OCPBUGS-104452: Fix TLS ciphers for MinVersion=1.3 #296
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| name: Docs Reminder | ||
|
|
||
| # Reminder for contributors and reviewers: when a pull request is labeled | ||
| # "kind/feature" (see classify.yaml) but does not touch the website/ | ||
| # documentation, fail this job so it's clearly visible. This check is not a | ||
| # required status check, so it does not block merging — it's only a visible | ||
| # reminder. Fixes: https://github.com/metallb/metallb/issues/2663 | ||
| on: | ||
| pull_request: | ||
| types: [opened, synchronize, reopened, labeled] | ||
|
|
||
| # Least privilege; read-only so this also works for pull requests from forks. | ||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| docs-reminder: | ||
| runs-on: ubuntu-22.04 | ||
| # classify.yaml is the single source of truth for PR kind; check its | ||
| # kind/feature label directly instead of re-deriving it from the PR body. | ||
| if: > | ||
| github.actor != 'dependabot[bot]' && | ||
| contains(github.event.pull_request.labels.*.name, 'kind/feature') | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
Comment on lines
+25
to
+28
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win Pin
🧰 Tools🪛 zizmor (1.29.0)[warning] 25-28: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🤖 Prompt for AI Agents |
||
| - name: Remind to document feature PRs | ||
| run: | | ||
| BASE=${{ github.event.pull_request.base.sha }} | ||
| HEAD=${{ github.event.pull_request.head.sha }} | ||
| if git diff --name-only "$BASE"..."$HEAD" | grep -q '^website/'; then | ||
| echo "Feature PR updates website/ docs." | ||
| exit 0 | ||
| fi | ||
| MSG="This PR is labeled \`kind/feature\` but does not update the \`website/\` documentation. If this feature is user-facing, please add or update the relevant docs under \`website/content/\` in this PR. This check is not required, so it does not block merging (see issue #2663)." | ||
| echo "### Documentation reminder" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "$MSG" >> "$GITHUB_STEP_SUMMARY" | ||
| echo "::error::$MSG" | ||
| exit 1 | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -210,6 +210,7 @@ controller: | |
| ## maxSurge: 25% | ||
| ## maxUnavailable: 25% | ||
| ## | ||
| revisionHistoryLimit: 10 | ||
| strategy: | ||
| type: RollingUpdate | ||
| serviceAccount: | ||
|
|
@@ -282,6 +283,7 @@ speaker: | |
| ## @param speaker.updateStrategy.type Speaker daemonset strategy type | ||
| ## ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/ | ||
| ## | ||
| revisionHistoryLimit: 10 | ||
| updateStrategy: | ||
| ## StrategyType | ||
| ## Can be set to RollingUpdate or OnDelete | ||
|
|
@@ -344,6 +346,24 @@ speaker: | |
| pullPolicy: | ||
| metricsPort: 9121 | ||
| resources: {} | ||
| # -- Path to the tini binary inside the FRR container. Override this | ||
| # when using an FRR image (e.g. Docker Hardened Images) that places | ||
| # tini at a different location. | ||
| tiniPath: /sbin/tini | ||
| # -- Path to the docker-start script inside the FRR container. Override | ||
| # this when using an FRR image (e.g. Docker Hardened Images) that places | ||
| # docker-start at a different location. | ||
| dockerStartPath: /usr/lib/frr/docker-start | ||
| # -- Security context for the FRR container. | ||
| securityContext: | ||
| readOnlyRootFilesystem: true | ||
| allowPrivilegeEscalation: false | ||
| capabilities: | ||
| add: | ||
| - NET_ADMIN | ||
| - NET_RAW | ||
| - SYS_ADMIN | ||
| - NET_BIND_SERVICE | ||
|
Comment on lines
+357
to
+366
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- relevant chart files ---'
git ls-files 'charts/metallb/values.yaml' 'charts/metallb/templates/speaker.yaml' 'charts/metallb/README.md' 'charts/metallb/Chart.yaml'
printf '%s\n' '--- values.yaml security-context section ---'
cat -n charts/metallb/values.yaml | sed -n '330,385p'
