OCPBUGS-2739: Uplift terraform-provider-ironic to 0.3.0

[elfosardo]

Use GO 1.18
Update to terraform SDK to 2.0
Remove go-getter dependency

[openshift-ci]

@elfosardo: No Bugzilla bug is referenced in the title of this pull request.
To reference a bug, add 'Bug XXX:' to the title of this pull request and request another bug refresh with /bugzilla refresh.

Details

In response to this:

OCPBUGS-2739: Uplift terraform-provider-ironic to 0.3.0

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

@elfosardo: This pull request references Jira Issue OCPBUGS-2739, which is valid. The bug has been moved to the POST state.

6 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.11.z) matches configured target version for branch (4.11.z)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
• dependent bug Jira Issue OCPBUGS-3657 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE))
• dependent Jira Issue OCPBUGS-3657 targets the "4.12.0" version, which is one of the valid target versions: 4.12.0
• bug has dependents

Requesting review from QA contact:
/cc @pamoedom

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Use GO 1.18
Update to terraform SDK to 2.0
Remove go-getter dependency

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign jhixson74 for approval by writing /assign @jhixson74 in a comment. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@elfosardo: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-imdsv2	7379c6a	link	false	/test e2e-aws-imdsv2
ci/prow/okd-e2e-aws	7379c6a	link	false	/test okd-e2e-aws
ci/prow/e2e-aws-shared-vpc	7379c6a	link	false	/test e2e-aws-shared-vpc
ci/prow/okd-images	7379c6a	link	true	/test okd-images
ci/prow/e2e-aws-proxy	7379c6a	link	false	/test e2e-aws-proxy
ci/prow/e2e-aws-fips	7379c6a	link	false	/test e2e-aws-fips
ci/prow/e2e-ovirt	7379c6a	link	false	/test e2e-ovirt
ci/prow/e2e-aws	7379c6a	link	true	/test e2e-aws
ci/prow/e2e-openstack	7379c6a	link	false	/test e2e-openstack
ci/prow/e2e-azure	7379c6a	link	false	/test e2e-azure
ci/prow/e2e-vsphere	7379c6a	link	false	/test e2e-vsphere
ci/prow/e2e-metal-ipi	7379c6a	link	false	/test e2e-metal-ipi
ci/prow/e2e-crc	7379c6a	link	false	/test e2e-crc
ci/prow/e2e-ibmcloud	7379c6a	link	false	/test e2e-ibmcloud
ci/prow/e2e-aws-upi-proxy	7379c6a	link	false	/test e2e-aws-upi-proxy
ci/prow/e2e-gcp	7379c6a	link	false	/test e2e-gcp
ci/prow/e2e-aws-single-node	7379c6a	link	false	/test e2e-aws-single-node
ci/prow/e2e-libvirt	7379c6a	link	false	/test e2e-libvirt
ci/prow/images	7379c6a	link	true	/test images

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[r4f4]

@elfosardo This won't work on release-4.11 since we're not using Golang-1.18:

note: module requires Go 1.18
# github.com/zclconf/go-cty/cty/set
vendor/github.com/zclconf/go-cty/cty/set/iterator.go:3:17: syntax error: unexpected any, expecting ] 

[elfosardo]

@elfosardo This won't work on release-4.11 since we're not using Golang-1.18:

note: module requires Go 1.18
# github.com/zclconf/go-cty/cty/set
vendor/github.com/zclconf/go-cty/cty/set/iterator.go:3:17: syntax error: unexpected any, expecting ] 

@r4f4 thanks for the comment, I've noticed from the errors that indeed we're on go 1.17 in 4.11 and earlier
this precludes the possibility to fix this CVE related bug as go 1.18 is required to run some libraries
how's the issue has been treated for other providers to remove go-getter dependency in 4.11 and older versions?

[r4f4]

@elfosardo This won't work on release-4.11 since we're not using Golang-1.18:

note: module requires Go 1.18
# github.com/zclconf/go-cty/cty/set
vendor/github.com/zclconf/go-cty/cty/set/iterator.go:3:17: syntax error: unexpected any, expecting ] 

@r4f4 thanks for the comment, I've noticed from the errors that indeed we're on go 1.17 in 4.11 and earlier this precludes the possibility to fix this CVE related bug as go 1.18 is required to run some libraries how's the issue has been treated for other providers to remove go-getter dependency in 4.11 and older versions?

@jhixson74 did the work in [1] for ocp <= 4.10 and [2] for ocp 4.11, so he might better explain his reasoning. I think the idea was not to remove go-getter but to pin it to a version with the CVEs fixed using a Golang replace directive. His changes are already doing that for the ironic provider and it looks like you're both solving the same issues (although differently).

[1] #6361
[2] #6411

[elfosardo]

@r4f4 great, thanks!

[elfosardo]

this was already fixed as stated above

[openshift-ci-robot]

@elfosardo: This pull request references Jira Issue OCPBUGS-2739. The bug has been updated to no longer refer to the pull request using the external bug tracker. All external bug links have been closed. The bug has been moved to the NEW state.

Details

In response to this:

Use GO 1.18
Update to terraform SDK to 2.0
Remove go-getter dependency

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.