Skip to content

ACM-24354: address CVE-2025-47907 #340

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nunnatsa wants to merge 2 commits into
base: release-4.18
Choose a base branch
from
Open

ACM-24354: address CVE-2025-47907 #340

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ef30e94
ACM-24354: address CVE-2025-47907
nunnatsa Jan 8, 2026
31cd376
Fix unit test
nunnatsa Jan 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@

# Build the manager binary
# Run this with docker build --build-arg builder_image=<golang:x.y.z>
ARG builder_image=docker.io/golang:1.22
ARG builder_image=docker.io/golang:1.24
FROM ${builder_image} as builder
WORKDIR /workspace

Expand Down
2 changes: 1 addition & 1 deletion Dockerfile.rhtap
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.23 as builder
FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.24 as builder

# Run this with docker build --build_arg $(go env GOPROXY) to override the goproxy
ARG goproxy=https://proxy.golang.org
Expand Down
6 changes: 3 additions & 3 deletions controllers/kubevirtcluster_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,7 +165,7 @@ func (r *KubevirtClusterReconciler) reconcileNormal(ctx *context.ClusterContext,
// Create the service serving as load balancer, if not existing
if !externalLoadBalancer.IsFound() {
if err := externalLoadBalancer.Create(ctx); err != nil {
conditions.MarkFalse(ctx.KubevirtCluster, infrav1.LoadBalancerAvailableCondition, infrav1.LoadBalancerProvisioningFailedReason, clusterv1.ConditionSeverityWarning, err.Error())
conditions.MarkFalse(ctx.KubevirtCluster, infrav1.LoadBalancerAvailableCondition, infrav1.LoadBalancerProvisioningFailedReason, clusterv1.ConditionSeverityWarning, "%v", err)
return ctrl.Result{}, errors.Wrap(err, "failed to create load balancer")
}
}
Expand All @@ -180,7 +180,7 @@ func (r *KubevirtClusterReconciler) reconcileNormal(ctx *context.ClusterContext,
} else if ctx.KubevirtCluster.Spec.ControlPlaneServiceTemplate.Spec.Type == "LoadBalancer" {
lbip4, err := externalLoadBalancer.ExternalIP(ctx)
if err != nil {
conditions.MarkFalse(ctx.KubevirtCluster, infrav1.LoadBalancerAvailableCondition, infrav1.LoadBalancerProvisioningFailedReason, clusterv1.ConditionSeverityWarning, err.Error())
conditions.MarkFalse(ctx.KubevirtCluster, infrav1.LoadBalancerAvailableCondition, infrav1.LoadBalancerProvisioningFailedReason, clusterv1.ConditionSeverityWarning, "%v", err)
return ctrl.Result{}, errors.Wrap(err, "failed to get ExternalIP for the load balancer")
}
ctx.KubevirtCluster.Spec.ControlPlaneEndpoint = infrav1.APIEndpoint{
Expand All @@ -192,7 +192,7 @@ func (r *KubevirtClusterReconciler) reconcileNormal(ctx *context.ClusterContext,
} else {
lbip4, err := externalLoadBalancer.IP(ctx)
if err != nil {
conditions.MarkFalse(ctx.KubevirtCluster, infrav1.LoadBalancerAvailableCondition, infrav1.LoadBalancerProvisioningFailedReason, clusterv1.ConditionSeverityWarning, err.Error())
conditions.MarkFalse(ctx.KubevirtCluster, infrav1.LoadBalancerAvailableCondition, infrav1.LoadBalancerProvisioningFailedReason, clusterv1.ConditionSeverityWarning, "%v", err)
return ctrl.Result{}, errors.Wrap(err, "failed to get ClusterIP for the load balancer")
}
ctx.KubevirtCluster.Spec.ControlPlaneEndpoint = infrav1.APIEndpoint{
Expand Down
8 changes: 4 additions & 4 deletions controllers/kubevirtmachine_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,8 +265,8 @@ func (r *KubevirtMachineReconciler) reconcileNormal(ctx *context.MachineContext)
// Provision the underlying VM if not existing
if !isTerminal && !externalMachine.Exists() {
ctx.KubevirtMachine.Status.Ready = false
if err := externalMachine.Create(ctx.Context); err != nil {
conditions.MarkFalse(ctx.KubevirtMachine, infrav1.VMProvisionedCondition, infrav1.VMCreateFailedReason, clusterv1.ConditionSeverityError, fmt.Sprintf("Failed vm creation: %v", err))
if err = externalMachine.Create(ctx.Context); err != nil {
conditions.MarkFalse(ctx.KubevirtMachine, infrav1.VMProvisionedCondition, infrav1.VMCreateFailedReason, clusterv1.ConditionSeverityError, "Failed vm creation: %v", err)
return ctrl.Result{}, errors.Wrap(err, "failed to create VM instance")
}
ctx.Logger.Info("VM Created, waiting on vm to be provisioned.")
Expand All @@ -279,7 +279,7 @@ func (r *KubevirtMachineReconciler) reconcileNormal(ctx *context.MachineContext)
conditions.MarkTrue(ctx.KubevirtMachine, infrav1.VMProvisionedCondition)
} else {
reason, message := externalMachine.GetVMNotReadyReason()
conditions.MarkFalse(ctx.KubevirtMachine, infrav1.VMProvisionedCondition, reason, clusterv1.ConditionSeverityInfo, message)
conditions.MarkFalse(ctx.KubevirtMachine, infrav1.VMProvisionedCondition, reason, clusterv1.ConditionSeverityInfo, "%s", message)

// Waiting for VM to boot
ctx.KubevirtMachine.Status.Ready = false
Expand Down Expand Up @@ -372,7 +372,7 @@ func (r *KubevirtMachineReconciler) reconcileNormal(ctx *context.MachineContext)
conditions.MarkTrue(ctx.KubevirtMachine, infrav1.VMLiveMigratableCondition)
} else {
conditions.MarkFalse(ctx.KubevirtMachine, infrav1.VMLiveMigratableCondition, reason, clusterv1.ConditionSeverityInfo,
fmt.Sprintf("%s is not a live migratable machine: %s", ctx.KubevirtMachine.Name, message))
"%s is not a live migratable machine: %s", ctx.KubevirtMachine.Name, message)
}

return ctrl.Result{}, nil
Expand Down
27 changes: 11 additions & 16 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module sigs.k8s.io/cluster-api-provider-kubevirt

go 1.22.0
go 1.24.0

require (
github.com/go-logr/logr v1.4.2
Expand All @@ -10,7 +10,7 @@ require (
github.com/pkg/errors v0.9.1
github.com/spf13/cobra v1.8.0
github.com/spf13/pflag v1.0.5
golang.org/x/crypto v0.32.0
golang.org/x/crypto v0.46.0
gopkg.in/yaml.v3 v3.0.1
k8s.io/api v0.30.1
k8s.io/apimachinery v0.30.1
Expand Down Expand Up @@ -86,17 +86,16 @@ require (
go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.26.0 // indirect
golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
golang.org/x/net v0.34.0 // indirect
golang.org/x/oauth2 v0.18.0 // indirect
golang.org/x/sync v0.11.0 // indirect
golang.org/x/sys v0.30.0 // indirect
golang.org/x/term v0.29.0 // indirect
golang.org/x/text v0.22.0 // indirect
golang.org/x/time v0.5.0 // indirect
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
golang.org/x/net v0.48.0 // indirect
golang.org/x/oauth2 v0.34.0 // indirect
golang.org/x/sync v0.19.0 // indirect
golang.org/x/sys v0.40.0 // indirect
golang.org/x/term v0.39.0 // indirect
golang.org/x/text v0.33.0 // indirect
golang.org/x/time v0.14.0 // indirect
golang.org/x/tools v0.40.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/protobuf v1.33.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
Expand All @@ -109,7 +108,3 @@ require (
sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
)

replace golang.org/x/crypto => github.com/openshift/golang-crypto v0.33.1-0.20250310193910-9003f682e581

replace golang.org/x/net => golang.org/x/net v0.34.0
Loading