Skip to content

Commit c9001d8

Browse files
tenzen-ytenzen-y
authored
chore: Upgrade Go libraries to resolve some security issues in the katib-controller (#1888)
1 parent e2378c3 commit c9001d8

File tree

19 files changed

+1188
-262
lines changed

19 files changed

+1188
-262
lines changed

‎Makefile‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ HAS_SETUP_ENVTEST := $(shell command -v setup-envtest;)
55
COMMIT := v1beta1-$(shell git rev-parse --short=7 HEAD)
66
KATIB_REGISTRY := docker.io/kubeflowkatib
77
CPU_ARCH ?= amd64
8-
ENVTEST_K8S_VERSION ?= 1.22
8+
ENVTEST_K8S_VERSION ?= 1.23
99

1010
# for pytest
1111
PYTHONPATH := $(PYTHONPATH):$(CURDIR)/pkg/apis/manager/v1beta1/python:$(CURDIR)/pkg/apis/manager/health/python
@@ -19,10 +19,10 @@ test: envtest
1919

2020
envtest:
2121
ifndef HAS_SETUP_ENVTEST
22-
go install sigs.k8s.io/controller-runtime/tools/setup-envtest@c48baad70c539a2efb8dfe8850434ecc721c1ee1 # v0.10.0
23-
echo "setup-envtest has been installed"
22+
go install sigs.k8s.io/controller-runtime/tools/setup-envtest@bf71fc56485f6bf03e95ef6b0233ff36c695d4c9 # v0.11.2
23+
@echo "setup-envtest has been installed"
2424
endif
25-
echo "setup-envtest has already installed"
25+
@echo "setup-envtest has already installed"
2626

2727

2828
check: generate fmt vet lint
@@ -33,7 +33,7 @@ fmt:
3333
lint:
3434
ifndef HAS_LINT
3535
go install github.com/golangci/golangci-lint/cmd/[email protected]
36-
echo "golangci-lint has been installed"
36+
@echo "golangci-lint has been installed"
3737
endif
3838
hack/verify-golangci-lint.sh
3939

@@ -43,7 +43,7 @@ vet:
4343
shellcheck:
4444
ifndef HAS_SHELLCHECK
4545
bash hack/install-shellcheck.sh
46-
echo "shellcheck has been installed"
46+
@echo "shellcheck has been installed"
4747
endif
4848
hack/verify-shellcheck.sh
4949

‎cmd/metricscollector/v1beta1/file-metricscollector/main.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ import (
5353
"github.com/hpcloud/tail"
5454
psutil "github.com/shirou/gopsutil/v3/process"
5555
"google.golang.org/grpc"
56+
"google.golang.org/grpc/credentials/insecure"
5657
"k8s.io/klog"
5758

5859
commonv1beta1 "github.com/kubeflow/katib/pkg/apis/controller/common/v1beta1"
@@ -305,7 +306,7 @@ func watchMetricsFile(mFile string, stopRules stopRulesFlag, filters []string, f
305306
}
306307

307308
// Create connection and client for Early Stopping service.
308-
conn, err := grpc.Dial(*earlyStopServiceAddr, grpc.WithInsecure())
309+
conn, err := grpc.Dial(*earlyStopServiceAddr, grpc.WithTransportCredentials(insecure.NewCredentials()))
309310
if err != nil {
310311
klog.Fatalf("Could not connect to Early Stopping service, error: %v", err)
311312
}
@@ -427,7 +428,7 @@ func main() {
427428

428429
func reportMetrics(filters []string, fileFormat commonv1beta1.FileFormat) {
429430

430-
conn, err := grpc.Dial(*dbManagerServiceAddr, grpc.WithInsecure())
431+
conn, err := grpc.Dial(*dbManagerServiceAddr, grpc.WithTransportCredentials(insecure.NewCredentials()))
431432
if err != nil {
432433
klog.Fatalf("Could not connect to DB manager service, error: %v", err)
433434
}

‎go.mod‎

Lines changed: 70 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -10,127 +10,132 @@ require (
1010
github.com/go-sql-driver/mysql v1.5.0
1111
github.com/golang/mock v1.6.0
1212
github.com/golang/protobuf v1.5.2
13-
github.com/google/go-containerregistry v0.4.1-0.20210128200529-19c2b639fab1
14-
github.com/google/go-containerregistry/pkg/authn/k8schain v0.0.0-20210224013640-6928f6d356ab
13+
github.com/google/go-containerregistry v0.9.0
14+
github.com/google/go-containerregistry/pkg/authn/k8schain v0.0.0-20211222182933-7c19fa370dbd
1515
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0
1616
github.com/hpcloud/tail v1.0.1-0.20180514194441-a1dbeea552b7
1717
github.com/mattbaird/jsonpatch v0.0.0-20171005235357-81af80346b1a
18-
github.com/onsi/gomega v1.15.0
18+
github.com/onsi/gomega v1.17.0
1919
github.com/prometheus/client_golang v1.11.0
2020
github.com/shirou/gopsutil/v3 v3.22.5
21-
github.com/spf13/cobra v1.2.1
22-
github.com/spf13/viper v1.8.1
23-
github.com/tidwall/gjson v1.6.0
24-
golang.org/x/net v0.0.0-20210520170846-37e1c6afe023
25-
google.golang.org/grpc v1.38.0
26-
k8s.io/api v0.22.2
27-
k8s.io/apimachinery v0.22.2
28-
k8s.io/client-go v0.22.2
29-
k8s.io/code-generator v0.22.2
21+
github.com/spf13/cobra v1.4.0
22+
github.com/spf13/viper v1.9.0
23+
github.com/tidwall/gjson v1.14.1
24+
golang.org/x/net v0.0.0-20220516155154-20f960328961
25+
google.golang.org/grpc v1.47.0
26+
k8s.io/api v0.23.5
27+
k8s.io/apimachinery v0.23.5
28+
k8s.io/client-go v0.23.5
29+
k8s.io/code-generator v0.23.5
3030
k8s.io/klog v1.0.0
31-
k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e
32-
sigs.k8s.io/controller-runtime v0.10.0
31+
k8s.io/kube-openapi v0.0.0-20211115234752-e816edb12b65
32+
sigs.k8s.io/controller-runtime v0.11.2
3333
)
3434

3535
require (
36-
cloud.google.com/go v0.81.0 // indirect
37-
github.com/Azure/azure-sdk-for-go v43.0.0+incompatible // indirect
36+
cloud.google.com/go/compute v1.6.1 // indirect
37+
github.com/Azure/azure-sdk-for-go v65.0.0+incompatible // indirect
3838
github.com/Azure/go-autorest v14.2.0+incompatible // indirect
39-
github.com/Azure/go-autorest/autorest v0.11.18 // indirect
40-
github.com/Azure/go-autorest/autorest/adal v0.9.13 // indirect
39+
github.com/Azure/go-autorest/autorest v0.11.27 // indirect
40+
github.com/Azure/go-autorest/autorest/adal v0.9.20 // indirect
4141
github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
4242
github.com/Azure/go-autorest/autorest/to v0.3.0 // indirect
4343
github.com/Azure/go-autorest/autorest/validation v0.1.0 // indirect
4444
github.com/Azure/go-autorest/logger v0.2.1 // indirect
4545
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
4646
github.com/PuerkitoBio/purell v1.1.1 // indirect
4747
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
48-
github.com/aws/aws-sdk-go v1.28.2 // indirect
48+
github.com/aws/aws-sdk-go v1.36.30 // indirect
4949
github.com/beorn7/perks v1.0.1 // indirect
5050
github.com/cespare/xxhash/v2 v2.1.1 // indirect
5151
github.com/davecgh/go-spew v1.1.1 // indirect
52-
github.com/docker/cli v0.0.0-20191017083524-a8ff7f821017 // indirect
53-
github.com/docker/distribution v2.7.1+incompatible // indirect
54-
github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7 // indirect
55-
github.com/docker/docker-credential-helpers v0.6.3 // indirect
56-
github.com/emicklei/go-restful v2.9.5+incompatible // indirect
57-
github.com/evanphx/json-patch v4.11.0+incompatible // indirect
58-
github.com/form3tech-oss/jwt-go v3.2.3+incompatible // indirect
59-
github.com/fsnotify/fsnotify v1.4.9 // indirect
60-
github.com/go-logr/logr v0.4.0 // indirect
61-
github.com/go-logr/zapr v0.4.0 // indirect
52+
github.com/docker/cli v20.10.16+incompatible // indirect
53+
github.com/docker/distribution v2.8.1+incompatible // indirect
54+
github.com/docker/docker v20.10.16+incompatible // indirect
55+
github.com/docker/docker-credential-helpers v0.6.4 // indirect
56+
github.com/emicklei/go-restful v2.15.0+incompatible // indirect
57+
github.com/evanphx/json-patch v4.12.0+incompatible // indirect
58+
github.com/fsnotify/fsnotify v1.5.1 // indirect
59+
github.com/go-logr/logr v1.2.3 // indirect
60+
github.com/go-logr/zapr v1.2.0 // indirect
6261
github.com/go-ole/go-ole v1.2.6 // indirect
6362
github.com/go-openapi/jsonpointer v0.19.5 // indirect
6463
github.com/go-openapi/jsonreference v0.19.5 // indirect
6564
github.com/go-openapi/swag v0.19.14 // indirect
6665
github.com/gogo/protobuf v1.3.2 // indirect
66+
github.com/golang-jwt/jwt/v4 v4.2.0 // indirect
6767
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
6868
github.com/google/go-cmp v0.5.8 // indirect
69-
github.com/google/gofuzz v1.1.0 // indirect
70-
github.com/google/uuid v1.1.5 // indirect
69+
github.com/google/gofuzz v1.2.0 // indirect
70+
github.com/google/uuid v1.3.0 // indirect
7171
github.com/googleapis/gnostic v0.5.5 // indirect
7272
github.com/hashicorp/hcl v1.0.0 // indirect
7373
github.com/imdario/mergo v0.3.12 // indirect
7474
github.com/inconshreveable/mousetrap v1.0.0 // indirect
75-
github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af // indirect
75+
github.com/jmespath/go-jmespath v0.4.0 // indirect
7676
github.com/josharian/intern v1.0.0 // indirect
77-
github.com/json-iterator/go v1.1.11 // indirect
77+
github.com/json-iterator/go v1.1.12 // indirect
7878
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
7979
github.com/magiconair/properties v1.8.5 // indirect
80-
github.com/mailru/easyjson v0.7.6 // indirect
80+
github.com/mailru/easyjson v0.7.7 // indirect
8181
github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
82-
github.com/mitchellh/mapstructure v1.4.1 // indirect
82+
github.com/mitchellh/go-homedir v1.1.0 // indirect
83+
github.com/mitchellh/mapstructure v1.4.2 // indirect
8384
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
84-
github.com/modern-go/reflect2 v1.0.1 // indirect
85+
github.com/modern-go/reflect2 v1.0.2 // indirect
8586
github.com/opencontainers/go-digest v1.0.0 // indirect
86-
github.com/opencontainers/image-spec v1.0.1 // indirect
87-
github.com/pelletier/go-toml v1.9.3 // indirect
87+
github.com/opencontainers/image-spec v1.0.3-0.20220114050600-8b9d41f48198 // indirect
88+
github.com/pelletier/go-toml v1.9.4 // indirect
8889
github.com/pkg/errors v0.9.1 // indirect
8990
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
9091
github.com/prometheus/client_model v0.2.0 // indirect
91-
github.com/prometheus/common v0.26.0 // indirect
92+
github.com/prometheus/common v0.28.0 // indirect
9293
github.com/prometheus/procfs v0.6.0 // indirect
94+
github.com/sirupsen/logrus v1.8.1 // indirect
9395
github.com/spf13/afero v1.6.0 // indirect
94-
github.com/spf13/cast v1.3.1 // indirect
96+
github.com/spf13/cast v1.4.1 // indirect
9597
github.com/spf13/jwalterweatherman v1.1.0 // indirect
9698
github.com/spf13/pflag v1.0.5 // indirect
9799
github.com/subosito/gotenv v1.2.0 // indirect
98-
github.com/tidwall/match v1.0.1 // indirect
99-
github.com/tidwall/pretty v1.0.0 // indirect
100+
github.com/tidwall/match v1.1.1 // indirect
101+
github.com/tidwall/pretty v1.2.0 // indirect
100102
github.com/tklauser/go-sysconf v0.3.10 // indirect
101103
github.com/tklauser/numcpus v0.4.0 // indirect
102-
github.com/vdemeester/k8s-pkg-credentialprovider v1.19.7 // indirect
104+
github.com/vdemeester/k8s-pkg-credentialprovider v1.21.0-1 // indirect
103105
github.com/yusufpapurcu/wmi v1.2.2 // indirect
104106
go.uber.org/atomic v1.7.0 // indirect
105107
go.uber.org/multierr v1.6.0 // indirect
106-
go.uber.org/zap v1.19.0 // indirect
107-
golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83 // indirect
108-
golang.org/x/mod v0.4.2 // indirect
109-
golang.org/x/oauth2 v0.0.0-20210402161424-2e8d93401602 // indirect
110-
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
111-
golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27 // indirect
112-
golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d // indirect
113-
golang.org/x/text v0.3.6 // indirect
108+
go.uber.org/zap v1.19.1 // indirect
109+
golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3 // indirect
110+
golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 // indirect
111+
golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5 // indirect
112+
golang.org/x/sync v0.0.0-20220513210516-0976fa681c29 // indirect
113+
golang.org/x/sys v0.0.0-20220513210249-45d2b4557a2a // indirect
114+
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
115+
golang.org/x/text v0.3.7 // indirect
114116
golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
115-
golang.org/x/tools v0.1.2 // indirect
116-
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
117+
golang.org/x/tools v0.1.10 // indirect
118+
golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f // indirect
117119
gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
118120
gonum.org/v1/gonum v0.8.2 // indirect
119121
google.golang.org/appengine v1.6.7 // indirect
120-
google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c // indirect
121-
google.golang.org/protobuf v1.26.0 // indirect
122+
google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3 // indirect
123+
google.golang.org/protobuf v1.28.0 // indirect
122124
gopkg.in/fsnotify/fsnotify.v1 v1.4.7 // indirect
123125
gopkg.in/inf.v0 v0.9.1 // indirect
124-
gopkg.in/ini.v1 v1.62.0 // indirect
126+
gopkg.in/ini.v1 v1.63.2 // indirect
125127
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
126128
gopkg.in/yaml.v2 v2.4.0 // indirect
127-
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
128-
k8s.io/apiextensions-apiserver v0.22.1 // indirect
129-
k8s.io/component-base v0.22.1 // indirect
130-
k8s.io/gengo v0.0.0-20201214224949-b6c5ce23f027 // indirect
131-
k8s.io/klog/v2 v2.9.0 // indirect
132-
k8s.io/legacy-cloud-providers v0.19.7 // indirect
133-
k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a // indirect
134-
sigs.k8s.io/structured-merge-diff/v4 v4.1.2 // indirect
135-
sigs.k8s.io/yaml v1.2.0 // indirect
129+
gopkg.in/yaml.v3 v3.0.0 // indirect
130+
gotest.tools/v3 v3.1.0 // indirect
131+
k8s.io/apiextensions-apiserver v0.23.5 // indirect
132+
k8s.io/cloud-provider v0.21.0 // indirect
133+
k8s.io/component-base v0.23.5 // indirect
134+
k8s.io/gengo v0.0.0-20210813121822-485abfe95c7c // indirect
135+
k8s.io/klog/v2 v2.60.1 // indirect
136+
k8s.io/legacy-cloud-providers v0.21.0 // indirect
137+
k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
138+
sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6 // indirect
139+
sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
140+
sigs.k8s.io/yaml v1.3.0 // indirect
136141
)

0 commit comments

Comments
 (0)