Update autoscaler dependency to fix CVE #1740

oksanabaza · 2024-02-15T16:18:57Z

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

Bumps k8s.io/autoscaler/cluster-autoscaler@v0.0.0-20230925095857-cf8c507d2421 to k8s.io/autoscaler/cluster-autoscaler@v0.0.0-20231227135154-33fb7885a6f6 to remove a CVE.

Which issue(s) this PR fixes:

Fixes # High CVEs

Special notes for your reviewer:

Snyk scans showed that a high CVE was introduced through:

k8s.io/autoscaler/cluster-autoscaler@v0.0.0-20230925095857-cf8c507d2421 and fixed in k8s.io/autoscaler/cluster-autoscaler@v0.0.0-20231227135154-33fb7885a6f6.

Does this PR introduce a user-facing change?

NONE

linux-foundation-easycla · 2024-02-15T16:19:01Z

The committers listed above are authorized under a signed CLA.

✅ login: oksanabaza / name: Oksana Bazylieva (9cc980a)

netlify · 2024-02-15T16:19:02Z

✅ Deploy Preview for kubernetes-sigs-kueue ready!

Name	Link
🔨 Latest commit	`9cc980a`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-sigs-kueue/deploys/65e5e57d58049f00084cb2c8
😎 Deploy Preview	https://deploy-preview-1740--kubernetes-sigs-kueue.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

k8s-ci-robot · 2024-02-15T16:19:07Z

Hi @oksanabaza. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

kannon92 · 2024-02-15T20:13:54Z

/ok-to-test

alculquicondor · 2024-02-15T20:30:52Z

We better fix clusterautoscaler first and then upgrade to a version that doesn't use satori.

KPostOffice · 2024-02-28T15:59:25Z

Just a heads up, I opened another PR for cluster-autoscaler which upgrades the runc dependency. kubernetes/autoscaler#6569

alculquicondor · 2024-03-04T16:07:52Z

/lgtm
/approve

k8s-ci-robot · 2024-03-04T16:07:59Z

LGTM label has been added.

Git tree hash: 6694cb688d0f6d3d9d24f3cf35af23083974929f

k8s-ci-robot · 2024-03-04T16:07:59Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alculquicondor, oksanabaza

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [alculquicondor]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tenzen-y · 2024-03-04T16:14:50Z

go.mod

@@ -1,6 +1,6 @@
 module sigs.k8s.io/kueue

-go 1.21
+go 1.21.6


Suggested change

go 1.21.6

I'm not sure why we need this patch version.

oh shoot, we shouldn't need it.

I can send a PR in a bit.

One you submit PR, let me know.

This reverts commit 4573682.

alculquicondor · 2024-03-04T17:06:05Z

The version in the description doesn't match the code changes.
Reverting

alculquicondor · 2024-03-04T17:06:40Z

@oksanabaza can you take over after the revert?

oksanabaza · 2024-03-04T17:17:55Z

@alculquicondor sure, will do

This reverts commit 4573682.

…ubernetes-sigs#1804)

…" (kubernetes-sigs#1796) This reverts commit 4573682.

…ubernetes-sigs#1804)

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Feb 15, 2024

k8s-ci-robot requested review from denkensk and mimowo February 15, 2024 16:19

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Feb 15, 2024

oksanabaza force-pushed the cve-fix branch from a1506c4 to 1ca6c79 Compare February 15, 2024 16:35

k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Feb 15, 2024

oksanabaza marked this pull request as ready for review February 15, 2024 16:55

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 15, 2024

k8s-ci-robot requested a review from trasc February 15, 2024 16:55

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Feb 15, 2024

oksanabaza force-pushed the cve-fix branch 2 times, most recently from dfbc2e7 to 7dc586a Compare February 16, 2024 09:51

k8s-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Feb 16, 2024

oksanabaza force-pushed the cve-fix branch from 7dc586a to 2fd03e7 Compare February 16, 2024 13:11

k8s-ci-robot removed the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Feb 16, 2024

oksanabaza force-pushed the cve-fix branch from 7483946 to 2caf02b Compare February 27, 2024 12:02

Update autoscaler dependency to fix CVE

9cc980a

oksanabaza force-pushed the cve-fix branch from 2caf02b to 9cc980a Compare March 4, 2024 15:15

k8s-ci-robot assigned alculquicondor Mar 4, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 4, 2024

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 4, 2024

k8s-ci-robot merged commit 4573682 into kubernetes-sigs:main Mar 4, 2024
14 checks passed

k8s-ci-robot added this to the v0.7 milestone Mar 4, 2024

tenzen-y reviewed Mar 4, 2024

View reviewed changes

alculquicondor mentioned this pull request Mar 4, 2024

Use minor version for go #1794

Closed

alculquicondor added a commit to alculquicondor/kueue that referenced this pull request Mar 4, 2024

