Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
The diff you're trying to view is too large. We only load the first 3000 changed files.
2 changes: 1 addition & 1 deletion Dockerfile
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Build the manager binary
FROM golang:1.25 as builder
FROM golang:1.26 as builder

WORKDIR /workspace
# Copy the Go Modules manifests
Expand Down
2 changes: 1 addition & 1 deletion Dockerfile.daemon
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM golang:1.25 AS builder
FROM golang:1.26 AS builder

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Pin the builder image by digest (or use a Red Hat catalog base image).

golang:1.26 is mutable. Per the container policy, non-Red Hat images must be digest-pinned to make builds reproducible and reduce supply-chain drift.

Suggested patch
-FROM golang:1.26 AS builder
+FROM golang:1.26@sha256:<verified-digest> AS builder

As per coding guidelines: “non-RH images: pin by digest.”

🧰 Tools
🪛 Trivy (0.69.3)

[error] 1-1: Image user should not be 'root'

Specify at least 1 USER command in Dockerfile with non-root user as argument

Rule: DS-0002

Learn more

(IaC/Dockerfile)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile.daemon` at line 1, The FROM golang:1.26 AS builder statement uses
a mutable image tag that does not guarantee reproducible builds. Pin the golang
image by its SHA256 digest by appending `@sha256`:[digest] to the image reference.
Look up the correct digest for the golang:1.26 image and update the FROM
statement to use the full image reference with the digest to ensure builds are
reproducible and reduce supply-chain drift.

Source: Coding guidelines

WORKDIR /go/src/github.com/openshift/ingress-node-firewall
COPY . .

Expand Down
10 changes: 5 additions & 5 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ endif
IMG ?= quay.io/openshift/origin-ingress-node-firewall:latest
DAEMON_IMG ?= quay.io/openshift/origin-ingress-node-firewall-daemon:latest
# ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
ENVTEST_K8S_VERSION = 1.32.x
ENVTEST_K8S_VERSION = 1.36

# Default namespace
NAMESPACE ?= ingress-node-firewall-system
Expand Down Expand Up @@ -285,7 +285,7 @@ $(CONTROLLER_GEN): $(LOCALBIN)
.PHONY: envtest
envtest: $(ENVTEST) ## Download envtest-setup locally if necessary.
$(ENVTEST): $(LOCALBIN)
test -s $(LOCALBIN)/setup-envtest || GOBIN=$(LOCALBIN) GOFLAGS="" go install sigs.k8s.io/controller-runtime/tools/setup-envtest@release-0.20
test -s $(LOCALBIN)/setup-envtest || GOBIN=$(LOCALBIN) GOFLAGS="" go install sigs.k8s.io/controller-runtime/tools/setup-envtest@release-0.24

.PHONY: bundle
bundle: operator-sdk manifests kustomize ## Generate bundle manifests and metadata, then validate generated files.
Expand Down Expand Up @@ -386,7 +386,7 @@ lint: ## Run golangci-lint against code.
ifeq ($(CONTAINER_RUNNABLE), 0)
@GOPATH=${GOPATH} ./hack/lint.sh $(CONTAINER_RUNTIME)
else
echo "linter can only be run within a container since it needs a specific golangci-lint version"
GOFLAGS="" GOLANGCI_LINT_CACHE=/tmp/golangci-lint-cache go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION) 2>/dev/null && GOLANGCI_LINT_CACHE=/tmp/golangci-lint-cache golangci-lint run --verbose --timeout=15m0s
endif

.PHONY: vendors
Expand Down Expand Up @@ -419,7 +419,7 @@ catalog-push: ## Push a catalog image.
$(MAKE) docker-push IMG=$(CATALOG_IMG)

CILIUM_EBPF_VERSION := v0.18.0
GOLANGCI_LINT_VERSION = v1.54.2
GOLANGCI_LINT_VERSION = v2.12.2
CLANG ?= clang
CFLAGS := -O2 -g -Wall -Werror $(CFLAGS)
GOOS ?= linux
Expand All @@ -428,7 +428,7 @@ LOCAL_GENERATOR_IMAGE ?= ebpf-generator:latest
##@ eBPF development
.PHONY: prereqs
prereqs: ## Check if prerequisites are met, and installing missing dependencies
test -f $(shell go env GOPATH)/bin/golangci-lint || GOFLAGS="" go install github.com/golangci/golangci-lint/cmd/golangci-lint@${GOLANGCI_LINT_VERSION}
test -f $(shell go env GOPATH)/bin/golangci-lint || GOFLAGS="" go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@${GOLANGCI_LINT_VERSION}
test -f $(shell go env GOPATH)/bin/bpf2go || go install github.com/cilium/ebpf/cmd/bpf2go@${CILIUM_EBPF_VERSION}
test -f $(shell go env GOPATH)/bin/kind || go install sigs.k8s.io/kind@latest