printf '%s\n' '--- speaker template security-context rendering ---'
cat -n charts/metallb/templates/speaker.yaml | sed -n '390,445p'
printf '%s\n' '--- FRR image and security-context references ---'
rg -n -C 3 'frr|securityContext|runAsNonRoot|SYS_ADMIN|NET_ADMIN|NET_RAW|NET_BIND_SERVICE|allowPrivilegeEscalation|capabilities' charts/metallb
printf '%s\n' '--- README generated values around FRR securityContext ---'
rg -n -C 12 'Security context for the FRR container|NET_ADMIN|SYS_ADMIN|NET_RAW|NET_BIND_SERVICE|readOnlyRootFilesystem' charts/metallb/README.md || true
printf '%s\n' '--- chart metadata and image defaults ---'
cat -n charts/metallb/Chart.yaml | sed -n '1,100p'
rg -n -C 4 'image:|repository:|tag:|digest:' charts/metallb/values.yaml charts/metallb/templatesRepository: openshift/metallb Length of output: 50373 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- README FRR defaults ---'
sed -n '124,145p' charts/metallb/README.md
printf '%s\n' '--- README security-context rows ---'
rg -n -C 2 'speaker\.frr\.securityContext|readOnlyRootFilesystem|allowPrivilegeEscalation|capabilities|NET_ADMIN|NET_RAW|SYS_ADMIN|NET_BIND_SERVICE' charts/metallb/README.md
printf '%s\n' '--- all chart documentation for FRR capability rationale ---'
rg -n -i -C 3 'sys.admin|net.admin|net.raw|bind.service|capabilit|non.root|privilege' README.md docs charts .github 2>/dev/null | head -n 250 || true
printf '%s\n' '--- local references to the default FRR image ---'
rg -n -C 5 'quay\.io/frrouting/frr|frr:10\.5\.3|speaker\.frr\.securityContext' . --glob '!charts/metallb/README.md' --glob '!vendor/**' | head -n 250Repository: openshift/metallb Length of output: 25634 🌐 Web query:
💡 Result: According to official Kubernetes documentation, the allowPrivilegeEscalation field in a container's securityContext is always treated as true when the container is either run as privileged or has the CAP_SYS_ADMIN capability [1]. In practice, Kubernetes validation logic rejects configurations where allowPrivilegeEscalation is explicitly set to false while the container is configured to be privileged or to include the CAP_SYS_ADMIN capability [2][3]. The setting controls the no_new_privs flag on the container process; when allowPrivilegeEscalation is false, this flag is set, preventing processes from gaining more privileges than their parent process (such as via setuid binaries) [1][2][4]. It is important to note that the Kubernetes validation for this restriction specifically checks for the string "CAP_SYS_ADMIN" [5]. There have been identified inconsistencies where other dangerous capabilities (like CAP_SYS_MODULE or CAP_NET_ADMIN) or the variation "SYS_ADMIN" (without the "CAP_" prefix) may not trigger the same validation rejection, even though they can also enable privilege escalation [5][6][7]. Consequently, while the documentation states that CAP_SYS_ADMIN forces allowPrivilegeEscalation to true, users should be aware that the current implementation may not automatically block all equivalent privilege-escalating configurations [6]. Citations:
🌐 Web query:
💡 Result: The FRRouting (FRR) Docker image, including version 10.5.3, requires elevated Linux capabilities to function because it interacts directly with the host's networking stack to manage routing protocols [1][2]. While the exact required capabilities can depend on the specific routing daemons (e.g., bgpd, ospfd, zebra) you have enabled [1], it is standard practice and often necessary to provide a specific set of capabilities to the container. The commonly cited requirements for a functional FRR container include [1][3][4]: - NET_ADMIN: Required for modifying network interfaces, routing tables, and firewall rules [1]. - NET_RAW: Required for constructing raw packets (essential for many routing protocols) [1]. - SYS_ADMIN: Frequently required for configuring various kernel-level networking parameters [1]. - NET_BIND_SERVICE: Often required to bind to low-numbered privileged ports [1][3]. The official guidance emphasizes that when running the container, you should grant the full set of capabilities needed by any of the daemons you plan to enable [1]. Many real-world deployments, such as those using FRR in Kubernetes or Docker Compose, explicitly grant these four capabilities to ensure all protocol daemons function correctly [3][4][5][6]. If you are using a security-hardened environment, you may be able to restrict these based on a precise list of active daemons, but granting these is the standard approach for full functionality [1]. Always ensure your host system's kernel settings (e.g., IP forwarding) are configured appropriately to support the routing operations performed by the container [7]. Citations:
🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- FRR container and init-container sections ---'
sed -n '421,540p' charts/metallb/templates/speaker.yaml
printf '%s\n' '--- generated legacy FRR manifest security contexts and resources ---'
sed -n '2470,2675p' config/manifests/metallb-frr-prometheus.yaml | \
rg -n -C 5 'name: frr$|name: reloader|name: frr-metrics|securityContext:|capabilities:|resources:|readinessProbe:|livenessProbe:|startupProbe:|runAsNonRoot'
printf '%s\n' '--- capability and non-root settings in chart and legacy manifests ---'
rg -n -C 2 'drop:|add:|SYS_ADMIN|NET_ADMIN|NET_RAW|NET_BIND_SERVICE|runAsNonRoot|resources: \{\}|readinessProbe:' \
charts/metallb/templates/speaker.yaml charts/metallb/values.yaml \
config/frr/speaker-patch.yaml config/manifests/metallb-frr-prometheus.yaml | head -n 300
printf '%s\n' '--- upstream references available in repository metadata ---'
rg -n -i 'frrouting/frr|dockerfile|capabilities|SYS_ADMIN' .github docs config charts tasks.py \
--glob '!config/manifests/*.yaml' | head -n 200 || trueRepository: openshift/metallb Length of output: 17772 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- FRR upstream repository metadata ---'
curl -fsSL 'https://api.github.com/repos/FRRouting/frr/contents/docker' |
jq -r '.[] | [.name, .download_url] | `@tsv`' | head -n 80
printf '%s\n' '--- FRR repository references to container capabilities ---'
curl -fsSL 'https://api.github.com/search/code?q=repo%3AFRRouting%2Ffrr+SYS_ADMIN' |
jq -r '.message // empty, (.items[]?.html_url // empty)' || true
printf '%s\n' '--- MetalLB frr-k8s configuration capability references ---'
curl -fsSL 'https://raw.githubusercontent.com/metallb/frr-k8s/main/config/all-in-one/frr-k8s.yaml' |
rg -n -C 8 'capabilities:|SYS_ADMIN|NET_ADMIN|NET_RAW|NET_BIND_SERVICE|runAsNonRoot'Repository: openshift/metallb Length of output: 2137 🌐 Web query:
💡 Result: The references to SYS_ADMIN, NET_ADMIN, and NET_RAW in the context of FRRouting (FRR) version 10.5.3 relate to Linux capabilities required for the proper operation of the FRR routing suite within Docker containers [1][2][3][4]. FRR services such as zebra, bgpd, ospfd, and watchfrr perform tasks that require elevated system privileges, including managing network namespaces (for VRF support) and manipulating network interfaces [3]. Specifically: - CAP_SYS_ADMIN: Required by components like ospfd to perform operations such as switching network namespaces [3]. - CAP_NET_ADMIN: Required for managing network configurations, routing tables, and interface settings [1][3]. - CAP_NET_RAW: Required for crafting and accessing raw network packets [1][3]. In Docker environments, these capabilities are not granted by default for security reasons. Users running FRR containers often encounter permission errors if these capabilities are not explicitly provided at runtime [1][3]. To resolve these errors, operators must either run the container with the --privileged flag (which grants all capabilities) or, more securely, use --cap-add to grant only the specific capabilities required (e.g., --cap-add=NET_ADMIN --cap-add=NET_RAW --cap-add=SYS_ADMIN) [1][3]. Alternatively, some users may configure file-level capabilities using setcap on the specific FRR binaries within the container image, although this requires careful management of container security policies [1][2]. Citations:
🌐 Web query:
💡 Result: In the context of the MetalLB project and its FRRouting (FRR) integration, speaker.frr.securityContext refers to a configuration setting in the MetalLB Helm chart that defines the Kubernetes security context for the FRR sidecar container [1]. Historically, the FRR container in MetalLB required elevated Linux capabilities, including NET_ADMIN, NET_RAW, SYS_ADMIN, and NET_BIND_SERVICE, to perform networking operations such as BGP peering and ARP/NDP responses [1][2]. The addition of the speaker.frr.securityContext setting allowed operators to make these security settings configurable, enabling them to harden the container or adjust for custom images [1]. It is important to note: 1. Security Best Practices: While these capabilities were previously standard for the FRR sidecar, the project has historically moved to remove unnecessary elevated privileges (such as SYS_ADMIN) whenever possible to reduce the risk of container breakouts [3][4]. 2. Deprecation Warning: MetalLB has deprecated the FRR mode in favor of the frr-k8s mode [5]. Operators are encouraged to migrate to frr-k8s, which is the current default BGP backend [5]. 3. Current Implementation: In modern versions of the MetalLB chart, this configuration allows users to define the specific security context applied to the FRR container, maintaining the defaults that match required capabilities while providing flexibility for specific deployment environments [1]. Citations:
Drop all capabilities and document FRR security requirements. The template renders Retain 🤖 Prompt for AI AgentsSources: Path instructions, MCP tools |
||
|
|
||
| reloader: | ||
| resources: {} | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| go 1.26.0 | ||
|
|
||
| toolchain go1.26.5 | ||
|
|
||
| use ( | ||
| ../ | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,8 +1,8 @@ | ||
| module go.universe.tf/metallb | ||
|
|
||
| go 1.26.0 | ||
|
|
||
| toolchain go1.26.5 | ||
|
|
||
| require ( | ||
| github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc | ||
|
|
@@ -33,7 +33,7 @@ require ( | |
| ) | ||
|
|
||
| require ( | ||
| cel.dev/expr v0.25.1 // indirect | ||
| dario.cat/mergo v1.0.0 // indirect | ||
| github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect | ||
| github.com/Masterminds/semver/v3 v3.4.0 // indirect | ||
|
|
@@ -128,17 +128,17 @@ require ( | |
| go.yaml.in/yaml/v3 v3.0.4 // indirect | ||
| golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect | ||
| golang.org/x/net v0.55.0 // indirect | ||
| golang.org/x/oauth2 v0.34.0 // indirect | ||
| golang.org/x/sync v0.20.0 // indirect | ||
| golang.org/x/term v0.43.0 // indirect | ||
| golang.org/x/text v0.37.0 // indirect | ||
| golang.org/x/time v0.11.0 // indirect | ||
| golang.org/x/tools v0.44.0 // indirect | ||
| gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect | ||
| google.golang.org/grpc v1.79.3 // indirect | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
go mod why -m google.golang.org/grpc
go list -deps ./... | rg 'google.golang.org/grpc/(internal/transport|internal/xds/rbac)' || true
curl -fsS -X POST 'https://api.osv.dev/v1/query' \
-H 'Content-Type: application/json' \
-d '{"package":{"ecosystem":"Go","name":"google.golang.org/grpc"},"version":"v1.79.3"}'Repository: openshift/metallb Length of output: 9809 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- go.mod context ---'
sed -n '125,148p' go.mod
printf '%s\n' '--- executable package declarations ---'
rg -n --glob '*.go' '^package main$' .
printf '%s\n' '--- grpc imports ---'
rg -n --glob '*.go' 'google\.golang\.org/grpc' .
