Skip to content

WIP: CORENET-7047: CNCC K8s rebase to 1.36.1 #223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vinnie1110 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

WIP: CORENET-7047: CNCC K8s rebase to 1.36.1 #223

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1578c83
K8s update to 1.36.1
vinnie1110 May 27, 2026
f194123
Update .snyk with additional exclusions
vinnie1110 Jun 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
2 changes: 1 addition & 1 deletion .ci-operator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
build_root_image:
name: release
namespace: openshift
tag: rhel-9-release-golang-1.25-openshift-4.22
tag: rhel-9-release-golang-1.26-openshift-5.0
4 changes: 4 additions & 0 deletions .snyk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,3 +20,7 @@ exclude:
- vendor/github.com/openshift/api/config/v1/types_oauth.go
- vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/username_password_credential.go
- vendor/github.com/aws/aws-sdk-go/service/sts/api.go
- vendor/github.com/gofrs/uuid/v5/generator.go
- vendor/sigs.k8s.io/controller-runtime/pkg/log/log.go
- vendor/github.com/aws/aws-sdk-go/aws/endpoints/dep_service_ids.go
- vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/tlsconfigstore.go
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22 AS builder
FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.26-openshift-5.0 AS builder

@coderabbitai coderabbitai Bot Jun 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Search for base image policies or security documentation

# Check for security or container documentation
fd -i -e md -e txt . | xargs rg -i "base.?image|catalog.redhat|registry.ci.openshift" -C 2

# Check for other Dockerfiles in the repo using catalog.redhat.com
fd -t f "Dockerfile" | xargs rg "FROM.*catalog.redhat.com"

# Check CI operator config for image policies
rg "base.*image|catalog" .ci-operator.yaml -A 2 -B 2

Repository: openshift/cloud-network-config-controller

Length of output: 67

Harden Dockerfile per container security guidelines (non-root + least-context + HEALTHCHECK) and confirm base image registry policy.

  • ./Dockerfile (lines 1-15): Missing USER directive; container runs as root (DS-0002).
  • ./Dockerfile (line 4): COPY . . copies the full build context; copy only required files/dirs.
  • ./Dockerfile (lines 1, 7): Base images use registry.ci.openshift.org (ocp/builder... and ocp/5.0:base-rhel9); no repo policy/docs exception for registry.ci.openshift.org vs catalog.redhat.com was located—confirm this is allowed or switch to catalog.redhat.com.
  • ./Dockerfile (lines 1-15): Missing HEALTHCHECK.
🧰 Tools
🪛 Trivy (0.69.3)

[error] 1-1: Image user should not be 'root'

Specify at least 1 USER command in Dockerfile with non-root user as argument

Rule: DS-0002

Learn more

(IaC/Dockerfile)

[error] 1-1: Image user should not be 'root'

Specify at least 1 USER command in Dockerfile with non-root user as argument

Rule: DS-0002

Learn more

(IaC/Dockerfile)

[error] 1-1: Image user should not be 'root'

Specify at least 1 USER command in Dockerfile with non-root user as argument

Rule: DS-0002

Learn more

(IaC/Dockerfile)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` at line 1, Dockerfile currently runs as root, copies the entire
build context, lacks a HEALTHCHECK and uses images from
registry.ci.openshift.org without documented policy; fix by adding a non-root
USER directive (create/drop to a dedicated uid/gid and use USER <uid>), replace
COPY . . with targeted COPY of only required files/directories (e.g., COPY
go.mod go.sum ./ and COPY cmd/ ./ or similar) and use a multi-stage build to
limit context, add a HEALTHCHECK instruction that probes the running service
(e.g., curl or tcp check) with sensible interval/retries, and verify or switch
the FROM image references
(registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.26-openshift-5.0 and
ocp/5.0:base-rhel9) to an approved registry such as catalog.redhat.com or
document an exception in the repo policy.

Source: Coding guidelines


WORKDIR /go/src/github.com/openshift/cloud-network-config-controller
COPY . .

@coderabbitai coderabbitai Bot Jun 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Copy specific files instead of entire build context.

Line 4 copies the entire build context (.), violating the container security guideline "COPY specific files, not entire context". This can bloat the builder layer and risks including sensitive files.

