Skip to content

WIP: etcd backups #1657

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
bhperry wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

WIP: etcd backups #1657

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8c012e3
temp
bhperry Jun 22, 2026
c5f4957
temp2
bhperry Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
4 changes: 1 addition & 3 deletions bindata/etcd/cluster-backup-job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ spec:
#!/bin/sh
set -exuo pipefail

cluster-etcd-operator cluster-backup --backup-dir "${CLUSTER_BACKUP_PATH}"
cluster-etcd-operator cluster-backup --backup-dir "${CLUSTER_BACKUP_PATH}" --termination-log /dev/termination-log

resources:
requests:
Expand Down Expand Up @@ -89,5 +89,3 @@ spec:
configMap:
name: etcd-ca-bundle
- name: etc-kubernetes-cluster-backup
persistentVolumeClaim:
claimName: templated
97 changes: 51 additions & 46 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,10 @@
module github.com/openshift/cluster-etcd-operator

go 1.25.0
go 1.26.0

replace github.com/openshift/api => github.com/bhperry/openshift-api v0.0.0-20260724171108-0e2863a63be5

replace github.com/openshift/client-go => github.com/bhperry/openshift-client-go v0.0.0-20260724172246-3b02de06ce22
Comment on lines +5 to +7

@coderabbitai coderabbitai Bot Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== go.mod relevant lines =="
sed -n '1,30p' go.mod 2>/dev/null || true

echo
echo "== repo occurrences of bhperry and openshift replacements =="
rg -n "github.com/bhperry|github.com/openshift/api|github.com/openshift/client-go" -S . || true

echo
echo "== README/dependency mentions =="
rg -n "openshift|dependency|bhperry|supply|SBOM|sigstore|cosign" -S --glob '!vendor/**' --glob '!dist/**' --glob '!build/**' . || true

Repository: openshift/cluster-etcd-operator

Length of output: 50388

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== candidate go-related files =="
git ls-files | rg '(^go\.mod$|^go\.sum$|^Dockerfile$|\.github/workflows/|helm/|Makefile$|vendor/|pkg/|cmd/|openshift|openshift-client-go|openshift-api)' | head -200

echo
echo "== module references in code =="
rg -n '"github.com/(openshift|bhperry)/(api|client-go)|bhperry|openshift-client-go|openshift-api' --glob '*.go' --glob '!vendor/**' . || true

Repository: openshift/cluster-etcd-operator

Length of output: 19739

Remove the personal-fork replace directives before merge.

These module replacements make the build depend on github.com/bhperry/openshift-api and github.com/bhperry/openshift-client-go, so production builds can include unreviewed fork content. Keep the fork only as temporary draft wiring; use reviewed upstream commits or an auditable organization-owned fork before merging.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 5 - 7, Remove the personal-fork replace directives for
github.com/openshift/api and github.com/openshift/client-go from go.mod. Restore
dependencies to reviewed upstream module versions or an auditable
organization-owned fork, ensuring production builds no longer resolve through
github.com/bhperry.


require (
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
Expand All @@ -10,53 +14,53 @@ require (
github.com/onsi/ginkgo/v2 v2.27.2
github.com/onsi/gomega v1.38.2
github.com/openshift-eng/openshift-tests-extension v0.0.0-20250804142706-7b3ab438a292
github.com/openshift/api v0.0.0-20260619095050-5346161d1bf2
github.com/openshift/api v0.0.0-20260723163829-0f2bcae5eb15
github.com/openshift/build-machinery-go v0.0.0-20260625204636-d138cd032dd0
github.com/openshift/client-go v0.0.0-20260618131434-17fd91ed6167
github.com/openshift/library-go v0.0.0-20260630085645-45679084a74b
github.com/openshift/client-go v0.0.0-20260715172546-dac61734e0ec
github.com/openshift/library-go v0.0.0-20260721103755-0c9fbc9f043a
github.com/pkg/errors v0.9.1
github.com/prometheus/client_golang v1.23.2
github.com/prometheus/common v0.66.1
github.com/prometheus/common v0.67.5
github.com/robfig/cron v1.2.0
github.com/robfig/cron/v3 v3.0.1
github.com/spf13/cobra v1.10.0
github.com/spf13/cobra v1.10.2
github.com/spf13/pflag v1.0.10
github.com/stretchr/testify v1.11.1
github.com/vishvananda/netlink v1.0.0
go.etcd.io/etcd/api/v3 v3.6.6
go.etcd.io/etcd/client/pkg/v3 v3.6.6
go.etcd.io/etcd/client/v3 v3.6.6
go.etcd.io/etcd/server/v3 v3.6.6
go.etcd.io/etcd/api/v3 v3.6.8
go.etcd.io/etcd/client/pkg/v3 v3.6.8
go.etcd.io/etcd/client/v3 v3.6.8
go.etcd.io/etcd/server/v3 v3.6.8
go.etcd.io/etcd/tests/v3 v3.6.6
go.uber.org/zap v1.27.0
go.uber.org/zap v1.27.1
golang.org/x/sys v0.45.0
google.golang.org/grpc v1.72.2
google.golang.org/grpc v1.79.3

@coderabbitai coderabbitai Bot Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

curl -sS https://api.osv.dev/v1/query \
  -H 'Content-Type: application/json' \
  --data '{"package":{"name":"google.golang.org/grpc","ecosystem":"Go"},"version":"v1.79.3"}' |
  jq .

