[1.27] Bump runc to 1.1.6 #117242

haircommander · 2023-04-12T13:31:23Z

What type of PR is this?

/kind bug

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

cherry-picks of #117241 and #117095 for 1.27

Does this PR introduce a user-facing change?

CVE-2023-27561 CVE-2023-25809 CVE-2023-28642: Bump fix runc v1.1.4 -> v1.1.5

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

Signed-off-by: Peter Hunt <[email protected]>

dims · 2023-04-12T13:47:05Z

@haircommander could you please poke at why we are getting one more transitive dependency than we had before? Is there anything we can do about it? (submit a PR to update something or other in runc?)

/assign @liggitt

/logs/artifacts /home/prow/go/src/k8s.io/kubernetes
go: downloading github.com/kubernetes-sigs/depstat v0.7.0
go: downloading github.com/spf13/cobra v1.1.1
go: downloading github.com/spf13/pflag v1.0.5
/home/prow/go/src/k8s.io/kubernetes
HEAD is now at 168a654e467 Merge commit 'e5997[2](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/117242/check-dependency-stats/1646143991122497536#1:build-log.txt%3A2)2bc59280bc5899b[3](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/117242/check-dependency-stats/1646143991122497536#1:build-log.txt%3A3)2957ff088ef97c33fa' into release-1.27
Switched to a new branch 'base'
--- /logs/artifacts/stats-base.txt	2023-0[4](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/117242/check-dependency-stats/1646143991122497536#1:build-log.txt%3A4)-12 13:33:[5](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/117242/check-dependency-stats/1646143991122497536#1:build-log.txt%3A5)3.187195487 +0000
+++ /logs/artifacts/stats.txt	2023-04-12 13:33:52.8[6](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/117242/check-dependency-stats/1646143991122497536#1:build-log.txt%3A6)[7](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/117242/check-dependency-stats/1646143991122497536#1:build-log.txt%3A7)163257 +0000
@@ -1,6 +1,6 @@
 Direct Dependencies: 206 
-Transitive Dependencies: 230 
-Total Dependencies: 279 
+Transitive Dependencies: 231 
+Total Dependencies: 2[8](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/117242/check-dependency-stats/1646143991122497536#1:build-log.txt%3A8)0 
 Max Depth Of Dependencies: 23 
 All dependencies:
 
@@ -1[9](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/117242/check-dependency-stats/1646143991122497536#1:build-log.txt%3A9)9,6 +199,7 @@
 github.com/russross/blackfriday/v2
 github.com/seccomp/libseccomp-golang
 github.com/sergi/go-diff
+github.com/shurcooL/sanitized_anchor_name
 github.com/sirupsen/logrus
 github.com/soheilhy/cmux
 github.com/spf[13](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/117242/check-dependency-stats/1646143991122497536#1:build-log.txt%3A13)/cobra

haircommander · 2023-04-12T13:59:50Z

I am honestly not sure. Is it possible it's coming from hack/tools?

hack/tools/go.sum:github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=

this looks to be the same on master

hack/tools/go.sum:github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=

If I were to guess it's similarly happened in #117095 though I'm struggling to find the job to prove that

soltysh · 2023-04-12T14:11:03Z

The same dep that @dims pointed out appears in #117241 so it's clearly coming from that 1.1.6 bump, see https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/117241/check-dependency-stats/1646141874617978880

dims · 2023-04-12T14:34:21Z

@haircommander - if we bump runc like so, it will drop the shurcooL stuff, see why here:
urfave/cli@v1.22.9...v1.22.12

[davanum@c889f3bd53ed 10:27] ~/go/src/github.com/opencontainers/runc ⟩ git diff
diff --git a/go.mod b/go.mod
index 4b3dd3913081..28c51eb1bc5c 100644
--- a/go.mod
+++ b/go.mod
@@ -17,7 +17,7 @@ require (
        github.com/seccomp/libseccomp-golang v0.10.0
        github.com/sirupsen/logrus v1.9.0
        github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635
-       github.com/urfave/cli v1.22.9
+       github.com/urfave/cli v1.22.12
        github.com/vishvananda/netlink v1.1.0
        golang.org/x/net v0.9.0
        golang.org/x/sys v0.7.0
@@ -27,5 +27,5 @@ require (
 require (
        github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
        github.com/russross/blackfriday/v2 v2.1.0 // indirect
-       github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df // indirect
+       github.com/vishvananda/netns v0.0.4 // indirect
 )

dims · 2023-04-12T14:40:33Z

You can use go mod graph to identify this code path. i have some helper scripts to visualize this - https://gist.github.com/dims/7eb66bbed03f349f092b31dabd1bdd47#file-map-of-dependencies-readme-md

Here's what the diagram looks like when run against runc repo:

haircommander · 2023-04-12T14:41:09Z

@haircommander - if we bump runc like so, it will drop the shurcooL stuff, see why here:

sorry, it's not clear to me what the ask is here. Are you suggesting we propose those changes to runc upstream and wait for a 1.1.7?

dims · 2023-04-12T14:42:48Z

So now that we know. Please open a PR to bump urfave/cli to v1.22.12 and vishvananda/netns to v0.0.4 in opencontainers/runc repo.

we don't need for them to tag that to land this. i am happy to go with this PR as-is as long as we update quickly when next runc is tagged.

liggitt · 2023-04-12T15:43:00Z

So now that we know. Please open a PR to bump urfave/cli to v1.22.12 and vishvananda/netns to v0.0.4 in opencontainers/runc repo.

we don't need for them to tag that to land this. i am happy to go with this PR as-is as long as we update quickly when next runc is tagged.

