From 2c01a7dfe7670764a8b72bfb24fbde06f8c263f0 Mon Sep 17 00:00:00 2001 From: ci-robot Date: Mon, 17 Apr 2023 05:10:48 +0000 Subject: [PATCH 1/9] update last_rebase.sh --- scripts/auto-rebase/last_rebase.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/auto-rebase/last_rebase.sh b/scripts/auto-rebase/last_rebase.sh index 044a6f5fd5..bdbc467c65 100755 --- a/scripts/auto-rebase/last_rebase.sh +++ b/scripts/auto-rebase/last_rebase.sh @@ -1,2 +1,2 @@ #!/bin/bash -x -./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release:4.13.0-0.nightly-2023-04-13-171034" "registry.ci.openshift.org/ocp-arm64/release-arm64:4.13.0-0.nightly-arm64-2023-04-14-004314" "registry.access.redhat.com/lvms4/lvms-operator-bundle:v4.12" +./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release:4.13.0-0.nightly-2023-04-15-102029" "registry.ci.openshift.org/ocp-arm64/release-arm64:4.13.0-0.nightly-arm64-2023-04-15-102028" "registry.access.redhat.com/lvms4/lvms-operator-bundle:v4.12" From 39e8c256d2e411d5eca0c940ae7b808fb58bf989 Mon Sep 17 00:00:00 2001 From: ci-robot Date: Mon, 17 Apr 2023 05:10:49 +0000 Subject: [PATCH 2/9] update changelog --- scripts/auto-rebase/changelog.txt | 77 +++++++++++++++++++++++++++---- scripts/auto-rebase/commits.txt | 14 +++--- 2 files changed, 74 insertions(+), 17 deletions(-) diff --git a/scripts/auto-rebase/changelog.txt b/scripts/auto-rebase/changelog.txt index 65ec2fe921..50cc1956a7 100644 --- a/scripts/auto-rebase/changelog.txt +++ b/scripts/auto-rebase/changelog.txt @@ -1,16 +1,14 @@ -# cluster-kube-apiserver-operator embedded-component 5f038db7df7ade2f3da707394a14e391c693d25c to 02ea4a4120dd0f8eb49d070b1fe420ed6d1debba -083565cf97e4077cff36091aba5a276d469f8eed 2023-03-22T18:35:00+00:00 update apf configuration to use v1beta3 -# kubernetes embedded-component 22308ca177342eb6820b95e0cad1142e385ef4c9 to 0c79814882f4a4b842fbeab001c9f92f9de9a9b9 -71873f411a7949e19aca37d65494aba17cdbe2da 2023-03-16T19:57:24+00:00 UPSTREAM: : STOR-829: Add CSIInlineVolumeSecurity admission plugin -# machine-config-operator embedded-component 0318874b6243752bb0bd30f8e99bd03d19278b37 to 5d6b4e794bda70accd168867bba815e3b3e3b02a -f98d25046fa825cb91c2b6f97c928f44b53b1b0f 2023-03-28T08:02:56+00:00 OCPBUGS-8676: Fix kubelet.service node-ip for v6-primary dual-stack -# kubernetes image-amd64 22308ca177342eb6820b95e0cad1142e385ef4c9 to 0c79814882f4a4b842fbeab001c9f92f9de9a9b9 -71873f411a7949e19aca37d65494aba17cdbe2da 2023-03-16T19:57:24+00:00 UPSTREAM: : STOR-829: Add CSIInlineVolumeSecurity admission plugin -# kubernetes image-arm64 22308ca177342eb6820b95e0cad1142e385ef4c9 to 85375332a108abce2f23a61958ae7adcc449477c +# cluster-network-operator embedded-component b7b90a5bef21ebe3c91362bb1415469197e0290b to d9b70b9b587762e53863d61d0447f2f74580bd4b +498475d4f534072c1d49befb0d12b88059082f93 2023-04-13T05:50:19+00:00 OCPBUGS-11046: Fix allowlist ds template +# kubernetes embedded-component 0c79814882f4a4b842fbeab001c9f92f9de9a9b9 to 19816eefa6829861687df6dfe573708756c464cc +2e08e352eb705054f78f03a534a627ff8a038209 2023-04-12T20:02:20+02:00 UPSTREAM: : bump: apiserver-lib-go for fixed SCC admission +7101082be4e94ecdbad1da83df354131d90f5560 2023-04-12T17:00:37+00:00 UPSTREAM: 117242: vendor: bump runc to 1.1.6 +b75565423e47cd3d2bb7fbcc56f0bff21562c2a7 2023-04-12T17:00:37+00:00 UPSTREAM: 117242: CVE-2023-27561: Bump runc go module v1.1.4 -> v1.1.5 +5a2bcff32a30b8d9f9f937c6cb5d5d3e6ca5069f 2023-04-12T17:00:37+00:00 UPSTREAM: : disable load balancing on created cgroups when managed is enabled +c376be027feb599a81f5f38e5b1922e9c05065b2 2023-04-12T17:53:58+02:00 UPSTREAM: : SCC pod extractor: assume default SA if SA is empty 1721e67a44c1e57c0751240b0feb62fe610186be 2023-04-11T20:28:05+02:00 UPSTREAM: : hack/update-vendor.sh, make update and update image e61f3ad194851a5db1489aab125ead07612bb170 2023-04-11T20:25:49+02:00 UPSTREAM: : Force using the go tooling from the system 6aebbd28015e52d856ed6097f1918a8246316f35 2023-04-11T20:23:23+02:00 UPSTREAM: : manually resolve conflicts -71873f411a7949e19aca37d65494aba17cdbe2da 2023-03-16T19:57:24+00:00 UPSTREAM: : STOR-829: Add CSIInlineVolumeSecurity admission plugin 9e644106593f3f4aa98f8a84b23db5fa378900bd 2023-03-15T13:33:11+00:00 Release commit for Kubernetes v1.26.3 6138cccca8d2c9cbe81d62c20b573078cd846907 2023-03-09T16:10:53-05:00 Avoid metric lookup in Parallelizer.Util on every work piece 7cc066c1050a55201e391a1c354464c008d36c82 2023-03-09T15:47:02-05:00 One lock among PodNominator and SchedulingQueue @@ -48,3 +46,62 @@ d87b53b15dcc60f15a418dd23cf4912d92c41eaa 2023-02-03T00:01:07-05:00 Invoke gimme 25183b77325b58abdcd09d9c0e94791e7a6232c1 2023-02-03T00:01:06-05:00 Defer builds to test-cmd and test-integration targets a50ebe3c210c0744166d5e2d1510ff4aac732aef 2023-01-31T16:08:55-05:00 Set node_stage whenever available 6206ce9fbf49e09cbf950317db7cece29d2e023a 2023-01-30T15:37:02-05:00 Carefully compute request path for metrics +# machine-config-operator embedded-component 5d6b4e794bda70accd168867bba815e3b3e3b02a to 35b049f9d3eaac15fdf6632e2ecd8cf55bd539e3 +b1826289224b1e973b88f3d0903b63cc9118af83 2023-04-13T16:32:58+00:00 OCPBUGS-11280: Fixing forcedns dispatcher script permission issue for assisted sno rhel9 upgrade +1e962e3c33c905d86871fc740eaac69e3b6f12a8 2023-03-29T13:52:01+00:00 Splitting NetworkManager-onprem.conf.yaml to 2 files: 1. NetworkManager-onprem.conf.yaml will set unmanaged field as before and will do it only for onprem platforms as before 2. NetworkManager-ipv6.conf.yaml will set ipv6 flags for all platforms +# ovn-kubernetes image-amd64 c66883c01e06722319fdf18e9997231b6abda3aa to e3bef98aa599a90a7f24ab077e7b979d688eb537 +13db0f8dc40dea0a2a6d89810750f3dc9c3603d9 2023-03-28T10:56:40-04:00 Fixes Egress Firewall node selector for ipv6 +# kubernetes image-amd64 0c79814882f4a4b842fbeab001c9f92f9de9a9b9 to 19816eefa6829861687df6dfe573708756c464cc +2e08e352eb705054f78f03a534a627ff8a038209 2023-04-12T20:02:20+02:00 UPSTREAM: : bump: apiserver-lib-go for fixed SCC admission +7101082be4e94ecdbad1da83df354131d90f5560 2023-04-12T17:00:37+00:00 UPSTREAM: 117242: vendor: bump runc to 1.1.6 +b75565423e47cd3d2bb7fbcc56f0bff21562c2a7 2023-04-12T17:00:37+00:00 UPSTREAM: 117242: CVE-2023-27561: Bump runc go module v1.1.4 -> v1.1.5 +5a2bcff32a30b8d9f9f937c6cb5d5d3e6ca5069f 2023-04-12T17:00:37+00:00 UPSTREAM: : disable load balancing on created cgroups when managed is enabled +c376be027feb599a81f5f38e5b1922e9c05065b2 2023-04-12T17:53:58+02:00 UPSTREAM: : SCC pod extractor: assume default SA if SA is empty +1721e67a44c1e57c0751240b0feb62fe610186be 2023-04-11T20:28:05+02:00 UPSTREAM: : hack/update-vendor.sh, make update and update image +e61f3ad194851a5db1489aab125ead07612bb170 2023-04-11T20:25:49+02:00 UPSTREAM: : Force using the go tooling from the system +6aebbd28015e52d856ed6097f1918a8246316f35 2023-04-11T20:23:23+02:00 UPSTREAM: : manually resolve conflicts +9e644106593f3f4aa98f8a84b23db5fa378900bd 2023-03-15T13:33:11+00:00 Release commit for Kubernetes v1.26.3 +6138cccca8d2c9cbe81d62c20b573078cd846907 2023-03-09T16:10:53-05:00 Avoid metric lookup in Parallelizer.Util on every work piece +7cc066c1050a55201e391a1c354464c008d36c82 2023-03-09T15:47:02-05:00 One lock among PodNominator and SchedulingQueue +6968f56567c90ea4329448a9185445bb1f114295 2023-03-09T12:39:06-08:00 Removes old discovery hack ignoring 403 and 404 +363bcdd815c051e52954b1aab1cd503dfc19bff7 2023-03-09T12:38:02-08:00 Plumb stale GroupVersions through aggregated discovery +24f79b28edf2496aa63b7578b083362e009a987e 2023-03-09T10:08:08+01:00 releng/go: Update images, dependencies and version to Go 1.19.7 +6e8addd9a0a9e2983e3040e337b1b7ba6df83d87 2023-03-08T04:00:34+00:00 Tolerate empty discovery response in memcache client +5aefc0c454e0e4f7c431ddfdfe767859b36b55ac 2023-03-03T10:00:26+05:30 Fix for windows kube-proxy: 'externalTrafficPolicy: Local' results in no clusterIP entry in windows node. +4bab824def3417109b6dca8e16ad3b7fa80d74c8 2023-03-02T11:39:47-08:00 Deflake tests in staging/src/k8s.io/kube-aggregator/pkg/apiserver +20f36098d951df73b131e9408f1a37a74b84ba5d 2023-03-02T11:39:42-08:00 Fix a data race in TestDirty +d07478bd5a863273aec874c869bb8cd3de911bdc 2023-03-02T11:39:38-08:00 ut: fix TestLegacyFallbackNoCache versions order +b1f6dc0311402ffc8849ffab2998b38d839b9924 2023-03-02T11:36:43-08:00 Fix legacy fallback stale for aggregated discovery +3df1e8e32fdc4462bdfe1537d90ce4e6d83e6a9a 2023-03-02T02:29:31+00:00 add unit test +86a6f5d1b58ee63de1133b515001dd6d333b207a 2023-03-02T02:29:31+00:00 fix 116028 +e8627059b02a360f30a869abc7c1cbec00163651 2023-02-28T17:19:34-03:00 Re-enable label selector +1b063e1248ce9f38fda5456054fca77ecb320eec 2023-02-28T17:19:34-03:00 Add integration test for diff --prune --selector +215a91b4381ec2fded38e8d0253e0e3f3675f9cb 2023-02-28T17:19:32-03:00 Use label selector for filtering out resources when pruning. Matches same behavior as for kubectl apply +9ec50f523aa50219f2449b1acc119619d0642051 2023-02-27T10:58:28+01:00 svc: Support pods with same address +a4ea8e56c1558292233d6b4bb1d0712a21bf3518 2023-02-27T08:37:59+01:00 api: generated files +bb8e051b4b95e1eb0e2dc4e3e25b4373a8a6307d 2023-02-27T08:33:04+01:00 api: drop Resources.Claims from PVC and PVC template +5ea3848172c54a35b0e86a3709b983136e277293 2023-02-24T20:23:32+01:00 scheduler/framework/plugins/volumebinding: fix inaccurate log for when a volume is bound to a claim +f5261ae7362e90f20db2557bc83d590e83aeb7be 2023-02-24T07:25:58-08:00 Fix validation.go to validate without StatefulSetStartOrdinal feature gate check. Adds test case to validate regression fix of validation failing when spec.ordinals set and feature gate disabled +f945942cfa18acc3cb0d063a065fafa1e710dc88 2023-02-22T14:30:11+00:00 Update CHANGELOG/CHANGELOG-1.26.md for v1.26.2 +a87eb5d44f4d0008ef910d98d3b1983e3320bab7 2023-02-22T13:32:21+00:00 Release commit for Kubernetes v1.26.3-rc.0 +a05ec2e0147acb5955b21e4b971ae2e59a3ea019 2023-02-20T23:05:34+01:00 Remove global framework variable +072703c70b066c590686b9b75dcacab5a3f737dd 2023-02-15T10:25:09-08:00 fix race in aggregated discovery handler +bdecd47143ebfddfeacb36b9ff980446476eec9c 2023-02-14T17:46:31+00:00 Remove check for CSI driver running on node for CSI migration attach operations +00e1ab6b5dbf815eb6853a497b8ce1685a717536 2023-02-14T11:06:01-05:00 Disable multiple pv mount tests for vsphere intree driver +192f90ac9c5f0e04f0b9973952e0227cb37c5c4e 2023-02-13T21:26:58-05:00 Simplify construction of /metrics request +4e7930724f2afb60efc29b94ce1c5c75ceecb7cc 2023-02-08T16:54:52+05:30 Fix for issue with Loadbalancer policy creation for IPV6 endpoints in Dualstack mode. +83c3ca63a12eaadfa2fb20ea5d6b588904461193 2023-02-07T17:03:20-08:00 Bump konnectivity-client to v0.0.36 +29f810fc071157cfa55603e97c0065e50f45a131 2023-02-06T21:51:40+00:00 make GetSubnetPrefix IP family agnostic +d87b53b15dcc60f15a418dd23cf4912d92c41eaa 2023-02-03T00:01:07-05:00 Invoke gimme from kube::golang::verify_go_version +62386bb73950cbdec1f8938a3250937702222749 2023-02-03T00:01:07-05:00 Add gimme +25183b77325b58abdcd09d9c0e94791e7a6232c1 2023-02-03T00:01:06-05:00 Defer builds to test-cmd and test-integration targets +a50ebe3c210c0744166d5e2d1510ff4aac732aef 2023-01-31T16:08:55-05:00 Set node_stage whenever available +6206ce9fbf49e09cbf950317db7cece29d2e023a 2023-01-30T15:37:02-05:00 Carefully compute request path for metrics +# ovn-kubernetes image-arm64 c66883c01e06722319fdf18e9997231b6abda3aa to e3bef98aa599a90a7f24ab077e7b979d688eb537 +13db0f8dc40dea0a2a6d89810750f3dc9c3603d9 2023-03-28T10:56:40-04:00 Fixes Egress Firewall node selector for ipv6 +# kubernetes image-arm64 85375332a108abce2f23a61958ae7adcc449477c to 19816eefa6829861687df6dfe573708756c464cc +2e08e352eb705054f78f03a534a627ff8a038209 2023-04-12T20:02:20+02:00 UPSTREAM: : bump: apiserver-lib-go for fixed SCC admission +7101082be4e94ecdbad1da83df354131d90f5560 2023-04-12T17:00:37+00:00 UPSTREAM: 117242: vendor: bump runc to 1.1.6 +b75565423e47cd3d2bb7fbcc56f0bff21562c2a7 2023-04-12T17:00:37+00:00 UPSTREAM: 117242: CVE-2023-27561: Bump runc go module v1.1.4 -> v1.1.5 +5a2bcff32a30b8d9f9f937c6cb5d5d3e6ca5069f 2023-04-12T17:00:37+00:00 UPSTREAM: : disable load balancing on created cgroups when managed is enabled +c376be027feb599a81f5f38e5b1922e9c05065b2 2023-04-12T17:53:58+02:00 UPSTREAM: : SCC pod extractor: assume default SA if SA is empty diff --git a/scripts/auto-rebase/commits.txt b/scripts/auto-rebase/commits.txt index 95bd4bccd4..fdd44b74f8 