wip: CNTRLPLANE-2449: K8s 1.35 rebase#616
wip: CNTRLPLANE-2449: K8s 1.35 rebase#616ingvagabund wants to merge 11 commits intoopenshift:mainfrom
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@ingvagabund: This pull request references CNTRLPLANE-2449 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
Important Review skippedAuto reviews are limited based on label configuration. 🚫 Excluded labels (none allowed) (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughGo toolchain bumped to 1.25.0 and many module dependencies upgraded. Tests now emit watch bookmark events before real events. Effective API version is threaded into feature-gate and admission initializer flows; quota configuration now accepts Kubernetes informers. CI and image builder tags updated to Go 1.25. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Comment Tip Migrating from UI to YAML configuration.Use the |
|
@ingvagabund: This pull request references CNTRLPLANE-2449 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 149: The go.mod currently pins the vulnerable module
"go.opentelemetry.io/otel/sdk" at v1.36.0; update it to v1.40.0 or later to
remediate CVE-2026-24051. Edit go.mod to either bump the direct dependency to
v1.40.0+ or add a replace directive forcing "go.opentelemetry.io/otel/sdk" =>
"go.opentelemetry.io/otel/sdk v1.40.0" (or newer) and run `go mod tidy` / `go
get` so transitive consumers (e.g., library-go, k8s.io modules, otelhttp)
resolve the patched version. Ensure CI/builds pick up the new module by
verifying `go.sum` changes and running tests.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: b63522ea-2acb-40af-b8cb-0388c289052c
⛔ Files ignored due to path filters (294)
go.sumis excluded by!**/*.sumvendor/github.com/go-logr/logr/.golangci.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-logr/logr/funcr/funcr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/gogo/protobuf/sortkeys/sortkeys.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/opencontainers/runtime-spec/specs-go/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/opencontainers/runtime-spec/specs-go/version.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/.ci-operator.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/.coderabbit.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/.golangci.go-validated.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/.golangci.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/AGENTS.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/Dockerfile.ocpis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/Makefileis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/apiextensions/install.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/apiextensions/v1alpha1/Makefileis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/apiextensions/v1alpha1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/apiextensions/v1alpha1/register.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/apiextensions/v1alpha1/types_compatibilityrequirement.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/apiextensions/v1alpha1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/apiextensions/v1alpha1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/apiextensions/v1alpha1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/apps/v1/generated.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/apps/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/apps/v1/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/apps/v1/zz_prerelease_lifecycle_generated.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/authorization/v1/generated.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/authorization/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/build/v1/generated.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/build/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/cloudnetwork/v1/generated.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/cloudnetwork/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/register.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_apiserver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_authentication.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_cluster_image_policy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_cluster_version.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_feature.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_image_policy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_infrastructure.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_ingress.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_insights.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_network.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_tlssecurityprofile.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1alpha1/register.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1alpha1/types_backup.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1alpha1/types_cluster_image_policy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1alpha1/types_crio_credential_provider_config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1alpha1/types_image_policy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1alpha1/types_insights.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1alpha1/types_pki.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1alpha1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1alpha2/types_insights.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1alpha2/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/console/v1/types_console_sample.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/etcd/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/etcd/install.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/etcd/v1alpha1/Makefileis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/etcd/v1alpha1/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/etcd/v1alpha1/register.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/etcd/v1alpha1/types_pacemakercluster.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/etcd/v1alpha1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/etcd/v1alpha1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/etcd/v1alpha1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/features.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/features/features.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/features/legacyfeaturegates.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/features/util.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/image/v1/generated.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/image/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/install.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/machine/v1/types_controlplanemachineset.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/machine/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/machine/v1beta1/types_awsprovider.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/machine/v1beta1/types_machine.