Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 1 addition & 61 deletions .govulncheck.yaml
Original file line number Diff line number Diff line change
@@ -1,61 +1 @@
ignored-vulnerabilities:
# Panic when validating certificates with DSA public keys in crypto/x509
# Found in: crypto/x509@go1.23.12
# Fixed in: crypto/x509@go1.24.8
- id: GO-2025-4013
info: https://pkg.go.dev/vuln/GO-2025-4013
silence-until: 2026-01-03
# Lack of limit when parsing cookies can cause memory exhaustion in net/http
# Found in: net/http@go1.23.12
# Fixed in: net/http@go1.24.8
- id: GO-2025-4012
info: https://pkg.go.dev/vuln/GO-2025-4012
silence-until: 2026-01-03
# Parsing DER payload can cause memory exhaustion in encoding/asn1
# Found in: encoding/asn1@go1.23.12
# Fixed in: encoding/asn1@go1.24.8
- id: GO-2025-4011
info: https://pkg.go.dev/vuln/GO-2025-4011
silence-until: 2026-01-03
# Insufficient validation of bracketed IPv6 hostnames in net/url
# Found in: net/url@go1.23.12
# Fixed in: net/url@go1.24.8
- id: GO-2025-4010
info: https://pkg.go.dev/vuln/GO-2025-4010
silence-until: 2026-01-03
# Quadratic complexity when parsing some invalid inputs in encoding/pem
# Found in: encoding/pem@go1.23.12
# Fixed in: encoding/pem@go1.24.8
- id: GO-2025-4009
info: https://pkg.go.dev/vuln/GO-2025-4009
silence-until: 2026-01-03
# ALPN negotiation error contains attacker controlled information in crypto/tls
# Found in: crypto/tls@go1.23.12
# Fixed in: crypto/tls@go1.24.8
- id: GO-2025-4008
info: https://pkg.go.dev/vuln/GO-2025-4008
silence-until: 2026-01-03
# Quadratic complexity when checking name constraints in crypto/x509
# Found in: crypto/x509@go1.23.12
# Fixed in: crypto/x509@go1.24.9
- id: GO-2025-4007
info: https://pkg.go.dev/vuln/GO-2025-4007
silence-until: 2026-01-03
# Excessive CPU consumption in ParseAddress in net/mail
# Found in: net/mail@go1.23.12
# Fixed in: net/mail@go1.24.8
- id: GO-2025-4006
info: https://pkg.go.dev/vuln/GO-2025-4006
silence-until: 2026-01-03
# Excessive resource consumption when printing error string for host certificate validation in crypto/x509
# Found in: crypto/x509@go1.23.12
# Fixed in: crypto/x509@go1.24.11
- id: GO-2025-4155
info: https://pkg.go.dev/vuln/GO-2025-4155
silence-until: 2026-01-03
# Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
# Found in: crypto/x509@go1.23.12
# Fixed in: crypto/x509@go1.24.11
- id: GO-2025-4175
info: https://pkg.go.dev/vuln/GO-2025-4175
silence-until: 2026-01-03
ignored-vulnerabilities: []
2 changes: 1 addition & 1 deletion README.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ This is the CodeReady Toolchain Host Operator repository. It contains the OpenSh

== Build

Requires Go version 1.23.x (1.23.12 or higher) - download for your development environment https://golang.org/dl/[here].
Requires Go version 1.24.x (1.24.11 or higher) - download for your development environment https://golang.org/dl/[here].

This repository uses https://github.com/golang/go/wiki/Modules[Go modules].

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: bannedusers.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: masteruserrecords.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: notifications.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: nstemplatetiers.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: proxyplugins.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: socialevents.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: spacebindingrequests.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: spacebindings.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: spaceprovisionerconfigs.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: spacerequests.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
2 changes: 1 addition & 1 deletion config/crd/bases/toolchain.dev.openshift.com_spaces.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: spaces.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: tiertemplaterevisions.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: tiertemplates.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: toolchainclusters.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: toolchainconfigs.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: toolchainstatuses.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: usersignups.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.17.3
controller-gen.kubebuilder.io/version: v0.18.0
name: usertiers.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
4 changes: 2 additions & 2 deletions config/scorecard/kustomization.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
resources:
- bases/config.yaml
patchesJson6902:
patches:
- path: patches/basic.config.yaml
target:
group: scorecard.operatorframework.io
Expand All @@ -13,4 +13,4 @@ patchesJson6902:
version: v1alpha3
kind: Configuration
name: config
#+kubebuilder:scaffold:patchesJson6902
#+kubebuilder:scaffold:patches
2 changes: 1 addition & 1 deletion controllers/deactivation/deactivation_controller.go
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ type Reconciler struct {
// Reconcile reads the state of the cluster for a MUR object and determines whether to trigger deactivation or requeue based on its current status
// Note:
// The Controller will requeue the Request to be processed again if the returned error is non-nil or
// Result.Requeue is true, otherwise upon completion it will remove the work from the queue.
// Result.RequeueAfter > 0 is true, otherwise upon completion it will remove the work from the queue.
// nolint: gocyclo
func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.Result, error) {
logger := log.FromContext(ctx)
Expand Down
33 changes: 13 additions & 20 deletions controllers/deactivation/deactivation_controller_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ import (
murtest "github.com/codeready-toolchain/toolchain-common/pkg/test/masteruserrecord"
metricstest "github.com/codeready-toolchain/toolchain-common/pkg/test/metrics"