100644 --- a/scripts/auto-rebase/commits.txt +++ b/scripts/auto-rebase/commits.txt @@ -3,12 +3,12 @@ https://github.com/openshift/cluster-ingress-operator embedded-component 6aa482c https://github.com/openshift/cluster-kube-apiserver-operator embedded-component 02ea4a4120dd0f8eb49d070b1fe420ed6d1debba https://github.com/openshift/cluster-kube-controller-manager-operator embedded-component cdde94837bec1810dbad71ca070a84f212de0cbb https://github.com/openshift/cluster-kube-scheduler-operator embedded-component dc5cba57ddcdb5a4b43240d1c2ab908fa953d887 -https://github.com/openshift/cluster-network-operator embedded-component b7b90a5bef21ebe3c91362bb1415469197e0290b +https://github.com/openshift/cluster-network-operator embedded-component d9b70b9b587762e53863d61d0447f2f74580bd4b https://github.com/openshift/cluster-openshift-controller-manager-operator embedded-component 9a8aba8cad6491a31e743a7e366d758351482d88 https://github.com/openshift/cluster-policy-controller embedded-component d02c85ab3203fe22eddcc4694e17504ef34935de https://github.com/openshift/etcd embedded-component f70da9d78221bc3e6bf8ac14c0c4ecc106f4f57d -https://github.com/openshift/kubernetes embedded-component 0c79814882f4a4b842fbeab001c9f92f9de9a9b9 -https://github.com/openshift/machine-config-operator embedded-component 5d6b4e794bda70accd168867bba815e3b3e3b02a +https://github.com/openshift/kubernetes embedded-component 19816eefa6829861687df6dfe573708756c464cc +https://github.com/openshift/machine-config-operator embedded-component 35b049f9d3eaac15fdf6632e2ecd8cf55bd539e3 https://github.com/openshift/openshift-controller-manager embedded-component 87de83867ac51730f506138ee790a56ca21d9fc9 https://github.com/openshift/route-controller-manager embedded-component d7a8e22db412b6fabb7028ca0da8de8f3d9ac3c3 https://github.com/openshift/service-ca-operator embedded-component 1b89fdce3fcccecdc5fdb705fe674cd4bfc58a2a @@ -16,13 +16,13 @@ https://github.com/openshift/oc image-amd64 92b1a3d0e5d092430b523f6541aa0c504b22 https://github.com/openshift/coredns image-amd64 5560e4ad8c343c211f0b2f9d85ce7331b20b87cb https://github.com/openshift/router image-amd64 e28644631982fb4596e065d3ae85099f0886829d https://github.com/openshift/kube-rbac-proxy image-amd64 11b1439d48a47a408ae7e2dd851989f7b7b4f595 -https://github.com/openshift/ovn-kubernetes image-amd64 c66883c01e06722319fdf18e9997231b6abda3aa -https://github.com/openshift/kubernetes image-amd64 0c79814882f4a4b842fbeab001c9f92f9de9a9b9 +https://github.com/openshift/ovn-kubernetes image-amd64 e3bef98aa599a90a7f24ab077e7b979d688eb537 +https://github.com/openshift/kubernetes image-amd64 19816eefa6829861687df6dfe573708756c464cc https://github.com/openshift/service-ca-operator image-amd64 1b89fdce3fcccecdc5fdb705fe674cd4bfc58a2a https://github.com/openshift/oc image-arm64 92b1a3d0e5d092430b523f6541aa0c504b2222b3 https://github.com/openshift/coredns image-arm64 5560e4ad8c343c211f0b2f9d85ce7331b20b87cb https://github.com/openshift/router image-arm64 e28644631982fb4596e065d3ae85099f0886829d https://github.com/openshift/kube-rbac-proxy image-arm64 11b1439d48a47a408ae7e2dd851989f7b7b4f595 -https://github.com/openshift/ovn-kubernetes image-arm64 c66883c01e06722319fdf18e9997231b6abda3aa -https://github.com/openshift/kubernetes image-arm64 85375332a108abce2f23a61958ae7adcc449477c +https://github.com/openshift/ovn-kubernetes image-arm64 e3bef98aa599a90a7f24ab077e7b979d688eb537 +https://github.com/openshift/kubernetes image-arm64 19816eefa6829861687df6dfe573708756c464cc https://github.com/openshift/service-ca-operator image-arm64 1b89fdce3fcccecdc5fdb705fe674cd4bfc58a2a From 3fdfc373c953609c269a4289575e3252acc39082 Mon Sep 17 00:00:00 2001 From: ci-robot Date: Mon, 17 Apr 2023 05:12:18 +0000 Subject: [PATCH 3/9] update microshift/go.mod --- go.mod | 80 +++++++++++++++++----------------- go.sum | 135 ++++++++++++++++++++++++++++++--------------------------- 2 files changed, 112 insertions(+), 103 deletions(-) diff --git a/go.mod b/go.mod index 6258895839..c86a833680 100644 --- a/go.mod +++ b/go.mod @@ -17,7 +17,7 @@ require ( github.com/spf13/cobra v1.6.0 github.com/spf13/pflag v1.0.5 github.com/stretchr/testify v1.8.0 - golang.org/x/sys v0.5.0 + golang.org/x/sys v0.6.0 gopkg.in/yaml.v2 v2.4.0 // indirect k8s.io/api v0.26.1 k8s.io/apiextensions-apiserver v0.26.1 @@ -140,10 +140,10 @@ require ( github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect github.com/opencontainers/go-digest v1.0.0 // indirect - github.com/opencontainers/runc v1.1.4 // indirect + github.com/opencontainers/runc v1.1.6 // indirect github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 // indirect github.com/opencontainers/selinux v1.10.0 // indirect - github.com/openshift/apiserver-library-go v0.0.0-20230120221150-cefee9e0162b // indirect + github.com/openshift/apiserver-library-go v0.0.0-20230411124846-9fe2aa032a6f // indirect github.com/peterbourgon/diskv v2.0.1+incompatible // indirect github.com/pkg/profile v1.3.0 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect @@ -185,14 +185,14 @@ require ( go.uber.org/multierr v1.6.0 // indirect go.uber.org/zap v1.19.0 // indirect golang.org/x/crypto v0.1.0 // indirect - golang.org/x/mod v0.6.0 // indirect - golang.org/x/net v0.7.0 // indirect + golang.org/x/mod v0.8.0 // indirect + golang.org/x/net v0.8.0 // indirect golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5 // indirect - golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 // indirect - golang.org/x/term v0.5.0 // indirect - golang.org/x/text v0.7.0 // indirect + golang.org/x/sync v0.1.0 // indirect + golang.org/x/term v0.6.0 // indirect + golang.org/x/text v0.8.0 // indirect golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect - golang.org/x/tools v0.2.0 // indirect + golang.org/x/tools v0.6.0 // indirect google.golang.org/api v0.60.0 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21 // indirect @@ -221,7 +221,7 @@ require ( k8s.io/mount-utils v0.0.0 // indirect k8s.io/pod-security-admission v0.25.0 // indirect k8s.io/utils v0.0.0-20221107191617-1a15be271d1d // indirect - sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.35 // indirect + sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.36 // indirect sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect sigs.k8s.io/kube-storage-version-migrator v0.0.4 // indirect sigs.k8s.io/kustomize/api v0.12.1 // indirect @@ -231,34 +231,34 @@ require ( replace ( github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.4.1-0.20221214150008-e73634cb3870 // from kubernetes - k8s.io/api => github.com/openshift/kubernetes/staging/src/k8s.io/api v0.0.0-20230412020409-0c79814882f4 // staging kubernetes - k8s.io/apiextensions-apiserver => github.com/openshift/kubernetes/staging/src/k8s.io/apiextensions-apiserver v0.0.0-20230412020409-0c79814882f4 // staging kubernetes - k8s.io/apimachinery => github.com/openshift/kubernetes/staging/src/k8s.io/apimachinery v0.0.0-20230412020409-0c79814882f4 // staging kubernetes - k8s.io/apiserver => github.com/openshift/kubernetes/staging/src/k8s.io/apiserver v0.0.0-20230412020409-0c79814882f4 // staging kubernetes - k8s.io/cli-runtime => github.com/openshift/kubernetes/staging/src/k8s.io/cli-runtime v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/client-go => github.com/openshift/kubernetes/staging/src/k8s.io/client-go v0.0.0-20230412020409-0c79814882f4 // staging kubernetes - k8s.io/cloud-provider => github.com/openshift/kubernetes/staging/src/k8s.io/cloud-provider v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/cluster-bootstrap => github.com/openshift/kubernetes/staging/src/k8s.io/cluster-bootstrap v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/code-generator => github.com/openshift/kubernetes/staging/src/k8s.io/code-generator v0.0.0-20230412020409-0c79814882f4 // staging kubernetes - k8s.io/component-base => github.com/openshift/kubernetes/staging/src/k8s.io/component-base v0.0.0-20230412020409-0c79814882f4 // staging kubernetes - k8s.io/component-helpers => github.com/openshift/kubernetes/staging/src/k8s.io/component-helpers v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/controller-manager => github.com/openshift/kubernetes/staging/src/k8s.io/controller-manager v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/cri-api => github.com/openshift/kubernetes/staging/src/k8s.io/cri-api v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/csi-translation-lib => github.com/openshift/kubernetes/staging/src/k8s.io/csi-translation-lib v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/dynamic-resource-allocation => github.com/openshift/kubernetes/staging/src/k8s.io/dynamic-resource-allocation v0.0.0-20230412020409-0c79814882f4 // staging kubernetes - k8s.io/kms => github.com/openshift/kubernetes/staging/src/k8s.io/kms v0.0.0-20230412020409-0c79814882f4 // staging kubernetes - k8s.io/kube-aggregator => github.com/openshift/kubernetes/staging/src/k8s.io/kube-aggregator v0.0.0-20230412020409-0c79814882f4 // staging kubernetes - k8s.io/kube-controller-manager => github.com/openshift/kubernetes/staging/src/k8s.io/kube-controller-manager v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/kube-proxy => github.com/openshift/kubernetes/staging/src/k8s.io/kube-proxy v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/kube-scheduler => github.com/openshift/kubernetes/staging/src/k8s.io/kube-scheduler v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/kubectl => github.com/openshift/kubernetes/staging/src/k8s.io/kubectl v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/kubelet => github.com/openshift/kubernetes/staging/src/k8s.io/kubelet v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/kubernetes => github.com/openshift/kubernetes v0.0.0-20230412020409-0c79814882f4 // release kubernetes - k8s.io/legacy-cloud-providers => github.com/openshift/kubernetes/staging/src/k8s.io/legacy-cloud-providers v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/metrics => github.com/openshift/kubernetes/staging/src/k8s.io/metrics v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/mount-utils => github.com/openshift/kubernetes/staging/src/k8s.io/mount-utils v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/pod-security-admission => github.com/openshift/kubernetes/staging/src/k8s.io/pod-security-admission v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/sample-apiserver => github.com/openshift/kubernetes/staging/src/k8s.io/sample-apiserver v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/sample-cli-plugin => github.com/openshift/kubernetes/staging/src/k8s.io/sample-cli-plugin v0.0.0-20230412020409-0c79814882f4 // from kubernetes - k8s.io/sample-controller => github.com/openshift/kubernetes/staging/src/k8s.io/sample-controller v0.0.0-20230412020409-0c79814882f4 // from kubernetes + k8s.io/api => github.com/openshift/kubernetes/staging/src/k8s.io/api v0.0.0-20230414060647-19816eefa682 // staging kubernetes + k8s.io/apiextensions-apiserver => github.com/openshift/kubernetes/staging/src/k8s.io/apiextensions-apiserver v0.0.0-20230414060647-19816eefa682 // staging kubernetes + k8s.io/apimachinery => github.com/openshift/kubernetes/staging/src/k8s.io/apimachinery v0.0.0-20230414060647-19816eefa682 // staging kubernetes + k8s.io/apiserver => github.com/openshift/kubernetes/staging/src/k8s.io/apiserver v0.0.0-20230414060647-19816eefa682 // staging kubernetes + k8s.io/cli-runtime => github.com/openshift/kubernetes/staging/src/k8s.io/cli-runtime v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/client-go => github.com/openshift/kubernetes/staging/src/k8s.io/client-go v0.0.0-20230414060647-19816eefa682 // staging kubernetes + k8s.io/cloud-provider => github.com/openshift/kubernetes/staging/src/k8s.io/cloud-provider v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/cluster-bootstrap => github.com/openshift/kubernetes/staging/src/k8s.io/cluster-bootstrap v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/code-generator => github.com/openshift/kubernetes/staging/src/k8s.io/code-generator v0.0.0-20230414060647-19816eefa682 // staging kubernetes + k8s.io/component-base => github.com/openshift/kubernetes/staging/src/k8s.io/component-base v0.0.0-20230414060647-19816eefa682 // staging kubernetes + k8s.io/component-helpers => github.com/openshift/kubernetes/staging/src/k8s.io/component-helpers v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/controller-manager => github.com/openshift/kubernetes/staging/src/k8s.io/controller-manager