PSHP-316: update golang and base image for Hypershift Operator CVE remediation#8823
PSHP-316: update golang and base image for Hypershift Operator CVE remediation#8823BraeTroutman wants to merge 2 commits into
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
openshift-ci-robot
added
the
jira/valid-reference
|
@BraeTroutman: This pull request references PSHP-316 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Skipping CI for Draft Pull Request. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThis pull request updates the Go directive in Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8823 +/- ##
==========================================
+ Coverage 43.19% 43.28% +0.08%
==========================================
Files 767 771 +4
Lines 94910 95503 +593
==========================================
+ Hits 40997 41335 +338
- Misses 51050 51284 +234
- Partials 2863 2884 +21 see 15 files with indirect coverage changes
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 3: The Go toolchain version is now pinned to 1.25.11 in go.mod, but the
build images still reference older toolchains, so update the pinned Go version
in Containerfile.operator, Containerfile.control-plane, and
Dockerfile.github-actions-runner to 1.25.11 or newer. Make sure the changes are
consistent across these image definitions so any go build or related build step
runs with the same required toolchain version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 532c08d2-0f91-4683-8dbd-9c194c3134aa
📒 Files selected for processing (2)
Containerfile.operatorgo.mod
BraeTroutman
force-pushed
the
PSHP-316/june-cve
branch
2 times, most recently
from
ece88ee to
c6e575c
Compare
openshift-ci
Bot
added
area/ci-tooling
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Containerfile.operator`:
- Line 1: The Red Hat base image in the Containerfile is pinned to a
build-specific tag, so updates will not flow automatically. Update the FROM
reference for the builder stage, and also the runtime base image in the same
Containerfile, to use floating Red Hat tags instead of the fixed versions. Keep
the existing stage names and image sources intact while changing only the tag
values.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: bb672032-e585-4e42-bb10-1e50e0026bd5
⛔ Files ignored due to path filters (1)
hack/workspace/go.workis excluded by!**/*.work
📒 Files selected for processing (3)
Containerfile.control-planeContainerfile.operatorgo.mod
✅ Files skipped from review due to trivial changes (2)
- Containerfile.control-plane
- go.mod
BraeTroutman
force-pushed
the
PSHP-316/june-cve
branch
from
c6e575c to
f7f4c3f
Compare
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
BraeTroutman
force-pushed
the
PSHP-316/june-cve
branch
from
f7f4c3f to
5d772c6
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Containerfile.control-plane`:
- Line 1: The builder and runtime base images are pinned to specific Red Hat
build tags, which blocks automatic Red Hat security updates. Update the
Containerfile.control-plane FROM directives for both the builder stage and the
ubi-minimal runtime stage to use floating Red Hat tags instead of build-specific
version suffixes, following the Red Hat image policy while keeping non-Red Hat
images pinned by digest.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 2294a0aa-a572-47a5-9ff5-2501443bd361
⛔ Files ignored due to path filters (1)
hack/workspace/go.workis excluded by!**/*.work
📒 Files selected for processing (6)
Containerfile.cliContainerfile.control-planeContainerfile.operatorDockerfile.devDockerfile.e2ego.mod
✅ Files skipped from review due to trivial changes (1)
- Dockerfile.dev
🚧 Files skipped from review as they are similar to previous changes (1)
- go.mod
| @@ -1,4 +1,4 @@ | |||
| FROM registry.access.redhat.com/ubi9/go-toolset:1.25.9-1778054913 AS builder | |||
| FROM registry.access.redhat.com/ubi9/go-toolset:1.26.3-1782305929 AS builder | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Use floating Red Hat base image tags.
Both the go-toolset builder (Line 1) and the ubi-minimal runtime (Line 11) are pinned to build-specific tags (1.26.3-1782305929, 9.8-1782191395). Pinning these Red Hat bases prevents Red Hat-managed security updates from flowing automatically. Use floating Red Hat tags instead.
🔒 Proposed change
-FROM registry.access.redhat.com/ubi9/go-toolset:1.26.3-1782305929 AS builder
+FROM registry.access.redhat.com/ubi9/go-toolset:1.26 AS builder-FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8-1782191395
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8Also applies to: 11-11
🧰 Tools
🪛 Trivy (0.69.3)
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Containerfile.control-plane` at line 1, The builder and runtime base images
are pinned to specific Red Hat build tags, which blocks automatic Red Hat
security updates. Update the Containerfile.control-plane FROM directives for
both the builder stage and the ubi-minimal runtime stage to use floating Red Hat
tags instead of build-specific version suffixes, following the Red Hat image
policy while keeping non-Red Hat images pinned by digest.
Source: Path instructions
BraeTroutman
force-pushed
the
PSHP-316/june-cve
branch
3 times, most recently
from
52f66b5 to
a7c96d9
Compare
openshift-ci
Bot
added
the
area/api
BraeTroutman
force-pushed
the
PSHP-316/june-cve
branch
from
a7c96d9 to
af243dd
Compare
|
@BraeTroutman: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
/approve |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: BraeTroutman, clebs The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
addressing the below CVEs with golang minor version update, and bump to 9.8 ubi-minimal base image. [ticket here](https://redhat.atlassian.net/browse/PSHP-316) CVE-2026-33846 CVE-2026-33845 CVE-2026-42009 CVE-2026-42010 CVE-2026-4878 CVE-2026-33811 CVE-2026-39836 CVE-2026-27145 CVE-2026-42499 CVE-2026-33814 CVE-2026-42504 CVE-2026-39820
BraeTroutman
force-pushed
the
PSHP-316/june-cve
branch
from
af243dd to
d522607
Compare
golangci lint must be built on the same or higher version of golang as the project it is linting: update the github actions to use existing tools if their version matches, otherwise build fresh to ensure compatibility. The golang version of the linter image is also updated to the `1.26.4`
BraeTroutman
force-pushed
the
PSHP-316/june-cve
branch
from
e427f61 to
b528b0b
Compare
|
Now I have a complete understanding of the root cause. Let me produce the final report. Test Failure Analysis CompleteJob Information
Test Failure AnalysisErrorSummaryThe Root CauseGo toolchain version mismatch in hermetic build: builder image ships Go 1.26.3, but The failure chain is:
Why other Konflux builds on the same PR succeed:
Recommendations
Evidence
|
3 participants
What this PR does / why we need it:
Updates the ubi-minimal base image used for hypershift operator and other images to make use of ubi-minimal:9.8.
Go mod version is bumped to 1.25.11. Since there is no 1.25.11 tag in the go-toolset image, build images are updated to 1.26.3, which works due to golang compilation backwards compatibility guarantees
these bumps address the below CVEs
CVE-2026-33846
CVE-2026-33845
CVE-2026-42009
CVE-2026-42010
CVE-2026-4878
CVE-2026-33811
CVE-2026-39836
CVE-2026-27145
CVE-2026-42499
CVE-2026-33814
CVE-2026-42504
CVE-2026-39820
Which issue(s) this PR fixes:
Fixes #PSHP-316
Special notes for your reviewer:
Checklist:
Summary by CodeRabbit
Summary by CodeRabbit