Skip to content

Commit 4e1fdc8

Browse files
michael-valdronmichael-valdron
authored
Patch k8s and disable http/2 by default to mitigate rapid reset CVE (#60)
* patch dependencies Signed-off-by: Michael Valdron <mvaldron@redhat.com> * disable http/2 by default Signed-off-by: Michael Valdron <mvaldron@redhat.com> * add instructions to enable http/2 Signed-off-by: Michael Valdron <mvaldron@redhat.com> --------- Signed-off-by: Michael Valdron <mvaldron@redhat.com>
1 parent 6b3db41 commit 4e1fdc8

File tree

7 files changed

+109
-63
lines changed

7 files changed

+109
-63
lines changed

‎CONTRIBUTING.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,13 @@ The Makefile currently supports both Docker and Podman. To run the proper comman
4141

4242
8. Run `make deploy` to deploy the operator.
4343

44+
##### Enabling HTTP/2 on the Webhook Server
45+
46+
By default, http/2 on the webhook server is disabled due to [CVE-2023-44487](https://github.com/advisories/GHSA-qppj-fm5r-hxr3).
47+
48+
If you want to enable http/2 for the webhook server, build with `ENABLE_WEBHOOK_HTTP2=true make docker-build` or with
49+
`ENABLE_WEBHOOK_HTTP2=true make run` if running locally.
50+
4451
### Testing your Changes
4552

4653
All changes delivered to the Devfile Registry operator are expected to be sufficiently tested. This may include validating that existing tests pass, updating tests, or adding new tests.

‎Dockerfile

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,10 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -a -o
3737
ARG ENABLE_WEBHOOKS=true
3838
ENV ENABLE_WEBHOOKS=${ENABLE_WEBHOOKS}
3939

40+
# disable http/2 on the webhook server by default
41+
ARG ENABLE_WEBHOOK_HTTP2=false
42+
ENV ENABLE_WEBHOOK_HTTP2=${ENABLE_WEBHOOK_HTTP2}
43+
4044
# Use distroless as minimal base image to package the manager binary
4145
# Refer to https://github.com/GoogleContainerTools/distroless for more details
4246
FROM gcr.io/distroless/static:nonroot

‎Makefile

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ VERSION ?= `cat $(PWD)/VERSION`
1919
BUNDLE_IMG ?= quay.io/devfile/registry-operator-bundle:v$(VERSION)
2020
CERT_MANAGER_VERSION ?= v1.11.0
2121
ENABLE_WEBHOOKS ?= true
22+
ENABLE_WEBHOOK_HTTP2 ?= false
2223

2324
# Options for 'bundle-build'
2425
ifneq ($(origin CHANNELS), undefined)
@@ -170,7 +171,8 @@ generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and
170171
# Build the docker image
171172
.PHONY: docker-build
172173
docker-build:
173-
docker build . -t ${IMG} --build-arg ENABLE_WEBHOOKS=${ENABLE_WEBHOOKS}
174+
docker build . -t ${IMG} --build-arg ENABLE_WEBHOOKS=${ENABLE_WEBHOOKS} \
175+
--build-arg ENABLE_WEBHOOK_HTTP2=${ENABLE_WEBHOOK_HTTP2}
174176

175177
# Push the docker image
176178
.PHONY: docker-push

‎config/default/manager_auth_proxy_patch.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,13 @@ spec:
1616
drop: ["ALL"]
1717
seccompProfile:
1818
type: "RuntimeDefault"
19-
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1
19+
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.15.0
2020
args:
2121
- "--secure-listen-address=0.0.0.0:8443"
2222
- "--upstream=http://127.0.0.1:8080/"
2323
- "--logtostderr=true"
2424
- "--v=10"
25+
- "--http2-disable=true"
2526
ports:
2627
- containerPort: 8443
2728
protocol: TCP

‎go.mod

Lines changed: 25 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,16 @@ require (
77
github.com/devfile/registry-support/registry-library v0.0.0-20230327144043-0f64fa10dd3d
88
github.com/go-logr/logr v1.2.3
99
github.com/hashicorp/go-multierror v1.1.1
10-
github.com/onsi/ginkgo/v2 v2.6.0
11-
github.com/onsi/gomega v1.24.1
10+
github.com/onsi/ginkgo/v2 v2.9.1
11+
github.com/onsi/gomega v1.27.4
1212
github.com/openshift/api v0.0.0-20221013123532-e8b83ffadbab
1313
github.com/stretchr/testify v1.8.1
1414
gopkg.in/yaml.v2 v2.4.0
15-
k8s.io/api v0.26.2
16-
k8s.io/apiextensions-apiserver v0.26.1
17-
k8s.io/apimachinery v0.26.2
18-
k8s.io/client-go v0.26.2
19-
sigs.k8s.io/controller-runtime v0.14.5
15+
k8s.io/api v0.26.10
16+
k8s.io/apiextensions-apiserver v0.26.10
17+
k8s.io/apimachinery v0.27.7
18+
k8s.io/client-go v0.26.10
19+
sigs.k8s.io/controller-runtime v0.14.7
2020
)
2121