I agree with this, though the master PR should be reviewed by sig-node and merge before merging this to release-1.27

dims · 2023-04-12T17:58:53Z

I agree with this, though the master PR should be reviewed by sig-node and merge before merging this to release-1.27

💯

rphillips · 2023-04-24T18:40:31Z

/sig node
/triage accepted
/lgtm
/priority important-soon

k8s-ci-robot · 2023-04-24T18:40:38Z

LGTM label has been added.

Git tree hash: b5ce83c497733d72d20c8cd6bcaaef388514f70f

rphillips · 2023-04-24T18:41:03Z

/assign @liggitt @mrunalp

liggitt · 2023-04-24T19:01:18Z

/approve
for deps

pacoxu · 2023-04-25T09:58:06Z

/assign @kubernetes/release-managers

k8s-ci-robot · 2023-04-25T10:20:45Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: haircommander, liggitt, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [liggitt]
~~vendor/OWNERS~~ [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

dims · 2023-04-29T12:57:39Z

xref: #117647

PushkarJ and others added 2 commits April 12, 2023 09:27

CVE-2023-27561: Bump runc go module v1.1.4 -> v1.1.5

25b061d

vendor: bump runc to 1.1.6

e599722

Signed-off-by: Peter Hunt <[email protected]>

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. do-not-merge/cherry-pick-not-approved Indicates that a PR is not yet approved to merge into a release branch. labels Apr 12, 2023

k8s-ci-robot added this to the v1.27 milestone Apr 12, 2023

k8s-ci-robot requested review from dims and logicalhan April 12, 2023 13:32

k8s-ci-robot added the area/dependency Issues or PRs related to dependency changes label Apr 12, 2023

k8s-ci-robot requested a review from a team April 12, 2023 13:32

k8s-ci-robot assigned liggitt Apr 12, 2023

openshift-ci-robot mentioned this pull request Apr 12, 2023

UPSTREAM: <carry>: OCPNODE-1548,OCPNODE-1584: disable load balancing on created cgroups when managed is enabled openshift/kubernetes#1518

Merged

openshift-ci-robot mentioned this pull request Apr 12, 2023

[release-4.13] UPSTREAM: <carry>: OCPNODE-1548,OCPNODE-1584: disable load balancing on created cgroups when managed is enabled openshift/kubernetes#1543

Merged

This was referenced Apr 12, 2023

WIP: Rebase 1.27.1 openshift/kubernetes#1524

Closed

[WIP] Debug panic openshift/kubernetes#1546

Closed

Updating openshift-enterprise-pod images to be consistent with ART openshift/kubernetes#1533

Closed

This was referenced Apr 18, 2023

Updating openshift-enterprise-hyperkube images to be consistent with ART openshift/kubernetes#1535

Closed

WIP: Rebase CI test openshift/kubernetes#1539

Closed

rphillips mentioned this pull request Apr 24, 2023

Automated cherry pick of #117241: vendor: bump runc to 1.1.6 #117563

Closed

k8s-ci-robot assigned rphillips Apr 24, 2023

k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. and removed needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Apr 24, 2023

k8s-ci-robot assigned mrunalp Apr 24, 2023

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 24, 2023

saschagrunert approved these changes Apr 25, 2023

View reviewed changes

saschagrunert added cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. and removed do-not-merge/cherry-pick-not-approved Indicates that a PR is not yet approved to merge into a release branch. labels Apr 25, 2023

k8s-ci-robot merged commit 667e164 into kubernetes:release-1.27 Apr 25, 2023

openshift-ci-robot mentioned this pull request Apr 27, 2023

STOR-1263: Update to Kubernetes 1.27.1 openshift/kubernetes#1558

Merged

This was referenced Apr 28, 2023

High memory utilization on 1.13.4 release bottlerocket-os/bottlerocket#3057

Closed

[1.26] Bump runc/libcontainer to 1.1.6 #117681

Closed

[runc][1.1.6] Adding misc controller to cgroup v1 makes kubelet sad #117647

Closed

dims mentioned this pull request Apr 30, 2023

[1.26] Bump runc/libcontainer to 1.1.6 #117691

Merged

kolyshkin mentioned this pull request May 11, 2023

v1.1.6 regression: adding misc controller to cgroup v1 makes kubelet sad opencontainers/runc#3849

Closed

[1.27] Bump runc to 1.1.6 #117242

[1.27] Bump runc to 1.1.6 #117242

Uh oh!

Conversation

haircommander commented Apr 12, 2023

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

Uh oh!

dims commented Apr 12, 2023

Uh oh!

haircommander commented Apr 12, 2023

Uh oh!

soltysh commented Apr 12, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dims commented Apr 12, 2023

Uh oh!

dims commented Apr 12, 2023

Uh oh!

haircommander commented Apr 12, 2023

Uh oh!

dims commented Apr 12, 2023

Uh oh!

liggitt commented Apr 12, 2023

Uh oh!

dims commented Apr 12, 2023

Uh oh!

rphillips commented Apr 24, 2023

Uh oh!

k8s-ci-robot commented Apr 24, 2023

Uh oh!

rphillips commented Apr 24, 2023

Uh oh!

liggitt commented Apr 24, 2023

Uh oh!

pacoxu commented Apr 25, 2023

Uh oh!

k8s-ci-robot commented Apr 25, 2023

Uh oh!

dims commented Apr 29, 2023

Uh oh!

Uh oh!

soltysh commented Apr 12, 2023 •

edited

Loading