Expand Down
2 changes: 1 addition & 1 deletion api/v1alpha1/groupversion_info.go
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ var (
GroupVersion = schema.GroupVersion{Group: "ingressnodefirewall.openshift.io", Version: "v1alpha1"}

// SchemeBuilder is used to add go types to the GroupVersionKind scheme
SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion} //nolint:govet,staticcheck // kubebuilder generated

// AddToScheme adds the types in this group-version to the given scheme.
AddToScheme = SchemeBuilder.AddToScheme
Expand Down
7 changes: 1 addition & 6 deletions controllers/ingressnodefirewall_controller.go
Original file line number Diff line number Diff line change
Expand Up @@ -106,11 +106,6 @@ func (r *IngressNodeFirewallReconciler) Reconcile(ctx context.Context, req ctrl.
}
if yes, debugMode, err := r.isUsingBpfmanManager(ctx); yes && err == nil {
r.Log.Info("BPFMAN: Deleting ebpf program", "req.Name", req.Name)
interfaces := make([]string, 0,
len(ingressNodeFirewallCurrentNodeState.Spec.InterfaceIngressRules))
for intf := range ingressNodeFirewallCurrentNodeState.Spec.InterfaceIngressRules {
interfaces = append(interfaces, intf)
}
if err := bpf_mgr.BpfmanDetachNodeFirewall(ctx, r.Client, nil, debugMode); err != nil {
r.Log.Error(err, "Failed to delete ebpf program", "req.Name", req.Name)
return ctrl.Result{}, err
Expand Down Expand Up @@ -369,7 +364,7 @@ func (r *IngressNodeFirewallReconciler) buildNodeStates(
r.Log.Info("BPFMAN: Creating application object and attach ingress firewall prog")
err = bpf_mgr.BpfmanAttachNodeFirewall(ctx, r.Client, firewallObj, debugMode)
if err != nil {
errMsg := fmt.Sprintf("BPFMAN: Failed to attach ingress firewall prog")
errMsg := "BPFMAN: Failed to attach ingress firewall prog"
r.Log.Error(err, errMsg)
if !strings.Contains(err.Error(), programAlreadyExistsErr) {
state.Status = infv1alpha1.IngressNodeFirewallNodeStateStatus{
Expand Down
16 changes: 8 additions & 8 deletions controllers/ingressnodefirewall_controller_rules_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ var _ = Describe("IngressNodeFirewall controller rules", func() {
nodeStateList := &infv1alpha1.IngressNodeFirewallNodeStateList{}
err := k8sClient.List(ctx, nodeStateList)
if err != nil {
fmt.Fprintf(GinkgoWriter, "Could not list IngressNodeFirewallNodeStates on cleanup, err: %q", err)
_, _ = fmt.Fprintf(GinkgoWriter, "Could not list IngressNodeFirewallNodeStates on cleanup, err: %q", err)
return false
}
return len(nodeStateList.Items) == 0
Expand Down Expand Up @@ -756,7 +756,7 @@ var _ = Describe("IngressNodeFirewall controller rules", func() {
By("Creating new IngressNodeFirewall objects")
for k, spec := range tc.inSpecs {
objectName := fmt.Sprintf("firewall-%d", k)
fmt.Fprintf(GinkgoWriter, "By creating new IngressNodeFirewall object %s", objectName)
_, _ = fmt.Fprintf(GinkgoWriter, "By creating new IngressNodeFirewall object %s", objectName)
ingressNodeFirewall := infv1alpha1.IngressNodeFirewall{
TypeMeta: metav1.TypeMeta{},
ObjectMeta: metav1.ObjectMeta{Name: objectName},
Expand All @@ -780,12 +780,12 @@ var _ = Describe("IngressNodeFirewall controller rules", func() {
By("Making sure that the resource displays a successful synchronization status")
// Refresh the resource.
if err := k8sClient.Get(ctx, key, infns); err != nil {
fmt.Fprintf(GinkgoWriter, "Getting resource failed: %q\n", err)
_, _ = fmt.Fprintf(GinkgoWriter, "Getting resource failed: %q\n", err)
return false
}
// Compare synchronization status.
if infns.Status.SyncStatus != infv1alpha1.SyncOK {
fmt.Fprintf(GinkgoWriter,
_, _ = fmt.Fprintf(GinkgoWriter,
