[release-4.12] OCPBUGS-41942, OCPBUGS-41943: Update opentelemetry to mitigate CVE

[apoorvajagtap]

This commit replaces following:

• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc with relevant v0.46.0 [OCPBUGS-41942]
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp with relevant v0.44.0 [OCPBUGS-41943]

[openshift-ci-robot]

@apoorvajagtap: This pull request references Jira Issue OCPBUGS-41942, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.12.z) matches configured target version for branch (4.12.z)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
• release note text is set and does not match the template
• dependent bug Jira Issue OCPBUGS-38455 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
• dependent Jira Issue OCPBUGS-38455 targets the "4.13.z" version, which is one of the valid target versions: 4.13.0, 4.13.z
• bug has dependents

Requesting review from QA contact:
/cc @jitendar-singh

The bug has been updated to refer to the pull request using the external bug tracker.

This pull request references Jira Issue OCPBUGS-41943, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.12.z) matches configured target version for branch (4.12.z)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
• release note type set to "Release Note Not Required"
• dependent bug Jira Issue OCPBUGS-38456 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
• dependent Jira Issue OCPBUGS-38456 targets the "4.13.z" version, which is one of the valid target versions: 4.13.0, 4.13.z
• bug has dependents

Requesting review from QA contact:
/cc @jitendar-singh

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

This commit replaces following:

• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc with relevant v0.46.0 [OCPBUGS-41942]
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp with relevant v0.44.0 [OCPBUGS-41943]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[apoorvajagtap]

/assign @sayan-biswas

[sayan-biswas]

/approve

[apoorvajagtap]

/hold
needs some changes in the replace section. I'll push the changes soon.

[sayan-biswas]

@apoorvajagtap Are these changes done?

[openshift-ci]

New changes are detected. LGTM label has been removed.

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[openshift-bot]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

[openshift-bot]

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

[openshift-ci]

@openshift-bot: Closed this PR.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci-robot]

@apoorvajagtap: This pull request references Jira Issue OCPBUGS-41942. The bug has been updated to no longer refer to the pull request using the external bug tracker. All external bug links have been closed. The bug has been moved to the NEW state.

This pull request references Jira Issue OCPBUGS-41943. The bug has been updated to no longer refer to the pull request using the external bug tracker. All external bug links have been closed. The bug has been moved to the NEW state.

In response to this:

This commit replaces following:

• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc with relevant v0.46.0 [OCPBUGS-41942]
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp with relevant v0.44.0 [OCPBUGS-41943]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tjungblu]

/reopen
/remove-lifecycle rotten

@sayan-biswas I've still found the above jiras lingering in our CVE backlog - do you mind to push this one through?

[openshift-ci]

@tjungblu: Reopened this PR.

In response to this:

/reopen
/remove-lifecycle rotten

@sayan-biswas I've still found the above jiras lingering in our CVE backlog - do you mind to push this one through?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci-robot]

@apoorvajagtap: This pull request references Jira Issue OCPBUGS-41942, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.12.z) matches configured target version for branch (4.12.z)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
• release note text is set and does not match the template
• dependent bug Jira Issue OCPBUGS-38455 is in the state Closed (Done-Errata), which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
• dependent Jira Issue OCPBUGS-38455 targets the "4.13.z" version, which is one of the valid target versions: 4.13.0, 4.13.z
• bug has dependents

No GitHub users were found matching the public email listed for the QA contact in Jira (jitsingh@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

This pull request references Jira Issue OCPBUGS-41943, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.12.z) matches configured target version for branch (4.12.z)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
• release note type set to "Release Note Not Required"
• dependent bug Jira Issue OCPBUGS-38456 is in the state Closed (Done-Errata), which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
• dependent Jira Issue OCPBUGS-38456 targets the "4.13.z" version, which is one of the valid target versions: 4.13.0, 4.13.z
• bug has dependents

No GitHub users were found matching the public email listed for the QA contact in Jira (jitsingh@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

This commit replaces following:

• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc with relevant v0.46.0 [OCPBUGS-41942]
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp with relevant v0.44.0 [OCPBUGS-41943]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: apoorvajagtap, sayan-biswas

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ingvagabund]

/retest-required

[openshift-ci]

@apoorvajagtap: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	bd0a225	link	false	/test security
ci/prow/openshift-e2e-aws-builds-techpreview	bd0a225	link	false	/test openshift-e2e-aws-builds-techpreview
ci/prow/unit	bd0a225	link	true	/test unit
ci/prow/e2e-aws-operator	bd0a225	link	true	/test e2e-aws-operator
ci/prow/e2e-aws-ovn	bd0a225	link	true	/test e2e-aws-ovn
ci/prow/images	bd0a225	link	true	/test images
ci/prow/e2e-upgrade	bd0a225	link	true	/test e2e-upgrade
ci/prow/verify	bd0a225	link	true	/test verify

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[ingvagabund]

go: inconsistent vendoring in /go/src/github.com/openshift/cluster-openshift-controller-manager-operator:
	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc: is replaced in go.mod, but not marked as replaced in vendor/modules.txt
	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: is replaced in go.mod, but not marked as replaced in vendor/modules.txt
	To ignore the vendor directory, use -mod=readonly or -mod=mod.
	To sync the vendor directory, run:
		go mod vendor