printf '%s\n' '--- module references and build metadata ---'
rg -n 'go build|go install|cmd/|frr-tools|grpc' Makefile* Dockerfile* .github scripts hack deploy config 2>/dev/null || trueRepository: openshift/metallb Length of output: 50373 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
import json
import subprocess
from collections import defaultdict, deque
targets = ["./controller", "./speaker", "./frr-tools/metrics", "./frr-tools/cp-tool"]
proc = subprocess.Popen(
["go", "list", "-mod=vendor", "-json", "-deps", *targets],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
text=True,
)
decoder = json.JSONDecoder()
buf = ""
packages = {}
while True:
chunk = proc.stdout.read(65536)
if not chunk:
break
buf += chunk
while buf:
try:
obj, end = decoder.raw_decode(buf)
except json.JSONDecodeError:
break
buf = buf[end:].lstrip()
if "ImportPath" in obj:
packages[obj["ImportPath"]] = obj
stderr = proc.stderr.read()
status = proc.wait()
if status:
print(stderr)
raise SystemExit(status)
reverse = defaultdict(list)
for path, obj in packages.items():
for dep in obj.get("Imports", []):
reverse[dep].append(path)
print("--- vulnerable package presence ---")
for path in (
"google.golang.org/grpc",
"google.golang.org/grpc/internal/transport",
"google.golang.org/grpc/internal/xds/rbac",
):
print(path, "present" if path in packages else "absent")
print("--- target paths to grpc transport ---")
for target in targets:
start = next((p for p in packages if p == target[2:] or p.endswith("/" + target[2:])), None)
if not start:
print(target, "not listed")
continue
queue = deque([(start, [start])])
seen = {start}
found = None
while queue:
current, path = queue.popleft()
if current == "google.golang.org/grpc/internal/transport":
found = path
break
for parent in reverse[current]:
if parent not in seen:
seen.add(parent)
queue.append((parent, path + [parent]))
print(target, " -> ".join(found) if found else "no path")
print("--- grpc version in vendor/modules.txt ---")
with open("vendor/modules.txt") as f:
for line in f:
if line.startswith("# google.golang.org/grpc "):
print(line)
PYRepository: openshift/metallb Length of output: 531 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
import json
import subprocess
from collections import deque
targets = ["controller", "speaker", "frr-tools/metrics", "frr-tools/cp-tool"]
proc = subprocess.Popen(
["go", "list", "-mod=vendor", "-json", "-deps", "./..."],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
text=True,
)
decoder = json.JSONDecoder()
buf = ""
packages = {}
while True:
chunk = proc.stdout.read(65536)
if not chunk:
break
buf += chunk
while buf:
try:
obj, end = decoder.raw_decode(buf)
except json.JSONDecodeError:
break
buf = buf[end:].lstrip()
if "ImportPath" in obj:
packages[obj["ImportPath"]] = obj
stderr = proc.stderr.read()
status = proc.wait()
if status:
print(stderr)
raise SystemExit(status)
for target in targets:
start = next(
(path for path in packages if path == target or path.endswith("/" + target)),
None,
)
if not start:
print(f"{target}: package not listed")
continue
queue = deque([(start, [start])])
seen = {start}
paths = []
while queue:
current, path = queue.popleft()
if current in {
"google.golang.org/grpc/internal/transport",
"google.golang.org/grpc/internal/xds/rbac",
}:
paths.append(path)
continue
for dep in packages.get(current, {}).get("Imports", []):
if dep in packages and dep not in seen:
seen.add(dep)
queue.append((dep, path + [dep]))
print(f"--- {start} ---")
if paths:
for path in paths:
print(" -> ".join(path))
else:
print("no path to affected grpc packages")
PYRepository: openshift/metallb Length of output: 1188 Upgrade GO-2026-6061/GHSA-hrxh-6v49-42gf affects v1.79.3 and is fixed in v1.82.1. The 🧰 Tools🪛 OSV Scanner (2.4.0)[HIGH] 140-140: google.golang.org/grpc 1.79.3: Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc (GO-2026-6061) [HIGH] 140-140: google.golang.org/grpc 1.79.3: gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities 🤖 Prompt for AI AgentsSources: Path instructions, Linters/SAST tools |
||
| google.golang.org/protobuf v1.36.10 // indirect | ||
| gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect | ||
| gopkg.in/inf.v0 v0.9.1 // indirect | ||
| gopkg.in/yaml.v2 v2.4.0 // indirect | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: openshift/metallb
Length of output: 7942
🏁 Script executed:
Repository: openshift/metallb
Length of output: 535
Filter Dependabot by pull request author.
github.actoris the account that triggered the workflow, not the pull request author. A maintainer can label or reopen a Dependabot pull request, which makes this condition true. Usegithub.event.pull_request.user.login != 'dependabot[bot]'.🤖 Prompt for AI Agents