Patch k8scsi sidecars CVE-2019-11255 #413

jnaulty · 2019-11-22T07:07:20Z

Updated container image versions that have resolve the CVE according to
kubernetes/kubernetes/issues/85233

Is this a bug fix or adding new feature?
Bug Fix

What is this PR about? / Why do we need it?
Fixes #411
For CVE-2019-11255: CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation.

What testing is done?

make verify
make test

k8s-ci-robot · 2019-11-22T07:07:28Z

Welcome @jnaulty!

It looks like this is your first PR to kubernetes-sigs/aws-ebs-csi-driver 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/aws-ebs-csi-driver has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2019-11-22T07:07:28Z

Hi @jnaulty. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

coveralls · 2019-11-22T07:11:23Z

Pull Request Test Coverage Report for Build 989

0 of 0 changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 70.706%

Totals
Change from base Build 978:	0.0%
Covered Lines:	1231
Relevant Lines:	1741

💛 - Coveralls

jnaulty · 2019-11-22T07:21:43Z

/assign @bertinatto

bertinatto · 2019-11-22T08:16:19Z

/ok-to-test

jnaulty · 2019-11-22T10:51:53Z

/test pull-aws-ebs-csi-driver-e2e-single-az

jnaulty · 2019-11-22T10:58:17Z

I think the e2e test pull-aws-ebs-csi-driver-e2e-single-az might be a flaky test, I see the same failed test in a PR that changes just a markdown file #414 (comment)

bertinatto · 2019-11-22T14:38:10Z

/retest

jnaulty · 2019-11-22T15:59:48Z

/retest

jnaulty · 2019-11-22T16:51:47Z

@bertinatto
it seems to be consistently failing with this test:

[ebs-csi-e2e] [single-az] Snapshot
/home/prow/go/src/github.com/kubernetes-sigs/aws-ebs-csi-driver/tests/e2e/dynamic_provisioning.go:407
  should create a pod, write and read to it, take a volume snapshot, and create another pod from the snapshot [It]
  /home/prow/go/src/github.com/kubernetes-sigs/aws-ebs-csi-driver/tests/e2e/dynamic_provisioning.go:428

Is there any documented process for running the e2e tests on an existing cluster that has the new aws-ebs-csi driver installed?
I want to get logs from the provisioning container.

Update
taking a look at test-e2e-single-az makefile target

leakingtapan · 2019-11-22T21:51:03Z

@jnaulty Since external-resizer is impacted too, could you update it to v0.3.0 as well?

leakingtapan · 2019-11-22T21:54:00Z

Is there any documented process for running the e2e tests on an existing cluster that has the new aws-ebs-csi driver installed?

If you have a cluster created already, you could also follow steps here to run the test cases directly

leakingtapan · 2019-11-26T20:06:39Z

/retest

leakingtapan · 2020-01-08T23:29:17Z

I tested ur change manually @jnaulty one snapshot failure is due to:

E0108 23:22:30.299139       1 goroutinemap.go:150] Operation for "create-default/ebs-volume-snapshot[7a6d9d53-404e-40f0-98d8-e1873b459a9d]" failed. No retries permitted until 2020-01-08 23:24:32.299113892 +0000 UTC m=+963.204607650 (durationBeforeRetry 2m2s). Error: "snapshot controller failed to update default/ebs-volume-snapshot on API server: volumesnapshots.snapshot.storage.k8s.io \"ebs-volume-snapshot\" is forbidden: User \"system:serviceaccount:kube-system:ebs-csi-controller-sa\" cannot update resource \"volumesnapshots/status\" in API group \"snapshot.storage.k8s.io\" in the namespace \"default\""

This is because the new RBAC policy required for 1.2 snapshotter here for updating volumesnapshots/status:

  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshots/status"]
    verbs: ["update"]

Could you add this into ur PR in the rbac policy for snapshotter here?

leakingtapan · 2020-01-08T23:35:30Z

Given the above issue, please check other two sidecars RBAC policy as well to make sure they are up to date with for the given version.

jnaulty · 2020-01-14T19:48:08Z

Given the above issue, please check other two sidecars RBAC policy as well to make sure they are up to date with for the given version.

Thanks for the suggestion. Will do.

Checking:

external-resizer rbac: https://github.com/kubernetes-csi/external-resizer/blob/v0.3.0/deploy/kubernetes/rbac.yaml
external-snapshotter: https://github.com/kubernetes-csi/external-snapshotter/blob/release-1.2/deploy/kubernetes/rbac.yaml#L47-L49
external-provisioner: https://github.com/kubernetes-csi/external-provisioner/tree/v1.3.1

jnaulty · 2020-01-14T19:57:50Z

@leakingtapan
I'm not quite sure where the external-provisioner rbac policy is added for the aws-ebs-csi-driver.

I see it is using this rbac policy: https://github.com/kubernetes-csi/external-provisioner/blob/v1.3.1/deploy/kubernetes/rbac.yaml
but I don't see how it gets used by the aws-ebs-csi-driver.

leakingtapan · 2020-01-14T23:42:03Z

Here is the rbac for kustomize: https://github.com/kubernetes-sigs/aws-ebs-csi-driver/blob/master/deploy/kubernetes/base/rbac.yaml

You might want to update the rbac for helm manifest as well. It’s challenging to keep them in sync now. Manually Updating both side is what I do :P

jnaulty · 2020-01-21T17:40:37Z

Looks like there is an issue with the test-runner

W0121 17:38:56.643973   15281 executor.go:130] error running task "VPC/test-cluster-6952.k8s.local" (47s remaining to succeed): error creating VPC: VpcLimitExceeded: The maximum number of VPCs has been reached.
	status code: 400, request id: 512602ff-c28b-443f-993e-8eafd14227eb
I0121 17:38:56.644009   15281 executor.go:145] No progress made, sleeping before retrying 1 failed task(s)
I0121 17:39:06.644169   15281 executor.go:103] Tasks: 62 done / 95 total; 1 can run
W0121 17:39:07.067279   15281 executor.go:130] error running task "VPC/test-cluster-6952.k8s.local" (37s remaining to succeed): error creating VPC: VpcLimitExceeded: The maximum number of VPCs has been reached.
	status code: 400, request id: 45f00dd7-f227-4cb8-85d1-6282e55739f0
I0121 17:39:07.067319   15281 executor.go:145] No progress made, sleeping before retrying 1 failed task(s)

https://prow.k8s.io/view/gcs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_aws-ebs-csi-driver/413/pull-aws-ebs-csi-driver-e2e-single-az/1219670470392025089

jnaulty · 2020-01-21T18:13:06Z

/retest

jnaulty · 2020-01-21T18:47:54Z

@leakingtapan
looks like the addition of the RBAC rules helped (despite the temporary issue with VPC creation limit in the test infra).
https://prow.k8s.io/view/gcs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_aws-ebs-csi-driver/413/pull-aws-ebs-csi-driver-e2e-single-az/1219684562875977729

I'll squash down to a single commit

Changes: - Update container image versions that have resolve the CVE according to [kubernetes/kubernetes/issues/85233](kubernetes/kubernetes#85233) - Update snapshotter RBAC policy - Update resizer RBAC policy - Updates external-provisioner RBAC policy for v1.3.1 image - Update helm charts with updated RBAC policy ref: kubernetes-sigs#411

jnaulty · 2020-01-21T19:44:39Z

/test pull-aws-ebs-csi-driver-e2e-single-az

leakingtapan · 2020-01-22T06:54:59Z

/lgtm
/approve

k8s-ci-robot · 2020-01-22T06:55:12Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jnaulty, leakingtapan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [leakingtapan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@jieyu

@jieyu

@jieyu

@jieyu

* chore: update aws-ebs-csi-driver from 0.4.0 to 0.5.0 [Documentation](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/blob/v0.5.0/docs/README.md) filename | sha512 hash --------- | ------------ [v0.5.0.zip](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/archive/v0.5.0.zip) | `c53327e090352a7f79ee642dbf8c211733f4a2cb78968ec688a1eade55151e65f1f97cd228d22168317439f1db9f3d2f07dcaa2873f44732ad23aaf632cbef3a` [v0.5.0.tar.gz](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/archive/v0.5.0.tar.gz) | `ec4963d34c601cdf718838d90b8aa6f36b16c9ac127743e73fbe76118a606d41aced116aaaab73370c17bcc536945d5ccd735bc5a4a00f523025c8e41ddedcb8` * Add a cmdline option to add extra volume tags ([#353](kubernetes-sigs/aws-ebs-csi-driver#353), [@jieyu](https://github.com/jieyu)) * Switch to use kustomize for manifest ([#360](kubernetes-sigs/aws-ebs-csi-driver#360), [@leakingtapan](https://github.com/leakingtapan)) * enable users to set ec2-endpoint for nonstandard regions ([#369](kubernetes-sigs/aws-ebs-csi-driver#369), [@amdonov](https://github.com/amdonov)) * Add standard volume type ([#379](kubernetes-sigs/aws-ebs-csi-driver#379), [@leakingtapan](https://github.com/leakingtapan)) * Update aws sdk version to enable EKS IAM for SA ([#386](kubernetes-sigs/aws-ebs-csi-driver#386), [@leakingtapan](https://github.com/leakingtapan)) * Implement different driver modes and AWS Region override for controller service ([#438](kubernetes-sigs/aws-ebs-csi-driver#438), [@rfranzke](https://github.com/rfranzke)) * Add manifest files for snapshotter 2.0 ([#452](kubernetes-sigs/aws-ebs-csi-driver#452), [@leakingtapan](https://github.com/leakingtapan)) * Return success if instance or volume are not found ([#375](kubernetes-sigs/aws-ebs-csi-driver#375), [@bertinatto](https://github.com/bertinatto)) * Patch k8scsi sidecars CVE-2019-11255 ([#413](kubernetes-sigs/aws-ebs-csi-driver#413), [@jnaulty](https://github.com/jnaulty)) * Handle mount flags in NodeStageVolume ([#430](kubernetes-sigs/aws-ebs-csi-driver#430), [@bertinatto](https://github.com/bertinatto)) * Run upstream e2e test suites with migration ([#341](kubernetes-sigs/aws-ebs-csi-driver#341), [@wongma7](https://github.com/wongma7)) * Use new test framework for test orchestration ([#359](kubernetes-sigs/aws-ebs-csi-driver#359), [@leakingtapan](https://github.com/leakingtapan)) * Update to use 1.16 cluster with inline test enabled ([#362](kubernetes-sigs/aws-ebs-csi-driver#362), [@leakingtapan](https://github.com/leakingtapan)) * Enable leader election ([#380](kubernetes-sigs/aws-ebs-csi-driver#380), [@leakingtapan](https://github.com/leakingtapan)) * Update go mod and mount library ([#388](kubernetes-sigs/aws-ebs-csi-driver#388), [@leakingtapan](https://github.com/leakingtapan)) * Refactor NewCloud by pass in region ([#394](kubernetes-sigs/aws-ebs-csi-driver#394), [@leakingtapan](https://github.com/leakingtapan)) * helm: provide an option to set extra volume tags ([#396](kubernetes-sigs/aws-ebs-csi-driver#396), [@jieyu](https://github.com/jieyu)) * Allow override for csi-provisioner image ([#401](kubernetes-sigs/aws-ebs-csi-driver#401), [@gliptak](https://github.com/gliptak)) * Enable volume expansion e2e test for CSI migration ([#407](kubernetes-sigs/aws-ebs-csi-driver#407), [@leakingtapan](https://github.com/leakingtapan)) * Swith to use kops 1.16 ([#409](kubernetes-sigs/aws-ebs-csi-driver#409), [@leakingtapan](https://github.com/leakingtapan)) * Added tolerations for node support ([#420](kubernetes-sigs/aws-ebs-csi-driver#420), [@zerkms](https://github.com/zerkms)) * Update helm chart to better match available values and add the ability to add annotations ([#423](kubernetes-sigs/aws-ebs-csi-driver#423), [@krmichel](https://github.com/krmichel)) * [helm] Also add toleration support to controller ([#433](kubernetes-sigs/aws-ebs-csi-driver#433), [@jyaworski](https://github.com/jyaworski)) * Add ec2:ModifyVolume action ([#434](kubernetes-sigs/aws-ebs-csi-driver#434), [@zodiac12k](https://github.com/zodiac12k)) * Schedule the EBS CSI DaemonSet on all nodes by default ([#441](kubernetes-sigs/aws-ebs-csi-driver#441), [@pcfens](https://github.com/pcfens)) * bump chart version * chore: bump liveness probe from 1.1.0 to 2.0.0 - Introduce V(5) on the health check begin/success log lines to allow filtering of these entries from logs. If you would like to retain these log entries the action required would be to set `-v==5` or higher for the livenessprobe container. ([#57](kubernetes-csi/livenessprobe#57), [@stefansedich](https://github.com/stefansedich)) - Deprecated "--connection-timeout" argument has been removed. ([#59](kubernetes-csi/livenessprobe#59), [@msau42](https://github.com/msau42)) - Fix nil pointer bug when driver responds with not ready ([#58](kubernetes-csi/livenessprobe#58), [@scuzhanglei](https://github.com/scuzhanglei)) - Migrated to Go modules, so the source builds also outside of GOPATH. ([#53](kubernetes-csi/livenessprobe#53), [@pohly](https://github.com/pohly)) * chore: bump csi external-provisioner from 1.3.0 to 1.4.0 All external-provisioner versions < 1.4.0 are deprecated and will stop functioning in Kubernetes v1.20. See [#323](kubernetes-csi/external-provisioner#323) and [k/k#80978](kubernetes/kubernetes#80978) for more details. Upgrade your external-provisioner to v1.4+ before Kubernetes v1.20. None - Fixes migration scenarios for Topology, fstype, and accessmodes for the kubernetes.io/gce-pd in-tree plugin ([#277](kubernetes-csi/external-provisioner#277), [@davidz627](https://github.com/davidz627)) - Checks if volume content source is populated if creating a volume from a snapshot source. ([#283](kubernetes-csi/external-provisioner#283), [@zhucan](https://github.com/zhucan)) - Fixes issue when SelfLink removal is turned on in Kubernetes. ([#323](kubernetes-csi/external-provisioner#323), [@msau42](https://github.com/msau42)) - CSI driver can return `CreateVolumeResponse` with size 0, which means unknown volume size. In this case, Provisioner will use PVC requested size as PV size rather than 0 bytes ([#271](kubernetes-csi/external-provisioner#271), [@hoyho](https://github.com/hoyho)) - Fixed potential leak of volumes after CSI driver timeouts. ([#312](kubernetes-csi/external-provisioner#312), [@jsafrane](https://github.com/jsafrane)) - Fixes issue where provisioner provisions volumes for in-tree PVC's which have not been migrated ([#341](kubernetes-csi/external-provisioner#341), [@davidz627](https://github.com/davidz627)) - Send the CSI volume_id instead of PVC Name to the csi-driver in volumeCreate when datasource is PVC ([#310](kubernetes-csi/external-provisioner#310), [@Madhu-1](https://github.com/Madhu-1)) - Fixes nil pointer derefence in log when migration turned on ([#342](kubernetes-csi/external-provisioner#342), [@davidz627](https://github.com/davidz627)) - Handle deletion of CSI migrated volumes ([#273](kubernetes-csi/external-provisioner#273), [@ddebroy](https://github.com/ddebroy)) - Reduced logging noise of unrelated PVCs. Emit event on successful provisioning. ([#351](kubernetes-csi/external-provisioner#351), [@jsafrane](https://github.com/jsafrane)) - Added extra verification of source Snapshot and PersistentVolumeClaim before provisioning. ([#352](kubernetes-csi/external-provisioner#352), [@jsafrane](https://github.com/jsafrane)) * chore: bump attacher * Fixed handling of ControllerUnpublish errors. The attacher will retry to ControllerUnpublish a volume after any error except for NotFound. (#168, @jsafrane) * bump external-snapshotter from 1.1.0 to 1.2.2 Breaking Changes * Changes the API group name for the fake VolumeSnapshot object to "snapshot.storage.k8s.io" to be in-sync with the group name of the real VolumeSnapshot object. As a result, the generated interfaces for clientset and informers of VolumeSnapshot are also changed from "VolumeSnapshot" to "Snapshot". (#123, @xing-yang) New Features * Adds Finalizer on the snapshot source PVC to prevent it from being deleted when a snapshot is being created from it. (#47, @xing-yang) Other Notable Changes * Add Status subresource for VolumeSnapshot. (#121, @zhucan) * Cherry picks PR #138: Prebound snapshots will work correctly with CSI drivers that does not support ListSnasphots.(#156, @hakanmemisoglu) * Cherry picks PR #172: Added extra verification of source PersistentVolumeClaim before creating snapshot.(#173, @xing-yang) * bump external-resizer from 0.2.0 to 0.4.0 New Features * Add prometheus metrics to CSI external-resizer under the /metrics endpoint. This can be enabled via the "--metrics-address" and "--metrics-path" options. (#67, @saad-ali) Bug Fixes * Avoid concurrent processing of same PVCs (#6, @mlmhl) * Exit on CSI gRPC conn loss (#55, @ggriffiths) * Verify claimref associated with PVs before resizing (#57, @gnufied) Other Notable Changes * Migrated to Go modules, so the source builds also outside of GOPATH. (#60, @pohly) * feat(awsebscsiprovisioner): updated awsebscsiprovisioner flags - updated args as mentioned in comments - updated container versions as mentioned in the comments D2IQ-64990 #comment updated awsebscsiprovisioner pod arg * feat(awsebscsiprovisioner): added podAnnotations - added statefulSet.podAnnotations feature - added new roles and snapshotter-controller - added more values to be setable D2IQ-64992 #comment updated awsebscsiprovisioner to include statefulSet.podAnnotations * fix: added replacing system-x-critial replacement - this was added for being able to run the ct install / upgrade behaviour so that we also can test with that priorityClassName set pods, that normally get a system-node critial or system-cluster-critical priorityClassName set. These only will be allowed to run in namespace kube-system and that for we need to drop the priorityClassName here to null for our tests. - separated lint and install, as otherwise lint would fail because of the sed changes - exclude gcp-csi-driver [D2IQ-65765] [D2IQ-65765]: https://jira.d2iq.com/browse/D2IQ-65765 Co-authored-by: Sebastian Brandt <793580+sebbrandt87@users.noreply.github.com>

@jieyu

…bs-csi-driver from 0.4.0 to 0.5.0 [Documentation](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/blob/v0.5.0/docs/README.md) filename | sha512 hash --------- | ------------ [v0.5.0.zip](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/archive/v0.5.0.zip) | [v0.5.0.tar.gz](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/archive/v0.5.0.tar.gz) | * Add a cmdline option to add extra volume tags ([#353](kubernetes-sigs/aws-ebs-csi-driver#353), [@jieyu](https://github.com/jieyu)) * Switch to use kustomize for manifest ([#360](kubernetes-sigs/aws-ebs-csi-driver#360), [@leakingtapan](https://github.com/leakingtapan)) * enable users to set ec2-endpoint for nonstandard regions ([#369](kubernetes-sigs/aws-ebs-csi-driver#369), [@amdonov](https://github.com/amdonov)) * Add standard volume type ([#379](kubernetes-sigs/aws-ebs-csi-driver#379), [@leakingtapan](https://github.com/leakingtapan)) * Update aws sdk version to enable EKS IAM for SA ([#386](kubernetes-sigs/aws-ebs-csi-driver#386), [@leakingtapan](https://github.com/leakingtapan)) * Implement different driver modes and AWS Region override for controller service ([#438](kubernetes-sigs/aws-ebs-csi-driver#438), [@rfranzke](https://github.com/rfranzke)) * Add manifest files for snapshotter 2.0 ([#452](kubernetes-sigs/aws-ebs-csi-driver#452), [@leakingtapan](https://github.com/leakingtapan)) * Return success if instance or volume are not found ([#375](kubernetes-sigs/aws-ebs-csi-driver#375), [@bertinatto](https://github.com/bertinatto)) * Patch k8scsi sidecars CVE-2019-11255 ([#413](kubernetes-sigs/aws-ebs-csi-driver#413), [@jnaulty](https://github.com/jnaulty)) * Handle mount flags in NodeStageVolume ([#430](kubernetes-sigs/aws-ebs-csi-driver#430), [@bertinatto](https://github.com/bertinatto)) * Run upstream e2e test suites with migration ([#341](kubernetes-sigs/aws-ebs-csi-driver#341), [@wongma7](https://github.com/wongma7)) * Use new test framework for test orchestration ([#359](kubernetes-sigs/aws-ebs-csi-driver#359), [@leakingtapan](https://github.com/leakingtapan)) * Update to use 1.16 cluster with inline test enabled ([#362](kubernetes-sigs/aws-ebs-csi-driver#362), [@leakingtapan](https://github.com/leakingtapan)) * Enable leader election ([#380](kubernetes-sigs/aws-ebs-csi-driver#380), [@leakingtapan](https://github.com/leakingtapan)) * Update go mod and mount library ([#388](kubernetes-sigs/aws-ebs-csi-driver#388), [@leakingtapan](https://github.com/leakingtapan)) * Refactor NewCloud by pass in region ([#394](kubernetes-sigs/aws-ebs-csi-driver#394), [@leakingtapan](https://github.com/leakingtapan)) * helm: provide an option to set extra volume tags ([#396](kubernetes-sigs/aws-ebs-csi-driver#396), [@jieyu](https://github.com/jieyu)) * Allow override for csi-provisioner image ([#401](kubernetes-sigs/aws-ebs-csi-driver#401), [@gliptak](https://github.com/gliptak)) * Enable volume expansion e2e test for CSI migration ([#407](kubernetes-sigs/aws-ebs-csi-driver#407), [@leakingtapan](https://github.com/leakingtapan)) * Swith to use kops 1.16 ([#409](kubernetes-sigs/aws-ebs-csi-driver#409), [@leakingtapan](https://github.com/leakingtapan)) * Added tolerations for node support ([#420](kubernetes-sigs/aws-ebs-csi-driver#420), [@zerkms](https://github.com/zerkms)) * Update helm chart to better match available values and add the ability to add annotations ([#423](kubernetes-sigs/aws-ebs-csi-driver#423), [@krmichel](https://github.com/krmichel)) * [helm] Also add toleration support to controller ([#433](kubernetes-sigs/aws-ebs-csi-driver#433), [@jyaworski](https://github.com/jyaworski)) * Add ec2:ModifyVolume action ([#434](kubernetes-sigs/aws-ebs-csi-driver#434), [@zodiac12k](https://github.com/zodiac12k)) * Schedule the EBS CSI DaemonSet on all nodes by default ([#441](kubernetes-sigs/aws-ebs-csi-driver#441), [@pcfens](https://github.com/pcfens)) * bump chart version * chore: bump liveness probe from 1.1.0 to 2.0.0 - Introduce V(5) on the health check begin/success log lines to allow filtering of these entries from logs. If you would like to retain these log entries the action required would be to set or higher for the livenessprobe container. ([#57](kubernetes-csi/livenessprobe#57), [@stefansedich](https://github.com/stefansedich)) - Deprecated --connection-timeout argument has been removed. ([#59](kubernetes-csi/livenessprobe#59), [@msau42](https://github.com/msau42)) - Fix nil pointer bug when driver responds with not ready ([#58](kubernetes-csi/livenessprobe#58), [@scuzhanglei](https://github.com/scuzhanglei)) - Migrated to Go modules, so the source builds also outside of GOPATH. ([#53](kubernetes-csi/livenessprobe#53), [@pohly](https://github.com/pohly)) * chore: bump csi external-provisioner from 1.3.0 to 1.4.0 All external-provisioner versions < 1.4.0 are deprecated and will stop functioning in Kubernetes v1.20. See [#323](kubernetes-csi/external-provisioner#323) and [k/k#80978](kubernetes/kubernetes#80978) for more details. Upgrade your external-provisioner to v1.4+ before Kubernetes v1.20. None - Fixes migration scenarios for Topology, fstype, and accessmodes for the kubernetes.io/gce-pd in-tree plugin ([#277](kubernetes-csi/external-provisioner#277), [@davidz627](https://github.com/davidz627)) - Checks if volume content source is populated if creating a volume from a snapshot source. ([#283](kubernetes-csi/external-provisioner#283), [@zhucan](https://github.com/zhucan)) - Fixes issue when SelfLink removal is turned on in Kubernetes. ([#323](kubernetes-csi/external-provisioner#323), [@msau42](https://github.com/msau42)) - CSI driver can return with size 0, which means unknown volume size. In this case, Provisioner will use PVC requested size as PV size rather than 0 bytes ([#271](kubernetes-csi/external-provisioner#271), [@hoyho](https://github.com/hoyho)) - Fixed potential leak of volumes after CSI driver timeouts. ([#312](kubernetes-csi/external-provisioner#312), [@jsafrane](https://github.com/jsafrane)) - Fixes issue where provisioner provisions volumes for in-tree PVC's which have not been migrated ([#341](kubernetes-csi/external-provisioner#341), [@davidz627](https://github.com/davidz627)) - Send the CSI volume_id instead of PVC Name to the csi-driver in volumeCreate when datasource is PVC ([#310](kubernetes-csi/external-provisioner#310), [@Madhu-1](https://github.com/Madhu-1)) - Fixes nil pointer derefence in log when migration turned on ([#342](kubernetes-csi/external-provisioner#342), [@davidz627](https://github.com/davidz627)) - Handle deletion of CSI migrated volumes ([#273](kubernetes-csi/external-provisioner#273), [@ddebroy](https://github.com/ddebroy)) - Reduced logging noise of unrelated PVCs. Emit event on successful provisioning. ([#351](kubernetes-csi/external-provisioner#351), [@jsafrane](https://github.com/jsafrane)) - Added extra verification of source Snapshot and PersistentVolumeClaim before provisioning. ([#352](kubernetes-csi/external-provisioner#352), [@jsafrane](https://github.com/jsafrane)) * chore: bump attacher * Fixed handling of ControllerUnpublish errors. The attacher will retry to ControllerUnpublish a volume after any error except for NotFound. (#168, @jsafrane) * bump external-snapshotter from 1.1.0 to 1.2.2 Breaking Changes * Changes the API group name for the fake VolumeSnapshot object to snapshot.storage.k8s.io to be in-sync with the group name of the real VolumeSnapshot object. As a result, the generated interfaces for clientset and informers of VolumeSnapshot are also changed from VolumeSnapshot to Snapshot. (#123, @xing-yang) New Features * Adds Finalizer on the snapshot source PVC to prevent it from being deleted when a snapshot is being created from it. (#47, @xing-yang) Other Notable Changes * Add Status subresource for VolumeSnapshot. (#121, @zhucan) * Cherry picks PR #138: Prebound snapshots will work correctly with CSI drivers that does not support ListSnasphots.(#156, @hakanmemisoglu) * Cherry picks PR #172: Added extra verification of source PersistentVolumeClaim before creating snapshot.(#173, @xing-yang) * bump external-resizer from 0.2.0 to 0.4.0 New Features * Add prometheus metrics to CSI external-resizer under the /metrics endpoint. This can be enabled via the --metrics-address and --metrics-path options. (#67, @saad-ali) Bug Fixes * Avoid concurrent processing of same PVCs (#6, @mlmhl) * Exit on CSI gRPC conn loss (#55, @ggriffiths) * Verify claimref associated with PVs before resizing (#57, @gnufied) Other Notable Changes * Migrated to Go modules, so the source builds also outside of GOPATH. (#60, @pohly) * feat(awsebscsiprovisioner): updated awsebscsiprovisioner flags - updated args as mentioned in comments - updated container versions as mentioned in the comments D2IQ-64990 #comment updated awsebscsiprovisioner pod arg * feat(awsebscsiprovisioner): added podAnnotations - added statefulSet.podAnnotations feature - added new roles and snapshotter-controller - added more values to be setable D2IQ-64992 #comment updated awsebscsiprovisioner to include statefulSet.podAnnotations * fix: added replacing system-x-critial replacement - this was added for being able to run the ct install / upgrade behaviour so that we also can test with that priorityClassName set pods, that normally get a system-node critial or system-cluster-critical priorityClassName set. These only will be allowed to run in namespace kube-system and that for we need to drop the priorityClassName here to null for our tests. - separated lint and install, as otherwise lint would fail because of the sed changes - exclude gcp-csi-driver [D2IQ-65765] [D2IQ-65765]: https://jira.d2iq.com/browse/D2IQ-65765 Co-authored-by: Sebastian Brandt <793580+sebbrandt87@users.noreply.github.com>

k8s-ci-robot added do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Nov 22, 2019

k8s-ci-robot requested review from ddebroy and leakingtapan November 22, 2019 07:07

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Nov 22, 2019

k8s-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Nov 22, 2019

jnaulty force-pushed the jnaulty/issue-411 branch from 92146f0 to df7ef80 Compare November 22, 2019 07:11

k8s-ci-robot removed the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Nov 22, 2019

k8s-ci-robot assigned bertinatto Nov 22, 2019

jnaulty changed the title ~~fix #411 k8scsi sidecars CVE-2019-11255~~ Patch k8scsi sidecars CVE-2019-11255 Nov 22, 2019

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Nov 22, 2019

jnaulty force-pushed the jnaulty/issue-411 branch from df7ef80 to 4e84d64 Compare November 22, 2019 22:07

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Nov 22, 2019

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 14, 2020

jnaulty force-pushed the jnaulty/issue-411 branch from 4e84d64 to d663a36 Compare January 14, 2020 19:56

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 14, 2020

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jan 21, 2020

jnaulty force-pushed the jnaulty/issue-411 branch from a39d963 to 9b384ad Compare January 21, 2020 18:52

k8s-ci-robot assigned leakingtapan Jan 22, 2020

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jan 22, 2020

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 22, 2020

k8s-ci-robot merged commit c0abd8b into kubernetes-sigs:master Jan 22, 2020

joejulian mentioned this pull request Mar 6, 2020

chore: update awsebscsiprovisioner chart mesosphere/charts#492

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Patch k8scsi sidecars CVE-2019-11255 #413

Patch k8scsi sidecars CVE-2019-11255 #413

jnaulty commented Nov 22, 2019 •

edited

Loading

k8s-ci-robot commented Nov 22, 2019

k8s-ci-robot commented Nov 22, 2019

coveralls commented Nov 22, 2019 •

edited

Loading

jnaulty commented Nov 22, 2019

bertinatto commented Nov 22, 2019

jnaulty commented Nov 22, 2019

jnaulty commented Nov 22, 2019

bertinatto commented Nov 22, 2019

jnaulty commented Nov 22, 2019

jnaulty commented Nov 22, 2019 •

edited

Loading

leakingtapan commented Nov 22, 2019 •

edited

Loading

leakingtapan commented Nov 22, 2019

leakingtapan commented Nov 26, 2019

leakingtapan commented Jan 8, 2020 •

edited

Loading

leakingtapan commented Jan 8, 2020

jnaulty commented Jan 14, 2020 •

edited

Loading

jnaulty commented Jan 14, 2020

leakingtapan commented Jan 14, 2020 •

edited

Loading

jnaulty commented Jan 21, 2020

jnaulty commented Jan 21, 2020

jnaulty commented Jan 21, 2020 •

edited

Loading

jnaulty commented Jan 21, 2020

leakingtapan commented Jan 22, 2020

k8s-ci-robot commented Jan 22, 2020

Patch k8scsi sidecars CVE-2019-11255 #413

Patch k8scsi sidecars CVE-2019-11255 #413

Conversation

jnaulty commented Nov 22, 2019 • edited Loading

k8s-ci-robot commented Nov 22, 2019

k8s-ci-robot commented Nov 22, 2019

coveralls commented Nov 22, 2019 • edited Loading

Pull Request Test Coverage Report for Build 989

💛 - Coveralls

jnaulty commented Nov 22, 2019

bertinatto commented Nov 22, 2019

jnaulty commented Nov 22, 2019

jnaulty commented Nov 22, 2019

bertinatto commented Nov 22, 2019

jnaulty commented Nov 22, 2019

jnaulty commented Nov 22, 2019 • edited Loading

leakingtapan commented Nov 22, 2019 • edited Loading

leakingtapan commented Nov 22, 2019

leakingtapan commented Nov 26, 2019

leakingtapan commented Jan 8, 2020 • edited Loading

leakingtapan commented Jan 8, 2020

jnaulty commented Jan 14, 2020 • edited Loading

jnaulty commented Jan 14, 2020

leakingtapan commented Jan 14, 2020 • edited Loading

jnaulty commented Jan 21, 2020

jnaulty commented Jan 21, 2020

jnaulty commented Jan 21, 2020 • edited Loading

jnaulty commented Jan 21, 2020

leakingtapan commented Jan 22, 2020

k8s-ci-robot commented Jan 22, 2020

jnaulty commented Nov 22, 2019 •

edited

Loading

coveralls commented Nov 22, 2019 •

edited

Loading

jnaulty commented Nov 22, 2019 •

edited

Loading

leakingtapan commented Nov 22, 2019 •

edited

Loading

leakingtapan commented Jan 8, 2020 •

edited

Loading

jnaulty commented Jan 14, 2020 •

edited

Loading

leakingtapan commented Jan 14, 2020 •

edited

Loading

jnaulty commented Jan 21, 2020 •

edited

Loading