Revert "Update autoscaler dependency to fix CVE (kubernetes-sigs#1740)"

82989a3

This reverts commit 4573682.

alculquicondor mentioned this pull request Mar 4, 2024

Revert "Update autoscaler dependency to fix CVE (#1740)" #1796

Merged

k8s-ci-robot pushed a commit that referenced this pull request Mar 4, 2024

Revert "Update autoscaler dependency to fix CVE (#1740)" (#1796)

19457bc

This reverts commit 4573682.

oksanabaza added a commit to oksanabaza/kueue that referenced this pull request Mar 5, 2024

Fix of "Update autoscaler dependency to fix CVE (kubernetes-sigs#1740)"

acfebaa

oksanabaza added a commit to oksanabaza/kueue that referenced this pull request Mar 5, 2024

Fix "Update autoscaler dependency to fix CVE (kubernetes-sigs#1740)"

f6f409a

oksanabaza added a commit to oksanabaza/kueue that referenced this pull request Mar 5, 2024

Fix of "Update autoscaler dependency to fix CVE (kubernetes-sigs#1740)"

45db512

oksanabaza added a commit to oksanabaza/kueue that referenced this pull request Mar 5, 2024

Fix "Update autoscaler dependency to fix CVE (kubernetes-sigs#1740)"

0d79349

oksanabaza mentioned this pull request Mar 5, 2024

Fix "Update autoscaler dependency to fix CVE (#1740)" #1804

Merged

k8s-ci-robot pushed a commit that referenced this pull request Mar 6, 2024

Fix "Update autoscaler dependency to fix CVE (#1740)" (#1804)

4918ffc

ChristianZaccaria pushed a commit to ChristianZaccaria/kueue that referenced this pull request Apr 17, 2024

Fix "Update autoscaler dependency to fix CVE (kubernetes-sigs#1740)" (k…

549c5d2

…ubernetes-sigs#1804)

vsoch pushed a commit to researchapps/kueue that referenced this pull request Apr 18, 2024

Update autoscaler dependency to fix CVE (kubernetes-sigs#1740)

7759ee3

vsoch pushed a commit to researchapps/kueue that referenced this pull request Apr 18, 2024

Revert "Update autoscaler dependency to fix CVE (kubernetes-sigs#1740)…

b7de6ed

…" (kubernetes-sigs#1796) This reverts commit 4573682.

vsoch pushed a commit to researchapps/kueue that referenced this pull request Apr 18, 2024

Fix "Update autoscaler dependency to fix CVE (kubernetes-sigs#1740)" (k…

e908301

…ubernetes-sigs#1804)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update autoscaler dependency to fix CVE #1740

Update autoscaler dependency to fix CVE #1740

oksanabaza commented Feb 15, 2024 •

edited

Loading

linux-foundation-easycla bot commented Feb 15, 2024 •

edited

Loading

netlify bot commented Feb 15, 2024 •

edited

Loading

k8s-ci-robot commented Feb 15, 2024

kannon92 commented Feb 15, 2024

alculquicondor commented Feb 15, 2024

KPostOffice commented Feb 28, 2024 •

edited

Loading

alculquicondor commented Mar 4, 2024

k8s-ci-robot commented Mar 4, 2024

k8s-ci-robot commented Mar 4, 2024

tenzen-y Mar 4, 2024

alculquicondor Mar 4, 2024

tenzen-y Mar 4, 2024

alculquicondor commented Mar 4, 2024

alculquicondor commented Mar 4, 2024

oksanabaza commented Mar 4, 2024

Update autoscaler dependency to fix CVE #1740

Update autoscaler dependency to fix CVE #1740

Conversation

oksanabaza commented Feb 15, 2024 • edited Loading

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

linux-foundation-easycla bot commented Feb 15, 2024 • edited Loading

netlify bot commented Feb 15, 2024 • edited Loading

✅ Deploy Preview for kubernetes-sigs-kueue ready!

k8s-ci-robot commented Feb 15, 2024

kannon92 commented Feb 15, 2024

alculquicondor commented Feb 15, 2024

KPostOffice commented Feb 28, 2024 • edited Loading

alculquicondor commented Mar 4, 2024

k8s-ci-robot commented Mar 4, 2024

k8s-ci-robot commented Mar 4, 2024

tenzen-y Mar 4, 2024

Choose a reason for hiding this comment

alculquicondor Mar 4, 2024

Choose a reason for hiding this comment

tenzen-y Mar 4, 2024

Choose a reason for hiding this comment

alculquicondor commented Mar 4, 2024

alculquicondor commented Mar 4, 2024

oksanabaza commented Mar 4, 2024

oksanabaza commented Feb 15, 2024 •

edited

Loading

linux-foundation-easycla bot commented Feb 15, 2024 •

edited

Loading

netlify bot commented Feb 15, 2024 •

edited

Loading

KPostOffice commented Feb 28, 2024 •

edited

Loading