-
Notifications
You must be signed in to change notification settings - Fork 342
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for injecting tolerations to sonobuoy pod #1976
Conversation
@franknstyle Can you please review this? |
@franknstyle Gentle reminder. |
@masap can you take a look at CI failures please |
@franknstyle I got it, I will take a look. |
@franknstyle I checked the |
@franknstyle I think I can fix these warnings by myself. To do this, I would like to run the lint locally. But trailing command does not show the error. How to run the lint locally?
|
Thank you @masap, if you have a look in ./scripts/build_funcs.sh there is a lint func that wraps the call to |
Thank you for your response @franknstyle. It seems the
|
Let's disable typecheck and review in a following issue. Can you add a commit for adding
to |
Do you mean |
Hi @masap, Looks like we are failing a vuln scan now. Are you able to update the go mod to 1.21.4 and go mod tidy so stdlib get's updated. Thank you. |
Hmm, lint error still exists. According to [1], we can't disable We upgraded
I will fix this as well. [1] https://golangci-lint.run/welcome/faq/#why-do-you-have-typecheck-errors |
Fixed. |
@franknstyle Could you enable auto pipeline builds for this PR? This would help ensure the pipelines pass and reduce turnaround time, especially considering the timezone differences between all of us? |
38b876f
to
5d7d17c
Compare
I have confirmed that it passes, except for Windows-related checks with my local Github actions. |
f0b70ae
to
aa5665c
Compare
We upgraded golang lang 1.20 -> 1.21 by commit 9a64023. But according to [2], go1.21 is officially supported since golangci-lint v1.54.1. So, this PR upgrades golangci-lint to v1.54.2. Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
According to trivy, golang 1.21.4 has trailing vulnerabilities. We upgrade it to 1.21.11 to fix the vulnerabilities. $ trivy image masap20220915/sonobuoy:amd64-v0.57 2024-07-01T09:50:21+09:00 INFO Vulnerability scanning is enabled 2024-07-01T09:50:21+09:00 INFO Secret scanning is enabled 2024-07-01T09:50:21+09:00 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 2024-07-01T09:50:21+09:00 INFO Please see also https://aquasecurity.github.io/trivy/v0.52/docs/scanner/secret/#recommendation for faster secret detection 2024-07-01T09:50:24+09:00 INFO Detected OS family="debian" version="12.5" 2024-07-01T09:50:24+09:00 INFO [debian] Detecting vulnerabilities... os_version="12" pkg_num=3 2024-07-01T09:50:24+09:00 INFO Number of language-specific files num=1 2024-07-01T09:50:24+09:00 INFO [gobinary] Detecting vulnerabilities... masap20220915/sonobuoy:amd64-v0.57 (debian 12.5) Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) sonobuoy (gobinary) Total: 9 (UNKNOWN: 0, LOW: 0, MEDIUM: 7, HIGH: 1, CRITICAL: 1) ┌─────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬──────────────────────────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ ├─────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼──────────────────────────────────────────────────────────────┤ │ stdlib │ CVE-2024-24790 │ CRITICAL │ fixed │ 1.21.4 │ 1.21.11, 1.22.4 │ golang: net/netip: Unexpected behavior from Is methods for │ │ │ │ │ │ │ │ IPv4-mapped IPv6 addresses │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-24790 │ │ ├────────────────┼──────────┤ │ ├─────────────────┼──────────────────────────────────────────────────────────────┤ │ │ CVE-2023-45288 │ HIGH │ │ │ 1.21.9, 1.22.2 │ golang: net/http, x/net/http2: unlimited number of │ │ │ │ │ │ │ │ CONTINUATION frames causes DoS │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-45288 │ │ ├────────────────┼──────────┤ │ ├─────────────────┼──────────────────────────────────────────────────────────────┤ │ │ CVE-2023-39326 │ MEDIUM │ │ │ 1.20.12, 1.21.5 │ golang: net/http/internal: Denial of Service (DoS) via │ │ │ │ │ │ │ │ Resource Consumption via HTTP requests... │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-39326 │ │ ├────────────────┤ │ │ ├─────────────────┼──────────────────────────────────────────────────────────────┤ │ │ CVE-2023-45289 │ │ │ │ 1.21.8, 1.22.1 │ golang: net/http/cookiejar: incorrect forwarding of │ │ │ │ │ │ │ │ sensitive headers and cookies on HTTP redirect... │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-45289 │ │ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤ │ │ CVE-2023-45290 │ │ │ │ │ golang: net/http: memory exhaustion in │ │ │ │ │ │ │ │ Request.ParseMultipartForm │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-45290 │ │ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤ │ │ CVE-2024-24783 │ │ │ │ │ golang: crypto/x509: Verify panics on certificates with an │ │ │ │ │ │ │ │ unknown public key algorithm... │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-24783 │ │ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤ │ │ CVE-2024-24784 │ │ │ │ │ golang: net/mail: comments in display names are incorrectly │ │ │ │ │ │ │ │ handled │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-24784 │ │ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤ │ │ CVE-2024-24785 │ │ │ │ │ golang: html/template: errors returned from MarshalJSON │ │ │ │ │ │ │ │ methods may break template escaping │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-24785 │ │ ├────────────────┤ │ │ ├─────────────────┼──────────────────────────────────────────────────────────────┤ │ │ CVE-2024-24789 │ │ │ │ 1.21.11, 1.22.4 │ golang: archive/zip: Incorrect handling of certain ZIP files │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-24789 │ └─────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────┴──────────────────────────────────────────────────────────────┘ Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
ERROR: failed to solve: failed to compute cache key: mount callback failed on /tmp/containerd-mount1917080101: link /tmp/containerd-mount1917080101/Windows/INF/basicrender.inf /tmp/containerd-mount1917080101/Windows/System32/DriverStore/FileRepository/basicrender.inf_amd64_efdc64af60c69a6d/basicrender.inf: no such file or directory Error: Process completed with exit code 1. According to [1], we need to use ltsc2022 as a tag. [1] microsoft/Windows-Containers#493 Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
Resolves vmware-tanzu#1973. We can inject some tolerations to sonobuoy aggregator pod by adding trailing description into sonobuoy config json. { "AggregatorTolerations": [ { "effect": "NoSchedule", "key": "key1", "operator": "Equal", "value": "value1" }, { "effect": "NoSchedule", "key": "key2", "operator": "Equal", "value": "value2" } ] } Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
I confirmed all checks are passed. |
Thanks @masap, hope the pipeline will go through once @franknstyle approves. |
@franknstyle Can you please take a look at this PR again? |
To fix trailing warning. Total: 1 (MEDIUM: 1, HIGH: 0, CRITICAL: 0) ┌─────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬──────────────────────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ ├─────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼──────────────────────────────────────────────────────────┤ │ stdlib │ CVE-2024-24791 │ MEDIUM │ fixed │ 1.21.11 │ 1.21.12, 1.22.5 │ net/http: Denial of service due to improper 100-continue │ │ │ │ │ │ │ │ handling in net/http │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-24791 │ └─────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────┴──────────────────────────────────────────────────────────┘ Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
I fixed a CI error caused by new CVE (CVE-2024-24791). |
Thank you for your support @franknstyle! When can we expect the next release? |
What this PR does / why we need it:
Add support for injecting tolerations to sonobuoy pod
Which issue(s) this PR fixes
tolerations
to sonobuoy pod #1973.We can inject some tolerations to sonobuoy aggregator pod by adding trailing description into sonobuoy config json.
Special notes for your reviewer:
Release note: