search

kubernetes-sigs / prometheus-adapter

An implementation of the custom.metrics.k8s.io API using Prometheus
Apache License 2.0
1.9k stars 551 forks source link

Upgrade dependencies and otel vuln fix #652

Closed cerberus20 closed 3 months ago

cerberus20 commented 4 months ago

Bump otelhttp/grpc , custom metrics apiserver. and k8s dependencies. Also upgrade go version in makefile

k8s-ci-robot commented 4 months ago

Hi @cerberus20. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
jaybooth4 commented 4 months ago

Thanks so much for the CL cerberus20!

Should we also update the go version as part of this CL? https://github.com/kubernetes-sigs/prometheus-adapter/blob/master/Makefile#L11

cerberus20 commented 4 months ago

yeah, updated @jaybooth4

jaybooth4 commented 4 months ago

Nit @cerberus20 could we update go version to 1.22.2 to include the latest HTTP fixes? https://go.dev/doc/devel/release#go1.22.0

jaybooth4 commented 4 months ago

@dgrisonnet @olivierlemasle can we possibly get a quick review for these changes to improve security/vulns? Thanks!

logicalhan commented 4 months ago

/assign @dgrisonnet /triage accepted

CatherineF-dev commented 4 months ago

/lgtm

CatherineF-dev commented 4 months ago

LGTM. Tests will be triggered.

dgrisonnet commented 4 months ago

@cerberus20 could you please run make update-lint, it should make the verify test happy.

dgrisonnet commented 4 months ago

FWIW, prometheus-adapter is not impacted by the otel CVE

dgrisonnet commented 4 months ago

and I will most likely wait for https://github.com/kubernetes-sigs/custom-metrics-apiserver/pull/168 before cutting a new release of prometheus-adapter

k8s-ci-robot commented 4 months ago

New changes are detected. LGTM label has been removed.

k8s-ci-robot commented 4 months ago

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: cerberus20 Once this PR has been reviewed and has the lgtm label, please ask for approval from dgrisonnet. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files: - **[OWNERS](https://github.com/kubernetes-sigs/prometheus-adapter/blob/master/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
k8s-ci-robot commented 4 months ago

@cerberus20: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to [this](https://github.com/kubernetes-sigs/prometheus-adapter/pull/652#issuecomment-2081298298): >/retest-required Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
cerberus20 commented 4 months ago

@dgrisonnet @CatherineF-dev Can we please retrigger failed test? thank you

cerberus20 commented 4 months ago

/test pull-prometheus-adapter-verify

k8s-ci-robot commented 4 months ago

@cerberus20: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to [this](https://github.com/kubernetes-sigs/prometheus-adapter/pull/652#issuecomment-2081307592): >/test pull-prometheus-adapter-verify Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
CatherineF-dev commented 4 months ago

/ok-to-test

jaybooth4 commented 4 months ago

/retest

k8s-ci-robot commented 4 months ago

@jaybooth4: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to [this](https://github.com/kubernetes-sigs/prometheus-adapter/pull/652#issuecomment-2081628371): >/retest Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
CatherineF-dev commented 4 months ago

/retest

k8s-ci-robot commented 4 months ago

@cerberus20: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-prometheus-adapter-verify 85f9fe6d943d2a87c051c7b7d7bc84c3797780e1 link true /test pull-prometheus-adapter-verify

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
chc5 commented 3 months ago

Any updates here? I'd like to get these upgrades submitted to address vulnerabilities in this project.

dgrisonnet commented 3 months ago

Superseded by https://github.com/kubernetes-sigs/prometheus-adapter/pull/659