Fixing CVE-2026-25679#433
Open
npecka wants to merge 2 commits into
Open
Conversation
Contributor
WalkthroughBase image tags are incremented across the project: CI configuration builds use ChangesImage Dependencies
🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested labels
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: npecka The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #433 +/- ##
=======================================
Coverage 72.44% 72.44%
=======================================
Files 11 11
Lines 704 704
=======================================
Hits 510 510
Misses 173 173
Partials 21 21 🚀 New features to boost your workflow:
|
openshift-ci
Bot
added
the
do-not-merge/invalid-owners-file
Contributor
|
The content of OWNERS_ALIASES is invalid. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.pre-commit-config.yaml:
- Around line 123-133: The header comment above the pre-commit hook is
misleading: the text says "warn-only" but the hook with id "rbac-wildcard-check"
runs "entry: bash -c 'make rbac-wildcard-check'" and will block on non‑zero
exit; update the comment to reflect that this hook is blocking (or,
alternatively, change the hook to a non‑blocking configuration if intended).
Specifically, edit the comment block that references "RBAC WILDCARD CHECK" so it
no longer claims "warn-only" and instead documents that "rbac-wildcard-check"
will fail the commit on non‑zero exit, ensuring the description aligns with the
hook id and entry command.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 82f66471-c72b-4eaf-aca7-5f5e940690a6
⛔ Files ignored due to path filters (8)
boilerplate/_data/backing-image-tagis excluded by!boilerplate/**boilerplate/_data/last-boilerplate-commitis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/.codecov.ymlis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/OWNERS_ALIASESis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/golangci.ymlis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/pre-commit-config.yamlis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/standard.mkis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/updateis excluded by!boilerplate/**
📒 Files selected for processing (6)
.ci-operator.yaml.codecov.yml.pre-commit-config.yamlOWNERS_ALIASESbuild/Dockerfilebuild/Dockerfile.olm-registry
✅ Files skipped from review due to trivial changes (2)
- .ci-operator.yaml
- build/Dockerfile.olm-registry
Updates boilerplate version from image-v8.3.4 to image-v8.3.6 which includes golang 1.25.8 builder image for CVE-2026-25679 fix. Changes: - Updated boilerplate metadata to v8.3.6 - Updated operator build Dockerfile to use boilerplate:image-v8.3.6 - Updated UBI minimal base images to 9.8 The e2e test Dockerfile already contains golang 1.25.8 from the initial commit on this branch. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
openshift-ci
Bot
removed
the
do-not-merge/invalid-owners-file
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
build/Dockerfile (1)
6-11:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRun the runtime image as non-root.
The final stage has no
USERdirective, so it runs as root by default. That weakens container hardening.🔧 Suggested hardening patch
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8-1777460003 ENV OPERATOR_PATH=/go/src/github.com/openshift/splunk-forwarder-operator \ OPERATOR_BIN=splunk-forwarder-operator -WORKDIR /root/ +WORKDIR /tmp COPY --from=builder /go/src/github.com/openshift/splunk-forwarder-operator/build/_output/bin/${OPERATOR_BIN} /usr/local/bin/${OPERATOR_BIN} +USER 1001 LABEL io.openshift.managed.name="splunk-forwarder-operator" \ io.openshift.managed.description="This operator will be responsible for deploying the splunk forwarder."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@build/Dockerfile` around lines 6 - 11, The final Docker stage runs as root; add a non-root user and switch to it to harden the container: create a user/group (e.g., appuser), chown the copied binary referenced by OPERATOR_BIN and any needed WORKDIR contents, set HOME/WORKDIR to a non-root path rather than /root if appropriate, and add a USER appuser directive before the image is finalized so the splunk-forwarder-operator binary runs unprivileged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@build/Dockerfile`:
- Around line 6-11: The final Docker stage runs as root; add a non-root user and
switch to it to harden the container: create a user/group (e.g., appuser), chown
the copied binary referenced by OPERATOR_BIN and any needed WORKDIR contents,
set HOME/WORKDIR to a non-root path rather than /root if appropriate, and add a
USER appuser directive before the image is finalized so the
splunk-forwarder-operator binary runs unprivileged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 17bf7078-efa8-45d5-89b2-887e1004e939
⛔ Files ignored due to path filters (2)
boilerplate/_data/backing-image-tagis excluded by!boilerplate/**boilerplate/_data/last-boilerplate-commitis excluded by!boilerplate/**
📒 Files selected for processing (3)
.ci-operator.yamlbuild/Dockerfilebuild/Dockerfile.olm-registry
✅ Files skipped from review due to trivial changes (1)
- .ci-operator.yaml
Contributor
|
@npecka: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updating golang to 1.25.8 to fix cve-2026-25679
Summary by CodeRabbit