Skip to content

Commit 49b641e

Browse files
msupinodnmsupinodn
committed
Security fixes, Azure annotation guard, and version command
- Bump Go from 1.25.0 to 1.25.8 (fixes 8 stdlib CVEs in crypto/tls, crypto/x509, net/url, html/template, os) - Bump go.opentelemetry.io/otel/sdk from v1.36.0 to v1.40.0 (fixes CVE-2026-24051 HIGH: arbitrary code execution via PATH hijacking) - Fix directory permissions: 0666/os.ModePerm -> 0750 in deploy/deploy.go and topo/node/node.go - Harden Dockerfiles: pin base images, add non-root USER, use --no-install-recommends, multi-stage distroless build for wire/forward and webhook - Only apply Azure LB annotations on AKS clusters (was unconditional, causing unnecessary 10-min polling on non-Azure setups) - Add 'kne version' subcommand with git commit/tag injected via ldflags - Update CI: Go 1.25, migrate golangci-lint config to v2 format Made-with: Cursor
1 parent 28f67e9 commit 49b641e

File tree

16 files changed

+366
-235
lines changed

16 files changed

+366
-235
lines changed

‎.github/linters/.golangci.yml‎

Lines changed: 60 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,52 +1,76 @@
11
---
2-
#########################
3-
#########################
4-
## Golang Linter rules ##
5-
#########################
6-
#########################
2+
version: "2"
73

8-
# configure golangci-lint
9-
# see https://github.com/golangci/golangci-lint/blob/master/.golangci.example.yml
104
run:
115
timeout: 10m
12-
issues:
13-
exclude-rules:
14-
- path: _test\.go
15-
linters:
16-
- dupl
17-
- gosec
18-
- goconst
19-
- linters:
20-
- revive
21-
text: "var-naming: don't use leading k"
22-
- linters:
23-
- staticcheck
24-
text: "SA1019:"
6+
257
linters:
26-
disable-all: true
8+
default: none
279
enable:
2810
- gosec
2911
- unconvert
30-
- goimports
31-
- gofmt
3212
- gocritic
3313
- govet
3414
- revive
3515
- staticcheck
36-
- unconvert
3716
- unparam
3817
- unused
3918
- wastedassign
4019
- whitespace
41-
linters-settings:
42-
errcheck:
43-
# report about assignment of errors to blank identifier: `num, _ := strconv.Atoi(numStr)`;
44-
# default is false: such cases aren't reported by default.
45-
check-blank: true
46-
gocritic:
47-
disabled-checks:
48-
- singleCaseSwitch
49-
- appendAssign
50-
revive:
51-
ignore-generated-header: true
52-
severity: warning
20+
settings:
21+
errcheck:
22+
check-blank: true
23+
gocritic:
24+
disabled-checks:
25+
- singleCaseSwitch
26+
- appendAssign
27+
revive:
28+
rules:
29+
- name: blank-imports
30+
disabled: true
31+
- name: context-as-argument
32+
disabled: true
33+
- name: error-strings
34+
disabled: true
35+
- name: exported
36+
disabled: true
37+
- name: package-comments
38+
disabled: true
39+
- name: redefines-builtin-id
40+
disabled: true
41+
- name: unexported-return
42+
disabled: true
43+
- name: unused-parameter
44+
disabled: true
45+
- name: var-declaration
46+
disabled: true
47+
staticcheck:
48+
checks:
49+
- "all"
50+
- "-QF*"
51+
- "-ST1005"
52+
- "-ST1003"
53+
- "-S1030"
54+
exclusions:
55+
rules:
56+
- path: _test\.go
57+
linters:
58+
- dupl
59+
- gosec
60+
- goconst
61+
- linters:
62+
- revive
63+
text: "var-naming: don't use leading k"
64+
- linters:
65+
- staticcheck
66+
text: "SA1019:"
67+
presets:
68+
- comments
69+
- common-false-positives
70+
- legacy
71+
- std-error-handling
72+
73+
formatters:
74+
enable:
75+
- goimports
76+
- gofmt

‎.github/workflows/go.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
tests-excludes-regex: /cloudbuild
1616
race-tests-excludes-regex: /cloudbuild
1717
skip-race-tests: true
18-
go-versions: "['1.21']"
18+
go-versions: "['1.25']"
1919

2020
linter:
2121
uses: openconfig/common-ci/.github/workflows/linter.yml@v0.2.0

‎Makefile‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,10 +29,14 @@ up: kind-start
2929
## Destroy test environment
3030
down: kind-stop
3131