"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
Expand Down Expand Up @@ -224,8 +225,7 @@ func TestReconcile(t *testing.T) {
res, err := r.Reconcile(context.TODO(), req)
// then
require.NoError(t, err)
require.False(t, res.Requeue, "requeue should not be set")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm curios why we need to remove it?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

result.Requeue is deprecated

require.Equal(t, time.Duration(0), res.RequeueAfter, "requeueAfter should not be set")
assert.Empty(t, res.RequeueAfter, "requeueAfter should not be set")
assertThatUserSignupStateIsDeactivated(t, cl, username, false)
})

Expand All @@ -238,8 +238,7 @@ func TestReconcile(t *testing.T) {
res, err := r.Reconcile(context.TODO(), req)
// then
require.NoError(t, err)
require.False(t, res.Requeue, "requeue should not be set")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess we can also switch it to "assert.Empty(t, res.RequeueAfter)" as in other places.

Copy link
Contributor Author

@rsoaresd rsoaresd Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since the below line has require.Equal(t, time.Duration(0), res.RequeueAfter, "requeueAfter should not be set"), i did not add it. But I will replace require.Equal(t, time.Duration(0), res.RequeueAfter, "requeueAfter should not be set") to assert.Empty(t, res.RequeueAfter, "requeueAfter should not be set")

require.Equal(t, time.Duration(0), res.RequeueAfter, "requeueAfter should not be set")
assert.Empty(t, res.RequeueAfter, "requeueAfter should not be set")
assertThatUserSignupStateIsDeactivated(t, cl, username, false)
})

Expand Down Expand Up @@ -283,8 +282,7 @@ func TestReconcile(t *testing.T) {

// then
require.NoError(t, err)
require.False(t, res.Requeue, "requeue should not be set")
require.Equal(t, time.Duration(0), res.RequeueAfter, "requeueAfter should not be set")
assert.Empty(t, res.RequeueAfter, "requeueAfter should not be set")
assertThatUserSignupStateIsDeactivated(t, cl, username, false)

// Reload the userSignup
Expand Down Expand Up @@ -332,7 +330,7 @@ func TestReconcile(t *testing.T) {

// then
require.NoError(t, err)
require.False(t, res.Requeue)
assert.Empty(t, res.RequeueAfter)

// Reload the userSignup
require.NoError(t, cl.Get(context.TODO(), types.NamespacedName{Name: userSignupFoobar.Name, Namespace: operatorNamespace}, userSignupFoobar))
Expand Down Expand Up @@ -373,7 +371,7 @@ func TestReconcile(t *testing.T) {

// then
require.NoError(t, err)
require.False(t, res.Requeue)
assert.Empty(t, res.RequeueAfter)

// Reload the userSignup
require.NoError(t, cl.Get(context.TODO(), types.NamespacedName{Name: userSignupFoobar.Name, Namespace: operatorNamespace}, userSignupFoobar))
Expand Down Expand Up @@ -428,7 +426,6 @@ func TestReconcile(t *testing.T) {

// then
require.NoError(t, err)
require.False(t, res.Requeue)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had to delete this check because if we replace to assert.Empty(t, res.RequeueAfter, "requeueAfter should not be set"), it will fail with:

                --- FAIL: TestReconcile/controller_should_deactivate_user/usersignup_should_be_marked_as_deactivating_-_deactivate30_(30_days)/reconciliation_should_be_requeued_when_notification_not_yet_sent/usersignup_requeued_after_deactivating_notification_created_for_user (0.00s)
                    deactivation_controller_test.go:429: 
                        	Error Trace:	/home/runner/work/host-operator/host-operator/controllers/deactivation/deactivation_controller_test.go:429
                        	Error:      	Should be empty, but was 71h59m59.98258003s
                        	Test:       	TestReconcile/controller_should_deactivate_user/usersignup_should_be_marked_as_deactivating_-