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/machine/v1beta1/types_machineset.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/machine/v1beta1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/machine/v1beta1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/network/v1/generated.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/network/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/networkoperator/v1/generated.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/networkoperator/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/oauth/v1/generated.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/oauth/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_console.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_machineconfiguration.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_network.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1alpha1/register.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1alpha1/types_clusterapi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/project/v1/generated.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/project/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/quota/v1/generated.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/quota/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/route/v1/generated.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/route/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/samples/v1/generated.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/samples/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/security/v1/generated.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/security/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/template/v1/generated.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/template/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/user/v1/generated.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/api/user/v1/generated.protomessage.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/sccmatching/matcher.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/sccmatching/provider.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/seccomp/strategy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/sysctl/mustmatchpatterns.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/applyconfigurations/apps/v1/customdeploymentstrategyparams.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/applyconfigurations/apps/v1/deploymentcause.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/applyconfigurations/apps/v1/deploymentcauseimagetrigger.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/applyconfigurations/apps/v1/deploymentcondition.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/applyconfigurations/apps/v1/deploymentconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/applyconfigurations/apps/v1/deploymentconfigspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/applyconfigurations/apps/v1/deploymentconfigstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/applyconfigurations/apps/v1/deploymentdetails.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/applyconfigurations/apps/v1/deploymentstrategy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/applyconfigurations/apps/v1/deploymenttriggerimagechangeparams.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/applyconfigurations/apps/v1/deploymenttriggerpolicy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/applyconfigurations/apps/v1/execnewpodhook.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/applyconfigurations/apps/v1/lifecyclehook.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/applyconfigurations/apps/v1/recreatedeploymentstrategyparams.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/applyconfigurations/apps/v1/rollingdeploymentstrategyparams.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/applyconfigurations/apps/v1/tagimagehook.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/apps/clientset/versioned/fake/clientset_generated.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/applyconfigurations/authorization/v1/clusterrole.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/applyconfigurations/authorization/v1/clusterrolebinding.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/applyconfigurations/authorization/v1/grouprestriction.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/applyconfigurations/authorization/v1/policyrule.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/applyconfigurations/authorization/v1/role.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/applyconfigurations/authorization/v1/rolebinding.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/applyconfigurations/authorization/v1/rolebindingrestriction.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/applyconfigurations/authorization/v1/rolebindingrestrictionspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/applyconfigurations/authorization/v1/serviceaccountreference.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/applyconfigurations/authorization/v1/serviceaccountrestriction.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/applyconfigurations/authorization/v1/userrestriction.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/informers/externalversions/authorization/v1/clusterrole.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/informers/externalversions/authorization/v1/clusterrolebinding.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/informers/externalversions/authorization/v1/role.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/informers/externalversions/authorization/v1/rolebinding.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/informers/externalversions/authorization/v1/rolebindingrestriction.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/authorization/informers/externalversions/factory.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/binarybuildsource.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/bitbucketwebhookcause.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/build.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildcondition.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildconfigspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildconfigstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildoutput.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildpostcommitspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildsource.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildstatusoutput.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildstatusoutputto.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildstrategy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildtriggercause.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildtriggerpolicy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildvolume.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildvolumemount.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/buildvolumesource.