32+
LDFLAGS := -s -w \
33+
-X github.com/openconfig/kne/version.Version=$(TAG) \
34+
-X github.com/openconfig/kne/version.Commit=$(COMMIT)
35+
3236
.PHONY: build
3337
## Build kne
3438
build:
35-
CGO_ENABLED=0 go build -o $(KNE_CLI_BIN) -ldflags="-s -w" kne_cli/main.go
39+
CGO_ENABLED=0 go build -o $(KNE_CLI_BIN) -ldflags="$(LDFLAGS)" kne_cli/main.go
3640

3741
.PHONY: install
3842
## Install kne cli binary to user's local bin dir

‎cmd/root.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ import (
2323
"github.com/openconfig/kne/cmd/deploy"
2424
"github.com/openconfig/kne/cmd/topology"
2525
"github.com/openconfig/kne/topo"
26+
"github.com/openconfig/kne/version"
2627
"github.com/spf13/cobra"
2728
"github.com/spf13/viper"
2829
"k8s.io/client-go/util/homedir"
@@ -64,9 +65,20 @@ environment.`,
6465
root.AddCommand(topology.New())
6566
root.AddCommand(deploy.NewDeploy())
6667
root.AddCommand(deploy.NewTeardown())
68+
root.AddCommand(newVersionCmd())
6769
return root
6870
}
6971

72+
func newVersionCmd() *cobra.Command {
73+
return &cobra.Command{
74+
Use: "version",
75+
Short: "Print the version",
76+
Run: func(cmd *cobra.Command, _ []string) {
77+
fmt.Fprintln(cmd.OutOrStdout(), version.String())
78+
},
79+
}
80+
}
81+
7082
func defaultCfgFile() string {
7183
if home := homedir.HomeDir(); home != "" {
7284
return filepath.Join(home, ".config", "kne", "config.yaml")

‎deploy/deploy.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -633,7 +633,7 @@ func (k *KindSpec) checkDependencies() error {
633633

634634
func (k *KindSpec) create() error {
635635
// Create a KNE dir under /tmp intended to hold files to be mounted into the kind cluster.
636-
if err := os.MkdirAll("/tmp/kne", os.ModePerm); err != nil {
636+
if err := os.MkdirAll("/tmp/kne", 0750); err != nil {
637637
return err
638638
}
639639
if k.Recycle {

‎deploy/gobgp/Dockerfile‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,14 @@
1-
FROM hfam/ubuntu:latest
1+
FROM ubuntu:24.04
2+
3+
RUN apt-get update && apt-get install -y --no-install-recommends \
4+
curl \
5+
ca-certificates \
6+
&& rm -rf /var/lib/apt/lists/*
27

38
RUN curl -LO "https://github.com/osrg/gobgp/releases/download/v2.31.0/gobgp_2.31.0_linux_amd64.tar.gz" \
4-
&& tar -xzf gobgp_2.31.0_linux_amd64.tar.gz && chmod +x gobgpd && chmod +x gobgp \
5-
&& mv gobgpd /usr/local/bin/gobgpd && mv gobgp /usr/local/bin/gobgp
9+
&& tar -xzf gobgp_2.31.0_linux_amd64.tar.gz && chmod +x gobgpd && chmod +x gobgp \
10+
&& mv gobgpd /usr/local/bin/gobgpd && mv gobgp /usr/local/bin/gobgp \
11+
&& rm -f gobgp_2.31.0_linux_amd64.tar.gz
12+
13+
RUN groupadd -r kne && useradd -r -g kne -s /sbin/nologin kne
14+
USER kne

‎deploy/ubuntu/Dockerfile‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,19 @@
1-
FROM ubuntu:latest
1+
FROM ubuntu:24.04
22

3-
RUN apt-get update && apt-get install -y \
3+
RUN apt-get update && apt-get install -y --no-install-recommends \
44
curl \
55
wget \
66
iproute2 \
77
iputils-ping \
88
tcpdump \
99
telnet \
1010
traceroute \
11+
ca-certificates \
1112
&& rm -rf /var/lib/apt/lists/*
1213

1314
RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
1415
&& chmod +x kubectl \
1516
&& mv kubectl /usr/local/bin/kubectl
17+
18+
RUN groupadd -r kne && useradd -r -g kne -s /sbin/nologin kne
19+
USER kne

0 commit comments

Comments
 (0)