chore(deps): update module k8s.io/client-go to v0.20.0 [security] (release-0.29)

[redhat-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
k8s.io/client-go	replace	minor	v0.19.1 -> v0.20.0

---

Kubernetes client-go vulnerable to Sensitive Information Leak via Log File

CVE-2020-8565 / GHSA-8cfg-vx93-jvxw / GO-2021-0064

More information

Details

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.5, <= v1.18.13, <= v1.17.15, < v1.20.0-alpha2.

Severity

• CVSS Score: 4.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-8565
• https://github.com/kubernetes/kubernetes/issues/95623
• https://github.com/kubernetes/kubernetes/pull/95316
• https://github.com/kubernetes/client-go/commit/19875a3d5a2e0d4f51c976a9e0662de3c2c011e3
• https://github.com/kubernetes/client-go/commit/1b8383fc150c9b816b0072032cca75754c2734d0
• https://github.com/kubernetes/client-go/commit/44e1a07f2d513e375c4b6ee6e890040b47befe86
• https://github.com/kubernetes/client-go/commit/e8f871a2e5fadf90fc114565abc0963967f1a373
• https://github.com/kubernetes/kubernetes/commit/e99df0e5a75eb6e86123b56d53e9b7ca0fd00419
• https://github.com/kubernetes/client-go
• https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ
• https://pkg.go.dev/vuln/GO-2021-0064

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Unauthorized credential disclosure via debug logs in k8s.io/kubernetes and k8s.io/client-go

CVE-2020-8565 / GHSA-8cfg-vx93-jvxw / GO-2021-0064

More information

Details

Authorization tokens may be inappropriately logged if the verbosity level is set to a debug level. This is due to an incomplete fix for CVE-2019-11250.

Severity

Unknown

References

• https://github.com/kubernetes/kubernetes/pull/95316
• https://github.com/kubernetes/kubernetes/commit/e99df0e5a75eb6e86123b56d53e9b7ca0fd00419
• https://github.com/kubernetes/kubernetes/issues/95623

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

kubernetes/client-go (k8s.io/client-go)

v0.20.0

Compare Source

v0.19.16

Compare Source

v0.19.15

Compare Source

v0.19.14

Compare Source

v0.19.13

Compare Source

v0.19.12

Compare Source

v0.19.11

Compare Source

v0.19.10

Compare Source

v0.19.9

Compare Source

v0.19.8

Compare Source

v0.19.7

Compare Source

v0.19.6

Compare Source

v0.19.5

Compare Source

v0.19.4

Compare Source

v0.19.3

Compare Source

v0.19.2

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[redhat-renovate-bot]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: downloading k8s.io/client-go v0.20.0
go: downloading golang.org/x/sys v0.28.0
go: downloading golang.org/x/net v0.33.0
go: downloading golang.org/x/text v0.21.0
go: downloading golang.org/x/crypto v0.31.0
go: downloading golang.org/x/term v0.27.0
go: github.com/k8snetworkplumbingwg/ovs-cni/pkg/marker imports
	k8s.io/client-go/kubernetes imports
	k8s.io/client-go/kubernetes/typed/apiserverinternal/v1alpha1 imports
	k8s.io/api/apiserverinternal/v1alpha1: cannot find module providing package k8s.io/api/apiserverinternal/v1alpha1
go: github.com/k8snetworkplumbingwg/ovs-cni/pkg/marker imports
	k8s.io/client-go/kubernetes imports
	k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta1 imports
	k8s.io/api/flowcontrol/v1beta1: cannot find module providing package k8s.io/api/flowcontrol/v1beta1
go: github.com/k8snetworkplumbingwg/ovs-cni/pkg/marker imports
	k8s.io/client-go/kubernetes imports
	k8s.io/client-go/kubernetes/typed/node/v1 imports
	k8s.io/api/node/v1: cannot find module providing package k8s.io/api/node/v1

[kubevirt-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: redhat-renovate-bot
Once this PR has been reviewed and has the lgtm label, please assign phoracek for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request updates the k8s.io/client-go module to version v0.20.0. This update is essential for resolving a critical security vulnerability (CVE-2020-8565) that could expose sensitive authorization tokens in log files when debug logging is enabled. The change ensures enhanced security by preventing such information leakage.

Highlights

• Dependency Update: Updated the k8s.io/client-go module from v0.19.1 to v0.20.0.
• Security Fix: Addressed CVE-2020-8565, which prevents sensitive information like authorization and bearer tokens from being logged at high verbosity levels, mitigating a potential information leak.

Changelog

• go.mod
  • Updated the k8s.io/client-go module version to v0.20.0.

Activity

• The pull request was automatically generated by Renovate Bot.
• No human reviews or comments have been made yet.
• Automerge is currently disabled, requiring manual merging.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[kubevirt-bot]

@redhat-renovate-bot: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-e2e-ovs-cni	8540419	link	true	/test pull-e2e-ovs-cni-0.29

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[gemini-code-assist]

Code Review

This pull request updates k8s.io/client-go to v0.20.0 to address a security vulnerability. However, this introduces a version mismatch with other Kubernetes dependencies pinned to v0.19.1, which is a critical risk to the project's stability. My review suggests aligning all Kubernetes dependencies to a consistent version, preferably v0.20.6 to match what's in the require section of your go.mod, to ensure compatibility and resolve the security issue correctly.

[gemini-code-assist]

While updating k8s.io/client-go to v0.20.0 addresses the security vulnerability, it creates an inconsistency with other Kubernetes dependencies pinned to v0.19.1. This can lead to build failures or runtime issues. All k8s.io modules should be on a consistent version.

Given the require block uses v0.20.6 for k8s.io modules, it seems the intent is to upgrade to the 1.20 release series. To maintain compatibility, please update all k8s.io dependencies in this replace block to the same version. I'd recommend using v0.20.6 to match the require block. You should also update the comment on line 65.

Suggested change

	k8s.io/client-go => k8s.io/client-go v0.20.0
	k8s.io/client-go => k8s.io/client-go v0.20.6