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/commonspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/commonwebhookcause.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/configmapbuildsource.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/custombuildstrategy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/dockerbuildstrategy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/genericwebhookcause.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/gitbuildsource.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/githubwebhookcause.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/gitlabwebhookcause.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/gitsourcerevision.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/imagechangecause.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/imagechangetrigger.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/imagechangetriggerstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/imagelabel.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/imagesource.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/imagesourcepath.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/imagestreamtagreference.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/jenkinspipelinebuildstrategy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/proxyconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/secretbuildsource.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/secretlocalreference.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/secretspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/sourcebuildstrategy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/sourcecontroluser.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/sourcerevision.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/stageinfo.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/stepinfo.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/applyconfigurations/build/v1/webhooktrigger.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/build/clientset/versioned/fake/clientset_generated.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/acceptrisk.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/alibabacloudplatformstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/alibabacloudresourcetag.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/apiserver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/apiserverencryption.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/apiservernamedservingcert.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/apiserverservingcerts.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/apiserverspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/audit.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/auditcustomrule.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/authentication.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/authenticationspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/authenticationstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awsdnsspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awsingressspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awskmsconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awsplatformspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awsplatformstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awsresourcetag.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awsserviceendpoint.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/azureplatformstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/azureresourcetag.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/baremetalplatformloadbalancer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/baremetalplatformspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/baremetalplatformstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/basicauthidentityprovider.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/build.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/builddefaults.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/buildoverrides.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/buildspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/cloudcontrollermanagerstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/cloudloadbalancerconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/cloudloadbalancerips.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clustercondition.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clusterimagepolicy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clusterimagepolicyspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clusterimagepolicystatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clusternetworkentry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clusteroperator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clusteroperatorstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clusteroperatorstatuscondition.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clusterversion.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clusterversioncapabilitiesspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clusterversioncapabilitiesstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clusterversionspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clusterversionstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/componentoverride.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/componentroutespec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/componentroutestatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/conditionalupdate.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/conditionalupdaterisk.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/configmapfilereference.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/configmapnamereference.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/console.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/consoleauthentication.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/consolespec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/consolestatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/custom.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/customfeaturegates.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/customtlsprofile.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/deprecatedwebhooktokenauthenticator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/dns.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/dnsplatformspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/dnsspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/dnszone.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/equinixmetalplatformstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalipconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalippolicy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalplatformspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalplatformstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/extramapping.