jenkinsci / kubernetes-operator

Kubernetes native Jenkins Operator

https://jenkinsci.github.io/kubernetes-operator

Other

591 stars 231 forks source link

Patching vulnerabilities #940

Closed Rickyf115 closed 7 months ago

Rickyf115 commented 7 months ago

Changes

Patching some Critical and High vulnerabilities as identified from a Prisma scan

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you review them:

[ ] Includes tests (if functionality changed/added)
[ ] Includes docs (if user facing)
[x] Commit messages follow commit message best practices

See the contribution guide for more details.

Reviewer Notes

If API changes are included, additive changes must be approved by at least two OWNERS and backwards incompatible changes must be approved by more than 50% of the OWNERS.

Rickyf115 commented 7 months ago

We probably need to update the github environment to build off golang 1.21.4 to get these tests happy

Rickyf115 commented 7 months ago

Wanted to also update controller-util but unsure of what backwards compatibility we're aiming for here, as well as I didn't want to mess up reporting for testing, probably something to be done in the near future though, this is 9 minor versions behind

brokenpip3 commented 7 months ago

Thanks for your PR however you can't update a project like this by just updating the go mod and the go version.

First of all a lot of golang code will result not functional after an upgrade like this. Second: this project is based on operator-sdk that is based on kubebuilder, you need to follow the upgrade sdk instruction: https://sdk.operatorframework.io/docs/upgrading-sdk-version/ version by version and fix all the go code after. Not mentioning the tests part.

I'm already working on that on branch called version-9.0 and this is the operator-sdk update (now is already old I guess): https://github.com/jenkinsci/kubernetes-operator/commit/a76d38031090d131c7fdd744f3abda8910d349a5 but for the moment I was not able to find the appropriate time needed during an holiday or similar to complete the task.

Rickyf115 commented 7 months ago

Closing and will watch for your v9 update, thank you!

brokenpip3 commented 7 months ago

sure, yw. I wish I can have more time to dedicate on this milestone but it's not something I can do atm, not before the next year at least