v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/cri-api => github.com/openshift/kubernetes/staging/src/k8s.io/cri-api v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/csi-translation-lib => github.com/openshift/kubernetes/staging/src/k8s.io/csi-translation-lib v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/dynamic-resource-allocation => github.com/openshift/kubernetes/staging/src/k8s.io/dynamic-resource-allocation v0.0.0-20230414060647-19816eefa682 // staging kubernetes + k8s.io/kms => github.com/openshift/kubernetes/staging/src/k8s.io/kms v0.0.0-20230414060647-19816eefa682 // staging kubernetes + k8s.io/kube-aggregator => github.com/openshift/kubernetes/staging/src/k8s.io/kube-aggregator v0.0.0-20230414060647-19816eefa682 // staging kubernetes + k8s.io/kube-controller-manager => github.com/openshift/kubernetes/staging/src/k8s.io/kube-controller-manager v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/kube-proxy => github.com/openshift/kubernetes/staging/src/k8s.io/kube-proxy v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/kube-scheduler => github.com/openshift/kubernetes/staging/src/k8s.io/kube-scheduler v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/kubectl => github.com/openshift/kubernetes/staging/src/k8s.io/kubectl v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/kubelet => github.com/openshift/kubernetes/staging/src/k8s.io/kubelet v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/kubernetes => github.com/openshift/kubernetes v0.0.0-20230414060647-19816eefa682 // release kubernetes + k8s.io/legacy-cloud-providers => github.com/openshift/kubernetes/staging/src/k8s.io/legacy-cloud-providers v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/metrics => github.com/openshift/kubernetes/staging/src/k8s.io/metrics v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/mount-utils => github.com/openshift/kubernetes/staging/src/k8s.io/mount-utils v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/pod-security-admission => github.com/openshift/kubernetes/staging/src/k8s.io/pod-security-admission v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/sample-apiserver => github.com/openshift/kubernetes/staging/src/k8s.io/sample-apiserver v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/sample-cli-plugin => github.com/openshift/kubernetes/staging/src/k8s.io/sample-cli-plugin v0.0.0-20230414060647-19816eefa682 // from kubernetes + k8s.io/sample-controller => github.com/openshift/kubernetes/staging/src/k8s.io/sample-controller v0.0.0-20230414060647-19816eefa682 // from kubernetes ) diff --git a/go.sum b/go.sum index fc9ca6379f..1c00a8f9a6 100644 --- a/go.sum +++ b/go.sum @@ -589,8 +589,9 @@ github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3I github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0= github.com/opencontainers/image-spec v1.0.2 h1:9yCKha/T5XdGtO0q9Q9a6T5NUCsTn/DrBg0D7ufOcFM= github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0= -github.com/opencontainers/runc v1.1.4 h1:nRCz/8sKg6K6jgYAFLDlXzPeITBZJyX28DBVhWD+5dg= github.com/opencontainers/runc v1.1.4/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg= +github.com/opencontainers/runc v1.1.6 h1:XbhB8IfG/EsnhNvZtNdLB0GBw92GYEFvKlhaJk9jUgA= +github.com/opencontainers/runc v1.1.6/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50= github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0= github.com/opencontainers/runtime-spec v1.0.3-0.20200929063507-e6143ca7d51d/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0= github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 h1:3snG66yBm59tKhhSPQrQ/0bCrv1LQbKt40LnUPiUxdc= @@ -600,65 +601,65 @@ github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuh github.com/openshift/api v0.0.0-20230120195050-6ba31fa438f2/go.mod h1:ctXNyWanKEjGj8sss1KjjHQ3ENKFm33FFnS5BKaIPh4= github.com/openshift/api v0.0.0-20230208193339-068b2ae5534f h1:+GaTEfR8gYzh64fdlRKLYZLwt5p4wQd2mdnvkhFDa8k= github.com/openshift/api v0.0.0-20230208193339-068b2ae5534f/go.mod h1:ctXNyWanKEjGj8sss1KjjHQ3ENKFm33FFnS5BKaIPh4= -github.com/openshift/apiserver-library-go v0.0.0-20230120221150-cefee9e0162b h1:1AeKPWFTSSSqSl0VYmwnaOuxw2kExQgJ6pjuC4XV33A= -github.com/openshift/apiserver-library-go v0.0.0-20230120221150-cefee9e0162b/go.mod h1:FmOGJTf5L1X9LiqnsNDwKJyt5ycUNxnNqpxs0rgylTc= +github.com/openshift/apiserver-library-go v0.0.0-20230411124846-9fe2aa032a6f h1:rcaCMJa6vCtX/4orBfonBz2Z2zjdlJzDOzxwhlcq10U= +github.com/openshift/apiserver-library-go v0.0.0-20230411124846-9fe2aa032a6f/go.mod h1:pI5W5+O/b0A7qOAXuLLCQqQjoCcQoEPsoBNoFfScvUQ= github.com/openshift/build-machinery-go v0.0.0-20220913142420-e25cf57ea46d h1:RR4ah7FfaPR1WePizm0jlrsbmPu91xQZnAsVVreQV1k= github.com/openshift/build-machinery-go v0.0.0-20220913142420-e25cf57ea46d/go.mod h1:b1BuldmJlbA/xYtdZvKi+7j5YGB44qJUJDZ9zwiNCfE= github.com/openshift/client-go v0.0.0-20230120202327-72f107311084 h1:66uaqNwA+qYyQDwsMWUfjjau8ezmg1dzCqub13KZOcE= github.com/openshift/client-go v0.0.0-20230120202327-72f107311084/go.mod h1:M3h9m001PWac3eAudGG3isUud6yBjr5XpzLYLLTlHKo= github.com/openshift/cluster-policy-controller v0.0.0-20230324020700-d02c85ab3203 h1:rafkiE1rN2dQC0rq7q44mI4/69aEkcxmdpxVlwvTOPY= github.com/openshift/cluster-policy-controller v0.0.0-20230324020700-d02c85ab3203/go.mod h1:vlkRuwyRueLOQ/ZRRle+rCrh+YNoh+pzJm9WaN9e6mU= -github.com/openshift/kubernetes v0.0.0-20230412020409-0c79814882f4 h1:DxU8TWjU8Oena8Ghid/K+cmQLNJSJRhuUFdlHqrEYM0= -github.com/openshift/kubernetes v0.0.0-20230412020409-0c79814882f4/go.mod h1:FFmjFkZxW22qBBjGCdvUj9MzYgHeh1t+7fG3n7162tM= -github.com/openshift/kubernetes/staging/src/k8s.io/api v0.0.0-20230412020409-0c79814882f4 h1:dzCea/DHA2x6R9j+wTb7BY3LnqhorBSvVdmB/wF0b5o= -github.com/openshift/kubernetes/staging/src/k8s.io/api v0.0.0-20230412020409-0c79814882f4/go.mod h1:RTbOBHv2jYAglrayTACr8ehH2HG1tEW8PXS62qjcXsM= -github.com/openshift/kubernetes/staging/src/k8s.io/apiextensions-apiserver v0.0.0-20230412020409-0c79814882f4 h1:agPz3HCip5q6vbfHqIrZHBO2cq27NR6xPzlIWtiNV14= -github.com/openshift/kubernetes/staging/src/k8s.io/apiextensions-apiserver v0.0.0-20230412020409-0c79814882f4/go.mod h1:U0Mmzj5eyc8IBdGjsF2XR3dBQG0yqvhy468GKZvdfXU= -github.com/openshift/kubernetes/staging/src/k8s.io/apimachinery v0.0.0-20230412020409-0c79814882f4 h1:t45aNQ0O98VzJ9nA8mhvcXDl30FcmZpR/yfLudfnwPQ= -github.com/openshift/kubernetes/staging/src/k8s.io/apimachinery v0.0.0-20230412020409-0c79814882f4/go.mod h1:IgGsaYCHg2HXxQq/DkcLV7Qqb5wXHuiOghXAWNRvTIo= -github.com/openshift/kubernetes/staging/src/k8s.io/apiserver v0.0.0-20230412020409-0c79814882f4 h1:pXWg407R5iaAYV2w/ElE7MtOmxcZ62WpCq6f4S2/Cvk= -github.com/openshift/kubernetes/staging/src/k8s.io/apiserver v0.0.0-20230412020409-0c79814882f4/go.mod h1:xwqK7Ox7oH/b11ZMPYtqPV/OYt2ZlYZf7XsuukECSc4= -github.com/openshift/kubernetes/staging/src/k8s.io/cli-runtime v0.0.0-20230412020409-0c79814882f4 h1:paEpt3um9AlkuelIGXcweXP4MNcbSZqUZXmKK/ys77M= -github.com/openshift/kubernetes/staging/src/k8s.io/cli-runtime v0.0.0-20230412020409-0c79814882f4/go.mod h1:9VL9PumwGZm4ySijjOkqi2A8Q8o/jH6NPv36Hcyff2c= -github.com/openshift/kubernetes/staging/src/k8s.io/client-go v0.0.0-20230412020409-0c79814882f4 h1:EpfLJVTood6aq/ElFbWN+sWqx1aJYhvv0XRRZZHZVC0= -github.com/openshift/kubernetes/staging/src/k8s.io/client-go v0.0.0-20230412020409-0c79814882f4/go.mod h1:j2CuU4yppRfeP82jtQ9Og0EPAoA03neRboLDK7m4tQc= -github.com/openshift/kubernetes/staging/src/k8s.io/cloud-provider v0.0.0-20230412020409-0c79814882f4 h1:mtZeh53RDdQpMkIOn6Z0f3WOiWCcmw/Ua93PbDgW7Bk= -github.com/openshift/kubernetes/staging/src/k8s.io/cloud-provider v0.0.0-20230412020409-0c79814882f4/go.mod h1:C8LxhCSrMIvk2892MFXHd6Ygyy/cCVK30VOZZVm4KSM= -github.com/openshift/kubernetes/staging/src/k8s.io/cluster-bootstrap v0.0.0-20230412020409-0c79814882f4 h1:CJG+OQlmVbldHGEblR3d2HVcgm8KSQzlFaVzj8P8WxI= -github.com/openshift/kubernetes/staging/src/k8s.io/cluster-bootstrap v0.0.0-20230412020409-0c79814882f4/go.mod h1:sf8VADmgVR2MzucAzvUaYsYLUi8S4onGjDNXWp6+iOw= -github.com/openshift/kubernetes/staging/src/k8s.io/code-generator v0.0.0-20230412020409-0c79814882f4/go.mod h1:HDEVJ4fMSa8PKXQ5cJgG2PEEYCM9NDxpj7EojkpHatA= -github.com/openshift/kubernetes/staging/src/k8s.io/component-base v0.0.0-20230412020409-0c79814882f4 h1:oBP6cLuqYBCVpXsOIOhk++szFMFJ6Nwn+4Lgat1jkkQ= -github.com/openshift/kubernetes/staging/src/k8s.io/component-base v0.0.0-20230412020409-0c79814882f4/go.mod h1:Qixtkhh98MU5XSgj3qwsRRdXX650+J9CmYavg7UHfGc= -github.com/openshift/kubernetes/staging/src/k8s.io/component-helpers v0.0.0-20230412020409-0c79814882f4 h1:0aFCy3DFIJp9q7MjIdF+d7c9gRRldbzoADzeXJHD6Ps= -github.com/openshift/kubernetes/staging/src/k8s.io/component-helpers v0.0.0-20230412020409-0c79814882f4/go.mod h1:v9q5XN/HFJwSIQ9HiyzSh9Pgpkf0sdmLX2s4wWmub1c= -github.com/openshift/kubernetes/staging/src/k8s.io/controller-manager v0.0.0-20230412020409-0c79814882f4 h1:gtLRfQXW02jMSNd3b+OYihuYGnf3kdpM1XcxVho24yI= -github.com/openshift/kubernetes/staging/src/k8s.io/controller-manager v0.0.0-20230412020409-0c79814882f4/go.mod h1:45yXoVo9Jbbpsz92uqBbG2oVBkVEWv+4ROfek4yo0NE= -github.com/openshift/kubernetes/staging/src/k8s.io/cri-api v0.0.0-20230412020409-0c79814882f4 h1:UH2CrxJMeQfqUXKAdBS4wMrTkRr5IlMLtC4K6QLUVa0= -github.com/openshift/kubernetes/staging/src/k8s.io/cri-api v0.0.0-20230412020409-0c79814882f4/go.mod h1:X6BH8wZUzqCnAYka7oy7QYoBUcN3xSXV6rZIxdXoArE= -github.com/openshift/kubernetes/staging/src/k8s.io/csi-translation-lib v0.0.0-20230412020409-0c79814882f4 h1:hVdwgqxDk4bluPK25EPn8Pac41kd+Z5dEYx2rDlmlfA= -github.com/openshift/kubernetes/staging/src/k8s.io/csi-translation-lib v0.0.0-20230412020409-0c79814882f4/go.mod h1:aNNfBLYfQbTrwqWHK9JMaodwbDNG1lELDChC0mhKLJQ= -github.com/openshift/kubernetes/staging/src/k8s.io/dynamic-resource-allocation v0.0.0-20230412020409-0c79814882f4 h1:TFwYCrthXTV89eiKNewDLRHIxqzUVsOTDI6CRenseVs= -github.com/openshift/kubernetes/staging/src/k8s.io/dynamic-resource-allocation v0.0.0-20230412020409-0c79814882f4/go.mod h1:MovKp06tUSXe3MnKchEr1D8CdDZgIhYiw6D6sBjZy94= -github.com/openshift/kubernetes/staging/src/k8s.io/kms v0.0.0-20230412020409-0c79814882f4 h1:6x02hFqXOhHkpGrkQMnZxbze/W5ezpFJY24p+QBOSGc= -github.com/openshift/kubernetes/staging/src/k8s.io/kms v0.0.0-20230412020409-0c79814882f4/go.mod h1:RBaXXXu0TgOgwWU+GKrNbBjVj6I6mZ3Kuwxphmx83hM= -github.com/openshift/kubernetes/staging/src/k8s.io/kube-aggregator v0.0.0-20230412020409-0c79814882f4 h1:YE1eqfA+F0slkcQz/JUq/wLe6GOOWeyKYDXYjwTBMuw= -github.com/openshift/kubernetes/staging/src/k8s.io/kube-aggregator v0.0.0-20230412020409-0c79814882f4/go.mod h1:tZLl7PAQI9WT9QcUVeua4aK0EIZE1DZhQorO9WLoRGs= -github.com/openshift/kubernetes/staging/src/k8s.io/kube-controller-manager v0.0.0-20230412020409-0c79814882f4 h1:DhG+hjnNz9dWd99ZDYgTvGfa664Z1BeNdsitcr1S/E0= -github.com/openshift/kubernetes/staging/src/k8s.io/kube-controller-manager v0.0.0-20230412020409-0c79814882f4/go.mod h1:FmdoDrAFpzYtGWgaPrurpkB+ITnnOV/V/+uoFPovBKA= -github.com/openshift/kubernetes/staging/src/k8s.io/kube-scheduler v0.0.0-20230412020409-0c79814882f4 h1:at3OR4PQWIMjPX4Rj/gF0axWOCxJUaC/0nb0v5+aICg= -github.com/openshift/kubernetes/staging/src/k8s.io/kube-scheduler v0.0.0-20230412020409-0c79814882f4/go.mod h1:Zgt5E29gT4nxpbFBvx43u3fRNTfMAvqZxchXnjw+gOo= -github.com/openshift/kubernetes/staging/src/k8s.io/kubectl v0.0.0-20230412020409-0c79814882f4 h1:gwn29Sp0NX3xKTFS7RrOBNM/pKAQqKUOduPQSrFB85o= -github.com/openshift/kubernetes/staging/src/k8s.io/kubectl v0.0.0-20230412020409-0c79814882f4/go.mod h1:PHFHN0OYvl1mOobtWnD5t83uJuHy4pDEeshl0a/t5Do= -github.com/openshift/kubernetes/staging/src/k8s.io/kubelet v0.0.0-20230412020409-0c79814882f4 h1:6okyPOQlNzes/eX6zLDfxuZ8vq9TCClcMK/z2CspUNc= -github.com/openshift/kubernetes/staging/src/k8s.io/kubelet v0.0.0-20230412020409-0c79814882f4/go.mod h1:A6pOnDSKM3jdR7v/EOkKKuHWsR3GGm4T3Vr9jS1U6QA= -github.com/openshift/kubernetes/staging/src/k8s.io/legacy-cloud-providers v0.0.0-20230412020409-0c79814882f4 h1:XDfbRtXJkcJ+0DYpGDY5z+THMad2F645g4axdksFVyE= -github.com/openshift/kubernetes/staging/src/k8s.io/legacy-cloud-providers v0.0.0-20230412020409-0c79814882f4/go.mod h1:K4ChxIQRGSv8E4Cz3XSuZ38G5UwpTb/4p32vGMDpa1k= -github.com/openshift/kubernetes/staging/src/k8s.io/metrics v0.0.0-20230412020409-0c79814882f4 h1:0siZkDLsSH1EwQozlv4jSvXjv4J/YxShm5t+8D0R79U= -github.com/openshift/kubernetes/staging/src/k8s.io/metrics v0.0.0-20230412020409-0c79814882f4/go.mod h1:5qMnaoxtG8tgh9JRt99mH4aEw1Us6LFFigCQExPUeXQ= -github.com/openshift/kubernetes/staging/src/k8s.io/mount-utils v0.0.0-20230412020409-0c79814882f4 h1:shy31jV3C6duCqPIbpBoayfvub0MD+ewWMsk4SNHlmo= -github.com/openshift/kubernetes/staging/src/k8s.io/mount-utils v0.0.0-20230412020409-0c79814882f4/go.mod h1:1PgQc8yQxp+tnTD2lzlyNGTngwImNyANUq74eRnHT5U= -github.com/openshift/kubernetes/staging/src/k8s.io/pod-security-admission v0.0.0-20230412020409-0c79814882f4 h1:g3n+u+PZ/FEOf0lvfFcgDV+rMQdYsUa1uW8tLrr4yII= -github.com/openshift/kubernetes/staging/src/k8s.io/pod-security-admission v0.0.0-20230412020409-0c79814882f4/go.mod h1:KtKLalpm2l5WOPMqKs6VETKre5j3sPUz0D16MXQd1QI= +github.com/openshift/kubernetes v0.0.0-20230414060647-19816eefa682 h1:aAZOgCVCBWMRRwi5W/NazlOCaCLlaMI704LTMwo/HUg= +github.com/openshift/kubernetes v0.0.0-20230414060647-19816eefa682/go.mod h1:T0+m4H3K5iWzDP65vb1st8Pd3siJoeSpbC0EzmymTVk= +github.com/openshift/kubernetes/staging/src/k8s.io/api v0.0.0-20230414060647-19816eefa682 h1:f+5Fcc/WQpus26/zjyl/XCYr4NSNpAtYuf6bV2UJf14= +github.com/openshift/kubernetes/staging/src/k8s.io/api v0.0.0-20230414060647-19816eefa682/go.mod h1:uLYjAyw1JyCS9EUj6oUhl4eRy4XthcFpSodl6cOokQI= +github.com/openshift/kubernetes/staging/src/k8s.io/apiextensions-apiserver v0.0.0-20230414060647-19816eefa682 h1:oh00NNthfcbhoHHG9RMaQ+Q9gaB+OjU6LsjIOgTZ6dA= +github.com/openshift/kubernetes/staging/src/k8s.io/apiextensions-apiserver v0.0.0-20230414060647-19816eefa682/go.mod h1:yViNAI+IfEaoAVoSOgZXDmN4bMipiqwvrXekieIkdbY= +github.com/openshift/kubernetes/staging/src/k8s.io/apimachinery v0.0.0-20230414060647-19816eefa682 h1:w4uwFjypPaaff3++nri9Z6P+OdBnUf9lF8czEeiOCYM= +github.com/openshift/kubernetes/staging/src/k8s.io/apimachinery v0.0.0-20230414060647-19816eefa682/go.mod h1:ApuQzVQOyTrgHIGrmVljD8zZ+ZoHmXYbsFwLvSelf84= +github.com/openshift/kubernetes/staging/src/k8s.io/apiserver v0.0.0-20230414060647-19816eefa682 h1:Ac/LHZaMAqUr9rE4Q1oLG6iuLwwi6L3GAuTPdsqO15Y= +github.com/openshift/kubernetes/staging/src/k8s.io/apiserver v0.0.0-20230414060647-19816eefa682/go.mod h1:VFDYdzpH+ZfUFicJweH6XtgDJJ+bBhIMgS/NgM6c9+c= +github.com/openshift/kubernetes/staging/src/k8s.io/cli-runtime v0.0.0-20230414060647-19816eefa682 h1:LfPzMcGu+ns6q2+JD8KX2o3lxeUq8smiNSXwjLn98Do= +github.com/openshift/kubernetes/staging/src/k8s.io/cli-runtime v0.0.0-20230414060647-19816eefa682/go.mod h1:LumLfFU84tK2qax1WpUviAosYlqlUaSJTIEtYjYpfxw= +github.com/openshift/kubernetes/staging/src/k8s.io/client-go v0.0.0-20230414060647-19816eefa682 h1:4m/eWo2ebGxBMmYB9y6YoI4EWIKGDG8SRSciVCX1ilA= +github.com/openshift/kubernetes/staging/src/k8s.io/client-go v0.0.0-20230414060647-19816eefa682/go.mod h1:0QH/+sNaHFjTGTSyuwBXuHHhyBRa2r6ndYXUxchMPKI= +github.com/openshift/kubernetes/staging/src/k8s.io/cloud-provider v0.0.0-20230414060647-19816eefa682 h1:QVD1gei4qjU1ZzqLrrk9UUM4oL5xNU5WHQrOh+plP2o= +github.com/openshift/kubernetes/staging/src/k8s.io/cloud-provider v0.0.0-20230414060647-19816eefa682/go.mod h1:UDt2Nn2cJxGQWGuPZXA8zhtTccXCsbzIMD2QMvjAl/s= +github.com/openshift/kubernetes/staging/src/k8s.io/cluster-bootstrap v0.0.0-20230414060647-19816eefa682 h1:Le/7MKrlHyL0GzydqE9O2YuBPTEwnMG5cUJHPOqQSKE= +github.com/openshift/kubernetes/staging/src/k8s.io/cluster-bootstrap v0.0.0-20230414060647-19816eefa682/go.mod h1:CHVYBTORnxNcEy4sP3o5mXQCtQ+xakaDn7H4irLH4hE= +github.com/openshift/kubernetes/staging/src/k8s.io/code-generator v0.0.0-20230414060647-19816eefa682/go.mod h1:RPAt1JMA66rIEi+T0Dm3inLGbyc8PsaIoRuh006OoKQ= +github.com/openshift/kubernetes/staging/src/k8s.io/component-base v0.0.0-20230414060647-19816eefa682 h1:qyJleza3TMgCwXZ+b88cdGZMUz7G29GPpFNs0mGyscc= +github.com/openshift/kubernetes/staging/src/k8s.io/component-base v0.0.0-20230414060647-19816eefa682/go.mod h1:4bzeXuIaKw5yabxEcNwxVYHKi0wLgcjl5naBxe4N1cw= +github.com/openshift/kubernetes/staging/src/k8s.io/component-helpers v0.0.0-20230414060647-19816eefa682 h1:nvGIHfDumItIc0eHmw1XkyaHYqODBrw4LFt6qX2UAE0= +github.com/openshift/kubernetes/staging/src/k8s.io/component-helpers v0.0.0-20230414060647-19816eefa682/go.mod h1:1kjV28ccOe1eJI0U3RSRTXDv8PSWILLyDrRHnlN0b5Q= +github.com/openshift/kubernetes/staging/src/k8s.io/controller-manager v0.0.0-20230414060647-19816eefa682 h1:ieDpK+9kwFiYrZLf8szWJs034wF7DPyZ6imE9lvPwmU= +github.com/openshift/kubernetes/staging/src/k8s.io/controller-manager v0.0.0-20230414060647-19816eefa682/go.mod h1:MzAfXD5g03ADE/cQOanac914VXKVm+PE21CdbMnqHh8= +github.com/openshift/kubernetes/staging/src/k8s.io/cri-api v0.0.0-20230414060647-19816eefa682 h1:LHuIB1W4NAG9ZnrRQdfctquaE4GLKgCSQjny5JZYr+4= +github.com/openshift/kubernetes/staging/src/k8s.io/cri-api v0.0.0-20230414060647-19816eefa682/go.mod h1:sjqtRwsq9OIu27wzHZyTUxhszi4BTrLOZUP3XxMT3ac= +github.com/openshift/kubernetes/staging/src/k8s.io/csi-translation-lib v0.0.0-20230414060647-19816eefa682 h1:IJ5E8PY+2bWAGqpmqDtkU2W4t6XmLC76x921nr1JVmY= +github.com/openshift/kubernetes/staging/src/k8s.io/csi-translation-lib v0.0.0-20230414060647-19816eefa682/go.mod h1:3iftQXweshE6LzQ4a0nccCFroiXuvkd0Tv0yVhVZo3g= +github.com/openshift/kubernetes/staging/src/k8s.io/dynamic-resource-allocation v0.0.0-20230414060647-19816eefa682 h1:SImSqAAOj9J8LfLmHFnMRAHSedb14k0fejLGldaAi1k= +github.com/openshift/kubernetes/staging/src/k8s.io/dynamic-resource-allocation v0.0.0-20230414060647-19816eefa682/go.mod h1:i5+I2dCeC47HR6g0aFW6nr1wNfWRlyFmiSDs2NqFs3I= +github.com/openshift/kubernetes/staging/src/k8s.io/kms v0.0.0-20230414060647-19816eefa682 h1:3rSkUFhklB10N5Xp3Dm3Wn6g+xyRNXdoRQaGdzGEMvs= +github.com/openshift/kubernetes/staging/src/k8s.io/kms v0.0.0-20230414060647-19816eefa682/go.mod h1:uzei6+XRNkQICBV+e8BACOZwRpfWPvpZ6bVCWYsuxfQ= +github.com/openshift/kubernetes/staging/src/k8s.io/kube-aggregator v0.0.0-20230414060647-19816eefa682 h1:WJVg9acdlTWqKOiC7JbJa2Ev0kFki5tL4mcdxTAkUMQ= +github.com/openshift/kubernetes/staging/src/k8s.io/kube-aggregator v0.0.0-20230414060647-19816eefa682/go.mod h1:HLz7lzU2qNPgSwDA8ZH4T6Ll6kWU6Y6BpIzPWYfLBkc= +github.com/openshift/kubernetes/staging/src/k8s.io/kube-controller-manager v0.0.0-20230414060647-19816eefa682 h1:YJruCzvKX+sqPHNK87ZdNJ3bld9cDh86nMuI1V50yKM= +github.com/openshift/kubernetes/staging/src/k8s.io/kube-controller-manager v0.0.0-20230414060647-19816eefa682/go.mod h1:W/OyRa4Ahdv09yt5iHcxSrTCn2yg33rlMqo9yW1GFm0= +github.com/openshift/kubernetes/staging/src/k8s.io/kube-scheduler v0.0.0-20230414060647-19816eefa682 h1:cGUyvu78+r830+joBbEILP5vkmM0udzZWvwEFYKSc30= +github.com/openshift/kubernetes/staging/src/k8s.io/kube-scheduler v0.0.0-20230414060647-19816eefa682/go.mod h1:gAOk6X5CwD031FqXVf7CD4yQdou7UUUmP0FmRqCGPUI= +github.com/openshift/kubernetes/staging/src/k8s.io/kubectl v0.0.0-20230414060647-19816eefa682 h1:1tYc5o7kN6Vx2Jr/HQLt8AQImp8TT2hBZWRIT0ZRfL8= +github.com/openshift/kubernetes/staging/src/k8s.io/kubectl v0.0.0-20230414060647-19816eefa682/go.mod h1:plN+kBQozEYwSUD3aB9oFwrpkVeIN5xVpQ6sLRbSiNs= +github.com/openshift/kubernetes/staging/src/k8s.io/kubelet v0.0.0-20230414060647-19816eefa682 h1:F6Iq7mYVCz+EkVxwtb56Rg6EWbQ/JTSVo0zbrwZ+RTE= +github.com/openshift/kubernetes/staging/src/k8s.io/kubelet v0.0.0-20230414060647-19816eefa682/go.mod h1:au5YzS8yhxLz767EWIVfabqOrCtMfjppQRDQ+BPnNCE= +github.com/openshift/kubernetes/staging/src/k8s.io/legacy-cloud-providers v0.0.0-20230414060647-19816eefa682 h1:4I/f6SZBayfieqXt7Zk0cWkbfXDGBdLTXFpDCXeAuX0= +github.com/openshift/kubernetes/staging/src/k8s.io/legacy-cloud-providers v0.0.0-20230414060647-19816eefa682/go.mod h1:j7EjbuGsi5n1jhuQ1s2xbgsV4H5MOY6iTjtp+CaBsh0= +github.com/openshift/kubernetes/staging/src/k8s.io/metrics v0.0.0-20230414060647-19816eefa682 h1:UCHUJBT8ieT0lja74AgVhU54Td2iFFLurUKKwv+ibig= +github.com/openshift/kubernetes/staging/src/k8s.io/metrics v0.0.0-20230414060647-19816eefa682/go.mod h1:0XHkNqJcpcb3wT61pTKmEWoX8uuV9Q5N2Z48NrDYdww= +github.com/openshift/kubernetes/staging/src/k8s.io/mount-utils v0.0.0-20230414060647-19816eefa682 h1:BT1oPp1IvgYzpmksSeyoSvl61E4NbAQKyFt7wKEO+nY= +github.com/openshift/kubernetes/staging/src/k8s.io/mount-utils v0.0.0-20230414060647-19816eefa682/go.mod h1:Xv4esSdxyeauCQqd77P5rMAjH8eAhtUfZjgykqPkXIg= +github.com/openshift/kubernetes/staging/src/k8s.io/pod-security-admission v0.0.0-20230414060647-19816eefa682 h1:/LcItEq3+hoyU2Cw181TFbGTSegdYWIC3AFlFwGTre4= +github.com/openshift/kubernetes/staging/src/k8s.io/pod-security-admission v0.0.0-20230414060647-19816eefa682/go.mod h1:t18RIruuLO3r+O64ycCBgy26pv4C82be62Gkaneigqo= github.com/openshift/library-go v0.0.0-20230222090221-582055a1d5c4 h1:B9e1Sga7Q6iSI1YgzLgfABo+LDET7HZngJ+tKlrwVSk= github.com/openshift/library-go v0.0.0-20230222090221-582055a1d5c4/go.mod h1:xO4nAf0qa56dgvEJWVD1WuwSJ8JWPU1TYLBQrlutWnE= github.com/openshift/onsi-ginkgo/v2 v2.4.1-0.20221214150008-e73634cb3870 h1:YH3Z3ZWCDWjkAGdZpK5rCm5pRZ4wt0uEx1GwvCiO3+I= @@ -935,8 +936,9 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= -golang.org/x/mod v0.6.0 h1:b9gGHsz9/HhJ3HF5DHQytPpuwocVTChQJK3AvoLRD5I= golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI= +golang.org/x/mod v0.8.0 h1:LUYupSeNrTNCGzR/hVBk2NHZO4hXcVaW1k4Qx7rjPx8= +golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -992,8 +994,9 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco= golang.org/x/net v0.3.1-0.20221206200815-1e63c2f08a10/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE= golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws= -golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g= -golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ= +golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -1026,8 +1029,9 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 h1:uVc8UZUe6tr40fFVnUP5Oj+veunVezqYl9z7DYw9xzw= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o= +golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -1115,15 +1119,17 @@ golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ= +golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA= golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ= -golang.org/x/term v0.5.0 h1:n2a8QNdAb0sZNpU9R1ALUXBbY+w51fCQDN+7EdxNBsY= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= +golang.org/x/term v0.6.0 h1:clScbb1cHjoCkyRbWwBEUZ5H/tIFu5TAXIqaZD0Gcjw= +golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -1136,8 +1142,9 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= -golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68= +golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= @@ -1208,8 +1215,9 @@ golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= -golang.org/x/tools v0.2.0 h1:G6AHpWxTMGY1KyEYoAQ5WTtIekUUvDNjan3ugu60JvE= golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA= +golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM= +golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= @@ -1430,8 +1438,9 @@ k8s.io/utils v0.0.0-20221107191617-1a15be271d1d/go.mod h1:OLgZIPagt7ERELqWJFomSt rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8= rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0= rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= -sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.35 h1:+xBL5uTc+BkPBwmMi3vYfUJjq+N3K+H6PXeETwf5cPI= sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.35/go.mod h1:WxjusMwXlKzfAs4p9km6XJRndVt2FROgMVCE4cdohFo= +sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.36 h1:PUuX1qIFv309AT8hF/CdPKDmsG/hn/L8zRX7VvISM3A= +sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.36/go.mod h1:WxjusMwXlKzfAs4p9km6XJRndVt2FROgMVCE4cdohFo= sigs.k8s.io/controller-tools v0.2.8/go.mod h1:9VKHPszmf2DHz/QmHkcfZoewO6BL7pPs9uAiBVsaJSE= sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k= sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= From ee5b59e708ee99aea13854ca8f5d750c3a63ebc8 Mon Sep 17 00:00:00 2001 From: ci-robot Date: Mon, 17 Apr 2023 05:12:30 +0000 Subject: [PATCH 4/9] update microshift/vendor --- .../libcontainer/cgroups/ebpf/ebpf_linux.go | 2 +- .../runc/libcontainer/cgroups/fs/fs.go | 1 + .../libcontainer/cgroups/systemd/common.go | 66 ++- .../libcontainer/cgroups/systemd/cpuset.go | 5 + .../runc/libcontainer/cgroups/systemd/v1.go | 12 +- .../runc/libcontainer/cgroups/systemd/v2.go | 2 +- .../runc/libcontainer/cgroups/utils.go | 6 +- .../configs/validate/validator.go | 5 +- .../runc/libcontainer/container_linux.go | 2 +- .../runc/libcontainer/eaccess_go119.go | 17 + .../runc/libcontainer/eaccess_stub.go | 10 + .../runc/libcontainer/factory_linux.go | 11 +- .../runc/libcontainer/init_linux.go | 5 +- .../runc/libcontainer/rootfs_linux.go | 82 +-- .../runc/libcontainer/standard_init_linux.go | 11 +- .../opencontainers/runc/libcontainer/sync.go | 14 +- .../runc/libcontainer/system/linux.go | 19 - .../runc/libcontainer/user/user.go | 14 +- .../sccmatching/patched_sc_accessors.go | 471 ++++++++++++++++++ .../sccmatching/provider.go | 46 +- vendor/golang.org/x/net/html/doc.go | 15 + vendor/golang.org/x/net/html/escape.go | 81 +++ vendor/golang.org/x/net/html/render.go | 2 +- vendor/golang.org/x/net/html/token.go | 10 +- .../x/sync/singleflight/singleflight.go | 11 +- vendor/golang.org/x/sys/cpu/hwcap_linux.go | 15 + vendor/golang.org/x/sys/cpu/runtime_auxv.go | 16 + .../x/sys/cpu/runtime_auxv_go121.go | 19 + vendor/golang.org/x/sys/execabs/execabs.go | 2 +- .../golang.org/x/sys/execabs/execabs_go118.go | 6 + .../golang.org/x/sys/execabs/execabs_go119.go | 4 + vendor/golang.org/x/sys/unix/ioctl.go | 17 +- vendor/golang.org/x/sys/unix/ioctl_zos.go | 8 +- vendor/golang.org/x/sys/unix/ptrace_darwin.go | 6 + vendor/golang.org/x/sys/unix/ptrace_ios.go | 6 + vendor/golang.org/x/sys/unix/syscall_aix.go | 5 +- vendor/golang.org/x/sys/unix/syscall_bsd.go | 3 +- .../golang.org/x/sys/unix/syscall_darwin.go | 12 +- .../x/sys/unix/syscall_darwin_amd64.go | 1 + .../x/sys/unix/syscall_darwin_arm64.go | 1 + .../x/sys/unix/syscall_dragonfly.go | 1 + .../golang.org/x/sys/unix/syscall_freebsd.go | 43 +- .../x/sys/unix/syscall_freebsd_386.go | 17 +- .../x/sys/unix/syscall_freebsd_amd64.go | 17 +- .../x/sys/unix/syscall_freebsd_arm.go | 15 +- .../x/sys/unix/syscall_freebsd_arm64.go | 15 +- .../x/sys/unix/syscall_freebsd_riscv64.go | 15 +- vendor/golang.org/x/sys/unix/syscall_hurd.go | 8 + vendor/golang.org/x/sys/unix/syscall_linux.go | 36 +- .../golang.org/x/sys/unix/syscall_netbsd.go | 5 +- .../golang.org/x/sys/unix/syscall_openbsd.go | 1 + .../golang.org/x/sys/unix/syscall_solaris.go | 21 +- .../x/sys/unix/syscall_zos_s390x.go | 4 +- vendor/golang.org/x/sys/unix/zerrors_linux.go | 10 +- .../x/sys/unix/zptrace_armnn_linux.go | 8 +- .../x/sys/unix/zptrace_linux_arm64.go | 4 +- .../x/sys/unix/zptrace_mipsnn_linux.go | 8 +- .../x/sys/unix/zptrace_mipsnnle_linux.go | 8 +- .../x/sys/unix/zptrace_x86_linux.go | 8 +- .../golang.org/x/sys/unix/zsyscall_aix_ppc.go | 10 + .../x/sys/unix/zsyscall_aix_ppc64.go | 10 + .../x/sys/unix/zsyscall_aix_ppc64_gc.go | 7 + .../x/sys/unix/zsyscall_aix_ppc64_gccgo.go | 8 + .../x/sys/unix/zsyscall_darwin_amd64.go | 16 + .../x/sys/unix/zsyscall_darwin_arm64.go | 16 + .../x/sys/unix/zsyscall_dragonfly_amd64.go | 10 + .../x/sys/unix/zsyscall_freebsd_386.go | 20 + .../x/sys/unix/zsyscall_freebsd_amd64.go | 20 + .../x/sys/unix/zsyscall_freebsd_arm.go | 20 + .../x/sys/unix/zsyscall_freebsd_arm64.go | 20 + .../x/sys/unix/zsyscall_freebsd_riscv64.go | 20 + .../golang.org/x/sys/unix/zsyscall_linux.go | 10 + .../x/sys/unix/zsyscall_netbsd_386.go | 10 + .../x/sys/unix/zsyscall_netbsd_amd64.go | 10 + .../x/sys/unix/zsyscall_netbsd_arm.go | 10 + .../x/sys/unix/zsyscall_netbsd_arm64.go | 10 + .../x/sys/unix/zsyscall_openbsd_386.go | 8 + .../x/sys/unix/zsyscall_openbsd_amd64.go | 8 + .../x/sys/unix/zsyscall_openbsd_arm.go | 8 + .../x/sys/unix/zsyscall_openbsd_arm64.go | 8 + .../x/sys/unix/zsyscall_openbsd_mips64.go | 8 + .../x/sys/unix/zsyscall_openbsd_ppc64.go | 8 + .../x/sys/unix/zsyscall_openbsd_riscv64.go | 8 + .../x/sys/unix/zsyscall_solaris_amd64.go | 11 + .../x/sys/unix/zsyscall_zos_s390x.go | 10 + .../x/sys/unix/ztypes_freebsd_386.go | 2 +- .../x/sys/unix/ztypes_freebsd_amd64.go | 2 +- .../x/sys/unix/ztypes_freebsd_arm.go | 2 +- .../x/sys/unix/ztypes_freebsd_arm64.go | 2 +- .../x/sys/unix/ztypes_freebsd_riscv64.go | 2 +- vendor/golang.org/x/sys/unix/ztypes_linux.go | 140 ++++-- .../golang.org/x/sys/unix/ztypes_linux_386.go | 2 +- .../x/sys/unix/ztypes_linux_amd64.go | 2 +- .../golang.org/x/sys/unix/ztypes_linux_arm.go | 2 +- .../x/sys/unix/ztypes_linux_arm64.go | 2 +- .../x/sys/unix/ztypes_linux_loong64.go | 2 +- .../x/sys/unix/ztypes_linux_mips.go | 2 +- .../x/sys/unix/ztypes_linux_mips64.go | 2 +- .../x/sys/unix/ztypes_linux_mips64le.go | 2 +- .../x/sys/unix/ztypes_linux_mipsle.go | 2 +- .../golang.org/x/sys/unix/ztypes_linux_ppc.go | 2 +- .../x/sys/unix/ztypes_linux_ppc64.go | 2 +- .../x/sys/unix/ztypes_linux_ppc64le.go | 2 +- .../x/sys/unix/ztypes_linux_riscv64.go | 2 +- .../x/sys/unix/ztypes_linux_s390x.go | 2 +- .../x/sys/unix/ztypes_linux_sparc64.go | 2 +- .../x/sys/windows/syscall_windows.go | 6 +- .../golang.org/x/sys/windows/types_windows.go | 85 ++++ .../x/sys/windows/zsyscall_windows.go | 27 + .../x/text/encoding/internal/internal.go | 2 +- .../x/text/unicode/norm/forminfo.go | 2 +- .../x/tools/internal/gocommand/version.go | 23 + .../x/tools/internal/imports/fix.go | 9 +- .../x/tools/internal/imports/sortimports.go | 1 + .../x/tools/internal/imports/zstdlib.go | 188 ++++++- vendor/k8s.io/api/core/v1/generated.proto | 2 +- vendor/k8s.io/api/core/v1/types.go | 2 +- .../core/v1/types_swagger_doc_generated.go | 2 +- .../discovery/aggregated_discovery.go | 44 +- .../discovery/cached/memory/memcache.go | 53 +- .../client-go/discovery/discovery_client.go | 118 +++-- .../pkg/apiserver/handler_discovery.go | 31 +- .../pkg/api/persistentvolumeclaim/util.go | 4 + vendor/k8s.io/kubernetes/pkg/api/pod/util.go | 10 + .../pkg/apis/apps/validation/validation.go | 20 +- .../k8s.io/kubernetes/pkg/apis/core/types.go | 2 +- .../util/endpointslice/endpointset.go | 8 +- .../volume/attachdetach/util/util.go | 17 - .../volume/persistentvolume/pv_controller.go | 2 +- .../generated/openapi/zz_generated.openapi.go | 2 +- .../pkg/kubelet/cm/cgroup_manager_linux.go | 15 + .../pkg/scheduler/framework/interface.go | 3 + .../framework/parallelize/parallelism.go | 5 +- .../framework/plugins/volumebinding/binder.go | 10 +- .../scheduler/framework/runtime/framework.go | 4 + .../internal/queue/scheduling_queue.go | 77 +-- .../kubernetes/pkg/scheduler/scheduler.go | 9 +- .../operationexecutor/operation_generator.go | 10 + .../podsecurity/patch_podspecextractor.go | 4 + vendor/modules.txt | 132 ++--- .../konnectivity-client/pkg/client/client.go | 64 ++- .../konnectivity-client/pkg/client/conn.go | 14 +- 142 files changed, 2178 insertions(+), 598 deletions(-) create mode 100644 vendor/github.com/opencontainers/runc/libcontainer/eaccess_go119.go create mode 100644 vendor/github.com/opencontainers/runc/libcontainer/eaccess_stub.go create mode 100644 vendor/github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/sccmatching/patched_sc_accessors.go create mode 100644 vendor/golang.org/x/sys/cpu/runtime_auxv.go create mode 100644 vendor/golang.org/x/sys/cpu/runtime_auxv_go121.go diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/ebpf/ebpf_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/ebpf/ebpf_linux.go index 104c74a890..35b00aaf05 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/ebpf/ebpf_linux.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/ebpf/ebpf_linux.go @@ -93,7 +93,7 @@ var ( ) // Loosely based on the BPF_F_REPLACE support check in -// . +// https://github.com/cilium/ebpf/blob/v0.6.0/link/syscalls.go. // // TODO: move this logic to cilium/ebpf func haveBpfProgReplace() bool { diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/fs.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/fs.go index fb4fcc7f75..9e2f0ec04c 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/fs.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/fs.go @@ -28,6 +28,7 @@ var subsystems = []subsystem{ &FreezerGroup{}, &RdmaGroup{}, &NameGroup{GroupName: "name=systemd", Join: true}, + &NameGroup{GroupName: "misc", Join: true}, } var errSubsystemDoesNotExist = errors.New("cgroup: subsystem does not exist") diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/common.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/common.go index 45744c15c0..50746ae0c5 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/common.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/common.go @@ -293,8 +293,18 @@ func generateDeviceProperties(r *configs.Resources) ([]systemdDbus.Property, err // rules separately to systemd) we can safely skip entries that don't // have a corresponding path. if _, err := os.Stat(entry.Path); err != nil { - logrus.Debugf("skipping device %s for systemd: %s", entry.Path, err) - continue + // Also check /sys/dev so that we don't depend on /dev/{block,char} + // being populated. (/dev/{block,char} is populated by udev, which + // isn't strictly required for systemd). Ironically, this happens most + // easily when starting containerd within a runc created container + // itself. + + // We don't bother with securejoin here because we create entry.Path + // right above here, so we know it's safe. + if _, err := os.Stat("/sys" + entry.Path); err != nil { + logrus.Warnf("skipping device %s for systemd: %s", entry.Path, err) + continue + } } } deviceAllowList = append(deviceAllowList, entry) @@ -343,32 +353,52 @@ func isUnitExists(err error) bool { return isDbusError(err, "org.freedesktop.systemd1.UnitExists") } -func startUnit(cm *dbusConnManager, unitName string, properties []systemdDbus.Property) error { +func startUnit(cm *dbusConnManager, unitName string, properties []systemdDbus.Property, ignoreExist bool) error { statusChan := make(chan string, 1) + retry := true + +retry: err := cm.retryOnDisconnect(func(c *systemdDbus.Conn) error { _, err := c.StartTransientUnitContext(context.TODO(), unitName, "replace", properties, statusChan) return err }) - if err == nil { - timeout := time.NewTimer(30 * time.Second) - defer timeout.Stop() - - select { - case s := <-statusChan: - close(statusChan) - // Please refer to https://pkg.go.dev/github.com/coreos/go-systemd/v22/dbus#Conn.StartUnit - if s != "done" { - resetFailedUnit(cm, unitName) - return fmt.Errorf("error creating systemd unit `%s`: got `%s`", unitName, s) - } - case <-timeout.C: + if err != nil { + if !isUnitExists(err) { + return err + } + if ignoreExist { + // TODO: remove this hack. + // This is kubelet making sure a slice exists (see + // https://github.com/opencontainers/runc/pull/1124). + return nil + } + if retry { + // In case a unit with the same name exists, this may + // be a leftover failed unit. Reset it, so systemd can + // remove it, and retry once. resetFailedUnit(cm, unitName) - return errors.New("Timeout waiting for systemd to create " + unitName) + retry = false + goto retry } - } else if !isUnitExists(err) { return err } + timeout := time.NewTimer(30 * time.Second) + defer timeout.Stop() + + select { + case s := <-statusChan: + close(statusChan) + // Please refer to https://pkg.go.dev/github.com/coreos/go-systemd/v22/dbus#Conn.StartUnit + if s != "done" { + resetFailedUnit(cm, unitName) + return fmt.Errorf("error creating systemd unit `%s`: got `%s`", unitName, s) + } + case <-timeout.C: + resetFailedUnit(cm, unitName) + return errors.New("Timeout waiting for systemd to create " + unitName) + } + return nil } diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/cpuset.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/cpuset.go index 83d10dd705..dd474cf1b1 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/cpuset.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/cpuset.go @@ -51,5 +51,10 @@ func RangeToBits(str string) ([]byte, error) { // do not allow empty values return nil, errors.New("empty value") } + + // fit cpuset parsing order in systemd + for l, r := 0, len(ret)-1; l < r; l, r = l+1, r-1 { + ret[l], ret[r] = ret[r], ret[l] + } return ret, nil } diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/v1.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/v1.go index a74a05a5cd..046c3056fb 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/v1.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/v1.go @@ -71,6 +71,7 @@ var legacySubsystems = []subsystem{ &fs.NetClsGroup{}, &fs.NameGroup{GroupName: "name=systemd"}, &fs.RdmaGroup{}, + &fs.NameGroup{GroupName: "misc"}, } func genV1ResourcesProperties(r *configs.Resources, cm *dbusConnManager) ([]systemdDbus.Property, error) { @@ -206,7 +207,7 @@ func (m *legacyManager) Apply(pid int) error { properties = append(properties, c.SystemdProps...) - if err := startUnit(m.dbus, unitName, properties); err != nil { + if err := startUnit(m.dbus, unitName, properties, pid == -1); err != nil { return err } @@ -273,14 +274,7 @@ func getSubsystemPath(slice, unit, subsystem string) (string, error) { return "", err } - initPath, err := cgroups.GetInitCgroup(subsystem) - if err != nil { - return "", err - } - // if pid 1 is systemd 226 or later, it will be in init.scope, not the root - initPath = strings.TrimSuffix(filepath.Clean(initPath), "init.scope") - - return filepath.Join(mountpoint, initPath, slice, unit), nil + return filepath.Join(mountpoint, slice, unit), nil } func (m *legacyManager) Freeze(state configs.FreezerState) error { diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/v2.