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/featuregate.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/featuregateattributes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/featuregatedetails.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/featuregateselection.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/featuregatestatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/fulciocawithrekor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/gatherconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/gathererconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/gatherers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/gcpplatformstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/gcpresourcelabel.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/gcpresourcetag.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/githubidentityprovider.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/gitlabidentityprovider.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/googleidentityprovider.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/htpasswdidentityprovider.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/hubsource.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/hubsourcestatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/ibmcloudplatformspec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/ibmcloudplatformstatus.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/ibmcloudserviceendpoint.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/identityprovider.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/identityproviderconfig.gois excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (6)
go.modpkg/apps/apiserver/registry/deploylog/rest_test.gopkg/apps/apiserver/registry/deploylog/wait_test.gopkg/cmd/openshift-apiserver/cmd.gopkg/cmd/openshift-apiserver/openshiftadmission/plugin_initializer.gopkg/cmd/openshift-apiserver/openshiftapiserver/config.go
| go.opentelemetry.io/otel/sdk v1.34.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.35.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.36.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.36.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check for available patches and which direct dependencies bring in the vulnerable version
# Check which direct dependencies require the vulnerable otel/sdk version
echo "=== Checking dependency chain for go.opentelemetry.io/otel/sdk ==="
go mod graph | grep 'go.opentelemetry.io/otel/sdk@'
# Query GitHub Security Advisory for patch information
echo -e "\n=== Checking for security advisories and patches ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 5, ecosystem: GOMOD, package: "go.opentelemetry.io/otel/sdk") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: openshift/openshift-apiserver
Length of output: 2541
🌐 Web query:
GO-2026-4394 go.opentelemetry.io otel sdk vulnerability
💡 Result:
GO-2026-4394 (aliases: CVE-2026-24051, GHSA-9h8m-3fm2-qjrq) is an arbitrary code execution issue in the OpenTelemetry Go SDK affecting go.opentelemetry.io/otel/sdk (specifically go.opentelemetry.io/otel/sdk/resource). It’s a PATH hijacking / untrusted search path problem on macOS/Darwin: the host resource detector runs the ioreg command via the system PATH, so a local attacker who can influence PATH can get a malicious ioreg executed in the application’s context. [2] [3]
- Affected versions:
>= 1.21.0and< 1.40.0(i.e., through1.39.0) [1] [2] - Fixed version:
1.40.0[1] [2] - Remediation: upgrade to
go.opentelemetry.io/otel/sdkv1.40.0+ (or ensurePATHcannot be attacker-controlled on macOS/Darwin systems). [2] [3]
Sources: [1] [2] [3]
🌐 Web query:
GHSA-9h8m-3fm2-qjrq opentelemetry vulnerability
💡 Result:
GHSA-9h8m-3fm2-qjrq (aka CVE-2026-24051) is a local arbitrary code execution issue in the OpenTelemetry Go SDK caused by PATH hijacking on macOS/Darwin: sdk/resource/host_id.go runs the ioreg command via the system search path, so an attacker who can influence the process PATH can cause execution of a malicious ioreg binary in the application’s context. CVSS 3.1: 7.0 (High), AV:L. [1][2]
- Affected package:
go.opentelemetry.io/otel/sdk[1][3] - Affected versions: >= 1.21.0 and < 1.40.0 (some writeups describe it as
v1.20.0–1.39.0, but the reviewed affected range is>=1.21.0,<1.40.0) [1][3] - Fixed version: 1.40.0 (patch commit
d45961b…) [1][2][3]
What to do: upgrade go.opentelemetry.io/otel/sdk to v1.40.0+. [1][3]
Sources
[1] GitHub Advisory Database – GHSA-9h8m-3fm2-qjrq / CVE-2026-24051 (open-telemetry/opentelemetry-go)
[2] NVD – CVE-2026-24051
[3] OSV / Go vuln entry – GO-2026-4394
🌐 Web query:
go.opentelemetry.io/otel/sdk v1.36.0 security vulnerability PATH hijacking
💡 Result:
go.opentelemetry.io/otel/sdk v1.36.0 is affected by CVE-2026-24051 / GHSA-9h8m-3fm2-qjrq (PATH hijacking / untrusted search path) on macOS/Darwin. The issue is in sdk/resource/host_id.go, which executes the ioreg command by name (via PATH search); a local attacker who can influence PATH can potentially get arbitrary code execution in the application’s context. Affected versions are >= 1.21.0 and <= 1.39.0 (so 1.36.0 is included). Fixed in v1.40.0. [1][2]
Mitigation: upgrade to go.opentelemetry.io/otel (and related modules) v1.40.0 or later. [1][2]
Sources
[1] GitHub Security Advisory: GHSA-9h8m-3fm2-qjrq (open-telemetry/opentelemetry-go) (github.com)
[2] NVD: CVE-2026-24051 (nvd.nist.gov)
Citations:
Critical: Address HIGH severity security vulnerability in OpenTelemetry SDK.
The OpenTelemetry SDK v1.36.0 contains CVE-2026-24051 (GO-2026-4394 / GHSA-9h8m-3fm2-qjrq), a HIGH severity local code execution vulnerability (CVSS 7.0). On macOS/Darwin systems, the SDK's host resource detector executes ioreg via the system PATH, allowing a local attacker with PATH control to achieve arbitrary code execution.
Upgrade to go.opentelemetry.io/otel/sdk v1.40.0 or later. Since this is pulled in by multiple direct dependencies (library-go, k8s.io modules, otelhttp), you may need to update those direct dependencies or add a replace directive to force the patched version.
🧰 Tools
🪛 OSV Scanner (2.3.3)
[HIGH] 149-149: go.opentelemetry.io/otel/sdk 1.36.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
(GO-2026-4394)
[HIGH] 149-149: go.opentelemetry.io/otel/sdk 1.36.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 149, The go.mod currently pins the vulnerable module
"go.opentelemetry.io/otel/sdk" at v1.36.0; update it to v1.40.0 or later to
remediate CVE-2026-24051. Edit go.mod to either bump the direct dependency to
v1.40.0+ or add a replace directive forcing "go.opentelemetry.io/otel/sdk" =>
"go.opentelemetry.io/otel/sdk v1.40.0" (or newer) and run `go mod tidy` / `go
get` so transitive consumers (e.g., library-go, k8s.io modules, otelhttp)
resolve the patched version. Ensure CI/builds pick up the new module by
verifying `go.sum` changes and running tests.
|
@ingvagabund: This pull request references CNTRLPLANE-2449 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
ingvagabund
force-pushed
the
k8s-1.35-rebase
branch
from
6fbd8e1 to
941a19c
Compare
|
@ingvagabund: This pull request references CNTRLPLANE-2449 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@ingvagabund: This pull request references CNTRLPLANE-2449 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
images/Dockerfile.rhel (1)
1-13: Static analysis: Image runs as root (pre-existing).Trivy flagged that no
USERdirective specifies a non-root user. This is a pre-existing condition, not introduced by this PR. In OpenShift, this may be intentional since SecurityContextConstraints (SCC) typically enforce non-root execution at runtime.If adding an explicit non-root user is desired for defense-in-depth, consider:
🛡️ Optional: Add non-root USER directive
FROM registry.ci.openshift.org/ocp/4.22:base-rhel9 COPY --from=builder /go/src/github.com/openshift/openshift-apiserver/openshift-apiserver /usr/bin/ COPY --from=builder /go/src/github.com/openshift/openshift-apiserver/openshift-apiserver-tests-ext.gz /usr/bin/ +USER 1001 ENTRYPOINT ["/usr/bin/openshift-apiserver"]🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@images/Dockerfile.rhel` around lines 1 - 13, The Dockerfile currently leaves the container running as root; update the Dockerfile to set a non-root user after the final image stage by creating or using a low-privilege UID/GID and adding a USER directive (apply changes after the COPY --from=builder steps and before ENTRYPOINT), ensure any binaries copied by COPY --from=builder (openshift-apiserver and openshift-apiserver-tests-ext.gz) have appropriate ownership and file permissions (chown/chmod) so the new user can execute them, and then replace/keep ENTRYPOINT ["/usr/bin/openshift-apiserver"] as-is so the container runs with the non-root user at runtime.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@images/Dockerfile.rhel`:
- Around line 1-13: The Dockerfile currently leaves the container running as
root; update the Dockerfile to set a non-root user after the final image stage
by creating or using a low-privilege UID/GID and adding a USER directive (apply
changes after the COPY --from=builder steps and before ENTRYPOINT), ensure any
binaries copied by COPY --from=builder (openshift-apiserver and
openshift-apiserver-tests-ext.gz) have appropriate ownership and file
permissions (chown/chmod) so the new user can execute them, and then
replace/keep ENTRYPOINT ["/usr/bin/openshift-apiserver"] as-is so the container
runs with the non-root user at runtime.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: bf497d6d-e46d-4ef3-b196-f6561523548e
📒 Files selected for processing (2)
.ci-operator.yamlimages/Dockerfile.rhel
|
/retest-required |
|
@ingvagabund: This pull request references CNTRLPLANE-2449 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
ingvagabund
force-pushed
the
k8s-1.35-rebase
branch
from
49d59a8 to
a94a06b
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (2)
hack/openapi-violation.list (2)
368-369: Please confirm these new OpenShift-ownednames_matchsuppressions are unavoidable.These entries are for
github.com/openshift/api/..., not the rebasedk8s.io/...surface. If the companion API bump introduced or promoted these fields, I’d rather fix the underlying Go/json/proto names there than permanently widen the allowlist here. If they’re already compatibility-frozen, please point this PR at the owning API change or follow-up so this doesn’t look like silent debt growth.Also applies to: 381-382, 392-393, 493-493
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@hack/openapi-violation.list` around lines 368 - 369, The new names_match suppressions for OpenShift-owned API types (ImagePolicyPKIRootOfTrust with fields CertificateAuthorityIntermediatesData and CertificateAuthorityRootsData) must be validated: check the upstream github.com/openshift/api repo to confirm whether these field/name mismatches were introduced by a companion API bump or are compatibility-frozen; if the mismatch can be fixed in the owning API, remove the suppression and open/point to that PR, otherwise add a brief comment in the suppression list referencing the upstream PR or issue that makes this unavoidable and include the owning API change identifier so reviewers can trace the decision.
668-669: Please verify we’re not papering over fixable streaming-list tag issues in OpenShift APIs.Because these suppressions are all under
github.com/openshift/api/..., this widens the local exception list for list types we own. If the correspondingListMeta/Itemstags can still be corrected in the companion API repo, that would be preferable to baking in morestreaming_list_type_json_tagsdebt here.Also applies to: 674-674, 683-683, 687-687, 696-696, 700-700, 730-730
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@hack/openapi-violation.list` around lines 668 - 669, The suppression entries in hack/openapi-violation.list are hiding potential streaming-list json tag problems for the types CompatibilityRequirementList (specifically its Items field) and its embedded ListMeta in github.com/openshift/api/apiextensions/v1alpha1; locate the CompatibilityRequirementList definition and its ListMeta and Items fields in the companion api repo, correct their struct/json tags so they conform to streaming-list requirements (fix the json tag on Items and ensure ListMeta is properly tagged/embedded), then remove the corresponding suppression lines from hack/openapi-violation.list; if a tag cannot be changed for a backward-compatibility reason, add a concise justification comment in the api repo and keep a minimal, targeted suppression here.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@hack/openapi-violation.list`:
- Around line 368-369: The new names_match suppressions for OpenShift-owned API
types (ImagePolicyPKIRootOfTrust with fields
CertificateAuthorityIntermediatesData and CertificateAuthorityRootsData) must be
validated: check the upstream github.com/openshift/api repo to confirm whether
these field/name mismatches were introduced by a companion API bump or are
compatibility-frozen; if the mismatch can be fixed in the owning API, remove the
suppression and open/point to that PR, otherwise add a brief comment in the
suppression list referencing the upstream PR or issue that makes this
unavoidable and include the owning API change identifier so reviewers can trace
the decision.
- Around line 668-669: The suppression entries in hack/openapi-violation.list
are hiding potential streaming-list json tag problems for the types
CompatibilityRequirementList (specifically its Items field) and its embedded
ListMeta in github.com/openshift/api/apiextensions/v1alpha1; locate the
CompatibilityRequirementList definition and its ListMeta and Items fields in the
companion api repo, correct their struct/json tags so they conform to
streaming-list requirements (fix the json tag on Items and ensure ListMeta is
properly tagged/embedded), then remove the corresponding suppression lines from
hack/openapi-violation.list; if a tag cannot be changed for a
backward-compatibility reason, add a concise justification comment in the api
repo and keep a minimal, targeted suppression here.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 75ace495-7a91-4c49-be63-fb5d0f35aeac
⛔ Files ignored due to path filters (1)
pkg/openapi/zz_generated.openapi.gois excluded by!**/zz_generated*
📒 Files selected for processing (1)
hack/openapi-violation.list
|
/retest-required |
1 similar comment
|
/retest-required |
ingvagabund
force-pushed
the
k8s-1.35-rebase
branch
2 times, most recently
from
98b6584 to
10579ea
Compare
|
@ingvagabund: This pull request references CNTRLPLANE-2449 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@ingvagabund: This pull request references CNTRLPLANE-2449 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@ingvagabund: This pull request references CNTRLPLANE-2449 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@ingvagabund: This pull request references CNTRLPLANE-2449 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
ingvagabund
force-pushed
the
k8s-1.35-rebase
branch
from
a4be2a6 to
d963cf8
Compare
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ingvagabund The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/testwith openshift/openshift-apiserver/main/e2e-aws-ovn openshift/origin#30885 |
|
/testwith openshift/openshift-apiserver/main/e2e-aws-ovn-builds openshift/origin#30885 |
|
/testwith openshift/openshift-apiserver/main/e2e-aws-ovn openshift/origin#30885 |
|
/testwith openshift/openshift-apiserver/main/e2e-aws-ovn-builds openshift/origin#30885 |
|
/test e2e-aws-ovn |
|
/test e2e-aws-ovn-builds |
|
/retest-required |
…for watch.Bookmark even type Persisting the annotations is needed to properly signal sync completion to reflectors
…a running build These events are synthetic and used for signaling sync completion
…aming (openshift types)
|
@ingvagabund: This pull request references CNTRLPLANE-2449 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
ingvagabund
force-pushed
the
k8s-1.35-rebase
branch
from
87ef3f0 to
df60e1a
Compare
|
@ingvagabund: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Evidence for openshift/kubernetes-apiserver#84
Picking up #615
Notes:
Because of changing the way the OpenAPI names are generated the current
"github.com/openshift/api..."entries underpkg/openapi/zz-generated.openapi.goare no longer sufficient. The new code expects REST friendly names of"com.github.openshift.api...."form. At the same time the original"github.com/openshift/api..."entries are still needed. Otherwise the following error is produced:To generate the original OpenAPI names each OpenShift type needs to implement k8s.io/kube-openapi/pkg/util.OpenAPIModelNamer interface:
Experimenting with updating
vendor/k8s.io/apiserver/pkg/endpoints/openapi/openapi.goby extendingDefinitionNamer.DefinitionNamerto fallback to generating the REST friendly name in case the original entry is used helps yet it produces its own errors:This requires additional changes to escape
/chars. TBDThe alternative is to update the code to use the new REST friendly names only. Yet, that requires at least to update all
schema_openshift_functions inpkg/openapi/zz-generated.openapi.go. Question is whether this can introduce regressions?Inconsistent JSON Pointer escaping when using GetDefinitionName results as schema map keys kubernetes/kube-openapi#580 needs to be fixed as well
Summary by CodeRabbit
Chores
Refactor
Tests