Merge https://github.com/kubernetes/cloud-provider-vsphere:master (564bf3e) into main #118
The diff you're trying to view is too large. We only load the first 3000 changed files.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
Binary file not shown.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -72,6 +72,14 @@ rules: | |
| - list | ||
| - watch | ||
| - update | ||
| - apiGroups: | ||
| - "discovery.k8s.io" | ||
| resources: | ||
| - endpointslices | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -50,7 +50,7 @@ serviceAccount: | |
| daemonset: | ||
| annotations: {} | ||
| image: registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere | ||
| tag: v1.36.0 | ||
| pullPolicy: IfNotPresent | ||
| dnsPolicy: ClusterFirst | ||
| cmdline: | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,7 +5,7 @@ options: | |
| substitution_option: ALLOW_LOOSE | ||
| machineType: 'E2_HIGHCPU_8' | ||
| steps: | ||
| - name: 'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20260205-38cfa9523f' | ||
| entrypoint: make | ||
| env: | ||
| - DOCKER_CLI_EXPERIMENTAL=enabled | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,7 +5,7 @@ options: | |
| substitution_option: ALLOW_LOOSE | ||
| machineType: 'E2_HIGHCPU_8' | ||
| steps: | ||
| - name: 'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20260205-38cfa9523f' | ||
| entrypoint: make | ||
| env: | ||
| - DOCKER_CLI_EXPERIMENTAL=enabled | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,7 +14,7 @@ | |
| ## BUILD ARGS ## | ||
| ################################################################################ | ||
| # This build arg allows the specification of a custom Golang image. | ||
| ARG GOLANG_IMAGE=golang:1.26.0 | ||
|
|
||
| # The distroless image on which the CPI manager image is built. | ||
| ARG DISTROLESS_IMAGE=gcr.io/distroless/static-debian11:latest | ||
|
|
@@ -27,7 +27,7 @@ ARG DISTROLESS_IMAGE=gcr.io/distroless/static-debian11:latest | |
| FROM ${GOLANG_IMAGE} as builder | ||
|
|
||
| # This build arg is the version to embed in the CPI binary | ||
| ARG VERSION=1.36.0 | ||
|
|
||
| # This build arg controls the GOPROXY setting | ||
| ARG GOPROXY | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -233,7 +233,7 @@ spec: | |
| priorityClassName: system-node-critical | ||
| containers: | ||
| - name: vsphere-cloud-controller-manager | ||
| image: registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.36.0 | ||
| args: | ||
| - --cloud-provider=vsphere | ||
| - --v=2 | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,35 +1,37 @@ | ||
| module k8s.io/cloud-provider-vsphere | ||
|
|
||
| go 1.26.0 | ||
|
|
||
| replace github.com/vmware-tanzu/vm-operator/pkg/constants/testlabels => github.com/vmware-tanzu/vm-operator/pkg/constants/testlabels v0.0.0-20260502065817-4ee333ccd54c | ||
|
|
||
| // vm-operator version: prefer alignment with CAPV https://github.com/kubernetes-sigs/cluster-api-provider-vsphere/blob/main/go.mod#L11 | ||
| // (may temporarily diverge when CPI needs a newer api/v1alpha6 commit before CAPV bumps). | ||
| require ( | ||
| github.com/fsnotify/fsnotify v1.10.1 | ||
| github.com/golang/mock v1.6.0 | ||
| github.com/google/uuid v1.6.0 | ||
| github.com/pkg/errors v0.9.1 | ||
| github.com/prometheus/client_golang v1.23.2 | ||
| github.com/spf13/cobra v1.10.2 | ||
| github.com/spf13/pflag v1.0.10 | ||
| github.com/stretchr/testify v1.11.1 | ||
| github.com/vmware-tanzu/nsx-operator/pkg/apis v0.0.0-20260423081355-beab2417344a | ||
| github.com/vmware-tanzu/nsx-operator/pkg/client v0.0.0-20260423081355-beab2417344a | ||
| github.com/vmware-tanzu/vm-operator/api v1.9.1-0.20260502065817-4ee333ccd54c | ||
| github.com/vmware/govmomi v0.53.0 | ||
| github.com/vmware/vsphere-automation-sdk-go/lib v0.7.0 | ||
| github.com/vmware/vsphere-automation-sdk-go/runtime v0.7.0 | ||
| github.com/vmware/vsphere-automation-sdk-go/services/nsxt v0.12.0 | ||
| golang.org/x/net v0.53.0 | ||
| gopkg.in/gcfg.v1 v1.2.3 | ||
| gopkg.in/yaml.v2 v2.4.0 | ||
| k8s.io/api v0.36.0 | ||
| k8s.io/apimachinery v0.36.0 | ||
| k8s.io/client-go v0.36.0 | ||
| k8s.io/cloud-provider v0.36.0 | ||
| k8s.io/code-generator v0.36.0 | ||
| k8s.io/component-base v0.36.0 | ||
| k8s.io/klog/v2 v2.140.0 | ||
| sigs.k8s.io/yaml v1.6.0 | ||
| ) | ||
|
|
||
|
|
@@ -41,14 +43,12 @@ require ( | |
| github.com/beevik/etree v1.1.3 // indirect | ||
| github.com/beorn7/perks v1.0.1 // indirect | ||
| github.com/blang/semver/v4 v4.0.0 // indirect | ||
| github.com/cenkalti/backoff/v5 v5.0.3 // indirect | ||
| github.com/cespare/xxhash/v2 v2.3.0 // indirect | ||
| github.com/coreos/go-semver v0.3.1 // indirect | ||
| github.com/coreos/go-systemd/v22 v22.7.0 // indirect | ||
| github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect | ||
| github.com/emicklei/go-restful/v3 v3.13.0 // indirect | ||
