Skip to content

OCPBUGS-78477: Bump API to support ExternalOIDCWithUpstreamParity new API fields #1125

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jhadvig wants to merge 2 commits into
base: main
Choose a base branch
from
Open

OCPBUGS-78477: Bump API to support ExternalOIDCWithUpstreamParity new API fields #1125

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
abced7d
OCPBUGS-78477: Bump API to support ExternalOIDCWithUpstreamParity new…
jhadvig Mar 16, 2026
41016bf
Fix go version in Dockerfile.ocp and remove the old Dockerfile.rhel7
jhadvig Mar 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
4 changes: 2 additions & 2 deletions Dockerfile.ocp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.20 AS builder
FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22 AS builder
ARG TAGS=ocp
WORKDIR /go/src/github.com/openshift/console-operator
COPY . .
ENV GO_PACKAGE github.com/openshift/console-operator
RUN go build -ldflags "-X $GO_PACKAGE/pkg/version.versionFromGit=$(git describe --long --tags --abbrev=7 --match 'v[0-9]*')" -tags="${TAGS}" -o console ./cmd/console

FROM registry.ci.openshift.org/ocp/4.20:base-rhel9
FROM registry.ci.openshift.org/ocp/4.22:base-rhel9
RUN useradd console-operator
USER console-operator
COPY --from=builder /go/src/github.com/openshift/console-operator/console /usr/bin/console
Expand Down
33 changes: 0 additions & 33 deletions Dockerfile.rhel7
View file
Open in desktop

This file was deleted.

89 changes: 44 additions & 45 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
module github.com/openshift/console-operator

go 1.24.0
go 1.25.0

toolchain go1.24.4
toolchain go1.25.5
Comment on lines +3 to +5
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Declared versions in go.mod:"
sed -n '1,12p' go.mod

echo
echo "Potential Go version pins in repo config:"
rg -n --hidden -g '!**/vendor/**' \
  -e 'toolchain go1\.[0-9]+\.[0-9]+' \
  -e '\bgo 1\.[0-9]+\.[0-9]+\b' \
  -e 'golang:1\.[0-9]+' \
  -e 'GO_VERSION|GOTOOLCHAIN'

Repository: openshift/console-operator

Length of output: 502

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Checking Dockerfile(s) ==="
find . -name "Dockerfile*" -type f ! -path "*/vendor/*" -exec grep -n -i "go\|golang" {} + 2>/dev/null || echo "No Dockerfile Go refs found"

echo
echo "=== Checking GitHub Actions workflows ==="
find .github/workflows -name "*.y*ml" -type f 2>/dev/null -exec grep -n "go-version\|golang\|GO_VERSION\|1\.[0-9]" {} + || echo "No workflows found or no Go version pins"

echo
echo "=== Checking Makefile and build scripts ==="
find . -maxdepth 2 -type f \( -name "Makefile" -o -name "*.sh" -o -name "build*" \) ! -path "*/vendor/*" ! -path "*/.git/*" -exec grep -l "go\|GOLANG\|GO_VERSION" {} \; 2>/dev/null | head -10

echo
echo "=== Checking if any files mention go 1.24 ==="
rg -n "go\s+1\.24|golang:1\.24|go1\.24" --hidden -g '!**/vendor/**' || echo "No 1.24 references found"

echo
echo "=== Checking for .tool-versions or similar ==="
find . -maxdepth 2 -type f \( -name ".tool-versions" -o -name ".go-version" \) -exec cat {} \;

Repository: openshift/console-operator

Length of output: 1589

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Makefile content (first 50 lines) ==="
head -50 Makefile || echo "Makefile not readable"

echo
echo "=== test-unit.sh ==="
cat test-unit.sh 2>/dev/null || echo "File not found"

echo
echo "=== test-e2e.sh (first 30 lines) ==="
head -30 test-e2e.sh 2>/dev/null || echo "File not found"

echo
echo "=== File listing for Dockerfile* ==="
ls -la Dockerfile* 2>/dev/null

echo
echo "=== AGENTS.md first 20 lines ==="
head -20 AGENTS.md

Repository: openshift/console-operator

Length of output: 5394

Update Dockerfile.ocp and documentation to use Go 1.25.

go.mod now requires go 1.25.0 and toolchain go1.25.5, but Dockerfile.ocp still uses golang-1.24-openshift-4.20. This will cause build failures or unexpected toolchain downloads in restricted environments. Additionally, AGENTS.md documents "Go version 1.24.0 (toolchain: go1.24.4)", which is now outdated.