Repository: openshift/cluster-etcd-operator

Length of output: 6584

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== go.mod grpc line =="
grep -n 'google.golang.org/grpc' go.mod || true

echo
echo "== go.sum grpc entries =="
grep -n 'google.golang.org/grpc' go.sum || true

echo
echo "== gRPC usage / RBAC/xDS import context =="
rg -n 'google\.golang\.org/grpc|grpc/xds|xds|rbac|Rbac|RequestedServerName|Metadata|SourcedMetadata' -S . --glob '!vendor/**' --glob '!_out/**' | head -200

Repository: openshift/cluster-etcd-operator

Length of output: 4622

Remove or update the vulnerable gRPC dependency.

google.golang.org/grpc v1.79.3 is affected by GHSA-hrxh-6v49-42gf. This module is only referenced as an indirect/transitive dependency now; remove the stale go.mod/go.sum entry or update it to a patched version such as v1.82.1, then regenerate go.sum and rerun vulnerability scanning.

🧰 Tools
🪛 OSV Scanner (2.4.0)

[HIGH] 37-37: google.golang.org/grpc 1.79.3: gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

(GHSA-hrxh-6v49-42gf)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 37, Update the google.golang.org/grpc dependency in go.mod
from v1.79.3 to a patched version such as v1.82.1, or remove it if no longer
required transitively; regenerate the corresponding go.sum entries and rerun
vulnerability scanning to confirm the vulnerable version is absent.

Source: Linters/SAST tools

gopkg.in/natefinch/lumberjack.v2 v2.2.1
gopkg.in/yaml.v3 v3.0.1
k8s.io/api v0.35.1
k8s.io/apiextensions-apiserver v0.35.1
k8s.io/apimachinery v0.35.1
k8s.io/apiserver v0.35.1
k8s.io/client-go v0.35.1
k8s.io/component-base v0.35.1
k8s.io/api v0.36.2
k8s.io/apiextensions-apiserver v0.36.2
k8s.io/apimachinery v0.36.2
k8s.io/apiserver v0.36.2
k8s.io/client-go v0.36.2
k8s.io/component-base v0.36.2
k8s.io/cri-api v0.34.2
k8s.io/klog/v2 v2.140.0
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2
k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3
)

require (
cel.dev/expr v0.24.0 // indirect
cel.dev/expr v0.25.1 // indirect
github.com/NYTimes/gziphandler v1.1.1 // indirect
github.com/VividCortex/ewma v1.2.0 // indirect
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/bgentry/speakeasy v0.2.0 // indirect
github.com/blang/semver/v4 v4.0.0 // indirect
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/cheggaaa/pb/v3 v3.1.6 // indirect
github.com/coreos/go-semver v0.3.1 // indirect
github.com/coreos/go-systemd/v22 v22.5.0 // indirect
github.com/coreos/go-systemd/v22 v22.7.0 // indirect
github.com/dustin/go-humanize v1.0.1 // indirect
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
github.com/fatih/color v1.18.0 // indirect
Expand All @@ -82,7 +86,7 @@ require (
github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/btree v1.1.3 // indirect
Expand All @@ -92,9 +96,9 @@ require (
github.com/google/uuid v1.6.0 // indirect
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 // indirect
github.com/imdario/mergo v0.3.7 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/jonboulle/clockwork v0.5.0 // indirect
Expand All @@ -110,7 +114,7 @@ require (
github.com/pkg/profile v1.7.0 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/procfs v0.16.1 // indirect
github.com/prometheus/procfs v0.19.2 // indirect
github.com/rivo/uniseg v0.4.7 // indirect
github.com/sirupsen/logrus v1.9.3 // indirect
github.com/soheilhy/cmux v0.1.5 // indirect
Expand All @@ -121,41 +125,42 @@ require (
github.com/xiang90/probing v0.0.0-20221125231312-a49e3df8f510 // indirect
go.etcd.io/bbolt v1.4.3 // indirect
go.etcd.io/etcd/etcdctl/v3 v3.6.6 // indirect
go.etcd.io/etcd/pkg/v3 v3.6.6 // indirect
go.etcd.io/etcd/pkg/v3 v3.6.8 // indirect
go.etcd.io/gofail v0.2.0 // indirect
go.etcd.io/raft/v3 v3.6.0 // indirect
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
go.opentelemetry.io/otel v1.36.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 // indirect
go.opentelemetry.io/otel/metric v1.36.0 // indirect
go.opentelemetry.io/otel/sdk v1.36.0 // indirect
go.opentelemetry.io/otel/trace v1.36.0 // indirect
go.opentelemetry.io/proto/otlp v1.5.0 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.65.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
go.opentelemetry.io/otel v1.41.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 // indirect
go.opentelemetry.io/otel/metric v1.41.0 // indirect
go.opentelemetry.io/otel/sdk v1.40.0 // indirect

@coderabbitai coderabbitai Bot Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

curl -sS https://api.osv.dev/v1/query \
  -H 'Content-Type: application/json' \
  --data '{"package":{"name":"go.opentelemetry.io/otel/sdk","ecosystem":"Go"},"version":"v1.40.0"}' |
  jq .