| github.com/felixge/httpsnoop v1.0.4 // indirect | ||
| github.com/fxamacker/cbor/v2 v2.9.0 // indirect | ||
| github.com/gibson042/canonicaljson-go v1.0.3 // indirect | ||
|
|
@@ -60,12 +60,11 @@ require ( | |
| github.com/gogo/protobuf v1.3.2 // indirect | ||
| github.com/golang-jwt/jwt/v4 v4.5.2 // indirect | ||
| github.com/golang/protobuf v1.5.4 // indirect | ||
| github.com/google/cel-go v0.26.0 // indirect | ||
| github.com/google/gnostic-models v0.7.0 // indirect | ||
| github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0 // indirect | ||
| github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 // indirect | ||
| github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 // indirect | ||
| github.com/inconshreveable/mousetrap v1.1.0 // indirect | ||
| github.com/josharian/intern v1.0.0 // indirect | ||
| github.com/json-iterator/go v1.1.12 // indirect | ||
|
|
@@ -77,58 +76,57 @@ require ( | |
| github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect | ||
| github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect | ||
| github.com/prometheus/client_model v0.6.2 // indirect | ||
| github.com/prometheus/common v0.67.5 // indirect | ||
| github.com/prometheus/procfs v0.19.2 // indirect | ||
| github.com/stoewer/go-strcase v1.3.0 // indirect | ||
| github.com/x448/float16 v0.8.4 // indirect | ||
| go.etcd.io/etcd/api/v3 v3.6.10 // indirect | ||
| go.etcd.io/etcd/client/pkg/v3 v3.6.10 // indirect | ||
| go.etcd.io/etcd/client/v3 v3.6.10 // indirect | ||
| go.opentelemetry.io/auto/sdk v1.2.1 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.65.0 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect | ||
| go.opentelemetry.io/otel v1.41.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.41.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.40.0 // indirect | ||
|
There was a problem hiding this comment. 🧩 Analysis chain🌐 Web query:
💡 Result: The fixed version for the GHSA-hfvc-g4fc-pqhx vulnerability in go.opentelemetry.io/otel/sdk (part of opentelemetry-go) is v1.43.0. Affected versions are >= v1.15.0 and <= v1.42.0. This vulnerability (CVE-2026-39883) is an incomplete fix for a prior PATH hijacking issue (GHSA-9h8m-3fm2-qjrq / CVE-2026-24051), where the BSD kenv command was not using an absolute path. The fix uses "/bin/kenv" and was included in the v1.43.0 release on 2026-04-03. Citations:
Upgrade The installed version v1.40.0 is affected by HIGH severity vulnerability GHSA-hfvc-g4fc-pqhx (CVE-2026-39883): BSD kenv command not using absolute path enables PATH hijacking. Update the indirect dependency to v1.43.0 (released 2026-04-03) or later, or use a replace directive in go.mod if upstream has not yet resolved the transitive dependency. 🧰 Tools🪛 OSV Scanner (2.3.5)[HIGH] 92-92: go.opentelemetry.io/otel/sdk 1.40.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking 🤖 Prompt for AI Agents |
||
| go.opentelemetry.io/otel/trace v1.41.0 // indirect | ||
| go.opentelemetry.io/proto/otlp v1.9.0 // indirect | ||
| go.uber.org/multierr v1.11.0 // indirect | ||
| go.uber.org/zap v1.27.1 // indirect | ||
| go.yaml.in/yaml/v2 v2.4.3 // indirect | ||
| go.yaml.in/yaml/v3 v3.0.4 // indirect | ||
| golang.org/x/crypto v0.50.0 // indirect | ||
| golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect | ||
| golang.org/x/mod v0.34.0 // indirect | ||
| golang.org/x/oauth2 v0.34.0 // indirect | ||
| golang.org/x/sync v0.20.0 // indirect | ||
| golang.org/x/sys v0.43.0 // indirect | ||
| golang.org/x/term v0.42.0 // indirect | ||
| golang.org/x/text v0.36.0 // indirect | ||
| golang.org/x/time v0.14.0 // indirect | ||
| golang.org/x/tools v0.43.0 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect | ||
| google.golang.org/grpc v1.79.3 // indirect | ||
| google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect | ||
| gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect | ||
| gopkg.in/inf.v0 v0.9.1 // indirect | ||
| gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect | ||
| gopkg.in/warnings.v0 v0.1.2 // indirect | ||
| gopkg.in/yaml.v3 v3.0.1 // indirect | ||
| k8s.io/apiserver v0.36.0 // indirect | ||
| k8s.io/component-helpers v0.36.0 // indirect | ||
| k8s.io/controller-manager v0.36.0 // indirect | ||
| k8s.io/gengo/v2 v2.0.0-20250922181213-ec3ebc5fd46b // indirect | ||
| k8s.io/kms v0.36.0 // indirect | ||
| k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect | ||
| k8s.io/streaming v0.36.0 // indirect | ||
| k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect | ||
| sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect | ||
| sigs.k8s.io/controller-runtime v0.19.0 // indirect | ||
| sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect | ||
| sigs.k8s.io/randfill v1.0.0 // indirect | ||
| sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect | ||
| ) | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.