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/v2.go index de0cb974d4..94d24ee450 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/v2.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/v2.go @@ -284,7 +284,7 @@ func (m *unifiedManager) Apply(pid int) error { properties = append(properties, c.SystemdProps...) - if err := startUnit(m.dbus, unitName, properties); err != nil { + if err := startUnit(m.dbus, unitName, properties, pid == -1); err != nil { return fmt.Errorf("unable to start unit %q (properties %+v): %w", unitName, properties, err) } diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/utils.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/utils.go index b32af4ee53..fc4ae44a48 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/utils.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/utils.go @@ -162,8 +162,10 @@ func readProcsFile(dir string) ([]int, error) { // ParseCgroupFile parses the given cgroup file, typically /proc/self/cgroup // or /proc//cgroup, into a map of subsystems to cgroup paths, e.g. -// "cpu": "/user.slice/user-1000.slice" -// "pids": "/user.slice/user-1000.slice" +// +// "cpu": "/user.slice/user-1000.slice" +// "pids": "/user.slice/user-1000.slice" +// // etc. // // Note that for cgroup v2 unified hierarchy, there are no per-controller diff --git a/vendor/github.com/opencontainers/runc/libcontainer/configs/validate/validator.go b/vendor/github.com/opencontainers/runc/libcontainer/configs/validate/validator.go index 627621a58d..4fbd308dad 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/configs/validate/validator.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/configs/validate/validator.go @@ -131,9 +131,8 @@ func (v *ConfigValidator) cgroupnamespace(config *configs.Config) error { // convertSysctlVariableToDotsSeparator can return sysctl variables in dots separator format. // The '/' separator is also accepted in place of a '.'. // Convert the sysctl variables to dots separator format for validation. -// More info: -// https://man7.org/linux/man-pages/man8/sysctl.8.html -// https://man7.org/linux/man-pages/man5/sysctl.d.5.html +// More info: sysctl(8), sysctl.d(5). +// // For example: // Input sysctl variable "net/ipv4/conf/eno2.100.rp_filter" // will return the converted value "net.ipv4.conf.eno2/100.rp_filter" diff --git a/vendor/github.com/opencontainers/runc/libcontainer/container_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/container_linux.go index 9df830d8cd..dd61dfd3c9 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/container_linux.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/container_linux.go @@ -926,7 +926,7 @@ func (c *linuxContainer) criuSupportsExtNS(t configs.NamespaceType) bool { } func criuNsToKey(t configs.NamespaceType) string { - return "extRoot" + strings.Title(configs.NsName(t)) + "NS" + return "extRoot" + strings.Title(configs.NsName(t)) + "NS" //nolint:staticcheck // SA1019: strings.Title is deprecated } func (c *linuxContainer) handleCheckpointingExternalNamespaces(rpcOpts *criurpc.CriuOpts, t configs.NamespaceType) error { diff --git a/vendor/github.com/opencontainers/runc/libcontainer/eaccess_go119.go b/vendor/github.com/opencontainers/runc/libcontainer/eaccess_go119.go new file mode 100644 index 0000000000..cc1e2079a7 --- /dev/null +++ b/vendor/github.com/opencontainers/runc/libcontainer/eaccess_go119.go @@ -0,0 +1,17 @@ +//go:build !go1.20 +// +build !go1.20 + +package libcontainer + +import "golang.org/x/sys/unix" + +func eaccess(path string) error { + // This check is similar to access(2) with X_OK except for + // setuid/setgid binaries where it checks against the effective + // (rather than real) uid and gid. It is not needed in go 1.20 + // and beyond and will be removed later. + + // Relies on code added in https://go-review.googlesource.com/c/sys/+/468877 + // and older CLs linked from there. + return unix.Faccessat(unix.AT_FDCWD, path, unix.X_OK, unix.AT_EACCESS) +} diff --git a/vendor/github.com/opencontainers/runc/libcontainer/eaccess_stub.go b/vendor/github.com/opencontainers/runc/libcontainer/eaccess_stub.go new file mode 100644 index 0000000000..7c049fd7aa --- /dev/null +++ b/vendor/github.com/opencontainers/runc/libcontainer/eaccess_stub.go @@ -0,0 +1,10 @@ +//go:build go1.20 + +package libcontainer + +func eaccess(path string) error { + // Not needed in Go 1.20+ as the functionality is already in there + // (added by https://go.dev/cl/416115, https://go.dev/cl/414824, + // and fixed in Go 1.20.2 by https://go.dev/cl/469956). + return nil +} diff --git a/vendor/github.com/opencontainers/runc/libcontainer/factory_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/factory_linux.go index e6c71ac34e..a1fa7de2d2 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/factory_linux.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/factory_linux.go @@ -179,6 +179,12 @@ func (l *LinuxFactory) Create(id string, config *configs.Config) (Container, err return nil, fmt.Errorf("unable to get cgroup PIDs: %w", err) } if len(pids) != 0 { + if config.Cgroups.Systemd { + // systemd cgroup driver can't add a pid to an + // existing systemd unit and will return an + // error anyway, so let's error out early. + return nil, fmt.Errorf("container's cgroup is not empty: %d process(es) found", len(pids)) + } // TODO: return an error. logrus.Warnf("container's cgroup is not empty: %d process(es) found", len(pids)) logrus.Warn("DEPRECATED: running container in a non-empty cgroup won't be supported in runc 1.2; https://github.com/opencontainers/runc/issues/3132") @@ -338,10 +344,9 @@ func (l *LinuxFactory) StartInitialization() (err error) { defer func() { if e := recover(); e != nil { - if e, ok := e.(error); ok { - err = fmt.Errorf("panic from initialization: %w, %s", e, debug.Stack()) + if ee, ok := e.(error); ok { + err = fmt.Errorf("panic from initialization: %w, %s", ee, debug.Stack()) } else { - //nolint:errorlint // here e is not of error type err = fmt.Errorf("panic from initialization: %v, %s", e, debug.Stack()) } } diff --git a/vendor/github.com/opencontainers/runc/libcontainer/init_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/init_linux.go index 1e5c394c3e..2e4c59353c 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/init_linux.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/init_linux.go @@ -411,8 +411,9 @@ func fixStdioPermissions(u *user.ExecUser) error { return &os.PathError{Op: "fstat", Path: file.Name(), Err: err} } - // Skip chown if uid is already the one we want. - if int(s.Uid) == u.Uid { + // Skip chown if uid is already the one we want or any of the STDIO descriptors + // were redirected to /dev/null. + if int(s.Uid) == u.Uid || s.Rdev == null.Rdev { continue } diff --git a/vendor/github.com/opencontainers/runc/libcontainer/rootfs_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/rootfs_linux.go index ec7638e4d5..c3f88fc703 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/rootfs_linux.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/rootfs_linux.go @@ -329,26 +329,41 @@ func mountCgroupV2(m *configs.Mount, c *mountConfig) error { if err := os.MkdirAll(dest, 0o755); err != nil { return err } - return utils.WithProcfd(c.root, m.Destination, func(procfd string) error { - if err := mount(m.Source, m.Destination, procfd, "cgroup2", uintptr(m.Flags), m.Data); err != nil { - // when we are in UserNS but CgroupNS is not unshared, we cannot mount cgroup2 (#2158) - if errors.Is(err, unix.EPERM) || errors.Is(err, unix.EBUSY) { - src := fs2.UnifiedMountpoint - if c.cgroupns && c.cgroup2Path != "" { - // Emulate cgroupns by bind-mounting - // the container cgroup path rather than - // the whole /sys/fs/cgroup. - src = c.cgroup2Path - } - err = mount(src, m.Destination, procfd, "", uintptr(m.Flags)|unix.MS_BIND, "") - if c.rootlessCgroups && errors.Is(err, unix.ENOENT) { - err = nil - } - } - return err - } - return nil + err = utils.WithProcfd(c.root, m.Destination, func(procfd string) error { + return mount(m.Source, m.Destination, procfd, "cgroup2", uintptr(m.Flags), m.Data) }) + if err == nil || !(errors.Is(err, unix.EPERM) || errors.Is(err, unix.EBUSY)) { + return err + } + + // When we are in UserNS but CgroupNS is not unshared, we cannot mount + // cgroup2 (#2158), so fall back to bind mount. + bindM := &configs.Mount{ + Device: "bind", + Source: fs2.UnifiedMountpoint, + Destination: m.Destination, + Flags: unix.MS_BIND | m.Flags, + PropagationFlags: m.PropagationFlags, + } + if c.cgroupns && c.cgroup2Path != "" { + // Emulate cgroupns by bind-mounting the container cgroup path + // rather than the whole /sys/fs/cgroup. + bindM.Source = c.cgroup2Path + } + // mountToRootfs() handles remounting for MS_RDONLY. + // No need to set c.fd here, because mountToRootfs() calls utils.WithProcfd() by itself in mountPropagate(). + err = mountToRootfs(bindM, c) + if c.rootlessCgroups && errors.Is(err, unix.ENOENT) { + // ENOENT (for `src = c.cgroup2Path`) happens when rootless runc is being executed + // outside the userns+mountns. + // + // Mask `/sys/fs/cgroup` to ensure it is read-only, even when `/sys` is mounted + // with `rbind,ro` (`runc spec --rootless` produces `rbind,ro` for `/sys`). + err = utils.WithProcfd(c.root, m.Destination, func(procfd string) error { + return maskPath(procfd, c.label) + }) + } + return err } func doTmpfsCopyUp(m *configs.Mount, rootfs, mountLabel string) (Err error) { @@ -398,32 +413,43 @@ func doTmpfsCopyUp(m *configs.Mount, rootfs, mountLabel string) (Err error) { func mountToRootfs(m *configs.Mount, c *mountConfig) error { rootfs := c.root - mountLabel := c.label - mountFd := c.fd - dest, err := securejoin.SecureJoin(rootfs, m.Destination) - if err != nil { - return err - } + // procfs and sysfs are special because we need to ensure they are actually + // mounted on a specific path in a container without any funny business. switch m.Device { case "proc", "sysfs": // If the destination already exists and is not a directory, we bail - // out This is to avoid mounting through a symlink or similar -- which + // out. This is to avoid mounting through a symlink or similar -- which // has been a "fun" attack scenario in the past. // TODO: This won't be necessary once we switch to libpathrs and we can // stop all of these symlink-exchange attacks. + dest := filepath.Clean(m.Destination) + if !strings.HasPrefix(dest, rootfs) { + // Do not use securejoin as it resolves symlinks. + dest = filepath.Join(rootfs, dest) + } if fi, err := os.Lstat(dest); err != nil { if !os.IsNotExist(err) { return err } - } else if fi.Mode()&os.ModeDir == 0 { + } else if !fi.IsDir() { return fmt.Errorf("filesystem %q must be mounted on ordinary directory", m.Device) } if err := os.MkdirAll(dest, 0o755); err != nil { return err } - // Selinux kernels do not support labeling of /proc or /sys + // Selinux kernels do not support labeling of /proc or /sys. return mountPropagate(m, rootfs, "", nil) + } + + mountLabel := c.label + mountFd := c.fd + dest, err := securejoin.SecureJoin(rootfs, m.Destination) + if err != nil { + return err + } + + switch m.Device { case "mqueue": if err := os.MkdirAll(dest, 0o755); err != nil { return err diff --git a/vendor/github.com/opencontainers/runc/libcontainer/standard_init_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/standard_init_linux.go index 081d1503a3..c09a7bed30 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/standard_init_linux.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/standard_init_linux.go @@ -198,11 +198,12 @@ func (l *linuxStandardInit) Init() error { if err != nil { return err } - // exec.LookPath might return no error for an executable residing on a - // file system mounted with noexec flag, so perform this extra check - // now while we can still return a proper error. - if err := system.Eaccess(name); err != nil { - return &os.PathError{Op: "exec", Path: name, Err: err} + // exec.LookPath in Go < 1.20 might return no error for an executable + // residing on a file system mounted with noexec flag, so perform this + // extra check now while we can still return a proper error. + // TODO: remove this once go < 1.20 is not supported. + if err := eaccess(name); err != nil { + return &os.PathError{Op: "eaccess", Path: name, Err: err} } // Set seccomp as close to execve as possible, so as few syscalls take diff --git a/vendor/github.com/opencontainers/runc/libcontainer/sync.go b/vendor/github.com/opencontainers/runc/libcontainer/sync.go index c9a23ef3a7..25dc286307 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/sync.