search

kubernetes-client / java

Official Java client library for kubernetes
http://kubernetes.io/
Apache License 2.0
3.48k stars 1.86k forks source link

Un maintained Opensource package being used in this project : com.microsoft.azure:adal4j #3169

Open vijeyanidhi opened 4 months ago

vijeyanidhi commented 4 months ago

Describe the bug

This opensource software is using an unsupported package com.microsoft.azure:adal4j https://github.com/AzureAD/azure-activedirectory-library-for-java which has been in maintenance in 2021 and archived in 2023.

the project has been shifted to https://github.com/AzureAD/microsoft-authentication-library-for-java should be used in this particular project instead of the older un maintained project artifact.

Client Version 20.0.0

Kubernetes Version Not required here

Java Version Java 8, 11, 17

To Reproduce Steps to reproduce the behavior:

Expected behavior A clear and concise description of what you expected to happen.

KubeConfig If applicable, add a KubeConfig file with secrets redacted.

Server (please complete the following information):

Additional context Add any other context about the problem here.

vijeyanidhi commented 4 months ago

dependency tree

[INFO] +- io.kubernetes:client-java:jar:20.0.0:compile
[INFO] |  +- io.prometheus:simpleclient:jar:0.16.0:compile
[INFO] |  |  +- io.prometheus:simpleclient_tracer_otel:jar:0.16.0:compile
[INFO] |  |  |  \- io.prometheus:simpleclient_tracer_common:jar:0.16.0:compile
[INFO] |  |  \- io.prometheus:simpleclient_tracer_otel_agent:jar:0.16.0:compile
[INFO] |  +- io.prometheus:simpleclient_httpserver:jar:0.16.0:compile
[INFO] |  |  \- io.prometheus:simpleclient_common:jar:0.16.0:compile
[INFO] |  +- io.kubernetes:client-java-api:jar:20.0.0:compile
[INFO] |  |  +- javax.annotation:javax.annotation-api:jar:1.3.2:compile
[INFO] |  |  +- jakarta.annotation:jakarta.annotation-api:jar:2.1.1:compile
[INFO] |  |  +- io.swagger:swagger-annotations:jar:1.6.13:compile
[INFO] |  |  +- com.squareup.okhttp3:logging-interceptor:jar:4.10.0:compile
[INFO] |  |  \- io.gsonfire:gson-fire:jar:1.9.0:compile
[INFO] |  +- io.kubernetes:client-java-proto:jar:20.0.0:compile
[INFO] |  +- org.yaml:snakeyaml:jar:2.0:compile
[INFO] |  +- org.apache.commons:commons-compress:jar:1.21:compile
[INFO] |  +- org.slf4j:slf4j-api:jar:2.0.9:compile
[INFO] |  +- org.bouncycastle:bcpkix-jdk18on:jar:1.77:compile
[INFO] |  |  \- org.bouncycastle:bcutil-jdk18on:jar:1.77:compile
[INFO] |  +- com.microsoft.azure:adal4j:jar:1.6.7:compile
[INFO] |  |  \- com.nimbusds:oauth2-oidc-sdk:jar:9.4:compile
[INFO] |  |     +- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile
[INFO] |  |     +- com.nimbusds:content-type:jar:2.1:compile
[INFO] |  |     +- com.nimbusds:lang-tag:jar:1.5:compile
[INFO] |  |     \- com.nimbusds:nimbus-jose-jwt:jar:9.8.1:compile
vijeyanidhi commented 4 months ago

https://mvnrepository.com/artifact/com.microsoft.azure/adal4j/1.6.7

Screenshot 2024-03-08 at 01 28 37

last release was done in 2021 April

brendandburns commented 4 months ago

Given that this code is being deprecated in newer Kubernetes versions, we should consider just ripping out this code entirely.

vijeyanidhi commented 4 months ago

Given that this code is being deprecated in newer Kubernetes versions, we should consider just ripping out this code entirely.

so I am assuming this is going to be released in version 21 or version 22? and not anytime in this week?

codefromthecrypt commented 4 months ago

I took a look and also tried the migration guide. It isn't straight-forward and very likely to introduce bugs.

My recommendation would be to plan to remove the code using this dependency as @brendandburns mentioned, and do nothing about it otherwise. To do something otherwise would both require very strong rationale, and also be in concert with an actual user of this project and specifically the active directory component.

My 2p, and I'm not a maintainer, so take it for what it's worth.

codefromthecrypt commented 4 months ago

raised this to buy some time https://github.com/kubernetes-client/java/pull/3175

k8s-triage-robot commented 1 month ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 3 weeks ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten