Skip to content

MGMT-20398: Force status on bmh after install #10606

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pastequo wants to merge 2 commits into
base: master
Choose a base branch
from
Open

MGMT-20398: Force status on bmh after install #10606

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bb2d6dc
MGMT-20398: Force bmh state if ironic doesn't update it
pastequo Jul 27, 2026
4c01cfe
MGMT-20398: Vendor
pastequo Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
The diff you're trying to view is too large. We only load the first 3000 changed files.
22 changes: 12 additions & 10 deletions cmd/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,6 +173,7 @@ var Options struct {
AllowConvergedFlow bool `envconfig:"ALLOW_CONVERGED_FLOW" default:"true"`
EnableMetal3 bool `envconfig:"ENABLE_METAL3" default:"true"`
PauseProvisionedBMHs bool `envconfig:"PAUSE_PROVISIONED_BMHS" default:"true"`
StaleProvisioningRemediationEnabled bool `envconfig:"STALE_PROVISIONING_REMEDIATION_ENABLED" default:"true"`
ForceInsecurePolicyJson bool `envconfig:"FORCE_INSECURE_POLICY_JSON" default:"false"`
PreprovisioningImageControllerConfig controllers.PreprovisioningImageControllerConfig
BMACConfig controllers.BMACConfig
Expand Down Expand Up @@ -358,16 +359,17 @@ func startKubeAPIControllers(

if Options.EnableMetal3 && Options.EnableImageService {
failOnError((&controllers.BMACReconciler{
Client: ctrlMgr.GetClient(),
APIReader: ctrlMgr.GetAPIReader(),
Log: log,
Scheme: ctrlMgr.GetScheme(),
Installer: bm,
SpokeK8sClientFactory: spokeClientFactory,
ConvergedFlowEnabled: useConvergedFlow,
PauseProvisionedBMHs: Options.PauseProvisionedBMHs,
Drainer: &controllers.KubectlDrainer{},
Config: &Options.BMACConfig,
Client: ctrlMgr.GetClient(),
APIReader: ctrlMgr.GetAPIReader(),
Log: log,
Scheme: ctrlMgr.GetScheme(),
Installer: bm,
SpokeK8sClientFactory: spokeClientFactory,
ConvergedFlowEnabled: useConvergedFlow,
PauseProvisionedBMHs: Options.PauseProvisionedBMHs,
StaleProvisioningRemediationEnabled: Options.StaleProvisioningRemediationEnabled,
Drainer: &controllers.KubectlDrainer{},
Config: &Options.BMACConfig,
}).SetupWithManager(ctrlMgr), "unable to create controller BMH")
}
failOnError((&controllers.AgentClusterInstallReconciler{
Expand Down
4 changes: 2 additions & 2 deletions cmd/operator/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,7 +212,7 @@ func main() {
Scheme: mgr.GetScheme(),
NodeSelector: nodeSelector,
Tolerations: tolerations,
Recorder: mgr.GetEventRecorderFor("agentserviceconfig-controller"),
Recorder: mgr.GetEventRecorderFor("agentserviceconfig-controller"), //nolint:staticcheck // required few changes
PodIntrospector: introspector,
IsOpenShift: isOpenShift,
},
Expand All @@ -229,7 +229,7 @@ func main() {
Scheme: mgr.GetScheme(),
NodeSelector: nodeSelector,
Tolerations: tolerations,
Recorder: mgr.GetEventRecorderFor("hypershiftagentserviceconfig-controller"),
Recorder: mgr.GetEventRecorderFor("hypershiftagentserviceconfig-controller"), //nolint:staticcheck // required few changes
IsOpenShift: isOpenShift,
},
Client: mgr.GetClient(),
Expand Down
2 changes: 1 addition & 1 deletion cmd/webadmission/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ func main() {
)
}

func createDecoder() *admission.Decoder {
func createDecoder() admission.Decoder {
scheme := runtime.NewScheme()
err := hiveext.AddToScheme(scheme)
if err != nil {
Expand Down
13 changes: 7 additions & 6 deletions config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -258,23 +258,24 @@ rules:
- apiGroups:
- metal3.io
resources:
- preprovisioningimages
- baremetalhosts/status
- preprovisioningimages/status
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- metal3.io
resources:
- preprovisioningimages/status
- preprovisioningimages
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- metal3.io
resources:
Expand Down
13 changes: 7 additions & 6 deletions deploy/olm-catalog/manifests/assisted-service-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -808,23 +808,24 @@ spec:
- apiGroups:
- metal3.io
resources:
- preprovisioningimages
- baremetalhosts/status
- preprovisioningimages/status
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- metal3.io
resources:
- preprovisioningimages/status
- preprovisioningimages
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- metal3.io
resources:
Expand Down
129 changes: 55 additions & 74 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,37 +35,37 @@ require (
github.com/google/renameio v1.0.1
github.com/google/uuid v1.6.0
github.com/hashicorp/go-multierror v1.1.1
github.com/hashicorp/go-version v1.6.0
github.com/hashicorp/go-version v1.7.0
github.com/iancoleman/strcase v0.2.0
github.com/itchyny/gojq v0.12.8
github.com/jackc/pgx/v5 v5.6.0
Comment thread
pastequo marked this conversation as resolved.