"SyncStatus does not match SyncOK, instead got: %q\n", infns.Status.SyncStatus)
return false
}
Expand All @@ -796,7 +796,7 @@ var _ = Describe("IngressNodeFirewall controller rules", func() {
ingressesEqual := equality.Semantic.DeepEqual(
infns.Spec.InterfaceIngressRules, tc.outSpec.InterfaceIngressRules)
if !ingressesEqual {
fmt.Fprintf(GinkgoWriter, "Ingresses do not match. Got: '%v', Expected '%v'\n",
_, _ = fmt.Fprintf(GinkgoWriter, "Ingresses do not match. Got: '%v', Expected '%v'\n",
infns.Spec.InterfaceIngressRules, tc.outSpec.InterfaceIngressRules)
}
return ingressesEqual
Expand All @@ -806,12 +806,12 @@ var _ = Describe("IngressNodeFirewall controller rules", func() {
By("Making sure that the resource displays an error synchronization status")
// Refresh the resource.
if err := k8sClient.Get(ctx, key, infns); err != nil {
fmt.Fprintf(GinkgoWriter, "Getting resource failed: %q\n", err)
_, _ = fmt.Fprintf(GinkgoWriter, "Getting resource failed: %q\n", err)
return false
}
// Compare the synchronzition status.
if infns.Status.SyncStatus != infv1alpha1.SyncError {
fmt.Fprintf(GinkgoWriter,
_, _ = fmt.Fprintf(GinkgoWriter,
"SyncStatus does not match SyncError, got: %q\n", infns.Status.SyncStatus)
return false
}
Expand All @@ -820,7 +820,7 @@ var _ = Describe("IngressNodeFirewall controller rules", func() {
// Compare the error message.
syncErrorContains := strings.Contains(infns.Status.SyncErrorMessage, tc.statusError)
if !syncErrorContains {
fmt.Fprintf(GinkgoWriter, "Sync error does not contain expected string '%s'. Got: '%s'\n",
_, _ = fmt.Fprintf(GinkgoWriter, "Sync error does not contain expected string '%s'. Got: '%s'\n",
tc.statusError, infns.Status.SyncErrorMessage)
}
return syncErrorContains
Expand Down
42 changes: 21 additions & 21 deletions controllers/ingressnodefirewall_controller_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,7 @@ var _ = Describe("IngressNodeFirewall controller", func() {
nodeStateList := &infv1alpha1.IngressNodeFirewallNodeStateList{}
err := k8sClient.List(ctx, nodeStateList)
if err != nil {
fmt.Fprintf(GinkgoWriter, "Could not list IngressNodeFirewallNodeStates on cleanup, err: %q", err)
_, _ = fmt.Fprintf(GinkgoWriter, "Could not list IngressNodeFirewallNodeStates on cleanup, err: %q", err)
return false
}
return len(nodeStateList.Items) == 0
Expand All @@ -119,12 +119,12 @@ var _ = Describe("IngressNodeFirewall controller", func() {
Eventually(func() bool {
err := k8sClient.List(ctx, nodeStateList, []client.ListOption{}...)
if err != nil {
fmt.Fprintf(GinkgoWriter, "Could not list IngressNodeFirewallNodeStates during this iteration\n")
_, _ = fmt.Fprintf(GinkgoWriter, "Could not list IngressNodeFirewallNodeStates during this iteration\n")
return false
}
// Check number of items.
if len(nodeStateList.Items) != len(expectedNodeNames) {
fmt.Fprintf(GinkgoWriter, "Could not find the desired number of IngressNodeFirewallNodeStates\n")
_, _ = fmt.Fprintf(GinkgoWriter, "Could not find the desired number of IngressNodeFirewallNodeStates\n")
return false
}
// Check item names.
Expand All @@ -137,21 +137,21 @@ var _ = Describe("IngressNodeFirewall controller", func() {
}
}
if !nameMatches {
fmt.Fprintf(GinkgoWriter,
_, _ = fmt.Fprintf(GinkgoWriter,
"Did not find the expected IngressNodeFirewallNodeState with name %s\n", name)
return false
}
}
// Check item content.
for _, nodeState := range nodeStateList.Items {
if _, ok := nodeState.Spec.InterfaceIngressRules["eth0"]; !ok {
fmt.Fprintf(GinkgoWriter,
_, _ = fmt.Fprintf(GinkgoWriter,
"IngressNodeFirewallNodeState.Spec.InterfaceIngressRules[%s] does not exist "+
"for object with name %s\n", "eth0", nodeState.Name)
return false
}
if !equality.Semantic.DeepEqual(nodeState.Spec.InterfaceIngressRules["eth0"], rules) {
fmt.Fprintf(GinkgoWriter,
_, _ = fmt.Fprintf(GinkgoWriter,
"IngressNodeFirewallNodeState.Spec.Ingress does not match IngressNodeFirewall.Spec.Ingress "+
"for object with name %s\n", nodeState.Name)
return false
Expand Down Expand Up @@ -403,7 +403,7 @@ var _ = Describe("IngressNodeFirewall controller with multiple objects", func()
nodeStateList := &infv1alpha1.IngressNodeFirewallNodeStateList{}
err := k8sClient.List(ctx, nodeStateList)
if err != nil {
fmt.Fprintf(GinkgoWriter, "Could not list IngressNodeFirewallNodeStates on cleanup, err: %q", err)
_, _ = fmt.Fprintf(GinkgoWriter, "Could not list IngressNodeFirewallNodeStates on cleanup, err: %q", err)
return false
}
return len(nodeStateList.Items) == 0
Expand All @@ -419,12 +419,12 @@ var _ = Describe("IngressNodeFirewall controller with multiple objects", func()
Eventually(func() bool {
err := k8sClient.List(ctx, nodeStateList, []client.ListOption{}...)
if err != nil {
fmt.Fprintf(GinkgoWriter, "Could not list IngressNodeFirewallNodeStates during this iteration\n")
_, _ = fmt.Fprintf(GinkgoWriter, "Could not list IngressNodeFirewallNodeStates during this iteration\n")
return false
}
// Check number of items.
if len(nodeStateList.Items) != len(expectedNodeNames) {
fmt.Fprintf(GinkgoWriter, "Could not find the desired number of IngressNodeFirewallNodeStates\n")
_, _ = fmt.Fprintf(GinkgoWriter, "Could not find the desired number of IngressNodeFirewallNodeStates\n")
return false
}
// Check item names.
Expand All @@ -437,21 +437,21 @@ var _ = Describe("IngressNodeFirewall controller with multiple objects", func()
}
}
if !nameMatches {
fmt.Fprintf(GinkgoWriter,
_, _ = fmt.Fprintf(GinkgoWriter,
"Did not find the expected IngressNodeFirewallNodeState with name %s\n", name)
return false
}
}
// Check item content.
for _, nodeState := range nodeStateList.Items {
if _, ok := nodeState.Spec.InterfaceIngressRules["eth0"]; !ok {
fmt.Fprintf(GinkgoWriter,
_, _ = fmt.Fprintf(GinkgoWriter,
"IngressNodeFirewallNodeState.Spec.InterfaceIngressRules[%s] does not exist "+
"for object with name %s\n", "eth0", nodeState.Name)
return false
}
if !equality.Semantic.DeepEqual(nodeState.Spec.InterfaceIngressRules["eth0"], rules) {
fmt.Fprintf(GinkgoWriter,
_, _ = fmt.Fprintf(GinkgoWriter,
"IngressNodeFirewallNodeState.Spec.Ingress does not match IngressNodeFirewall.Spec.Ingress "+
"for object with name %s\n", nodeState.Name)
return false
Expand Down Expand Up @@ -487,19 +487,19 @@ var _ = Describe("IngressNodeFirewall controller with multiple objects", func()
Eventually(func() bool {
err := k8sClient.List(ctx, nodeStateList, []client.ListOption{}...)
if err != nil {
fmt.Fprintf(GinkgoWriter, "Could not list IngressNodeFirewallNodeStates during this iteration\n")
_, _ = fmt.Fprintf(GinkgoWriter, "Could not list IngressNodeFirewallNodeStates during this iteration\n")
return false
}
// Check item content.
for _, nodeState := range nodeStateList.Items {
if _, ok := nodeState.Spec.InterfaceIngressRules["eth0"]; !ok {
fmt.Fprintf(GinkgoWriter,
_, _ = fmt.Fprintf(GinkgoWriter,
"IngressNodeFirewallNodeState.Spec.InterfaceIngressRules[%s] does not exist "+
"for object with name %s\n", "eth0", nodeState.Name)
return false
}
if !equality.Semantic.DeepEqual(nodeState.Spec.InterfaceIngressRules["eth0"], rules2) {
fmt.Fprintf(GinkgoWriter,
_, _ = fmt.Fprintf(GinkgoWriter,
"IngressNodeFirewallNodeState.Spec.Ingress does not match IngressNodeFirewall.Spec.Ingress "+
"for object with name %s %v\n", nodeState.Name, nodeState.Spec.InterfaceIngressRules["eth0"])