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/sync.go @@ -15,16 +15,16 @@ type syncType string // during container setup. They come in pairs (with procError being a generic // response which is followed by an &initError). // -// [ child ] <-> [ parent ] +// [ child ] <-> [ parent ] // -// procHooks --> [run hooks] -// <-- procResume +// procHooks --> [run hooks] +// <-- procResume // -// procReady --> [final setup] -// <-- procRun +// procReady --> [final setup] +// <-- procRun // -// procSeccomp --> [pick up seccomp fd with pidfd_getfd()] -// <-- procSeccompDone +// procSeccomp --> [pick up seccomp fd with pidfd_getfd()] +// <-- procSeccompDone const ( procError syncType = "procError" procReady syncType = "procReady" diff --git a/vendor/github.com/opencontainers/runc/libcontainer/system/linux.go b/vendor/github.com/opencontainers/runc/libcontainer/system/linux.go index 039059a444..e1d6eb1803 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/system/linux.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/system/linux.go @@ -31,25 +31,6 @@ func (p ParentDeathSignal) Set() error { return SetParentDeathSignal(uintptr(p)) } -// Eaccess is similar to unix.Access except for setuid/setgid binaries -// it checks against the effective (rather than real) uid and gid. -func Eaccess(path string) error { - err := unix.Faccessat2(unix.AT_FDCWD, path, unix.X_OK, unix.AT_EACCESS) - if err != unix.ENOSYS && err != unix.EPERM { //nolint:errorlint // unix errors are bare - return err - } - - // Faccessat2() not available; check if we are a set[ug]id binary. - if os.Getuid() == os.Geteuid() && os.Getgid() == os.Getegid() { - // For a non-set[ug]id binary, use access(2). - return unix.Access(path, unix.X_OK) - } - - // For a setuid/setgid binary, there is no fallback way - // so assume we can execute the binary. - return nil -} - func Execv(cmd string, args []string, env []string) error { name, err := exec.LookPath(cmd) if err != nil { diff --git a/vendor/github.com/opencontainers/runc/libcontainer/user/user.go b/vendor/github.com/opencontainers/runc/libcontainer/user/user.go index 2473c5eadd..a1e216683d 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/user/user.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/user/user.go @@ -280,13 +280,13 @@ func GetExecUserPath(userSpec string, defaults *ExecUser, passwdPath, groupPath // found in any entry in passwd and group respectively. // // Examples of valid user specifications are: -// * "" -// * "user" -// * "uid" -// * "user:group" -// * "uid:gid -// * "user:gid" -// * "uid:group" +// - "" +// - "user" +// - "uid" +// - "user:group" +// - "uid:gid +// - "user:gid" +// - "uid:group" // // It should be noted that if you specify a numeric user or group id, they will // not be evaluated as usernames (only the metadata will be filled). So attempting diff --git a/vendor/github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/sccmatching/patched_sc_accessors.go b/vendor/github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/sccmatching/patched_sc_accessors.go new file mode 100644 index 0000000000..7b24270c93 --- /dev/null +++ b/vendor/github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/sccmatching/patched_sc_accessors.go @@ -0,0 +1,471 @@ +/* + * This file is a copy of k8s.io/kubernetes/pkg/securitycontext/accessors.go that + * contains the patch from https://github.com/kubernetes/kubernetes/pull/115968 + * that only appears in kube 1.27. + * FIXME: Remove this file when OpenShift users kube 1.27 as its base. + */ + +package sccmatching + +import ( + "reflect" + + api "k8s.io/kubernetes/pkg/apis/core" + "k8s.io/kubernetes/pkg/securitycontext" +) + +type SecccompProfileAccessor interface { + SeccompProfile() *api.SeccompProfile +} + +type SeccompProfileMutator interface { + SetSeccompProfile(*api.SeccompProfile) +} + +type PatchedPodSecurityContextAccessor interface { + securitycontext.PodSecurityContextAccessor + SecccompProfileAccessor +} + +type PatchedPodSecurityContextMutator interface { + securitycontext.PodSecurityContextMutator + SecccompProfileAccessor + SeccompProfileMutator +} + +// NewPodSecurityContextAccessor returns an accessor for the given pod security context. +// May be initialized with a nil PodSecurityContext. +func NewPodSecurityContextAccessor(podSC *api.PodSecurityContext) PatchedPodSecurityContextAccessor { + return &podSecurityContextWrapper{podSC: podSC} +} + +// NewPodSecurityContextMutator returns a mutator for the given pod security context. +// May be initialized with a nil PodSecurityContext. +func NewPodSecurityContextMutator(podSC *api.PodSecurityContext) PatchedPodSecurityContextMutator { + return &podSecurityContextWrapper{podSC: podSC} +} + +type podSecurityContextWrapper struct { + podSC *api.PodSecurityContext +} + +func (w *podSecurityContextWrapper) PodSecurityContext() *api.PodSecurityContext { + return w.podSC +} + +func (w *podSecurityContextWrapper) ensurePodSC() { + if w.podSC == nil { + w.podSC = &api.PodSecurityContext{} + } +} + +func (w *podSecurityContextWrapper) HostNetwork() bool { + if w.podSC == nil { + return false + } + return w.podSC.HostNetwork +} +func (w *podSecurityContextWrapper) SetHostNetwork(v bool) { + if w.podSC == nil && v == false { + return + } + w.ensurePodSC() + w.podSC.HostNetwork = v +} +func (w *podSecurityContextWrapper) HostPID() bool { + if w.podSC == nil { + return false + } + return w.podSC.HostPID +} +func (w *podSecurityContextWrapper) SetHostPID(v bool) { + if w.podSC == nil && v == false { + return + } + w.ensurePodSC() + w.podSC.HostPID = v +} +func (w *podSecurityContextWrapper) HostIPC() bool { + if w.podSC == nil { + return false + } + return w.podSC.HostIPC +} +func (w *podSecurityContextWrapper) SetHostIPC(v bool) { + if w.podSC == nil && v == false { + return + } + w.ensurePodSC() + w.podSC.HostIPC = v +} +func (w *podSecurityContextWrapper) SELinuxOptions() *api.SELinuxOptions { + if w.podSC == nil { + return nil + } + return w.podSC.SELinuxOptions +} +func (w *podSecurityContextWrapper) SetSELinuxOptions(v *api.SELinuxOptions) { + if w.podSC == nil && v == nil { + return + } + w.ensurePodSC() + w.podSC.SELinuxOptions = v +} +func (w *podSecurityContextWrapper) RunAsUser() *int64 { + if w.podSC == nil { + return nil + } + return w.podSC.RunAsUser +} +func (w *podSecurityContextWrapper) SetRunAsUser(v *int64) { + if w.podSC == nil && v == nil { + return + } + w.ensurePodSC() + w.podSC.RunAsUser = v +} +func (w *podSecurityContextWrapper) RunAsGroup() *int64 { + if w.podSC == nil { + return nil + } + return w.podSC.RunAsGroup +} +func (w *podSecurityContextWrapper) SetRunAsGroup(v *int64) { + if w.podSC == nil && v == nil { + return + } + w.ensurePodSC() + w.podSC.RunAsGroup = v +} + +func (w *podSecurityContextWrapper) RunAsNonRoot() *bool { + if w.podSC == nil { + return nil + } + return w.podSC.RunAsNonRoot +} +func (w *podSecurityContextWrapper) SetRunAsNonRoot(v *bool) { + if w.podSC == nil && v == nil { + return + } + w.ensurePodSC() + w.podSC.RunAsNonRoot = v +} +func (w *podSecurityContextWrapper) SeccompProfile() *api.SeccompProfile { + if w.podSC == nil { + return nil + } + return w.podSC.SeccompProfile +} +func (w *podSecurityContextWrapper) SetSeccompProfile(p *api.SeccompProfile) { + if w.podSC == nil && p == nil { + return + } + w.ensurePodSC() + w.podSC.SeccompProfile = p +} +func (w *podSecurityContextWrapper) SupplementalGroups() []int64 { + if w.podSC == nil { + return nil + } + return w.podSC.SupplementalGroups +} +func (w *podSecurityContextWrapper) SetSupplementalGroups(v []int64) { + if w.podSC == nil && len(v) == 0 { + return + } + w.ensurePodSC() + if len(v) == 0 && len(w.podSC.SupplementalGroups) == 0 { + return + } + w.podSC.SupplementalGroups = v +} +func (w *podSecurityContextWrapper) FSGroup() *int64 { + if w.podSC == nil { + return nil + } + return w.podSC.FSGroup +} +func (w *podSecurityContextWrapper) SetFSGroup(v *int64) { + if w.podSC == nil && v == nil { + return + } + w.ensurePodSC() + w.podSC.FSGroup = v +} + +type PatchedContainerSecurityContextAccessor interface { + securitycontext.ContainerSecurityContextAccessor + SecccompProfileAccessor +} + +type PatchedContainerSecurityContextMutator interface { + securitycontext.ContainerSecurityContextMutator + SecccompProfileAccessor + SeccompProfileMutator +} + +// NewContainerSecurityContextAccessor returns an accessor for the provided container security context +// May be initialized with a nil SecurityContext +func NewContainerSecurityContextAccessor(containerSC *api.SecurityContext) PatchedContainerSecurityContextAccessor { + return &containerSecurityContextWrapper{containerSC: containerSC} +} + +// NewContainerSecurityContextMutator returns a mutator for the provided container security context +// May be initialized with a nil SecurityContext +func NewContainerSecurityContextMutator(containerSC *api.SecurityContext) PatchedContainerSecurityContextMutator { + return &containerSecurityContextWrapper{containerSC: containerSC} +} + +type containerSecurityContextWrapper struct { + containerSC *api.SecurityContext +} + +func (w *containerSecurityContextWrapper) ContainerSecurityContext() *api.SecurityContext { + return w.containerSC +} + +func (w *containerSecurityContextWrapper) ensureContainerSC() { + if w.containerSC == nil { + w.containerSC = &api.SecurityContext{} + } +} + +func (w *containerSecurityContextWrapper) Capabilities() *api.Capabilities { + if w.containerSC == nil { + return nil + } + return w.containerSC.Capabilities +} +func (w *containerSecurityContextWrapper) SetCapabilities(v *api.Capabilities) { + if w.containerSC == nil && v == nil { + return + } + w.ensureContainerSC() + w.containerSC.Capabilities = v +} +func (w *containerSecurityContextWrapper) Privileged() *bool { + if w.containerSC == nil { + return nil + } + return w.containerSC.Privileged +} +func (w *containerSecurityContextWrapper) SetPrivileged(v *bool) { + if w.containerSC == nil && v == nil { + return + } + w.ensureContainerSC() + w.containerSC.Privileged = v +} +func (w *containerSecurityContextWrapper) ProcMount() api.ProcMountType { + if w.containerSC == nil { + return api.DefaultProcMount + } + if w.containerSC.ProcMount == nil { + return api.DefaultProcMount + } + return *w.containerSC.ProcMount +} +func (w *containerSecurityContextWrapper) SELinuxOptions() *api.SELinuxOptions { + if w.containerSC == nil { + return nil + } + return w.containerSC.SELinuxOptions +} +func (w *containerSecurityContextWrapper) SetSELinuxOptions(v *api.SELinuxOptions) { + if w.containerSC == nil && v == nil { + return + } + w.ensureContainerSC() + w.containerSC.SELinuxOptions = v +} +func (w *containerSecurityContextWrapper) RunAsUser() *int64 { + if w.containerSC == nil { + return nil + } + return w.containerSC.RunAsUser +} +func (w *containerSecurityContextWrapper) SetRunAsUser(v *int64) { + if w.containerSC == nil && v == nil { + return + } + w.ensureContainerSC() + w.containerSC.RunAsUser = v +} +func (w *containerSecurityContextWrapper) RunAsGroup() *int64 { + if w.containerSC == nil { + return nil + } + return w.containerSC.RunAsGroup +} +func (w *containerSecurityContextWrapper) SetRunAsGroup(v *int64) { + if w.containerSC == nil && v == nil { + return + } + w.ensureContainerSC() + w.containerSC.RunAsGroup = v +} + +func (w *containerSecurityContextWrapper) RunAsNonRoot() *bool { + if w.containerSC == nil { + return nil + } + return w.containerSC.RunAsNonRoot +} +func (w *containerSecurityContextWrapper) SetRunAsNonRoot(v *bool) { + if w.containerSC == nil && v == nil { + return + } + w.ensureContainerSC() + w.containerSC.RunAsNonRoot = v +} +func (w *containerSecurityContextWrapper) ReadOnlyRootFilesystem() *bool { + if w.containerSC == nil { + return nil + } + return w.containerSC.ReadOnlyRootFilesystem +} +func (w *containerSecurityContextWrapper) SetReadOnlyRootFilesystem(v *bool) { + if w.containerSC == nil && v == nil { + return + } + w.ensureContainerSC() + w.containerSC.ReadOnlyRootFilesystem = v +} +func (w *containerSecurityContextWrapper) SeccompProfile() *api.SeccompProfile { + if w.containerSC == nil { + return nil + } + return w.containerSC.SeccompProfile +} +func (w *containerSecurityContextWrapper) SetSeccompProfile(p *api.SeccompProfile) { + if w.containerSC == nil && p == nil { + return + } + w.ensureContainerSC() + w.containerSC.SeccompProfile = p +} + +func (w *containerSecurityContextWrapper) AllowPrivilegeEscalation() *bool { + if w.containerSC == nil { + return nil + } + return w.containerSC.AllowPrivilegeEscalation +} +func (w *containerSecurityContextWrapper) SetAllowPrivilegeEscalation(v *bool) { + if w.containerSC == nil && v == nil { + return + } + w.ensureContainerSC() + w.containerSC.AllowPrivilegeEscalation = v +} + +// NewEffectiveContainerSecurityContextAccessor returns an accessor for reading effective values +// for the provided pod security context and container security context +func NewEffectiveContainerSecurityContextAccessor(podSC PatchedPodSecurityContextAccessor, containerSC PatchedContainerSecurityContextMutator) PatchedContainerSecurityContextAccessor { + return &effectiveContainerSecurityContextWrapper{podSC: podSC, containerSC: containerSC} +} + +// NewEffectiveContainerSecurityContextMutator returns a mutator for reading and writing effective values +// for the provided pod security context and container security context +func NewEffectiveContainerSecurityContextMutator(podSC PatchedPodSecurityContextAccessor, containerSC PatchedContainerSecurityContextMutator) PatchedContainerSecurityContextMutator { + return &effectiveContainerSecurityContextWrapper{podSC: podSC, containerSC: containerSC} +} + +type effectiveContainerSecurityContextWrapper struct { + podSC PatchedPodSecurityContextAccessor + containerSC PatchedContainerSecurityContextMutator +} + +func (w *effectiveContainerSecurityContextWrapper) ContainerSecurityContext() *api.SecurityContext { + return w.containerSC.ContainerSecurityContext() +} + +func (w *effectiveContainerSecurityContextWrapper) Capabilities() *api.Capabilities { + return w.containerSC.Capabilities() +} +func (w *effectiveContainerSecurityContextWrapper) SetCapabilities(v *api.Capabilities) { + if !reflect.DeepEqual(w.Capabilities(), v) { + w.containerSC.SetCapabilities(v) + } +} +func (w *effectiveContainerSecurityContextWrapper) Privileged() *bool { + return w.containerSC.Privileged() +} +func (w *effectiveContainerSecurityContextWrapper) SetPrivileged(v *bool) { + if !reflect.DeepEqual(w.Privileged(), v) { + w.containerSC.SetPrivileged(v) + } +} +func (w *effectiveContainerSecurityContextWrapper) ProcMount() api.ProcMountType { + return w.containerSC.ProcMount() +} +func (w *effectiveContainerSecurityContextWrapper) SELinuxOptions() *api.SELinuxOptions { + if v := w.containerSC.SELinuxOptions(); v != nil { + return v + } + return w.podSC.SELinuxOptions() +} +func (w *effectiveContainerSecurityContextWrapper) SetSELinuxOptions(v *api.SELinuxOptions) { + if !reflect.DeepEqual(w.SELinuxOptions(), v) { + w.containerSC.SetSELinuxOptions(v) + } +} +func (w *effectiveContainerSecurityContextWrapper) RunAsUser() *int64 { + if v := w.containerSC.RunAsUser(); v != nil { + return v + } + return w.podSC.RunAsUser() +} +func (w *effectiveContainerSecurityContextWrapper) SetRunAsUser(v *int64) { + if !reflect.DeepEqual(w.RunAsUser(), v) { + w.containerSC.SetRunAsUser(v) + } +} +func (w *effectiveContainerSecurityContextWrapper) RunAsGroup() *int64 { + if v := w.containerSC.RunAsGroup(); v != nil { + return v + } + return w.podSC.RunAsGroup() +} +func (w *effectiveContainerSecurityContextWrapper) SetRunAsGroup(v *int64) { + if !reflect.DeepEqual(w.RunAsGroup(), v) { + w.containerSC.SetRunAsGroup(v) + } +} + +func (w *effectiveContainerSecurityContextWrapper) RunAsNonRoot() *bool { + if v := w.containerSC.RunAsNonRoot(); v != nil { + return v + } + return w.podSC.RunAsNonRoot() +} +func (w *effectiveContainerSecurityContextWrapper) SetRunAsNonRoot(v *bool) { + if !reflect.DeepEqual(w.RunAsNonRoot(), v) { + w.containerSC.SetRunAsNonRoot(v) + } +} +func (w *effectiveContainerSecurityContextWrapper) ReadOnlyRootFilesystem() *bool { + return w.containerSC.ReadOnlyRootFilesystem() +} +func (w *effectiveContainerSecurityContextWrapper) SetReadOnlyRootFilesystem(v *bool) { + if !reflect.DeepEqual(w.ReadOnlyRootFilesystem(), v) { + w.containerSC.SetReadOnlyRootFilesystem(v) + } +} +func (w *effectiveContainerSecurityContextWrapper) SeccompProfile() *api.SeccompProfile { + return w.containerSC.SeccompProfile() +} +func (w *effectiveContainerSecurityContextWrapper) SetSeccompProfile(p *api.SeccompProfile) { + if !reflect.DeepEqual(w.SeccompProfile(), p) { + w.containerSC.SetSeccompProfile(p) + } +} +func (w *effectiveContainerSecurityContextWrapper) AllowPrivilegeEscalation() *bool { + return w.containerSC.AllowPrivilegeEscalation() +} +func (w *effectiveContainerSecurityContextWrapper) SetAllowPrivilegeEscalation(v *bool) { + if !reflect.DeepEqual(w.AllowPrivilegeEscalation(), v) { + w.containerSC.SetAllowPrivilegeEscalation(v) + } +} diff --git a/vendor/github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/sccmatching/provider.go b/vendor/github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/sccmatching/provider.go index 2535000f94..dea78e1e83 100644 --- a/vendor/github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/sccmatching/provider.go +++ b/vendor/github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/sccmatching/provider.go @@ -2,6 +2,7 @@ package sccmatching import ( "fmt" + "strings" corev1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/util/sets" @@ -99,7 +100,7 @@ func NewSimpleProvider(scc *securityv1.SecurityContextConstraints) (SecurityCont // on the PodSecurityContext it will not be changed. Validate should be used after the context // is created to ensure it complies with the required restrictions. func (s *simpleProvider) CreatePodSecurityContext(pod *api.Pod) (*api.PodSecurityContext, map[string]string, error) { - sc := securitycontext.NewPodSecurityContextMutator(pod.Spec.SecurityContext) + sc := NewPodSecurityContextMutator(pod.Spec.SecurityContext) annotationsCopy := maps.CopySS(pod.Annotations) @@ -138,6 +139,7 @@ func (s *simpleProvider) CreatePodSecurityContext(pod *api.Pod) (*api.PodSecurit annotationsCopy = map[string]string{} } annotationsCopy[api.SeccompPodAnnotationKey] = seccompProfile + sc.SetSeccompProfile(seccompFieldForAnnotation(seccompProfile)) } return sc.PodSecurityContext(), annotationsCopy, nil @@ -147,9 +149,9 @@ func (s *simpleProvider) CreatePodSecurityContext(pod *api.Pod) (*api.PodSecurit // container's security context then it will not be changed. Validation should be used after // the context is created to ensure it complies with the required restrictions. func (s *simpleProvider) CreateContainerSecurityContext(pod *api.Pod, container *api.Container) (*api.SecurityContext, error) { - sc := securitycontext.NewEffectiveContainerSecurityContextMutator( - securitycontext.NewPodSecurityContextAccessor(pod.Spec.SecurityContext), - securitycontext.NewContainerSecurityContextMutator(container.SecurityContext), + sc := NewEffectiveContainerSecurityContextMutator( + NewPodSecurityContextAccessor(pod.Spec.SecurityContext), + NewContainerSecurityContextMutator(container.SecurityContext), ) if sc.RunAsUser() == nil { uid, err := s.runAsUserStrategy.Generate(pod, container) @@ -214,6 +216,11 @@ func (s *simpleProvider) CreateContainerSecurityContext(pod *api.Pod, container } } + containerSeccomp, ok := pod.Annotations[api.SeccompContainerAnnotationKeyPrefix+container.Name] + if ok { + sc.SetSeccompProfile(seccompFieldForAnnotation(containerSeccomp)) + } + // if the SCC sets DefaultAllowPrivilegeEscalation and the container security context // allowPrivilegeEscalation is not set, then default to that set by the SCC. // @@ -497,3 +504,34 @@ func allowsVolumeType(allowedVolumes sets.String, fsType securityv1.FSType, volu fsType == securityv1.FSProjected && sccutil.IsOnlyServiceAccountTokenSources(volumeSource.Projected) } + +// seccompFieldForAnnotation takes a pod annotation and returns the converted +// seccomp profile field. +// SeccompAnnotations removal is planned for Kube 1.27, remove this logic afterwards +func seccompFieldForAnnotation(annotation string) *api.SeccompProfile { + // If only seccomp annotations are specified, copy the values into the + // corresponding fields. This ensures that existing applications continue + // to enforce seccomp, and prevents the kubelet from needing to resolve + // annotations & fields. + if annotation == corev1.SeccompProfileNameUnconfined { + return &api.SeccompProfile{Type: api.SeccompProfileTypeUnconfined} + } + + if annotation == api.SeccompProfileRuntimeDefault || annotation == api.DeprecatedSeccompProfileDockerDefault { + return &api.SeccompProfile{Type: api.SeccompProfileTypeRuntimeDefault} + } + + if strings.HasPrefix(annotation, corev1.SeccompLocalhostProfileNamePrefix) { + localhostProfile := strings.TrimPrefix(annotation, corev1.SeccompLocalhostProfileNamePrefix) + if localhostProfile != "" { + return &api.SeccompProfile{ + Type: api.SeccompProfileTypeLocalhost, + LocalhostProfile: &localhostProfile, + } + } + } + + // we can only reach this code path if the localhostProfile name has a zero + // length or if the annotation has an unrecognized value + return nil +} diff --git a/vendor/golang.org/x/net/html/doc.go b/vendor/golang.org/x/net/html/doc.go index 822ed42a04..7a96eae331 100644 --- a/vendor/golang.org/x/net/html/doc.go +++ b/vendor/golang.org/x/net/html/doc.go @@ -92,6 +92,21 @@ example, to process each anchor node in depth-first order: The relevant specifications include: https://html.spec.whatwg.org/multipage/syntax.html and https://html.spec.whatwg.org/multipage/syntax.html#tokenization + +# Security Considerations + +Care should be taken when parsing and interpreting HTML, whether full documents +or fragments, within the framework of the HTML specification, especially with +regard to untrusted inputs. + +This package provides both a tokenizer and a parser. Only the parser constructs +a DOM according to the HTML specification, resolving malformed and misplaced +tags where appropriate. The tokenizer simply tokenizes the HTML presented to it, +and as such does not resolve issues that may exist in the processed HTML, +producing a literal interpretation of the input. + +If your use case requires semantically well-formed HTML, as defined by the +WHATWG specifiction, the parser should be used rather than the tokenizer. */ package html // import "golang.org/x/net/html" diff --git a/vendor/golang.org/x/net/html/escape.go b/vendor/golang.org/x/net/html/escape.go index d856139620..04c6bec210 100644 --- a/vendor/golang.org/x/net/html/escape.go +++ b/vendor/golang.org/x/net/html/escape.go @@ -193,6 +193,87 @@ func lower(b []byte) []byte { return b } +// escapeComment is like func escape but escapes its input bytes less often. +// Per https://github.com/golang/go/issues/58246 some HTML comments are (1) +// meaningful and (2) contain angle brackets that we'd like to avoid escaping +// unless we have to. +// +// "We have to" includes the '&' byte, since that introduces other escapes. +// +// It also includes those bytes (not including EOF) that would otherwise end +// the comment. Per the summary table at the bottom of comment_test.go, this is +// the '>' byte that, per above, we'd like to avoid escaping unless we have to. +// +// Studying the summary table (and T actions in its '>' column) closely, we +// only need to escape in states 43, 44, 49, 51 and 52. State 43 is at the +// start of the comment data. State 52 is after a '!'. The other three states +// are after a '-'. +// +// Our algorithm is thus to escape every '&' and to escape '>' if and only if: +// - The '>' is after a '!' or '-' (in the unescaped data) or +// - The '>' is at the start of the comment data (after the opening ""); err != nil { diff --git a/vendor/golang.org/x/net/html/token.go b/vendor/golang.org/x/net/html/token.go index 50f7c6aac8..5c2a1f4efa 100644 --- a/vendor/golang.org/x/net/html/token.go +++ b/vendor/golang.org/x/net/html/token.go @@ -110,7 +110,7 @@ func (t Token) String() string { case SelfClosingTagToken: return "<" + t.tagString() + "/>" case CommentToken: - return "" + return "" case DoctypeToken: return "" } @@ -598,10 +598,10 @@ scriptDataDoubleEscapeEnd: // readComment reads the next comment token starting with "