Fix security

Makefile

@@ -32,7 +32,7 @@ TOOLS_BIN_DIR := $(TOOLS_DIR)/bin
 #
 # Go.
 #
-GO_VERSION ?= 1.26.3
+GO_VERSION ?= 1.26.4
 
 # Binaries
 GO_INSTALL := ./hack/go-install.sh

cluster/images/controller-manager/Dockerfile

@@ -14,7 +14,7 @@
 ##                               BUILD ARGS                                   ##
 ################################################################################
 # This build arg allows the specification of a custom Golang image.
-ARG GOLANG_IMAGE=golang:1.26.3
+ARG GOLANG_IMAGE=golang:1.26.4
 
 # The distroless image on which the CPI manager image is built.
 ARG DISTROLESS_IMAGE=gcr.io/distroless/static-debian11:latest

pkg/cloudprovider/vsphereparavirtual/config/config.go

@@ -43,8 +43,6 @@ const (
 	SupervisorClusterAccessNamespaceFile = "namespace"
 	// SupervisorAPIServerPortEnv reads supervisor service endpoint info from env
 	SupervisorAPIServerPortEnv string = "SUPERVISOR_APISERVER_PORT"
-	// SupervisorAPIServerEndpointIPEnv reads supervisor API server endpoint IP from env
-	SupervisorAPIServerEndpointIPEnv string = "SUPERVISOR_APISERVER_ENDPOINT_IP"
 	// SupervisorServiceAccountNameEnv reads supervisor service account name from env
 	SupervisorServiceAccountNameEnv string = "SUPERVISOR_CLUSTER_SERVICEACCOUNT_SECRET_NAME"
 	// SupervisorAPIServerFQDN reads supervisor service API server's fully qualified domain name from env
@@ -53,8 +51,6 @@ const (
 
 // SupervisorEndpoint is the supervisor cluster endpoint
 type SupervisorEndpoint struct {
-	// supervisor cluster proxy service hostname
-	Endpoint string
 	// supervisor cluster proxy service  port
 	Port string
 }
@@ -74,12 +70,6 @@ func ReadOwnerRef(path string) (*metav1.OwnerReference, error) {
 }
 
 func readSupervisorConfig() (*SupervisorEndpoint, error) {
-	remoteVip := os.Getenv(SupervisorAPIServerEndpointIPEnv)
-	if remoteVip == "" {
-		// call os.Exit(1) for the pod to restart
-		klog.Fatalf("%s is missing in env vars", SupervisorAPIServerEndpointIPEnv)
-	}
-
 	remotePort := os.Getenv(SupervisorAPIServerPortEnv)
 
 	if remotePort == "" {
@@ -88,9 +78,8 @@ func readSupervisorConfig() (*SupervisorEndpoint, error) {
 
 	}
 
-	klog.V(6).Infof("Configured with remote apiserver %s:%s", remoteVip, remotePort)
+	klog.V(6).Infof("Configured with remote apiserver port %s", remotePort)
 	return &SupervisorEndpoint{
-		Endpoint: remoteVip,
 		Port:     remotePort,
 	}, nil
 

pkg/cloudprovider/vsphereparavirtual/config/config_test.go

@@ -109,31 +109,37 @@ func TestReadOwnerRef(t *testing.T) {
 }
 
 func TestReadSupervisorConfig(t *testing.T) {
-	endpoint := "test.sv.proxy"
-	port := "6443"
-
-	err := os.Setenv(SupervisorAPIServerEndpointIPEnv, endpoint)
-	if err != nil {
-		t.Errorf("Should be able to set env var: %s", err)
+	tests := []struct {
+		name         string
+		portEnv      string
+		expectedPort string
+	}{
+		{
+			name:         "port is configured",
+			portEnv:      "6443",
+			expectedPort: "6443",
+		},
 	}
 
-	err = os.Setenv(SupervisorAPIServerPortEnv, port)
-	if err != nil {
-		t.Errorf("Should be able to set env var: %s", err)
-	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			err := os.Setenv(SupervisorAPIServerPortEnv, tc.portEnv)
+			if err != nil {
+				t.Errorf("Should be able to set env var: %s", err)
+			}
 
-	defer os.Setenv(SupervisorAPIServerEndpointIPEnv, "") // clean up
-	defer os.Setenv(SupervisorAPIServerPortEnv, "")       // clean up
+			defer os.Unsetenv(SupervisorAPIServerPortEnv)
 
-	svEndpoint, _ := readSupervisorConfig()
+			svEndpoint, err := readSupervisorConfig()
+			if err != nil {
+				t.Fatalf("unexpected error: %s", err)
+			}
 
-	if svEndpoint.Endpoint != endpoint {
-		t.Fatalf("incorrect endpoint: %s", svEndpoint.Endpoint)
-	}
-	if svEndpoint.Port != port {
-		t.Fatalf("incorrect port: %s", svEndpoint.Port)
+			if svEndpoint.Port != tc.expectedPort {
+				t.Fatalf("incorrect port: got %q, want %q", svEndpoint.Port, tc.expectedPort)
+			}
+		})
 	}
-
 }
 
 func TestGetNameSpace(t *testing.T) {
@@ -187,23 +193,20 @@ func TestGetRestConfig(t *testing.T) {
 	tests := []struct {
 		fileExists bool
 		fqdn       string
-		endpoint   string
 		port       string
 		token      string
 		ca         string
 	}{
 		{
 			fileExists: false,
 			fqdn:       "supervisor.default.svc",
-			endpoint:   "192.163.1.100",
 			port:       "6443",
 			token:      "test-token",
 			ca:         "test-ca",
 		},
 		{
 			fileExists: true,
 			fqdn:       "supervisor.default.svc",
-			endpoint:   "192.163.1.200",
 			port:       "6443",
 			token:      "test-token",
 			ca:         "test-ca",
@@ -226,18 +229,12 @@ func TestGetRestConfig(t *testing.T) {
 				t.Errorf("failed to create test ca file, %s", err)
 			}
 
-			err = os.Setenv(SupervisorAPIServerEndpointIPEnv, test.endpoint)
-			if err != nil {
-				t.Errorf("Should be able to set env var: %s", err)
-			}
-
 			err = os.Setenv(SupervisorAPIServerPortEnv, test.port)
 			if err != nil {
 				t.Errorf("Should be able to set env var: %s", err)
 			}
 
-			defer os.Setenv(SupervisorAPIServerEndpointIPEnv, "") // clean up
-			defer os.Setenv(SupervisorAPIServerPortEnv, "")       // clean up
+			defer os.Unsetenv(SupervisorAPIServerPortEnv)
 
 			cfg, err := GetRestConfig(dir)
 			if err != nil {
@@ -250,18 +247,12 @@ func TestGetRestConfig(t *testing.T) {
 				t.Fatalf("incorrect Token: %s", cfg.BearerToken)
 			}
 		} else {
-			err := os.Setenv(SupervisorAPIServerEndpointIPEnv, test.endpoint)
-			if err != nil {
-				t.Errorf("Should be able to set env var: %s", err)
-			}
-
-			err = os.Setenv(SupervisorAPIServerPortEnv, test.port)
+			err := os.Setenv(SupervisorAPIServerPortEnv, test.port)
 			if err != nil {
 				t.Errorf("Should be able to set env var: %s", err)
 			}
 
-			defer os.Setenv(SupervisorAPIServerEndpointIPEnv, "") // clean up
-			defer os.Setenv(SupervisorAPIServerPortEnv, "")       // clean up
+			defer os.Unsetenv(SupervisorAPIServerPortEnv)
 
 			_, err = GetRestConfig(dir)
 			if err == nil {