components in 2026 include: 1. CVE-2026-35469: An allocation of resources vulnerability (CWE-770) in the moby/spdystream dependency, which affected the openshift-apiserver [1][2]. This was addressed in multiple OpenShift releases (e.g., 4.19, 4.22) by updating spdystream to v0.5.1 [1][2][3]. 2. CVE-2026-46579: An authentication bypass vulnerability in the OpenShift Router (haproxy-router), where improper header handling allowed impersonation of client certificate identities [5]. 3. Dependency-Level Vulnerabilities: OpenShift frequently issues security updates (RHSA) to address vulnerabilities in underlying Go packages, such as: - Go net/url parsing issues (e.g., CVE-2026-25679) [4]. - Go crypto/x509/tls denial-of-service flaws related to certificate chain building (e.g., CVE-2026-32280) [4]. 4. Client-Specific Concerns: While Snyk lists entries like CVE-2026-33811 and CVE-2026-34986 for packages labeled openshift-clients, these are often related to broader Go library issues (e.g., CGO DNS resolver, buffer calculations) rather than unique flaws in the OpenShift client-go code itself [6][7]. For the most accurate and up-to-date information, you should monitor the official Red Hat Security Advisory (RHSA) portal. Red Hat regularly publishes errata updates (e.g., RHSA-2026:25180, RHSA-2026:23240) that bundle fixes for these vulnerabilities across different OpenShift Container Platform (OCP) versions [8][9][4]. You can search the Red Hat Security Advisories portal for specific advisories related to your installed OCP version [10].

Citations:

Document and plan removal of fork replace directives before merging to production.

The replace directives redirect critical openshift/api and openshift/client-go packages to a personal fork (QiWang19), using versions with more recent timestamps than the original upstream versions. While acceptable in a draft PR for development and testing, this poses a supply chain security risk and lacks the required provenance attestations and artifact signing per the supply chain security guidelines.

Ensure these replace directives are removed or formally justified before merging to production branches. If the fork patches are required, work toward upstreaming them and reverting to the original dependencies.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 444 - 445, Remove the replace directives in go.mod that
redirect github.com/openshift/api and github.com/openshift/client-go packages to
the QiWang19 personal fork. If the fork patches are necessary for functionality,
first work to upstream those patches to the original openshift repositories,
then revert these replace directives to use the official packages instead. If
these forks must remain for production, add formal documentation and
justification to the pull request explaining the supply chain security
implications and how they meet provenance and signing requirements.

Source: Path instructions

go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc => go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0
k8s.io/api => github.com/openshift/kubernetes/staging/src/k8s.io/api v0.0.0-20260305123649-d18f3f005eaa
k8s.io/apiextensions-apiserver => github.com/openshift/kubernetes/staging/src/k8s.io/apiextensions-apiserver v0.0.0-20260305123649-d18f3f005eaa
Expand Down
Loading