Repository: openshift/cluster-etcd-operator

Length of output: 3970

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "go.mod entries for OpenTelemetry packages:"
grep -n 'go.opentelemetry.io/otel' go.mod || true

echo
echo "Dependency metadata for go.opentelemetry.io/otel/sdk@v1.40.0:"
go list -m -json go.opentelemetry.io/otel/sdk@v1.40.0 2>&1 || true

echo
echo "Dependency metadata for patched/compatible versions:"
for v in v1.43.0 v1.43.1 v1.44.0; do
  echo "--- go.opentelemetry.io/otel/sdk@${v}"
  go list -m -json "go.opentelemetry.io/otel/sdk@${v}" 2>&1 || true
done

Repository: openshift/cluster-etcd-operator

Length of output: 1437

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "Module metadata from go.sum:"
rg 'go.opentelemetry.io/otel/sdk v1\.4[0-9]\.[0-9]+|go.opentelemetry.io/otel/sdk v1\.43\.0|go.opentelemetry.io/otel/sdk v1\.43\.1|go.opentelemetry.io/otel/sdk v1\.44\.0' go.sum || true

echo
echo "Current OpenTelemetry versions in go.mod:"
python3 - <<'PY'
from pathlib import Path
for line in Path("go.mod").read_text().splitlines():
    if "opentelemetry.io/otel" in line:
        print(line.strip())
PY

echo
echo "Vendor manifest module version for SDK if present:"
python3 - <<'PY'
from pathlib import Path
import re
p = Path("vendor/modules.txt")
if p.exists():
    for m in re.findall(r'^## go\.opentelemetry\.io/otel/sdk v[0-9][^\n]*', p.read_text().splitlines()[0:100] + p.read_text().splitlines()):
        pass
    for line in p.read_text().splitlines():
        if line.startswith("## go.opentelemetry.io/otel/sdk "):
            print(line)
else:
    print("vendor/modules.txt not found")
PY

Repository: openshift/cluster-etcd-operator

Length of output: 1124

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
import re
p = Path("vendor/modules.txt")
if p.exists():
    for line in p.read_text().splitlines():
        if line.startswith("## go.opentelemetry.io/otel/sdk "):
            print(line)
else:
    print("vendor/modules.txt not found")
PY

Repository: openshift/cluster-etcd-operator

Length of output: 169

Upgrade go.opentelemetry.io/otel/sdk to v1.43.0 or later.

v1.40.0 is affected by GHSA-hfvc-g4fc-pqhx / CVE-2026-39883, a high-severity PATH-hijacking issue in the BSD/Solaris resource host ID path. Run go get -u go.opentelemetry.io/otel/sdk@v1.43.0 and refresh go.mod, go.sum, and vendor/modules.txt to keep the OpenTelemetry modules consistent.

🧰 Tools
🪛 OSV Scanner (2.4.0)

[HIGH] 138-138: go.opentelemetry.io/otel/sdk 1.40.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

(GHSA-hfvc-g4fc-pqhx)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 138, Upgrade the go.opentelemetry.io/otel/sdk dependency from
v1.40.0 to v1.43.0 or later, then refresh go.mod, go.sum, and vendor/modules.txt
so all OpenTelemetry module versions remain consistent.

Source: Linters/SAST tools

go.opentelemetry.io/otel/trace v1.41.0 // indirect
go.opentelemetry.io/proto/otlp v1.9.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/crypto v0.52.0 // indirect
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
golang.org/x/net v0.55.1-0.20260602153038-42abb857022c // indirect
golang.org/x/oauth2 v0.30.0 // indirect
golang.org/x/oauth2 v0.34.0 // indirect
golang.org/x/sync v0.20.0 // indirect
golang.org/x/term v0.43.0 // indirect
golang.org/x/text v0.37.0 // indirect
golang.org/x/time v0.15.0 // indirect
golang.org/x/tools v0.44.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a // indirect
google.golang.org/protobuf v1.36.8 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
k8s.io/kms v0.35.1 // indirect
k8s.io/kube-aggregator v0.35.1 // indirect
k8s.io/kms v0.36.2 // indirect
k8s.io/kube-aggregator v0.36.2 // indirect
k8s.io/kube-openapi v0.0.0-20260519202549-bbf5c5577288 // indirect
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
k8s.io/streaming v0.36.2 // indirect
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/kube-storage-version-migrator v0.0.6-0.20230721195810-5c8923c5ff96 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
Expand Down
Loading