Skip to content

SANDBOX-1357: update kube & openshift dependencies to 4.19 #696

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rsoaresd merged 15 commits into from
Sep 16, 2025
Merged

SANDBOX-1357: update kube & openshift dependencies to 4.19 #696

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
2934127
SANDBOX-1357: update controller-gen.kubebuilder.io/version to v0.17.2
Sep 4, 2025
a573a4f
Merge branch 'master' into generate_by_api_pull_484_member
Sep 4, 2025
c03c075
Merge branch 'master' into generate_by_api_pull_484_member
rsoaresd Sep 4, 2025
7cd8a80
SANDBOX-1357: update kube & openshift dependencies to 4.19
Sep 4, 2025
16b78a8
update toolchain-common
Sep 4, 2025
b419938
update OWNER_AND_BRANCH_LOCATION
Sep 4, 2025
090a9dc
remove get-tool.mk
rsoaresd Sep 8, 2025
9a105b8
fix
rsoaresd Sep 8, 2025
b0ffec0
Merge branch 'master' into generate_by_api_pull_484_member
rsoaresd Sep 8, 2025
ffcf921
Merge branch 'master' into generate_by_api_pull_484_member
rsoaresd Sep 8, 2025
c5c2d15
update golang.org/x/net
rsoaresd Sep 9, 2025
3faf430
Merge branch 'master' into generate_by_api_pull_484_member
rsoaresd Sep 10, 2025
6358145
update replace
rsoaresd Sep 10, 2025
c83a74c
Merge branch 'master' into generate_by_api_pull_484_member
rsoaresd Sep 15, 2025
107bed8
remove replace
rsoaresd Sep 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .golangci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ linters:
- testifylint
- unparam
- zerologlint
- copyloopvar
disable:
- contextcheck
- noctx
Expand Down
20 changes: 1 addition & 19 deletions .govulncheck.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1 @@
ignored-vulnerabilities:
# Request smuggling due to acceptance of invalid chunked data in net/http
# Found in Found in: net/http/internal@go1.22.12
# Fixed in Fixed in: net/http/internal@go1.23.8
- id: GO-2025-3563
info: https://pkg.go.dev/vuln/GO-2025-3563
silence-until: 2025-10-01
# Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall
# Found in Found in: os@go1.22.12
# Fixed in Fixed in: os@go1.23.10
- id: GO-2025-3750
info: https://pkg.go.dev/vuln/GO-2025-3750
silence-until: 2025-10-01
# Sensitive headers not cleared on cross-origin redirect in net/http
# Found in Found in: net/http@go1.22.12
# Fixed in Fixed in: net/http@go1.23.10
- id: GO-2025-3751
info: https://pkg.go.dev/vuln/GO-2025-3751
silence-until: 2025-10-01
ignored-vulnerabilities: []
2 changes: 1 addition & 1 deletion README.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ This is the CodeReady Toolchain Member Operator repository. It contains the Open

== Build

Requires Go version 1.22.x (1.22.12 or higher) - download for your development environment https://golang.org/dl/[here].
Requires Go version 1.23.x (1.23.12 or higher) - download for your development environment https://golang.org/dl/[here].

This repository uses https://github.com/golang/go/wiki/Modules[Go modules].