2222
require (
@@ -36,24 +36,26 @@ require (
3636
github.com/evanphx/json-patch/v5 v5.6.0 // indirect
3737
github.com/fsnotify/fsnotify v1.6.0 // indirect
3838
github.com/go-logr/zapr v1.2.3 // indirect
39-
github.com/go-openapi/jsonpointer v0.19.5 // indirect
40-
github.com/go-openapi/jsonreference v0.20.0 // indirect
41-
github.com/go-openapi/swag v0.19.14 // indirect
39+
github.com/go-openapi/jsonpointer v0.19.6 // indirect
40+
github.com/go-openapi/jsonreference v0.20.1 // indirect
41+
github.com/go-openapi/swag v0.22.3 // indirect
42+
github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 // indirect
4243
github.com/gogo/protobuf v1.3.2 // indirect
4344
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
4445
github.com/golang/protobuf v1.5.3 // indirect
4546
github.com/google/gnostic v0.5.7-v3refs // indirect
4647
github.com/google/go-cmp v0.5.9 // indirect
4748
github.com/google/gofuzz v1.2.0 // indirect
48-
github.com/google/uuid v1.2.0 // indirect
49+
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect
50+
github.com/google/uuid v1.3.0 // indirect
4951
github.com/gorilla/mux v1.8.0 // indirect
5052
github.com/hashicorp/errwrap v1.1.0 // indirect
5153
github.com/hashicorp/go-version v1.4.0 // indirect
5254
github.com/imdario/mergo v0.3.12 // indirect
5355
github.com/josharian/intern v1.0.0 // indirect
5456
github.com/json-iterator/go v1.1.12 // indirect
5557
github.com/klauspost/compress v1.13.6 // indirect
56-
github.com/mailru/easyjson v0.7.6 // indirect
58+
github.com/mailru/easyjson v0.7.7 // indirect
5759
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
5860
github.com/moby/locker v1.0.1 // indirect
5961
github.com/moby/term v0.0.0-20221205130635-1aeaba878587 // indirect
@@ -69,31 +71,33 @@ require (
6971
github.com/prometheus/client_model v0.3.0 // indirect
7072
github.com/prometheus/common v0.39.0 // indirect
7173
github.com/prometheus/procfs v0.8.0 // indirect
74+
github.com/rogpeppe/go-internal v1.11.0 // indirect
7275
github.com/sirupsen/logrus v1.9.0 // indirect
7376
github.com/spf13/pflag v1.0.5 // indirect
7477
go.uber.org/atomic v1.7.0 // indirect
7578
go.uber.org/multierr v1.6.0 // indirect
7679
go.uber.org/zap v1.24.0 // indirect
77-
golang.org/x/net v0.8.0 // indirect
80+
golang.org/x/net v0.17.0 // indirect
7881
golang.org/x/oauth2 v0.3.0 // indirect
7982
golang.org/x/sync v0.1.0 // indirect
80-
golang.org/x/sys v0.6.0 // indirect
81-
golang.org/x/term v0.6.0 // indirect
82-
golang.org/x/text v0.8.0 // indirect
83+
golang.org/x/sys v0.13.0 // indirect
84+
golang.org/x/term v0.13.0 // indirect
85+
golang.org/x/text v0.13.0 // indirect
8386
golang.org/x/time v0.3.0 // indirect
87+
golang.org/x/tools v0.7.0 // indirect
8488
gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
8589
google.golang.org/appengine v1.6.7 // indirect
8690
google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21 // indirect
8791
google.golang.org/grpc v1.49.0 // indirect
8892
google.golang.org/protobuf v1.28.1 // indirect
8993
gopkg.in/inf.v0 v0.9.1 // indirect
9094
gopkg.in/yaml.v3 v3.0.1 // indirect
91-
k8s.io/component-base v0.26.1 // indirect
92-
k8s.io/klog/v2 v2.80.1 // indirect
93-
k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect
94-
k8s.io/utils v0.0.0-20221128185143-99ec85e7a448 // indirect
95+
k8s.io/component-base v0.26.10 // indirect
96+
k8s.io/klog/v2 v2.90.1 // indirect
97+
k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect
98+
k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect
9599
oras.land/oras-go v1.2.2 // indirect
96-
sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
100+
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
97101
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
98102
sigs.k8s.io/yaml v1.3.0 // indirect
99103
)

0 commit comments

Comments
 (0)