Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NETOBSERV-1369: Disable http/2 #466

Merged
merged 2 commits into from
Oct 30, 2023
Merged

Conversation

jotak
Copy link
Member

@jotak jotak commented Oct 19, 2023

Additional remediations for CVE-2023-39325 CVE-2023-44487: Disable HTTP/2 on:

  • Webhook server
  • Metrics server
  • FLP and Console plugin via env GODEBUG
  • Update kube-rbac-proxy to v0.14.4

Also bump all k8s / contorller-runtime dependencies Stop support for go1.19, add support for go1.21 (still uses 1.20 for builds)

Description

Dependencies

n/a

Checklist

If you are not familiar with our processes or don't know what to answer in the list below, let us know in a comment: the maintainers will take care of that.

  • Is this PR backed with a JIRA ticket? If so, make sure it is written as a title prefix (in general, PRs affecting the NetObserv/Network Observability product should be backed with a JIRA ticket - especially if they bring user facing changes).
  • Does this PR require product documentation?
    • If so, make sure the JIRA epic is labelled with "documentation" and provides a description relevant for doc writers, such as use cases or scenarios. Any required step to activate or configure the feature should be documented there, such as new CRD knobs.
  • Does this PR require a product release notes entry?
    • If so, fill in "Release Note Text" in the JIRA.
  • Is there anything else the QE team should know before testing? E.g: configuration changes, environment setup, etc.
    • If so, make sure it is described in the JIRA ticket.
  • QE requirements (check 1 from the list):
    • Standard QE validation, with pre-merge tests unless stated otherwise.
    • Regression tests only (e.g. refactoring with no user-facing change).
    • No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

@codecov
Copy link

codecov bot commented Oct 19, 2023

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (1ddca8a) 54.95% compared to head (661e167) 54.97%.
Report is 1 commits behind head on main.

❗ Current head 661e167 differs from pull request most recent head 4793d52. Consider uploading reports for the commit 4793d52 to get more accurate results

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #466      +/-   ##
==========================================
+ Coverage   54.95%   54.97%   +0.02%     
==========================================
  Files          47       47              
  Lines        6460     6463       +3     
==========================================
+ Hits         3550     3553       +3     
  Misses       2668     2668              
  Partials      242      242              
Flag Coverage Δ
unittests 54.97% <100.00%> (+0.02%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files Coverage Δ
controllers/consoleplugin/consoleplugin_objects.go 94.64% <100.00%> (+0.01%) ⬆️
controllers/flowlogspipeline/flp_common_objects.go 80.13% <100.00%> (+0.05%) ⬆️

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@jotak jotak changed the title Disable http/2 NETOBSERV-1369: Disable http/2 Oct 19, 2023
@openshift-ci-robot
Copy link
Collaborator

openshift-ci-robot commented Oct 19, 2023

@jotak: This pull request references NETOBSERV-1369 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.15.0" version, but no target version was set.

In response to this:

Additional remediations for CVE-2023-39325 CVE-2023-44487: Disable HTTP/2 on:

  • Webhook server
  • Metrics server
  • FLP and Console plugin via env GODEBUG
  • Update kube-rbac-proxy to v0.14.4

Also bump all k8s / contorller-runtime dependencies Stop support for go1.19, add support for go1.21 (still uses 1.20 for builds)

Description

Dependencies

n/a

Checklist

If you are not familiar with our processes or don't know what to answer in the list below, let us know in a comment: the maintainers will take care of that.

  • Is this PR backed with a JIRA ticket? If so, make sure it is written as a title prefix (in general, PRs affecting the NetObserv/Network Observability product should be backed with a JIRA ticket - especially if they bring user facing changes).
  • Does this PR require product documentation?
  • If so, make sure the JIRA epic is labelled with "documentation" and provides a description relevant for doc writers, such as use cases or scenarios. Any required step to activate or configure the feature should be documented there, such as new CRD knobs.
  • Does this PR require a product release notes entry?
  • If so, fill in "Release Note Text" in the JIRA.
  • Is there anything else the QE team should know before testing? E.g: configuration changes, environment setup, etc.
  • If so, make sure it is described in the JIRA ticket.
  • QE requirements (check 1 from the list):
  • Standard QE validation, with pre-merge tests unless stated otherwise.
  • Regression tests only (e.g. refactoring with no user-facing change).
  • No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@jotak jotak added the ok-to-test To set manually when a PR is safe to test. Triggers image build on PR. label Oct 19, 2023
@openshift-ci-robot
Copy link
Collaborator

openshift-ci-robot commented Oct 19, 2023

@jotak: This pull request references NETOBSERV-1369 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.15.0" version, but no target version was set.

In response to this:

Additional remediations for CVE-2023-39325 CVE-2023-44487: Disable HTTP/2 on:

  • Webhook server
  • Metrics server
  • FLP and Console plugin via env GODEBUG
  • Update kube-rbac-proxy to v0.14.4

Also bump all k8s / contorller-runtime dependencies Stop support for go1.19, add support for go1.21 (still uses 1.20 for builds)

Description

Dependencies

n/a

Checklist

If you are not familiar with our processes or don't know what to answer in the list below, let us know in a comment: the maintainers will take care of that.

  • Is this PR backed with a JIRA ticket? If so, make sure it is written as a title prefix (in general, PRs affecting the NetObserv/Network Observability product should be backed with a JIRA ticket - especially if they bring user facing changes).
  • Does this PR require product documentation?
  • If so, make sure the JIRA epic is labelled with "documentation" and provides a description relevant for doc writers, such as use cases or scenarios. Any required step to activate or configure the feature should be documented there, such as new CRD knobs.
  • Does this PR require a product release notes entry?
  • If so, fill in "Release Note Text" in the JIRA.
  • Is there anything else the QE team should know before testing? E.g: configuration changes, environment setup, etc.
  • If so, make sure it is described in the JIRA ticket.
  • QE requirements (check 1 from the list):
  • Standard QE validation, with pre-merge tests unless stated otherwise.
  • Regression tests only (e.g. refactoring with no user-facing change).
  • No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci-robot
Copy link
Collaborator

openshift-ci-robot commented Oct 19, 2023

@jotak: This pull request references NETOBSERV-1369 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.15.0" version, but no target version was set.

In response to this:

Additional remediations for CVE-2023-39325 CVE-2023-44487: Disable HTTP/2 on:

  • Webhook server
  • Metrics server
  • FLP and Console plugin via env GODEBUG
  • Update kube-rbac-proxy to v0.14.4

Also bump all k8s / contorller-runtime dependencies Stop support for go1.19, add support for go1.21 (still uses 1.20 for builds)

Description

Dependencies

n/a

Checklist

If you are not familiar with our processes or don't know what to answer in the list below, let us know in a comment: the maintainers will take care of that.

  • Is this PR backed with a JIRA ticket? If so, make sure it is written as a title prefix (in general, PRs affecting the NetObserv/Network Observability product should be backed with a JIRA ticket - especially if they bring user facing changes).
  • Does this PR require product documentation?
  • If so, make sure the JIRA epic is labelled with "documentation" and provides a description relevant for doc writers, such as use cases or scenarios. Any required step to activate or configure the feature should be documented there, such as new CRD knobs.
  • Does this PR require a product release notes entry?
  • If so, fill in "Release Note Text" in the JIRA.
  • Is there anything else the QE team should know before testing? E.g: configuration changes, environment setup, etc.
  • If so, make sure it is described in the JIRA ticket.
  • QE requirements (check 1 from the list):
  • Standard QE validation, with pre-merge tests unless stated otherwise.
  • Regression tests only (e.g. refactoring with no user-facing change).
  • No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@github-actions
Copy link

New images:

  • quay.io/netobserv/network-observability-operator:b59602c
  • quay.io/netobserv/network-observability-operator-bundle:v0.0.0-b59602c
  • quay.io/netobserv/network-observability-operator-catalog:v0.0.0-b59602c

They will expire after two weeks.

To deploy this build:

# Direct deployment, from operator repo
IMAGE=quay.io/netobserv/network-observability-operator:b59602c make deploy

# Or using operator-sdk
operator-sdk run bundle quay.io/netobserv/network-observability-operator-bundle:v0.0.0-b59602c

Or as a Catalog Source:

apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: netobserv-dev
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: quay.io/netobserv/network-observability-operator-catalog:v0.0.0-b59602c
  displayName: NetObserv development catalog
  publisher: Me
  updateStrategy:
    registryPoll:
      interval: 1m

@jotak jotak added the no-doc This PR doesn't require documentation change on the NetObserv operator label Oct 19, 2023
jpinsonneau
jpinsonneau previously approved these changes Oct 19, 2023
@@ -10,7 +10,7 @@ jobs:
runs-on: ubuntu-latest
strategy:
matrix:
go: ['1.19','1.20']
go: ['1.20','1.21']
Copy link
Contributor

@msherif1234 msherif1234 Oct 19, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

u need to modify go: ['1.20']in the other yml files to be go: ['1.21']

workflows/pull_request.yml:      if: ${{ matrix.go == '1.20' }}
workflows/push_image_pr.yml:        go: ['1.20']
workflows/release.yml:        go: ['1.20']
workflows/push_image.yml:        go: ['1.20']
workflows/push_image.yml:        go: ['1.20']