Expand Down
2 changes: 1 addition & 1 deletion config/crd/bases/toolchain.dev.openshift.com_idlers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.16.5
controller-gen.kubebuilder.io/version: v0.17.2
name: idlers.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
2 changes: 1 addition & 1 deletion config/crd/bases/toolchain.dev.openshift.com_memberoperatorconfigs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.16.5
controller-gen.kubebuilder.io/version: v0.17.2
name: memberoperatorconfigs.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
2 changes: 1 addition & 1 deletion config/crd/bases/toolchain.dev.openshift.com_memberstatuses.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.16.5
controller-gen.kubebuilder.io/version: v0.17.2
name: memberstatuses.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
2 changes: 1 addition & 1 deletion config/crd/bases/toolchain.dev.openshift.com_nstemplatesets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.16.5
controller-gen.kubebuilder.io/version: v0.17.2
name: nstemplatesets.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
2 changes: 1 addition & 1 deletion config/crd/bases/toolchain.dev.openshift.com_spacebindingrequests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.16.5
controller-gen.kubebuilder.io/version: v0.17.2
name: spacebindingrequests.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
2 changes: 1 addition & 1 deletion config/crd/bases/toolchain.dev.openshift.com_spacerequests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.16.5
controller-gen.kubebuilder.io/version: v0.17.2
name: spacerequests.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
2 changes: 1 addition & 1 deletion config/crd/bases/toolchain.dev.openshift.com_toolchainclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.16.5
controller-gen.kubebuilder.io/version: v0.17.2
name: toolchainclusters.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
2 changes: 1 addition & 1 deletion config/crd/bases/toolchain.dev.openshift.com_useraccounts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.16.5
controller-gen.kubebuilder.io/version: v0.17.2
name: useraccounts.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
2 changes: 1 addition & 1 deletion config/crd/bases/toolchain.dev.openshift.com_workspaces.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.16.5
controller-gen.kubebuilder.io/version: v0.17.2
name: workspaces.toolchain.dev.openshift.com
spec:
group: toolchain.dev.openshift.com
Expand Down
97 changes: 57 additions & 40 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,32 +1,38 @@
module github.com/codeready-toolchain/member-operator

require (
github.com/codeready-toolchain/api v0.0.0-20250603081710-8a56a236e3a4
github.com/codeready-toolchain/toolchain-common v0.0.0-20250506093954-2b65ad3a2e12
github.com/codeready-toolchain/api v0.0.0-20250916082953-4ecb3a4645e6
github.com/codeready-toolchain/toolchain-common v0.0.0-20250916085517-b50328535b99
github.com/go-logr/logr v1.4.2
github.com/google/go-cmp v0.6.0
// using latest commit from 'github.com/openshift/api branch release-4.18'
github.com/openshift/api v0.0.0-20250410062700-d6c84c55a124
github.com/google/go-cmp v0.7.0
// using latest commit from 'github.com/openshift/api branch release-4.19'
github.com/openshift/api v0.0.0-20250903165707-ce7baf0afbc4
Comment on lines +8 to +9
Copy link

@coderabbitai coderabbitai bot Sep 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Pin openshift/api to a commit on release-4.19 (verify current SHA).

The pseudo-version may not belong to release-4.19. Ensure it resolves to that branch to avoid drift.

🏁 Script executed:

#!/bin/bash
set -euo pipefail
remote=https://github.com/openshift/api
sha=$(printf '%s\n' 'ce7baf0afbc4')
git ls-remote "$remote" refs/heads/release-4.19 | awk '{print $1}' | grep -qi "$sha" && echo "OK on release-4.19" || echo "MISMATCH: $sha not on release-4.19"
echo "If mismatch, run: go get github.com/openshift/api@release-4.19 && go mod tidy"

Length of output: 120

Pin openshift/api to a commit on release-4.19 — current pseudo-version mismatch

Verification: SHA ce7baf0afbc4 is NOT on release-4.19.

File: go.mod (lines 8-9).

Action: replace the pseudo-version with a commit that is actually on release-4.19 or point to the branch. Run:
go get github.com/openshift/api@release-4.19 && go mod tidy
Or pin to a specific release-4.19 commit:
go get github.com/openshift/api@ && go mod tidy
Verify the chosen SHA belongs to release-4.19 before committing.

