OCPBUGS-24987, OCPBUGS-30319: bump lib-go to fix SAs acting as OAuth2 clients #142

liouk · 2024-03-14T10:41:13Z

Pulls openshift/kubernetes-apiserver#56

liouk · 2024-03-14T10:49:58Z

/hold proof PR

liouk · 2024-03-15T15:21:02Z

/retest-required

liouk · 2024-03-18T08:16:24Z

/retest-required

liouk · 2024-03-18T14:02:21Z

/retest-required

liouk · 2024-03-19T08:48:09Z

/retest-required

liouk · 2024-03-20T09:16:21Z

/retest-required

liouk · 2024-03-25T09:34:48Z

/retest-required

liouk · 2024-04-10T14:14:07Z

Updated PR to point to openshift/[email protected].

liouk · 2024-04-11T09:14:02Z

/retest-required

liouk · 2024-04-11T10:16:22Z

/retitle OCPBUGS-30319: Bump openshift/kubernetes-apiserver to openshift-apiserver-4.16-kubernetes-1.29.2

openshift-bot · 2024-04-11T10:16:45Z

@liouk: This pull request references Jira Issue OCPBUGS-30319, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.16.0) matches configured target version for branch (4.16.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @dpuniaredhat

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Pulls openshift/kubernetes-apiserver#56

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

stlaz · 2024-04-11T10:24:42Z

/retitle OCPBUGS-30319: bump lib-go to fix SAs acting as OAuth2 clients

stlaz · 2024-04-11T10:27:16Z

images/Dockerfile.rhel

@@ -1,4 +1,4 @@
-FROM registry.ci.openshift.org/ocp/builder:rhel-8-golang-1.19-openshift-4.14 AS builder


maybe also update the runner image?

You can't change the base image to RHEL 9 without also changing the build image to RHEL 9, because RHEL 8 and 9 have different versions of OpenSSL. This change has broken all FIPS clusters.

stlaz · 2024-04-11T10:49:09Z

pkg/server/headers/oauthbasic.go

-func WithPreserveAuthorizationHeader(handler http.Handler) http.Handler {
+var oauthHeaders = []string{
+	"Authorization",
+	"X-Remote-User",


Should we keep all the authentication headers the default handler chain removes?
The requestheader provider won't work properly in case any of the headers configured in https://github.com/openshift/api/blob/master/config/v1/types_oauth.go#L415-L424 match any headers that are being removed in the kube default handler chain.

…ft/*)

liouk · 2024-04-11T12:32:58Z

Proof PR updated and can now be used to perform the actual bump.

/hold cancel

stlaz · 2024-04-12T07:50:45Z

pkg/oauthserver/oauth_apiserver.go

+	preservedHeaders := make([]string, 0)
+	for _, identityProvider := range c.ExtraOAuthConfig.Options.IdentityProviders {
+		switch provider := identityProvider.Provider.Object.(type) {
+		case *osinv1.RequestHeaderIdentityProvider:
+			preservedHeaders = append(preservedHeaders, provider.Headers...)
+			preservedHeaders = append(preservedHeaders, provider.PreferredUsernameHeaders...)
+			preservedHeaders = append(preservedHeaders, provider.NameHeaders...)
+			preservedHeaders = append(preservedHeaders, provider.EmailHeaders...)
+		}
+	}


extract into a function, shove into the With*() call

stlaz · 2024-04-12T07:52:23Z

pkg/server/headers/oauthbasic.go

 )

-func WithPreserveAuthorizationHeader(handler http.Handler) http.Handler {
+func WithPreserveOAuthHeaders(handler http.Handler, preservedHeaders []string) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {


build the complete headers slice ahead of time, not during HTTP handling

stlaz · 2024-04-12T11:20:59Z

images/Dockerfile.rhel

 WORKDIR /go/src/github.com/openshift/oauth-server
 COPY . .
 ENV GO_PACKAGE github.com/openshift/oauth-server
 RUN make build --warn-undefined-variables

-FROM registry.ci.openshift.org/ocp/4.14:base
+FROM registry.ci.openshift.org/ocp/4.16:base


FROM registry.ci.openshift.org/ocp/4.16:base-rhel9

stlaz · 2024-04-12T13:01:16Z

/lgtm

stlaz · 2024-04-12T13:02:17Z

/retitle OCPBUGS-24987, OCPBUGS-30319: bump lib-go to fix SAs acting as OAuth2 clients

openshift-ci · 2024-04-12T13:13:48Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liouk, stlaz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [stlaz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2024-04-12T15:51:04Z

/retest-required

Remaining retests: 0 against base HEAD 8296c05 and 2 for PR HEAD bacdbd8 in total

openshift-ci · 2024-04-12T18:15:57Z

@liouk: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci-robot · 2024-04-12T18:18:52Z

@liouk: Jira Issue OCPBUGS-30319: Some pull requests linked via external trackers have merged:

The following pull requests linked via external trackers have not merged:

openshift/oauth-apiserver#108 is open

These pull request must merge or be unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-30319 has not been moved to the MODIFIED state.

In response to this:

Pulls openshift/kubernetes-apiserver#56

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-bot · 2024-04-12T22:53:50Z

[ART PR BUILD NOTIFIER]

This PR has been included in build oauth-server-container-v4.16.0-202404121812.p0.g396c1ff.assembly.stream.el9 for distgit oauth-server.
All builds following this will include this PR.

openshift-merge-robot · 2024-04-16T01:38:53Z

Fix included in accepted release 4.16.0-0.nightly-2024-04-15-184947

openshift-ci bot requested review from mfojtik and stlaz March 14, 2024 10:43

liouk mentioned this pull request Mar 14, 2024

[openshift-apiserver-4.16-kubernetes-1.29.2] Add carry patches from 4.15 openshift/kubernetes-apiserver#56

Merged

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 14, 2024

liouk force-pushed the prove-kubernetes-apiserver-56 branch 2 times, most recently from d03fda9 to db5c362 Compare March 15, 2024 12:21

liouk force-pushed the prove-kubernetes-apiserver-56 branch 4 times, most recently from 1c53e75 to f731bf2 Compare April 10, 2024 14:06

openshift-ci bot changed the title ~~Proof for https://github.com/openshift/kubernetes-apiserver/pull/56~~ OCPBUGS-30319: Bump openshift/kubernetes-apiserver to openshift-apiserver-4.16-kubernetes-1.29.2 Apr 11, 2024

openshift-ci bot requested a review from dpuniaredhat April 11, 2024 10:16

openshift-ci bot changed the title ~~OCPBUGS-30319: Bump openshift/kubernetes-apiserver to openshift-apiserver-4.16-kubernetes-1.29.2~~ OCPBUGS-30319: bump lib-go to fix SAs acting as OAuth2 clients Apr 11, 2024

stlaz reviewed Apr 11, 2024

View reviewed changes

bump and vendor (kubernetes,kubernetes-apiserver,api,k8s.io/*,openshi…

346c3ca

…ft/*)

replace obsolete kaudit.NewEventFromRequest()

7b966a6

liouk force-pushed the prove-kubernetes-apiserver-56 branch from f731bf2 to 4a5a3dc Compare April 11, 2024 12:17

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 11, 2024

stlaz suggested changes Apr 12, 2024

View reviewed changes

liouk force-pushed the prove-kubernetes-apiserver-56 branch from 4a5a3dc to c0803c4 Compare April 12, 2024 09:54

stlaz suggested changes Apr 12, 2024

View reviewed changes

liouk added 2 commits April 12, 2024 14:57

update builder and ci images

8a6f3a1

oauthserver: preserve headers used by RequestHeaderIdentityProvider

bacdbd8

liouk force-pushed the prove-kubernetes-apiserver-56 branch from c0803c4 to bacdbd8 Compare April 12, 2024 12:57

openshift-ci bot changed the title ~~OCPBUGS-30319: bump lib-go to fix SAs acting as OAuth2 clients~~ OCPBUGS-24987, OCPBUGS-30319: bump lib-go to fix SAs acting as OAuth2 clients Apr 12, 2024

openshift-ci bot assigned stlaz Apr 12, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Apr 12, 2024

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 12, 2024

openshift-merge-bot bot merged commit 396c1ff into openshift:master Apr 12, 2024
8 checks passed

openshift-ci-robot mentioned this pull request Apr 15, 2024

OCPBUGS-30319: bump lib-go to fix SAs acting as OAuth2 clients openshift/oauth-apiserver#108

Merged

This was referenced Apr 15, 2024

OCPBUGS-24987: Updating oauth-server-container image to be consistent with ART #140

Closed

NO-JIRA: bump lib-go, k8s to get rid of the goproxy dep #131

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-24987, OCPBUGS-30319: bump lib-go to fix SAs acting as OAuth2 clients #142

OCPBUGS-24987, OCPBUGS-30319: bump lib-go to fix SAs acting as OAuth2 clients #142

liouk commented Mar 14, 2024

liouk commented Mar 14, 2024

liouk commented Mar 15, 2024

liouk commented Mar 18, 2024

liouk commented Mar 18, 2024

liouk commented Mar 19, 2024

liouk commented Mar 20, 2024

liouk commented Mar 25, 2024

liouk commented Apr 10, 2024

liouk commented Apr 11, 2024

liouk commented Apr 11, 2024

openshift-bot commented Apr 11, 2024

stlaz commented Apr 11, 2024

stlaz Apr 11, 2024

zaneb Apr 16, 2024

stlaz Apr 11, 2024

liouk commented Apr 11, 2024

stlaz Apr 12, 2024

stlaz Apr 12, 2024

stlaz Apr 12, 2024

stlaz commented Apr 12, 2024

stlaz commented Apr 12, 2024

openshift-ci bot commented Apr 12, 2024

openshift-ci-robot commented Apr 12, 2024

openshift-ci bot commented Apr 12, 2024

openshift-ci-robot commented Apr 12, 2024

openshift-bot commented Apr 12, 2024

openshift-merge-robot commented Apr 16, 2024

		@@ -1,4 +1,4 @@
		FROM registry.ci.openshift.org/ocp/builder:rhel-8-golang-1.19-openshift-4.14 AS builder

OCPBUGS-24987, OCPBUGS-30319: bump lib-go to fix SAs acting as OAuth2 clients #142

OCPBUGS-24987, OCPBUGS-30319: bump lib-go to fix SAs acting as OAuth2 clients #142

Conversation

liouk commented Mar 14, 2024

liouk commented Mar 14, 2024

liouk commented Mar 15, 2024

liouk commented Mar 18, 2024

liouk commented Mar 18, 2024

liouk commented Mar 19, 2024

liouk commented Mar 20, 2024

liouk commented Mar 25, 2024

liouk commented Apr 10, 2024

liouk commented Apr 11, 2024

liouk commented Apr 11, 2024

openshift-bot commented Apr 11, 2024

stlaz commented Apr 11, 2024

stlaz Apr 11, 2024

Choose a reason for hiding this comment

zaneb Apr 16, 2024

Choose a reason for hiding this comment

stlaz Apr 11, 2024

Choose a reason for hiding this comment

liouk commented Apr 11, 2024

stlaz Apr 12, 2024

Choose a reason for hiding this comment

stlaz Apr 12, 2024

Choose a reason for hiding this comment

stlaz Apr 12, 2024

Choose a reason for hiding this comment

stlaz commented Apr 12, 2024

stlaz commented Apr 12, 2024

openshift-ci bot commented Apr 12, 2024

openshift-ci-robot commented Apr 12, 2024

openshift-ci bot commented Apr 12, 2024

openshift-ci-robot commented Apr 12, 2024

openshift-bot commented Apr 12, 2024

openshift-merge-robot commented Apr 16, 2024