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no, we keep using 1.20 as the main one, since this is what's still used atm for image builds. 1.21 is like a "preview" atm

OlivierCazade
OlivierCazade previously approved these changes Oct 19, 2023
@jotak jotak dismissed stale reviews from OlivierCazade and jpinsonneau via b113e00 October 23, 2023 06:43
@openshift-ci openshift-ci bot removed the lgtm label Oct 23, 2023
@github-actions github-actions bot removed the ok-to-test To set manually when a PR is safe to test. Triggers image build on PR. label Oct 23, 2023
Additional remediations for CVE-2023-39325 CVE-2023-44487: Disable HTTP/2 on:

- Webhook server
- Metrics server
- FLP and Console plugin via env GODEBUG

Also bump all k8s / contorller-runtime dependencies
Stop support for go1.19, add support for go1.21 (still uses 1.20 for
builds)
@openshift-ci openshift-ci bot added the lgtm label Oct 23, 2023
@Amoghrd
Copy link
Contributor

Amoghrd commented Oct 30, 2023

/ok-to-test

@openshift-ci openshift-ci bot added the ok-to-test To set manually when a PR is safe to test. Triggers image build on PR. label Oct 30, 2023
@github-actions
Copy link

New images:

  • quay.io/netobserv/network-observability-operator:3988939
  • quay.io/netobserv/network-observability-operator-bundle:v0.0.0-3988939
  • quay.io/netobserv/network-observability-operator-catalog:v0.0.0-3988939

They will expire after two weeks.

To deploy this build:

# Direct deployment, from operator repo
IMAGE=quay.io/netobserv/network-observability-operator:3988939 make deploy

# Or using operator-sdk
operator-sdk run bundle quay.io/netobserv/network-observability-operator-bundle:v0.0.0-3988939

Or as a Catalog Source:

apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: netobserv-dev
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: quay.io/netobserv/network-observability-operator-catalog:v0.0.0-3988939
  displayName: NetObserv development catalog
  publisher: Me
  updateStrategy:
    registryPoll:
      interval: 1m

@Amoghrd
Copy link
Contributor

Amoghrd commented Oct 30, 2023

/label qe-approved

@openshift-ci openshift-ci bot added the qe-approved QE has approved this pull request label Oct 30, 2023
@openshift-ci-robot
Copy link
Collaborator

openshift-ci-robot commented Oct 30, 2023

@jotak: This pull request references NETOBSERV-1369 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.15.0" version, but no target version was set.

In response to this:

Additional remediations for CVE-2023-39325 CVE-2023-44487: Disable HTTP/2 on:

  • Webhook server
  • Metrics server
  • FLP and Console plugin via env GODEBUG
  • Update kube-rbac-proxy to v0.14.4

Also bump all k8s / contorller-runtime dependencies Stop support for go1.19, add support for go1.21 (still uses 1.20 for builds)

Description

Dependencies

n/a

Checklist

If you are not familiar with our processes or don't know what to answer in the list below, let us know in a comment: the maintainers will take care of that.

  • Is this PR backed with a JIRA ticket? If so, make sure it is written as a title prefix (in general, PRs affecting the NetObserv/Network Observability product should be backed with a JIRA ticket - especially if they bring user facing changes).
  • Does this PR require product documentation?
  • If so, make sure the JIRA epic is labelled with "documentation" and provides a description relevant for doc writers, such as use cases or scenarios. Any required step to activate or configure the feature should be documented there, such as new CRD knobs.
  • Does this PR require a product release notes entry?
  • If so, fill in "Release Note Text" in the JIRA.
  • Is there anything else the QE team should know before testing? E.g: configuration changes, environment setup, etc.
  • If so, make sure it is described in the JIRA ticket.
  • QE requirements (check 1 from the list):
  • Standard QE validation, with pre-merge tests unless stated otherwise.
  • Regression tests only (e.g. refactoring with no user-facing change).
  • No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@jotak
Copy link
Member Author

jotak commented Oct 30, 2023

/approve

@openshift-ci
Copy link

openshift-ci bot commented Oct 30, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jotak

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot merged commit 0200e11 into netobserv:main Oct 30, 2023
9 checks passed
@jotak jotak deleted the disable-http2 branch November 1, 2023 08:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved jira/valid-reference lgtm no-doc This PR doesn't require documentation change on the NetObserv operator ok-to-test To set manually when a PR is safe to test. Triggers image build on PR. qe-approved QE has approved this pull request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants