Skip to content

Commit 12eeb9b

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #1188 from amacaskill/automated-cherry-pick-of-#1162-#1158-upstream-release-1.7
Automated cherry pick of #1162: Fix for CVEs #1158: go version updates
2 parents cee98e4 + 29b2a21 commit 12eeb9b

File tree

8 files changed

+45
-27
lines changed

8 files changed

+45
-27
lines changed

‎Dockerfile

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414

1515
ARG BUILDPLATFORM
1616

17-
FROM --platform=$BUILDPLATFORM golang:1.18.9 as builder
17+
FROM --platform=$BUILDPLATFORM golang:1.19.6 as builder
1818

1919
ARG STAGINGVERSION
2020
ARG TARGETPLATFORM
@@ -24,7 +24,7 @@ ADD . .
2424
RUN GOARCH=$(echo $TARGETPLATFORM | cut -f2 -d '/') GCE_PD_CSI_STAGING_VERSION=$STAGINGVERSION make gce-pd-driver
2525

2626
# Start from Kubernetes Debian base.
27-
FROM k8s.gcr.io/build-image/debian-base:buster-v1.9.0 as debian
27+
FROM gke.gcr.io/debian-base:bullseye-v1.4.3-gke.0 as debian
2828
# Install necessary dependencies
2929
# google_nvme_id script depends on the following packages: nvme-cli, xxd, bash
3030
RUN clean-install util-linux e2fsprogs mount ca-certificates udev xfsprogs nvme-cli xxd bash
@@ -74,28 +74,30 @@ COPY --from=debian /bin/ln /bin/ln
7474
COPY --from=debian /bin/udevadm /bin/udevadm
7575

7676
# Copy shared libraries into distroless base.
77-
COPY --from=debian /lib/${LIB_DIR_PREFIX}-linux-gnu/libblkid.so.1 \
77+
COPY --from=debian /lib/${LIB_DIR_PREFIX}-linux-gnu/libpcre.so.3 \
78+
/lib/${LIB_DIR_PREFIX}-linux-gnu/libselinux.so.1 \
79+
/lib/${LIB_DIR_PREFIX}-linux-gnu/libtinfo.so.6 \
80+
/lib/${LIB_DIR_PREFIX}-linux-gnu/libe2p.so.2 \
7881
/lib/${LIB_DIR_PREFIX}-linux-gnu/libcom_err.so.2 \
7982
/lib/${LIB_DIR_PREFIX}-linux-gnu/libdevmapper.so.1.02.1 \
80-
/lib/${LIB_DIR_PREFIX}-linux-gnu/libe2p.so.2 \
8183
/lib/${LIB_DIR_PREFIX}-linux-gnu/libext2fs.so.2 \
8284
/lib/${LIB_DIR_PREFIX}-linux-gnu/libgcc_s.so.1 \
8385
/lib/${LIB_DIR_PREFIX}-linux-gnu/liblzma.so.5 \
84-
/lib/${LIB_DIR_PREFIX}-linux-gnu/libmount.so.1 \
85-
/lib/${LIB_DIR_PREFIX}-linux-gnu/libpcre.so.3 \
86-
/lib/${LIB_DIR_PREFIX}-linux-gnu/libreadline.so.5 \
87-
/lib/${LIB_DIR_PREFIX}-linux-gnu/libselinux.so.1 \
88-
/lib/${LIB_DIR_PREFIX}-linux-gnu/libtinfo.so.6 \
89-
/lib/${LIB_DIR_PREFIX}-linux-gnu/libudev.so.1 \
90-
/lib/${LIB_DIR_PREFIX}-linux-gnu/libuuid.so.1 \
86+
/lib/${LIB_DIR_PREFIX}-linux-gnu/libreadline.so.8 \
9187
/lib/${LIB_DIR_PREFIX}-linux-gnu/libz.so.1 /lib/${LIB_DIR_PREFIX}-linux-gnu/
9288

93-
COPY --from=debian /usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libacl.so.1 \
89+
COPY --from=debian /usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libblkid.so.1 \
90+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libinih.so.1 \
91+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libmount.so.1 \
92+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libudev.so.1 \
93+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libuuid.so.1 \
94+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libacl.so.1 \
9495
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libattr.so.1 \
95-
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libicudata.so.63 \
96-
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libicui18n.so.63 \
97-
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libicuuc.so.63 \
96+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libicudata.so.67 \
97+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libicui18n.so.67 \
98+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libicuuc.so.67 \
9899
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libkmod.so.2 \
100+
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libpcre2-8.so.0 \
99101
/usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libstdc++.so.6 /usr/lib/${LIB_DIR_PREFIX}-linux-gnu/
100102

101103
# Copy NVME support required script and rules into distroless base.

‎Dockerfile.Windows

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
# limitations under the License.
1414

1515
ARG BASE_IMAGE
16-
FROM --platform=$BUILDPLATFORM golang:1.18.9 AS builder
16+
FROM --platform=$BUILDPLATFORM golang:1.19.6 AS builder
1717

1818
ARG TARGETPLATFORM
1919
ARG BUILDPLATFORM

‎Dockerfile.debug

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
FROM golang:1.13.15 as builder
15+
FROM golang:1.19.6 as builder
1616
WORKDIR /go/src/sigs.k8s.io/gcp-compute-persistent-disk-csi-driver
1717
ADD . .
1818

‎pkg/gce-cloud-provider/compute/gce-compute.go

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1129,9 +1129,13 @@ func (cloud *CloudProvider) waitForSnapshotCreation(ctx context.Context, project
11291129

11301130
// kmsKeyEqual returns true if fetchedKMSKey and storageClassKMSKey refer to the same key.
11311131
// fetchedKMSKey - key returned by the server
1132-
// example: projects/{0}/locations/{1}/keyRings/{2}/cryptoKeys/{3}/cryptoKeyVersions/{4}
1132+
//
1133+
// example: projects/{0}/locations/{1}/keyRings/{2}/cryptoKeys/{3}/cryptoKeyVersions/{4}
1134+
//
11331135
// storageClassKMSKey - key as provided by the client
1134-
// example: projects/{0}/locations/{1}/keyRings/{2}/cryptoKeys/{3}
1136+
//
1137+
// example: projects/{0}/locations/{1}/keyRings/{2}/cryptoKeys/{3}
1138+
//
11351139
// cryptoKeyVersions should be disregarded if the rest of the key is identical.
11361140
func KmsKeyEqual(fetchedKMSKey, storageClassKMSKey string) bool {
11371141
return removeCryptoKeyVersion(fetchedKMSKey) == removeCryptoKeyVersion(storageClassKMSKey)

‎pkg/gce-pd-csi-driver/node_test.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,9 @@ Copyright 2018 The Kubernetes Authors.
44
Licensed under the Apache License, Version 2.0 (the "License");
55
you may not use this file except in compliance with the License.
66
You may obtain a copy of the License at
7-
http://www.apache.org/licenses/LICENSE-2.0
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
810
Unless required by applicable law or agreed to in writing, software
911
distributed under the License is distributed on an "AS IS" BASIS,
1012
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

‎test/k8s-integration/main.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -572,6 +572,9 @@ func generateGCETestSkip(testParams *testParameters) string {
572572
skipString = skipString + "|\\[LinuxOnly\\]"
573573
}
574574

575+
// Snapshot and restore test fixes which is added in driver version 1.9+.
576+
skipString = skipString + "|should.provision.correct.filesystem.size.when.restoring.snapshot.to.larger.size.pvc"
577+
575578
return skipString
576579
}
577580

@@ -620,6 +623,10 @@ func generateGKETestSkip(testParams *testParameters) string {
620623
(!testParams.useGKEManagedDriver && (*curVer).lessThan(mustParseVersion("1.17.0"))) {
621624
skipString = skipString + "|VolumeSnapshotDataSource"
622625
}
626+
627+
// Snapshot and restore test fixes which is added in driver version 1.9+.
628+
skipString = skipString + "|should.provision.correct.filesystem.size.when.restoring.snapshot.to.larger.size.pvc"
629+
623630
return skipString
624631
}
625632

‎test/k8s-integration/version.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -131,9 +131,10 @@ func mustParseVersion(version string) *version {
131131
}
132132

133133
// Helper function to compare versions.
134-
// -1 -- if left < right
135-
// 0 -- if left == right
136-
// 1 -- if left > right
134+
//
135+
// -1 -- if left < right
136+
// 0 -- if left == right
137+
// 1 -- if left > right
137138
func (v *version) compare(right *version) int {
138139
for i, b := range v.version {
139140
if b > right.version[i] {

‎test/run-k8s-integration.sh

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,12 @@ readonly GCE_PD_TEST_FOCUS="PersistentVolumes\sGCEPD|[V|v]olume\sexpand|\[sig-st
3535
make -C "${PKGDIR}" test-k8s-integration
3636

3737
if [ "$use_kubetest2" = true ]; then
38-
go install sigs.k8s.io/kubetest2@latest;
39-
go install sigs.k8s.io/kubetest2/kubetest2-gce@latest;
40-
go install sigs.k8s.io/kubetest2/kubetest2-gke@latest;
41-
go install sigs.k8s.io/kubetest2/kubetest2-tester-ginkgo@latest;
38+
# Choose an older Kubetest2 commit version instead of using @latest
39+
# because of a regression in https://github.com/kubernetes-sigs/kubetest2/pull/183.
40+
go install sigs.k8s.io/kubetest2@0e09086b60c122e1084edd2368d3d27fe36f384f;
41+
go install sigs.k8s.io/kubetest2/kubetest2-gce@0e09086b60c122e1084edd2368d3d27fe36f384f;
42+
go install sigs.k8s.io/kubetest2/kubetest2-gke@0e09086b60c122e1084edd2368d3d27fe36f384f;
43+
go install sigs.k8s.io/kubetest2/kubetest2-tester-ginkgo@0e09086b60c122e1084edd2368d3d27fe36f384f;
4244
fi
4345

4446
base_cmd="${PKGDIR}/bin/k8s-integration-test \

0 commit comments

Comments
 (0)