🤖 Prompt for AI Agents 
In go.mod around lines 8-9, the pseudo-version github.com/openshift/api
v0.0.0-20250903165707-ce7baf0afbc4 is not a commit on release-4.19; replace it
with either the branch ref or a commit SHA that actually belongs to
release-4.19. Run: go get github.com/openshift/api@release-4.19 && go mod tidy
to point to the branch, or find a specific full commit SHA on release-4.19 and
run go get github.com/openshift/api@<full-sha> && go mod tidy; verify the chosen
SHA is on release-4.19 before committing.

github.com/pkg/errors v0.9.1
github.com/redhat-cop/operator-utils v1.3.8
github.com/stretchr/testify v1.10.0
go.uber.org/zap v1.26.0
go.uber.org/zap v1.27.0
gopkg.in/h2non/gock.v1 v1.0.14
k8s.io/api v0.31.2
k8s.io/client-go v0.31.2
k8s.io/api v0.32.2
k8s.io/client-go v0.32.2
k8s.io/klog v1.0.0
k8s.io/klog/v2 v2.130.1
k8s.io/metrics v0.31.2
sigs.k8s.io/controller-runtime v0.19.7
k8s.io/metrics v0.32.2
sigs.k8s.io/controller-runtime v0.20.4
sigs.k8s.io/controller-tools v0.17.3
sigs.k8s.io/kustomize/kustomize/v5 v5.5.0
)

require (
github.com/go-bindata/go-bindata/v3 v3.1.3
github.com/google/uuid v1.6.0
github.com/prometheus/client_golang v1.19.1
k8s.io/apiextensions-apiserver v0.31.2
k8s.io/apimachinery v0.31.2
k8s.io/kubectl v0.31.2
k8s.io/utils v0.0.0-20240921022957-49e7df575cb6
k8s.io/apiextensions-apiserver v0.32.2
k8s.io/apimachinery v0.32.2
k8s.io/code-generator v0.32.2
k8s.io/gengo v0.0.0-20230829151522-9cce18d56c01
k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f
k8s.io/kubectl v0.32.2
k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
sigs.k8s.io/yaml v1.4.0
)

Expand All @@ -42,72 +48,83 @@ require (
github.com/cloudflare/circl v1.6.1 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
github.com/evanphx/json-patch/v5 v5.9.0 // indirect
github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d // indirect
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
github.com/fatih/color v1.18.0 // indirect
github.com/fsnotify/fsnotify v1.7.0 // indirect
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
github.com/go-errors/errors v1.4.2 // indirect
github.com/go-logr/zapr v1.3.0 // indirect
github.com/go-openapi/jsonpointer v0.19.6 // indirect
github.com/go-openapi/jsonpointer v0.21.0 // indirect
github.com/go-openapi/jsonreference v0.20.2 // indirect
github.com/go-openapi/swag v0.22.4 // indirect
github.com/go-openapi/swag v0.23.0 // indirect
github.com/gobuffalo/flect v1.0.3 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/btree v1.1.3 // indirect
github.com/google/gnostic-models v0.6.8 // indirect
github.com/google/go-github/v52 v52.0.0 // indirect
github.com/google/go-querystring v1.1.0 // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad // indirect
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
github.com/gorilla/mux v1.8.1 // indirect
github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 // indirect
github.com/huandu/xstrings v1.3.3 // indirect
github.com/imdario/mergo v0.3.12 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/kisielk/errcheck v1.5.0 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/mattn/go-colorable v0.1.13 // indirect
github.com/mattn/go-isatty v0.0.20 // indirect
github.com/migueleliasweb/go-github-mock v0.0.18 // indirect
github.com/mitchellh/copystructure v1.0.0 // indirect
github.com/mitchellh/reflectwalk v1.0.0 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/openshift/library-go v0.0.0-20250403134058-7c43fdf96c62 // indirect
github.com/openshift/library-go v0.0.0-20250826065405-6d18d1191f49 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/client_model v0.6.1 // indirect
github.com/prometheus/common v0.55.0 // indirect
github.com/prometheus/procfs v0.15.1 // indirect
github.com/sergi/go-diff v1.2.0 // indirect
github.com/shopspring/decimal v1.2.0 // indirect
github.com/spf13/cast v1.3.1 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/spf13/cobra v1.9.1 // indirect
github.com/spf13/pflag v1.0.6 // indirect
github.com/x448/float16 v0.8.4 // indirect
github.com/xlab/treeprint v1.2.0 // indirect
go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
go.uber.org/multierr v1.11.0 // indirect
golang.org/x/crypto v0.31.0 // indirect
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
golang.org/x/net v0.33.0 // indirect
golang.org/x/oauth2 v0.21.0 // indirect
golang.org/x/sync v0.10.0 // indirect
golang.org/x/sys v0.28.0 // indirect
golang.org/x/term v0.27.0 // indirect
golang.org/x/text v0.21.0 // indirect
golang.org/x/time v0.3.0 // indirect
golang.org/x/crypto v0.36.0 // indirect
golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f // indirect
golang.org/x/mod v0.23.0 // indirect
golang.org/x/net v0.38.0 // indirect
golang.org/x/oauth2 v0.23.0 // indirect
Copy link

@coderabbitai coderabbitai bot Sep 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Upgrade vulnerable golang.org/x/oauth2.

v0.23.0 has known HIGH vulns; bump to a patched release (>= v0.27.0).

-   golang.org/x/oauth2 v0.23.0 // indirect
+   golang.org/x/oauth2 v0.27.0 // indirect

🌐 Web query:

What is the latest non-vulnerable version of golang.org/x/oauth2 as of today?

💡 Result:

Latest non-vulnerable version: v0.31.0. Fix for the vulnerability was released in v0.27.0. (pkg.go.dev, github.com)

Citations:

Upgrade golang.org/x/oauth2 to v0.31.0

v0.23.0 has a HIGH-severity vulnerability (GO-2025-3488); the fix was introduced in v0.27.0—upgrade to v0.31.0, the latest non-vulnerable release. cite12

-   golang.org/x/oauth2 v0.23.0 // indirect
+   golang.org/x/oauth2 v0.31.0 // indirect
🧰 Tools
🪛 OSV Scanner (2.1.0)

[HIGH] 106-106: golang.org/x/oauth2 0.23.0: Unexpected memory consumption during token parsing in golang.org/x/oauth2

(GO-2025-3488)

[HIGH] 106-106: golang.org/x/oauth2 0.23.0: golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability

(GHSA-6v2p-p543-phr9)

🤖 Prompt for AI Agents 
In go.mod around line 106, the project pins golang.org/x/oauth2 to v0.23.0 which
has a high-severity vulnerability; update the requirement to golang.org/x/oauth2
v0.31.0, then run go get golang.org/x/oauth2@v0.31.0 (or manually edit go.mod),
run go mod tidy to refresh go.sum, and run the test/build pipeline to ensure no
breakages.

golang.org/x/sync v0.12.0 // indirect
golang.org/x/sys v0.31.0 // indirect
golang.org/x/term v0.30.0 // indirect
golang.org/x/text v0.23.0 // indirect
golang.org/x/time v0.7.0 // indirect
golang.org/x/tools v0.30.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/protobuf v1.34.2 // indirect
google.golang.org/protobuf v1.36.1 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/cli-runtime v0.31.2 // indirect
k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
sigs.k8s.io/kustomize/api v0.17.2 // indirect
sigs.k8s.io/kustomize/kyaml v0.17.1 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
k8s.io/cli-runtime v0.32.2 // indirect
k8s.io/gengo/v2 v2.0.0-20240911193312-2b36238f13e9 // indirect
sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
sigs.k8s.io/kustomize/api v0.18.0 // indirect
sigs.k8s.io/kustomize/cmd/config v0.15.0 // indirect
sigs.k8s.io/kustomize/kyaml v0.18.1 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
)

go 1.22.0
go 1.23.0

toolchain go1.22.12
toolchain go1.23.12
Loading
Loading