Since res.Requeue is deprecated, we can only check that the requeue is not immediate by checking the RequeueAfter, in the way we are already checking in the line below (that should be ~about 3 days, in this particular case)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it's because it's being set (we expect the requeue) - this is also verified in the following lines

// The RequeueAfter should be ~about 3 days... let's accept if it's within 1 hour of that
require.WithinDuration(t, time.Now().Add(time.Duration(72)*time.Hour), time.Now().Add(res.RequeueAfter), time.Duration(1)*time.Hour)

Expand Down Expand Up @@ -466,7 +463,7 @@ func TestReconcile(t *testing.T) {
res, err := r.Reconcile(context.TODO(), req)
// then
require.NoError(t, err)
require.False(t, res.Requeue)
assert.Empty(t, res.RequeueAfter)

// Reload the userSignup
require.NoError(t, cl.Get(context.TODO(), types.NamespacedName{Name: userSignupFoobar.Name, Namespace: operatorNamespace}, userSignupFoobar))
Expand Down Expand Up @@ -495,8 +492,7 @@ func TestReconcile(t *testing.T) {
res, err := r.Reconcile(context.TODO(), req)
// then
require.NoError(t, err)
require.False(t, res.Requeue, "requeue should not be set")
require.Equal(t, time.Duration(0), res.RequeueAfter, "requeueAfter should not be set")
assert.Empty(t, res.RequeueAfter, "requeueAfter should not be set")
})
})
})
Expand All @@ -515,8 +511,7 @@ func TestReconcile(t *testing.T) {
res, err := r.Reconcile(context.TODO(), req)
// then
require.NoError(t, err)
require.False(t, res.Requeue, "requeue should not be set")
require.Equal(t, time.Duration(0), res.RequeueAfter, "requeue should not be set")
assert.Empty(t, res.RequeueAfter, "requeue should not be set")
assertThatUserSignupStateIsDeactivated(t, cl, username, true)
metricstest.AssertMetricsCounterEquals(t, 1, metrics.UserSignupAutoDeactivatedTotal)
})
Expand Down Expand Up @@ -605,7 +600,7 @@ func TestReconcile(t *testing.T) {

// then
require.NoError(t, err)
require.False(t, res.Requeue) // no requeue since user should not be auto deactivated
assert.Empty(t, res.RequeueAfter) // no requeue since user should not be auto deactivated

// Reload the userSignup
require.NoError(t, cl.Get(context.TODO(), types.NamespacedName{Name: userSignupFoobar.Name, Namespace: operatorNamespace}, userSignupFoobar))
Expand All @@ -625,7 +620,7 @@ func TestReconcile(t *testing.T) {

// The scheduled deactivation time should now be set to nil
require.Nil(t, userSignupFoobar.Status.ScheduledDeactivationTimestamp)
require.False(t, res.Requeue)
assert.Empty(t, res.RequeueAfter)
})
})

Expand Down Expand Up @@ -724,8 +719,7 @@ func TestReconcile(t *testing.T) {
// then
require.Error(t, err)
require.Contains(t, err.Error(), "usersignup get error")
require.False(t, res.Requeue, "requeue should not be set")
require.Equal(t, time.Duration(0), res.RequeueAfter, "requeueAfter should not be set")
assert.Empty(t, res.RequeueAfter, "requeueAfter should not be set")
})

// cannot update UserSignup
Expand Down Expand Up @@ -757,8 +751,7 @@ func TestReconcile(t *testing.T) {
// then
require.Error(t, err)
require.Contains(t, err.Error(), "usersignup update error")
require.False(t, res.Requeue, "requeue should not be set")
require.Equal(t, time.Duration(0), res.RequeueAfter, "requeueAfter should not be set")
assert.Empty(t, res.RequeueAfter, "requeueAfter should not be set")
assertThatUserSignupStateIsDeactivated(t, cl, username, false)
})
})
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ type Reconciler struct {
// and what is in the MasterUserRecord.Spec
// Note:
// The Controller will requeue the Request to be processed again if the returned error is non-nil or
// Result.Requeue is true, otherwise upon completion it will remove the work from the queue.
// Result.RequeueAfter > 0 is true, otherwise upon completion it will remove the work from the queue.
func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.Result, error) {
logger := log.FromContext(ctx)
logger.Info("Reconciling MasterUserRecord")
Expand Down
Loading
Loading