Affected files:

  • Dockerfile.ocp (line 1): Change golang-1.24-openshift-4.20 to golang-1.25-openshift-4.22 (matching Dockerfile.rhel7)
  • AGENTS.md (lines 7, 11): Update to "Go version 1.25.0 (toolchain: go1.25.5)"
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@go.mod` around lines 3 - 5, Update the OpenShift Docker base image string and
AGENTS.md Go version text to match the new go.mod/toolchain: replace the
Dockerfile.ocp base image value "golang-1.24-openshift-4.20" with
"golang-1.25-openshift-4.22" and update the two AGENTS.md occurrences of "Go
version 1.24.0 (toolchain: go1.24.4)" to "Go version 1.25.0 (toolchain:
go1.25.5)" so the container image and documentation align with go 1.25.0 /
toolchain go1.25.5.


require (
github.com/blang/semver v3.5.1+incompatible
Expand All @@ -11,20 +11,20 @@ require (
github.com/go-bindata/go-bindata v3.1.2+incompatible
github.com/go-test/deep v1.0.5
github.com/google/go-cmp v0.7.0
github.com/openshift/api v0.0.0-20260114133223-6ab113cb7368
github.com/openshift/api v0.0.0-20260306002634-d3bbdada155c
github.com/openshift/build-machinery-go v0.0.0-20250530140348-dc5b2804eeee
github.com/openshift/client-go v0.0.0-20260108185524-48f4ccfc4e13
github.com/openshift/library-go v0.0.0-20251020111130-eb4177eed478
github.com/spf13/cobra v1.9.1
github.com/openshift/client-go v0.0.0-20260306160707-3935d929fc7d
github.com/openshift/library-go v0.0.0-20260303171201-5d9eb6295ff6
github.com/spf13/cobra v1.10.0
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
gopkg.in/yaml.v2 v2.4.0
k8s.io/api v0.34.1
k8s.io/apiextensions-apiserver v0.34.1
k8s.io/apimachinery v0.34.1
k8s.io/client-go v0.34.1
k8s.io/component-base v0.34.1
k8s.io/api v0.35.1
k8s.io/apiextensions-apiserver v0.35.1
k8s.io/apimachinery v0.35.1
k8s.io/client-go v0.35.1
k8s.io/component-base v0.35.1
k8s.io/klog/v2 v2.130.1
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
)

require (
Expand All @@ -42,7 +42,7 @@ require (
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/fsnotify/fsnotify v1.9.0 // indirect
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
github.com/go-logr/logr v1.4.2 // indirect
github.com/go-logr/logr v1.4.3 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-openapi/jsonpointer v0.21.0 // indirect
github.com/go-openapi/jsonreference v0.20.2 // indirect
Expand All @@ -52,7 +52,7 @@ require (
github.com/google/btree v1.1.3 // indirect
github.com/google/cel-go v0.26.0 // indirect
github.com/google/gnostic-models v0.7.0 // indirect
github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db // indirect
github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
Expand All @@ -65,57 +65,56 @@ require (
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/pkg/profile v1.7.0 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/client_golang v1.22.0 // indirect
github.com/prometheus/client_model v0.6.1 // indirect
github.com/prometheus/common v0.62.0 // indirect
github.com/prometheus/procfs v0.15.1 // indirect
github.com/prometheus/client_golang v1.23.2 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/common v0.66.1 // indirect
github.com/prometheus/procfs v0.16.1 // indirect
github.com/robfig/cron v1.2.0 // indirect
github.com/sirupsen/logrus v1.9.3 // indirect
github.com/spf13/pflag v1.0.6 // indirect
github.com/spf13/pflag v1.0.9 // indirect
github.com/stoewer/go-strcase v1.3.0 // indirect
github.com/x448/float16 v0.8.4 // indirect
go.etcd.io/etcd/api/v3 v3.6.4 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.6.4 // indirect
go.etcd.io/etcd/client/v3 v3.6.4 // indirect
go.etcd.io/etcd/api/v3 v3.6.5 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.6.5 // indirect
go.etcd.io/etcd/client/v3 v3.6.5 // indirect
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
go.opentelemetry.io/otel v1.35.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
go.opentelemetry.io/otel v1.36.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 // indirect
go.opentelemetry.io/otel/metric v1.35.0 // indirect
go.opentelemetry.io/otel/sdk v1.34.0 // indirect
go.opentelemetry.io/otel/trace v1.35.0 // indirect
go.opentelemetry.io/otel/metric v1.36.0 // indirect
go.opentelemetry.io/otel/sdk v1.36.0 // indirect
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "1) Confirm pinned version in go.mod"
rg -n 'go\.opentelemetry\.io/otel/sdk\s+v' go.mod

echo
echo "2) Query OSV for this exact version"
cat >/tmp/osv-query.json <<'JSON'
{
  "package": { "ecosystem": "Go", "name": "go.opentelemetry.io/otel/sdk" },
  "version": "v1.36.0"
}
JSON
curl -s https://api.osv.dev/v1/query -d `@/tmp/osv-query.json` | jq '{vulns: [.vulns[]? | {id, summary, aliases, modified}]}'

echo
echo "3) Check direct imports in non-vendor code (reachability signal)"
rg -n --type=go -g '!**/vendor/**' 'go\.opentelemetry\.io/otel/sdk'