@coderabbitai coderabbitai Bot Aug 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Upgrade github.com/jackc/pgx/v5 before merge.

The v5.6.0 pin at Line 41 remains vulnerable. OSV Scanner reports critical SQL-injection and memory-safety advisories. pkg/db/db.go imports this module, so the dependency is used on a production path. Upgrade to a fixed release and regenerate dependency metadata. This repeats the existing review finding.

🧰 Tools
🪛 OSV Scanner (2.4.0)

[CRITICAL] 41-41: github.com/jackc/pgx/v5 5.6.0: CVE-2026-33815 in github.com/jackc/pgx

(GO-2026-4771)

[CRITICAL] 41-41: github.com/jackc/pgx/v5 5.6.0: CVE-2026-33816 in github.com/jackc/pgx

(GO-2026-4772)

[CRITICAL] 41-41: github.com/jackc/pgx/v5 5.6.0: SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx

(GO-2026-5004)

[CRITICAL] 41-41: github.com/jackc/pgx/v5 5.6.0: Memory-safety vulnerability in github.com/jackc/pgx/v5.

(GHSA-9jj7-4m8r-rfcm)

[CRITICAL] 41-41: github.com/jackc/pgx/v5 5.6.0: pgx: SQL Injection via placeholder confusion with dollar quoted string literals

(GHSA-j88v-2chj-qfwx)

[CRITICAL] 41-41: github.com/jackc/pgx/v5 5.6.0: pgx contains memory-safety vulnerability

(GHSA-xgrm-4fwx-7qm8)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 41, Upgrade the github.com/jackc/pgx/v5 dependency from
v5.6.0 to a fixed, non-vulnerable release, then regenerate the related
dependency metadata so go.mod and go.sum remain consistent.

Source: Linters/SAST tools

github.com/jinzhu/copier v0.3.5
github.com/kelseyhightower/envconfig v1.4.0
github.com/kennygrant/sanitize v1.2.4
github.com/krishicks/yaml-patch v0.0.10
github.com/metal3-io/baremetal-operator/apis v0.2.0
github.com/metal3-io/baremetal-operator/apis v0.13.1
github.com/moby/moby v27.2.1+incompatible

@coderabbitai coderabbitai Bot Aug 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Upgrade or isolate github.com/moby/moby.

The v27.2.1+incompatible pin at Line 47 remains affected by high-severity Docker/Moby advisories. Upgrade it if production or image-management code loads the affected packages. If this dependency is test-only, keep it outside the production dependency graph and document that boundary. This repeats the existing review finding.

🧰 Tools
🪛 OSV Scanner (2.4.0)

[HIGH] 47-47: github.com/moby/moby 27.2.1+incompatible: Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker

(GO-2026-4883)

[HIGH] 47-47: github.com/moby/moby 27.2.1+incompatible: Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker

(GO-2026-4887)

[HIGH] 47-47: github.com/moby/moby 27.2.1+incompatible: Race condition in 'docker cp' in github.com/docker/docker allows bind mount redirection

(GO-2026-5617)

[HIGH] 47-47: github.com/moby/moby 27.2.1+incompatible: Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap in github.com/docker/docker

(GO-2026-5668)

[HIGH] 47-47: github.com/moby/moby 27.2.1+incompatible: Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/docker

(GO-2026-5746)

[HIGH] 47-47: github.com/moby/moby 27.2.1+incompatible: Moby has an Off-by-one error in its plugin privilege validation

(GHSA-pxq6-2prw-chj9)

[HIGH] 47-47: github.com/moby/moby 27.2.1+incompatible: Docker: Race condition in docker cp allows bind mount redirection to host path

(GHSA-rg2x-37c3-w2rh)

[HIGH] 47-47: github.com/moby/moby 27.2.1+incompatible: Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

(GHSA-vp62-88p7-qqf5)

[HIGH] 47-47: github.com/moby/moby 27.2.1+incompatible: Moby has AuthZ plugin bypass when provided oversized request bodies

(GHSA-x744-4wpc-v9h2)

[HIGH] 47-47: github.com/moby/moby 27.2.1+incompatible: Docker: PUT /containers/{id}/archive executes container binary on the host

(GHSA-x86f-5xw2-fm2r)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 47, Update the github.com/moby/moby dependency from
v27.2.1+incompatible to a non-vulnerable compatible release when it is used by
production or image-management code; otherwise isolate it from the production
dependency graph as test-only and document that boundary.

Source: Linters/SAST tools

github.com/nmstate/nmstate/rust/src/go/nmstate v0.0.0-20220811151154-801022633c42
github.com/onsi/ginkgo v1.16.5
github.com/onsi/gomega v1.35.1
github.com/onsi/gomega v1.38.2
github.com/openshift-online/ocm-sdk-go v0.1.499
github.com/openshift/api v0.0.0-20251203133830-85216507eada
github.com/openshift/api v0.0.0-20260318185450-1f2fa3f09f4e
github.com/openshift/assisted-image-service v0.0.0-20231023144959-c402402f52bf
github.com/openshift/assisted-service/api v0.0.0
github.com/openshift/assisted-service/client v0.0.0
github.com/openshift/assisted-service/models v0.0.0
github.com/openshift/client-go v0.0.0-20230926161409-848405da69e1
github.com/openshift/cluster-baremetal-operator v0.0.0-20240207191432-82df158cd2e9
github.com/openshift/client-go v0.0.0-20260317180604-743f664b82d1
github.com/openshift/cluster-baremetal-operator v0.0.0-20260703233655-0d634647457a
github.com/openshift/custom-resource-status v1.1.3-0.20220503160415-f2fdb4999d87
github.com/openshift/generic-admission-server v1.14.1-0.20231020105858-8dcc3c9b298f
github.com/openshift/generic-admission-server v1.14.1-0.20260305203524-5df3cca1e3cd
github.com/openshift/hive/apis v0.0.0-20260415205034-aa1db747a6ba
github.com/openshift/image-customization-controller v0.0.0-20240307203510-394809633b6b
github.com/openshift/library-go v0.0.0-20231110170715-08d73a9c798b
github.com/openshift/library-go v0.0.0-20260302185341-e54c5496d2f0
github.com/patrickmn/go-cache v2.1.0+incompatible
github.com/pelletier/go-toml v1.9.5
github.com/pkg/errors v0.9.1
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.57.0
github.com/prometheus/client_golang v1.18.0
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.74.0
github.com/prometheus/client_golang v1.23.2
github.com/rs/cors v1.11.1
github.com/samber/lo v1.47.0
github.com/segmentio/kafka-go v0.4.38
Expand All @@ -84,24 +84,24 @@ require (
gopkg.in/yaml.v2 v2.4.0
gorm.io/driver/postgres v1.6.0
gorm.io/gorm v1.25.10
k8s.io/api v0.34.2
k8s.io/apiextensions-apiserver v0.29.5
k8s.io/apimachinery v0.34.2
k8s.io/client-go v0.29.9
k8s.io/klog/v2 v2.130.1
k8s.io/kube-aggregator v0.29.5
k8s.io/kubectl v0.29.9
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
k8s.io/api v0.35.6
k8s.io/apiextensions-apiserver v0.35.6
k8s.io/apimachinery v0.35.6
k8s.io/client-go v0.35.6
k8s.io/klog/v2 v2.140.0
k8s.io/kube-aggregator v0.35.6
k8s.io/kubectl v0.35.6
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2
open-cluster-management.io/api v0.12.0
sigs.k8s.io/controller-runtime v0.16.3
sigs.k8s.io/controller-runtime v0.23.3
sigs.k8s.io/yaml v1.6.0
)