🔒 Proposed fix 
-COPY . .
+COPY go.mod go.sum ./
+COPY vendor/ vendor/
+COPY pkg/ pkg/
+COPY cmd/ cmd/
+COPY Makefile ./
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
COPY . .
COPY go.mod go.sum ./
COPY vendor/ vendor/
COPY pkg/ pkg/
COPY cmd/ cmd/
COPY Makefile ./
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` at line 4, The Dockerfile currently uses a broad COPY . . which
pulls the entire build context into the image; replace this with explicit COPY
directives for only the needed artifacts (e.g., COPY package.json
package-lock.json ., COPY yarn.lock ., COPY src/ ./src or COPY dist/ ./dist) and
ensure a .dockerignore excludes secrets and dev-only files; update the
Dockerfile to reference those explicit filenames/dirs instead of '.' and add or
tighten .dockerignore entries to prevent sensitive or large files from being
included.

Source: Coding guidelines

RUN make build

FROM registry.ci.openshift.org/ocp/4.22:base-rhel9
FROM registry.ci.openshift.org/ocp/5.0:base-rhel9

COPY --from=builder /go/src/github.com/openshift/cloud-network-config-controller/_output/bin/cloud-network-config-controller /usr/bin/

Expand Down
112 changes: 57 additions & 55 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/openshift/cloud-network-config-controller

go 1.25.0
go 1.26.0

require (
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0
Expand All @@ -14,28 +14,28 @@ require (
github.com/gophercloud/gophercloud/v2 v2.1.1
github.com/gophercloud/utils/v2 v2.0.0-20241008104625-7cbb8fd76bb7
github.com/onsi/ginkgo v1.16.4
github.com/onsi/gomega v1.38.2
github.com/openshift/api v0.0.0-20260126183958-606bd613f9f7
github.com/openshift/client-go v0.0.0-20260108185524-48f4ccfc4e13
github.com/openshift/library-go v0.0.0-20260209094534-b6adacbfccda
github.com/onsi/gomega v1.39.0
github.com/openshift/api v0.0.0-20260521125114-09730f85d883
github.com/openshift/client-go v0.0.0-20260512113608-deb4dc54551a
github.com/openshift/library-go v0.0.0-20260526221523-b67ee3926ad5
github.com/pkg/errors v0.9.1
google.golang.org/api v0.179.0
gopkg.in/yaml.v2 v2.4.0
k8s.io/api v0.35.0
k8s.io/apimachinery v0.35.0
k8s.io/client-go v0.35.0
k8s.io/cloud-provider v0.35.0
k8s.io/klog/v2 v2.130.1
k8s.io/utils v0.0.0-20260108192941-914a6e750570
sigs.k8s.io/controller-runtime v0.23.1
k8s.io/api v0.36.1
k8s.io/apimachinery v0.36.1
k8s.io/client-go v0.36.1
k8s.io/cloud-provider v0.36.1
k8s.io/klog/v2 v2.140.0
k8s.io/utils v0.0.0-20260507154919-ff6756f316d2
sigs.k8s.io/controller-runtime v0.24.1
)

require go.opentelemetry.io/auto/sdk v1.1.0 // indirect
require go.opentelemetry.io/auto/sdk v1.2.1 // indirect

require (
cloud.google.com/go/auth v0.4.1 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.2 // indirect
cloud.google.com/go/compute/metadata v0.6.0 // indirect
cloud.google.com/go/compute/metadata v0.9.0 // indirect
github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.1 // indirect
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1 // indirect
Expand All @@ -53,26 +53,25 @@ require (
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/fsnotify/fsnotify v1.9.0 // indirect
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
github.com/fsnotify/fsnotify v1.10.1 // indirect
github.com/fxamacker/cbor/v2 v2.9.2 // indirect
github.com/go-logr/logr v1.4.3 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-openapi/jsonpointer v0.22.4 // indirect
github.com/go-openapi/jsonreference v0.21.4 // indirect
github.com/go-openapi/swag v0.25.4 // indirect
github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
github.com/go-openapi/swag/conv v0.25.4 // indirect
github.com/go-openapi/swag/fileutils v0.25.4 // indirect
github.com/go-openapi/swag/jsonname v0.25.4 // indirect
github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
github.com/go-openapi/swag/loading v0.25.4 // indirect
github.com/go-openapi/swag/mangling v0.25.4 // indirect
github.com/go-openapi/swag/netutils v0.25.4 // indirect
github.com/go-openapi/swag/stringutils v0.25.4 // indirect
github.com/go-openapi/swag/typeutils v0.25.4 // indirect
github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
github.com/go-openapi/jsonpointer v0.23.1 // indirect
github.com/go-openapi/jsonreference v0.21.5 // indirect
github.com/go-openapi/swag v0.26.0 // indirect
github.com/go-openapi/swag/cmdutils v0.26.0 // indirect
github.com/go-openapi/swag/conv v0.26.0 // indirect
github.com/go-openapi/swag/fileutils v0.26.0 // indirect
github.com/go-openapi/swag/jsonname v0.26.0 // indirect
github.com/go-openapi/swag/jsonutils v0.26.0 // indirect
github.com/go-openapi/swag/loading v0.26.0 // indirect
github.com/go-openapi/swag/mangling v0.26.0 // indirect
github.com/go-openapi/swag/netutils v0.26.0 // indirect
github.com/go-openapi/swag/stringutils v0.26.0 // indirect
github.com/go-openapi/swag/typeutils v0.26.0 // indirect
github.com/go-openapi/swag/yamlutils v0.26.0 // indirect
github.com/gofrs/uuid/v5 v5.3.0 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
Expand All @@ -96,41 +95,44 @@ require (
github.com/prometheus/client_golang v1.23.2 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/common v0.67.5 // indirect
github.com/prometheus/procfs v0.19.2 // indirect
github.com/prometheus/procfs v0.20.1 // indirect
github.com/robfig/cron v1.2.0 // indirect
github.com/spf13/pflag v1.0.10 // indirect
github.com/x448/float16 v0.8.4 // indirect
go.opencensus.io v0.24.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
go.opentelemetry.io/otel v1.36.0 // indirect
go.opentelemetry.io/otel/metric v1.36.0 // indirect
go.opentelemetry.io/otel/trace v1.36.0 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
go.opentelemetry.io/otel v1.41.0 // indirect
go.opentelemetry.io/otel/metric v1.41.0 // indirect
go.opentelemetry.io/otel/trace v1.41.0 // indirect
go.yaml.in/yaml/v2 v2.4.4 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/crypto v0.48.0 // indirect
golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
golang.org/x/net v0.50.0 // indirect
golang.org/x/oauth2 v0.35.0 // indirect
golang.org/x/sys v0.41.0 // indirect
golang.org/x/term v0.40.0 // indirect
golang.org/x/text v0.34.0 // indirect
golang.org/x/time v0.14.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a // indirect
google.golang.org/grpc v1.72.2 // indirect
google.golang.org/protobuf v1.36.11 // indirect
golang.org/x/crypto v0.51.0 // indirect
golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
golang.org/x/net v0.55.0 // indirect
golang.org/x/oauth2 v0.36.0 // indirect
golang.org/x/sys v0.45.0 // indirect
golang.org/x/term v0.43.0 // indirect
golang.org/x/text v0.37.0 // indirect
golang.org/x/time v0.15.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
google.golang.org/grpc v1.79.3 // indirect
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/apiextensions-apiserver v0.35.0 // indirect
k8s.io/apiserver v0.35.0 // indirect
k8s.io/component-base v0.35.0 // indirect
k8s.io/kube-aggregator v0.34.1 // indirect
k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4 // indirect
k8s.io/apiextensions-apiserver v0.36.1 // indirect
k8s.io/apiserver v0.36.1 // indirect
k8s.io/component-base v0.36.1 // indirect
k8s.io/kube-aggregator v0.36.1 // indirect
k8s.io/kube-openapi v0.0.0-20260520065146-aa012df4f4af // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/kube-storage-version-migrator v0.0.6-0.20230721195810-5c8923c5ff96 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
sigs.k8s.io/yaml v1.6.0 // indirect
)

// Replace library-go with a WIP-PR version for review and CI validation purposes
replace github.com/openshift/library-go => github.com/jubittajohn/library-go v0.0.0-20260523185030-8af7f5bef8e1
Comment thread
vinnie1110 marked this conversation as resolved.
Loading