return false
Expand Down Expand Up @@ -532,19 +532,19 @@ var _ = Describe("IngressNodeFirewall controller with multiple objects", func()
Eventually(func() bool {
err := k8sClient.List(ctx, nodeStateList, []client.ListOption{}...)
if err != nil {
fmt.Fprintf(GinkgoWriter, "Could not list IngressNodeFirewallNodeStates during this iteration\n")
_, _ = fmt.Fprintf(GinkgoWriter, "Could not list IngressNodeFirewallNodeStates during this iteration\n")
return false
}
// Check item content.
for _, nodeState := range nodeStateList.Items {
if _, ok := nodeState.Spec.InterfaceIngressRules["eth0"]; !ok {
fmt.Fprintf(GinkgoWriter,
_, _ = fmt.Fprintf(GinkgoWriter,
"IngressNodeFirewallNodeState.Spec.InterfaceIngressRules[%s] does not exist "+
"for object with name %s\n", "eth0", nodeState.Name)
return false
}
if !equality.Semantic.DeepEqual(nodeState.Spec.InterfaceIngressRules["eth0"], rules1) {
fmt.Fprintf(GinkgoWriter,
_, _ = fmt.Fprintf(GinkgoWriter,
"IngressNodeFirewallNodeState.Spec.Ingress does not match IngressNodeFirewall.Spec.Ingress "+
"for object with name %s %v\n", nodeState.Name, nodeState.Spec.InterfaceIngressRules["eth0"])
return false
Expand All @@ -567,12 +567,12 @@ func hasIngressNodeFirewallNodeStates(ctx context.Context, k8sClient client.Clie
// List all IngressNodeFirewallNodeStates.
err := k8sClient.List(ctx, nodeStateList, []client.ListOption{}...)
if err != nil {
fmt.Fprintf(GinkgoWriter, "Could not list IngressNodeFirewallNodeStates during this iteration\n")
_, _ = fmt.Fprintf(GinkgoWriter, "Could not list IngressNodeFirewallNodeStates during this iteration\n")
return false
}
// Check number of items.
if len(nodeStateList.Items) != len(expectedObjectNames) {
fmt.Fprintf(GinkgoWriter, "Could not find the desired number of IngressNodeFirewallNodeStates. "+
_, _ = fmt.Fprintf(GinkgoWriter, "Could not find the desired number of IngressNodeFirewallNodeStates. "+
"Found %d objects but expected to find %d objects. Object list: %+v\n",
len(nodeStateList.Items), len(expectedObjectNames), nodeStateList.Items)
return false
Expand All @@ -587,7 +587,7 @@ func hasIngressNodeFirewallNodeStates(ctx context.Context, k8sClient client.Clie
}
}
if !match {
fmt.Fprintf(GinkgoWriter, "Could not find expected IngressNodeFirewallNodeState %s. Object list: %v\n",
_, _ = fmt.Fprintf(GinkgoWriter, "Could not find expected IngressNodeFirewallNodeState %s. Object list: %v\n",
expectedName, nodeStateList.Items)
return false
}
Expand Down
2 changes: 1 addition & 1 deletion controllers/ingressnodefirewallconfig_controller.go
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@ func (r *IngressNodeFirewallConfigReconciler) Reconcile(ctx context.Context, req
condition = status.ConditionDegraded
err = errors.Wrapf(err, "FailedToSyncIngressNodeFirewallConfigResources")
} else {
err = status.IsIngressNodeFirewallConfigAvailable(ctx, r.Client, req.NamespacedName.Namespace)
err = status.IsIngressNodeFirewallConfigAvailable(ctx, r.Client, req.Namespace)
if err != nil {
if _, ok := err.(status.IngressNodeFirewallConfigResourcesNotReadyError); ok {
ctrResult = ctrl.Result{RequeueAfter: 5 * time.Second}
Expand Down
2 changes: 1 addition & 1 deletion controllers/ingressnodefirewallnodestate_controller.go
Original file line number Diff line number Diff line change
Expand Up @@ -123,5 +123,5 @@ func (r *IngressNodeFirewallNodeStateReconciler) reconcileResource(
}

func isNodeStateDeletionInProgress(nodeState *infv1alpha1.IngressNodeFirewallNodeState) bool {
return !nodeState.ObjectMeta.DeletionTimestamp.IsZero()
return !nodeState.DeletionTimestamp.IsZero()
}
Loading