Repository: openshift/console-operator

Length of output: 857

🏁 Script executed (no clone):

#!/bin/bash
set -euo pipefail

echo "=== Query OSV for go.opentelemetry.io/otel/sdk to find patched versions ==="
curl -s https://api.osv.dev/v1/query -d '{
  "package": { "ecosystem": "Go", "name": "go.opentelemetry.io/otel/sdk" }
}' | jq '.vulns[] | select(.id == "GO-2026-4394") | {
  id,
  summary,
  severity,
  cvss_score: .database_specific.cvss_v3_base_score,
  affected_versions: .affected[].versions,
  fixed_versions: .affected[].ranges[]? | select(.type == "SEMVER") | .events[]? | select(.fixed != null) | .fixed
}'

echo
echo "=== Also check for any available fix info ==="
curl -s https://api.osv.dev/v1/query -d '{
  "package": { "ecosystem": "Go", "name": "go.opentelemetry.io/otel/sdk" }
}' | jq '.vulns[] | select(.id == "GHSA-9h8m-3fm2-qjrq")'

Length of output: 3046

Upgrade go.opentelemetry.io/otel/sdk from v1.36.0 to v1.40.0 to address HIGH-severity RCE vulnerability.

This package is flagged by GO-2026-4394 / GHSA-9h8m-3fm2-qjrq (CVE-2026-24051). The vulnerability (CWE-426) allows arbitrary code execution via PATH hijacking on macOS/Darwin systems through the resource detection code in sdk/resource/host_id.go. Patched version v1.40.0 is available and should be applied before release.

🧰 Tools
🪛 OSV Scanner (2.3.3)

[HIGH] 89-89: go.opentelemetry.io/otel/sdk 1.36.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk

(GO-2026-4394)

[HIGH] 89-89: go.opentelemetry.io/otel/sdk 1.36.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

(GHSA-9h8m-3fm2-qjrq)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@go.mod` at line 89, Update the dependency version for the module path
go.opentelemetry.io/otel/sdk from v1.36.0 to v1.40.0 in go.mod to apply the
security patch for CVE-2026-24051, then refresh module metadata (e.g., run your
normal Go module update/cleanup step such as go get or go mod tidy) so the
lockfile/mod cache picks up v1.40.0; ensure CI builds use the updated go.mod to
confirm the patched version is resolved.

go.opentelemetry.io/otel/trace v1.36.0 // indirect
go.opentelemetry.io/proto/otlp v1.5.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
go.yaml.in/yaml/v2 v2.4.2 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/crypto v0.42.0 // indirect
golang.org/x/net v0.43.0 // indirect
golang.org/x/oauth2 v0.27.0 // indirect
golang.org/x/sync v0.17.0 // indirect
golang.org/x/sys v0.36.0 // indirect
golang.org/x/term v0.35.0 // indirect
golang.org/x/text v0.29.0 // indirect
golang.org/x/crypto v0.45.0 // indirect
golang.org/x/net v0.47.0 // indirect
golang.org/x/oauth2 v0.30.0 // indirect
golang.org/x/sync v0.18.0 // indirect
golang.org/x/sys v0.38.0 // indirect
golang.org/x/term v0.37.0 // indirect
golang.org/x/text v0.31.0 // indirect
golang.org/x/time v0.9.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb // indirect
google.golang.org/grpc v1.72.1 // indirect
google.golang.org/protobuf v1.36.5 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a // indirect
google.golang.org/grpc v1.72.2 // indirect
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

❓ Verification inconclusive

Script executed:

#!/bin/bash
# Check for patched versions and vulnerability details
echo "=== Check grpc vulnerability details ==="
gh api graphql -f query='
{
  securityVulnerabilities(first: 5, ecosystem: GO, package: "google.golang.org/grpc") {
    nodes {
      advisory {
        summary
        severity
        publishedAt
        ghsaId
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}'

echo ""
echo "=== Check latest grpc version ==="
curl -s "https://proxy.golang.org/google.golang.org/grpc/@latest" | jq .

Repository: openshift/console-operator

Repository: openshift/console-operator
Exit code: 0

stdout:

=== Check grpc vulnerability details ===
{
  "message": "Bad credentials",
  "documentation_url": "https://docs.github.com/rest",
  "status": "401"
}
=== Check latest grpc version ===
{
  "Version": "v1.79.3",
  "Time": "2026-03-17T23:13:23Z",
  "Origin": {
    "VCS": "git",
    "URL": "https://github.com/grpc/grpc-go",
    "Hash": "dda86dbd9cecb8b35b58c73d507d81d67761205f",
    "Ref": "refs/tags/v1.79.3"
  }
}

stderr:

gh: Bad credentials (HTTP 401)

GHSA-p77j-4mvh-x3m3 grpc vulnerability

GHSA-p77j-4mvh-x3m3 / CVE-2026-33186 (gRPC-Go) is a critical authorization-bypass issue in google.golang.org/grpc caused by improper input validation of the HTTP/2 :path pseudo-header. A gRPC-Go server would route requests whose :path omits the mandatory leading slash (e.g., Service/Method vs /Service/Method), but path-based authorization interceptors could evaluate the non-canonical path string—so “deny” rules written for canonical paths might not match, enabling bypass when a fallback “allow” rule exists. Affected: versions < 1.79.3. Fixed: 1.79.3 (and newer). Exploitability: attacker must be able to send raw HTTP/2 frames with malformed :path directly to the gRPC server. Workarounds: add an outer interceptor to reject methods not starting with /, enforce strict HTTP/2 pseudo-header compliance at a proxy/LB, and/or move to default-deny policies. [1]

Source: [1] GitHub Advisory Database (GHSA-p77j-4mvh-x3m3).

grpc v1.72.2 security vulnerability authorization bypass

gRPC Go module google.golang.org/grpc v1.72.2 is affected by an authorization-bypass issue where a client can send a malformed HTTP/2 :path header missing the leading /, which can bypass path-based “deny” authorization rules in interceptors such as grpc/authz (i.e., rules that rely on matching the RPC path/method). The gRPC-Go project fixed this by rejecting non-canonical paths (returning Unimplemented) in v1.79.3. [1][2]

What to do

  • Upgrade google.golang.org/grpc to v1.79.3 or later. [1]
  • If you can’t upgrade immediately: backport PR #8981 (strict server-side path checking) or add an equivalent server-side check to reject requests whose :path is not canonical (doesn’t start with /) before authz evaluation. [2]

About “CVE-2026-33186”

  • Some community posts refer to this issue as CVE-2026-33186, but as of now I only see that claim in community discussion (not an official gRPC-Go advisory/NVD entry). [3]

Sources:
[1] gRPC-Go v1.79.3 release notes (Security fix) https://github.com/grpc/grpc-go/releases (Release 1.79.3)
[2] Fix PR #8981 (“enforce strict path checking…”, authorization-bypass description) grpc/grpc-go#8981
[3] Community discussion referencing “CVE-2026-33186” https://www.reddit.com/r/golang/comments/1rxpiyw/cve202633186_grpcgo_has_an_authorization_bypass/

Upgrade google.golang.org/grpc to v1.79.3 to fix critical authorization-bypass vulnerability (GHSA-p77j-4mvh-x3m3).

grpc v1.72.2 is affected by an authorization-bypass vulnerability where malformed HTTP/2 :path pseudo-headers (missing leading slash) can bypass path-based authorization rules in interceptors. This allows unauthorized access when a fallback "allow" rule exists. Fixed in v1.79.3.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@go.mod` at line 106, The go.mod currently pins google.golang.org/grpc at
v1.72.2 which has a known authorization-bypass CVE; update the dependency
version to google.golang.org/grpc v1.79.3 in go.mod and run `go get`/`go mod
tidy` (or equivalent CI tooling) to refresh the lockfile and vendor files so the
project uses the patched grpc release; ensure any CI build/test runs pass after
updating and adjust any module replacements if present that could keep the old
version.

google.golang.org/protobuf v1.36.8 // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/apiserver v0.34.1 // indirect
k8s.io/kms v0.34.1 // indirect
k8s.io/kube-aggregator v0.34.1 // indirect
k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
k8s.io/apiserver v0.35.1 // indirect
k8s.io/kms v0.35.1 // indirect
k8s.io/kube-aggregator v0.35.1 // indirect
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/kube-storage-version-migrator v0.0.6-0.20230721195810-5c8923c5ff96 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
Expand Down
Loading