require (
cloud.google.com/go/compute/metadata v0.9.0 // indirect
cel.dev/expr v0.25.1 // indirect
dario.cat/mergo v1.0.2 // indirect
github.com/MakeNowJust/heredoc v1.0.0 // indirect
github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df // indirect
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
github.com/chai2010/gettext-go v1.0.2 // indirect
github.com/containerd/errdefs v1.0.0 // indirect
Expand All @@ -112,66 +112,64 @@ require (
github.com/ebitengine/purego v0.10.0 // indirect
github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab // indirect
github.com/emicklei/go-restful/v3 v3.12.2 // indirect
github.com/evanphx/json-patch/v5 v5.8.0 // indirect
github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d // indirect
github.com/go-errors/errors v1.4.2 // indirect
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
github.com/go-errors/errors v1.5.1 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-ole/go-ole v1.2.6 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/mock v1.6.0 // indirect
github.com/google/btree v1.1.3 // indirect
github.com/google/cel-go v0.17.7 // indirect
github.com/google/cel-go v0.26.0 // indirect
github.com/google/gnostic-models v0.7.0 // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.1 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
github.com/jackc/puddle/v2 v2.2.2 // indirect
github.com/kylelemons/godebug v1.1.0 // indirect
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
github.com/magiconair/properties v1.8.10 // indirect
github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
github.com/mitchellh/go-wordwrap v1.0.1 // indirect
github.com/moby/docker-image-spec v1.3.1 // indirect
github.com/moby/go-archive v0.2.0 // indirect
github.com/moby/patternmatcher v0.6.0 // indirect
github.com/moby/spdystream v0.5.1 // indirect
github.com/moby/sys/sequential v0.6.0 // indirect
github.com/moby/sys/user v0.4.0 // indirect
github.com/moby/sys/userns v0.1.0 // indirect
github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
github.com/morikuni/aec v1.0.0 // indirect
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
github.com/openshift-online/ocm-api-model/clientapi v0.0.453 // indirect
github.com/openshift-online/ocm-api-model/model v0.0.453 // indirect
github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/sergi/go-diff v1.2.0 // indirect
github.com/shirou/gopsutil/v4 v4.26.2 // indirect
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
github.com/stoewer/go-strcase v1.3.0 // indirect
github.com/tklauser/go-sysconf v0.3.16 // indirect
github.com/tklauser/numcpus v0.11.0 // indirect
github.com/x448/float16 v0.8.4 // indirect
github.com/xdg/scram v1.0.5 // indirect
github.com/xdg/stringprep v1.0.3 // indirect
github.com/xlab/treeprint v1.2.0 // indirect
github.com/yusufpapurcu/wmi v1.2.4 // indirect
go.etcd.io/bbolt v1.3.10 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 // indirect
go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
k8s.io/apiserver v0.29.5 // indirect
k8s.io/cli-runtime v0.29.9 // indirect
k8s.io/component-base v0.29.9 // indirect
k8s.io/kms v0.29.5 // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
k8s.io/apiserver v0.35.6 // indirect
k8s.io/cli-runtime v0.35.6 // indirect
k8s.io/component-base v0.35.6 // indirect
k8s.io/kms v0.35.6 // indirect
sigs.k8s.io/gateway-api v1.0.0 // indirect
sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3 // indirect
sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3 // indirect
sigs.k8s.io/kustomize/api v0.20.1 // indirect
sigs.k8s.io/kustomize/kyaml v0.20.1 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.2-0.20260122202528-d9cc6641c482 // indirect
)

require (
Expand All @@ -190,22 +188,18 @@ require (
github.com/docker/docker v28.5.2+incompatible // indirect
github.com/docker/go-connections v0.6.0
github.com/docker/go-units v0.5.0 // indirect
github.com/evanphx/json-patch v5.7.0+incompatible // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/fsnotify/fsnotify v1.7.0 // indirect
github.com/ghodss/yaml v1.0.0 // indirect
github.com/fsnotify/fsnotify v1.9.0 // indirect
github.com/go-logr/zapr v1.3.0 // indirect
github.com/go-openapi/analysis v0.23.0 // indirect
github.com/go-openapi/jsonpointer v0.21.0 // indirect
github.com/go-openapi/jsonreference v0.21.0 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/glog v1.2.5 // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
github.com/gorilla/css v1.0.0 // indirect
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
github.com/imdario/mergo v0.3.16 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/itchyny/timefmt-go v0.1.3 // indirect
github.com/jackc/pgpassfile v1.0.0 // indirect
Expand All @@ -218,7 +212,6 @@ require (
github.com/klauspost/compress v1.18.2 // indirect
github.com/lib/pq v1.10.9
github.com/mailru/easyjson v0.7.7 // indirect
github.com/metal3-io/baremetal-operator/pkg/hardwareutils v0.2.0 // indirect
github.com/microcosm-cc/bluemonday v1.0.26 // indirect
github.com/mitchellh/mapstructure v1.5.0 // indirect
github.com/moby/term v0.5.2 // indirect
Expand All @@ -233,27 +226,27 @@ require (
github.com/pierrec/lz4/v4 v4.1.17 // indirect
github.com/pkg/xattr v0.4.10
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/client_model v0.5.0 // indirect
github.com/prometheus/common v0.45.0 // indirect
github.com/prometheus/procfs v0.12.0 // indirect
github.com/spf13/cobra v1.8.0 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/common v0.66.1 // indirect
github.com/prometheus/procfs v0.16.1 // indirect
github.com/spf13/cobra v1.10.0 // indirect
github.com/spf13/pflag v1.0.10 // indirect
github.com/stretchr/objx v0.5.2 // indirect
github.com/testcontainers/testcontainers-go v0.41.0
github.com/ulikunitz/xz v0.5.15 // indirect
go.etcd.io/etcd/api/v3 v3.5.11 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.5.11 // indirect
go.etcd.io/etcd/client/v3 v3.5.11 // indirect
go.etcd.io/etcd/api/v3 v3.6.5 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.6.5 // indirect
go.etcd.io/etcd/client/v3 v3.6.5 // indirect
go.mongodb.org/mongo-driver v1.14.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
go.opentelemetry.io/otel v1.43.0 // indirect
go.opentelemetry.io/otel/metric v1.43.0 // indirect
go.opentelemetry.io/otel/sdk v1.43.0 // indirect
go.opentelemetry.io/otel/trace v1.43.0 // indirect
Comment thread
pastequo marked this conversation as resolved.
Comment on lines +241 to 246

@coderabbitai coderabbitai Bot Aug 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Resolve google.golang.org/grpc to a fixed version.

The dependency updates at Lines 241-246 still leave google.golang.org/grpc v1.79.3 in the module graph. OSV Scanner reports vulnerabilities in the xDS RBAC and HTTP/2 implementations. Upgrade the dependency that selects gRPC, then regenerate vendor metadata. This repeats the existing review finding.

🧰 Tools
🪛 OSV Scanner (2.4.0)

[HIGH] 241-241: google.golang.org/grpc 1.79.3: Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

(GO-2026-6061)

[HIGH] 241-241: google.golang.org/grpc 1.79.3: gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

(GHSA-hrxh-6v49-42gf)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 241 - 246, Update the dependency selecting
google.golang.org/grpc so the module graph resolves to a non-vulnerable fixed
version instead of v1.79.3, then regenerate go.mod/go.sum and vendor metadata to
reflect the resolved version. Preserve the existing OpenTelemetry dependency
updates.

Source: Linters/SAST tools

go.opentelemetry.io/proto/otlp v1.0.0 // indirect
go.opentelemetry.io/proto/otlp v1.5.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.26.0 // indirect
go.uber.org/zap v1.27.0 // indirect
golang.org/x/net v0.55.0 // indirect
golang.org/x/oauth2 v0.34.0 // indirect
golang.org/x/term v0.43.0 // indirect
Expand All @@ -267,28 +260,16 @@ require (
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
gopkg.in/yaml.v3 v3.0.1
k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.29.0 // indirect
k8s.io/kube-openapi v0.0.0-20260304202019-5b3e3fdb0acf // indirect
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/kube-storage-version-migrator v0.0.6-0.20230721195810-5c8923c5ff96 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect
)

replace (
github.com/google/gnostic-models => github.com/google/gnostic-models v0.6.8
github.com/metal3-io/baremetal-operator => github.com/openshift/baremetal-operator v0.0.0-20231019133159-8643f32fea3e
github.com/metal3-io/baremetal-operator/apis => github.com/openshift/baremetal-operator/apis v0.0.0-20231019133159-8643f32fea3e
github.com/metal3-io/baremetal-operator/pkg/hardwareutils => github.com/openshift/baremetal-operator/pkg/hardwareutils v0.0.0-20231019133159-8643f32fea3e
github.com/opencontainers/runc => github.com/opencontainers/runc v1.1.12
github.com/openshift/assisted-service/api => ./api
github.com/openshift/assisted-service/client => ./client
github.com/openshift/assisted-service/cmd/agentbasedinstaller => ./cmd/agentbasedinstaller
github.com/openshift/assisted-service/models => ./models
golang.org/x/oauth2 => github.com/openshift/golang-oauth2 v0.26.1-0.20250310184649-06a918c6239d
Comment thread
coderabbitai[bot] marked this conversation as resolved.
// k8s.io/api, apimachinery and kube-openapi pinned for k8s.io/client-go's scheme which uses alpha API packages
k8s.io/api => k8s.io/api v0.29.9
k8s.io/apimachinery => k8s.io/apimachinery v0.29.9
k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340
sigs.k8s.io/cluster-api-provider-aws => github.com/openshift/cluster-api-provider-aws v0.2.1-0.20201022175424-d30c7a274820
sigs.k8s.io/cluster-api-provider-azure => github.com/openshift/cluster-api-provider-azure v0.1.0-alpha.3.0.20201016155852-4090a6970205
)
Loading