Skip to content

Commit 2eaea1e

Browse files
komer3komer3
authored
ci: allow devbox bootstrap egress (#1073)
* ci: allow devbox bootstrap egress * ci: relax e2e runner hardening * ci: use ipv4 kind network for e2e * ci: allow linode object storage egress * ci: relax release workflow hardening * ci: restore build push hardening * build: bump Go toolchain to 1.25.10 * build: update x/net for vulncheck * build: tidy Go module checksums
1 parent 05c7417 commit 2eaea1e

8 files changed

Lines changed: 66 additions & 22 deletions

File tree

‎.github/workflows/build-push.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ jobs:
2424
api.github.com:443
2525
github.com:443
2626
auth.docker.io:443
27+
index.docker.io:443
2728
registry-1.docker.io:443
2829
production.cloudflare.docker.com:443
2930
gcr.io:443

‎.github/workflows/build_test_ci.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,12 @@ jobs:
5959
sum.golang.org:443
6060
*.githubusercontent.com:443
6161
storage.googleapis.com:443
62+
get.jetify.com:443
63+
get.jetpack.io:443
64+
releases.jetify.com:443
65+
releases.jetpack.io:443
66+
artifacts.nixos.org:443
67+
cache.nixos.org:443
6268
cli.codecov.io:443
6369
api.codecov.io:443
6470
ingest.codecov.io:443

‎.github/workflows/e2e-test.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,8 +115,15 @@ jobs:
115115
charts.jetstack.io:443
116116
helm.cilium.io:443
117117
linode.github.io:443
118+
*.linodeobjects.com:443
118119
dl.k8s.io:443
119120
cdn.dl.k8s.io:443
121+
get.jetify.com:443
122+
get.jetpack.io:443
123+
releases.jetify.com:443
124+
releases.jetpack.io:443
125+
artifacts.nixos.org:443
126+
cache.nixos.org:443
120127
121128
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
122129
with:
@@ -140,6 +147,17 @@ jobs:
140147
enable-cache: 'true'
141148
refresh-cli: 'false'
142149

150+
- name: Create IPv4-only kind network
151+
run: |
152+
# Pre-create the shared kind network as IPv4-only because
153+
# harden-runner block mode trips over Docker/kind's local IPv6
154+
# address advertisement during cluster setup.
155+
docker network inspect kind >/dev/null 2>&1 || \
156+
docker network create -d=bridge \
157+
-o com.docker.network.bridge.enable_ip_masquerade=true \
158+
-o com.docker.network.driver.mtu=1500 \
159+
kind
160+
143161
- name: Run E2E Test
144162
env:
145163
E2E_FLAGS: ${{ inputs.e2e-flags }}

‎.github/workflows/e2e-upgrade-test.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ jobs:
7979
charts.jetstack.io:443
8080
helm.cilium.io:443
8181
linode.github.io:443
82+
*.linodeobjects.com:443
8283
dl.k8s.io:443
8384
cdn.dl.k8s.io:443
8485
@@ -93,6 +94,17 @@ jobs:
9394
go-version-file: 'go.mod'
9495
check-latest: true
9596

97+
- name: Create IPv4-only kind network
98+
run: |
99+
# Pre-create the shared kind network as IPv4-only because
100+
# harden-runner block mode trips over Docker/kind's local IPv6
101+
# address advertisement during cluster setup.
102+
docker network inspect kind >/dev/null 2>&1 || \
103+
docker network create -d=bridge \
104+
-o com.docker.network.bridge.enable_ip_masquerade=true \
105+
-o com.docker.network.driver.mtu=1500 \
106+
kind
107+
96108
- name: Run Upgrade Test
97109
env:
98110
LINODE_REGION: us-sea

‎.github/workflows/pull_request_ci.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,12 @@ jobs:
7373
sum.golang.org:443
7474
*.githubusercontent.com:443
7575
storage.googleapis.com:443
76+
get.jetify.com:443
77+
get.jetpack.io:443
78+
releases.jetify.com:443
79+
releases.jetpack.io:443
80+
artifacts.nixos.org:443
81+
cache.nixos.org:443
7682
dl.k8s.io:443
7783
cdn.dl.k8s.io:443
7884
@@ -111,6 +117,7 @@ jobs:
111117
allowed-endpoints: >
112118
api.github.com:443
113119
github.com:443
120+
index.docker.io:443
114121
proxy.golang.org:443
115122
sum.golang.org:443
116123
go.dev:443

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
1717
with:
1818
disable-sudo: true
19-
egress-policy: block
19+
egress-policy: audit
2020
allowed-endpoints: >
2121
api.github.com:443
2222
github.com:443

‎go.mod‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ module github.com/linode/cluster-api-provider-linode
22

33
go 1.25.0
44

5-
toolchain go1.25.9
5+
toolchain go1.25.10
66

77
require (
88
github.com/akamai/AkamaiOPEN-edgegrid-golang/v12 v12.3.0
@@ -26,7 +26,7 @@ require (
2626
go.uber.org/automaxprocs v1.6.0
2727
go.uber.org/mock v0.6.0
2828
go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
29-
golang.org/x/mod v0.33.0
29+
golang.org/x/mod v0.34.0
3030
k8s.io/api v0.35.3
3131
k8s.io/apimachinery v0.35.3
3232
k8s.io/client-go v0.35.3
@@ -137,13 +137,13 @@ require (
137137
go.uber.org/multierr v1.11.0 // indirect
138138
go.uber.org/ratelimit v0.3.1 // indirect
139139
go.uber.org/zap v1.27.1 // indirect
140-
golang.org/x/net v0.52.0 // indirect
140+
golang.org/x/net v0.53.0 // indirect
141141
golang.org/x/oauth2 v0.35.0 // indirect
142-
golang.org/x/sys v0.42.0 // indirect
143-
golang.org/x/term v0.41.0 // indirect
144-
golang.org/x/text v0.35.0 // indirect
142+
golang.org/x/sys v0.43.0 // indirect
143+
golang.org/x/term v0.42.0 // indirect
144+
golang.org/x/text v0.36.0 // indirect
145145
golang.org/x/time v0.12.0 // indirect
146-
golang.org/x/tools v0.42.0 // indirect
146+
golang.org/x/tools v0.43.0 // indirect
147147
gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
148148
google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d // indirect
149149
google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect

‎go.sum‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -321,28 +321,28 @@ go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
321321
go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
322322
go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
323323
go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
324-
golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
325-
golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
324+
golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
325+
golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
326326
golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw=
327327
golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM=
328-
golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
329-
golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
330-
golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
331-
golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
328+
golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
329+
golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
330+
golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
331+
golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
332332
golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
333333
golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
334334
golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
335335
golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
336-
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
337-
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
338-
golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
339-
golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
340-
golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
341-
golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
336+
golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
337+
golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
338+
golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
339+
golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
340+
golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
341+
golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
342342
golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
343343
golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
344-
golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
345-
golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
344+
golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
345+
golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
346346
gomodules.xyz/jsonpatch/v2 v2.5.0 h1:JELs8RLM12qJGXU4u/TO3V25KW8GreMKl9pdkk14RM0=
347347
gomodules.xyz/jsonpatch/v2 v2.5.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
348348
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=

0 commit comments

Comments
 (0)