Skip to content

Commit 4e326df

Browse files
everettraveneverettraven
authored
✨ rapid reset scaffold remediation (#288)
* add flags to disable HTTP/2 and securely serve metrics in both the hybrid scaffolds and the binaries produced by this project for running helm and hybrid-helm operators to finish remediation of: GHSA-qppj-fm5r-hxr3 GHSA-4374-p667-p6c8 Signed-off-by: everettraven <[email protected]> * add missing import to hybrid scaffolding and regenerate testdata Signed-off-by: everettraven <[email protected]> * remove Port field from scaffolded manager.Options Signed-off-by: everettraven <[email protected]> * update hybrid scaffolding to point to the appropriate main.go in Makefile and Dockerfile Signed-off-by: everettraven <[email protected]> --------- Signed-off-by: everettraven <[email protected]>
1 parent 9359e2f commit 4e326df

File tree

9 files changed

+128
-47
lines changed

9 files changed

+128
-47
lines changed

‎internal/flags/flag.go

+25
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,14 @@
1515
package flags
1616

1717
import (
18+
"crypto/tls"
1819
"runtime"
1920
"time"
2021

2122
"github.com/spf13/pflag"
2223
"k8s.io/client-go/tools/leaderelection/resourcelock"
2324
"sigs.k8s.io/controller-runtime/pkg/manager"
25+
"sigs.k8s.io/controller-runtime/pkg/webhook"
2426
)
2527

2628
// Flags - Options to be used by a helm operator
@@ -33,6 +35,8 @@ type Flags struct {
3335
LeaderElectionNamespace string
3436
MaxConcurrentReconciles int
3537
ProbeAddr string
38+
EnableHTTP2 bool
39+
SecureMetrics bool
3640

3741
// Path to a controller-runtime componentconfig file.
3842
// If this is empty, use default values.
@@ -117,6 +121,16 @@ func (f *Flags) AddTo(flagSet *pflag.FlagSet) {
117121
" holding the leader lock (required if running locally with leader"+
118122
" election enabled).",
119123
)
124+
flagSet.BoolVar(&f.EnableHTTP2,
125+
"enable-http2",
126+
false,
127+
"enables HTTP/2 on the webhook and metrics servers",
128+
)
129+
flagSet.BoolVar(&f.SecureMetrics,
130+
"metrics-secure",
131+
false,
132+
"enables secure serving of the metrics endpoint",
133+
)
120134
}
121135

122136
// ToManagerOptions uses the flag set in f to configure options.
@@ -151,5 +165,16 @@ func (f *Flags) ToManagerOptions(options manager.Options) manager.Options {
151165
if options.LeaderElectionResourceLock == "" {
152166
options.LeaderElectionResourceLock = resourcelock.LeasesResourceLock
153167
}
168+
169+
disableHTTP2 := func(c *tls.Config) {
170+
c.NextProtos = []string{"http/1.1"}
171+
}
172+
if !f.EnableHTTP2 {
173+
options.WebhookServer = webhook.NewServer(webhook.Options{
174+
TLSOpts: []func(*tls.Config){disableHTTP2},
175+
})
176+
options.Metrics.TLSOpts = append(options.Metrics.TLSOpts, disableHTTP2)
177+
}
178+
options.Metrics.SecureServing = f.SecureMetrics
154179
return options
155180
}

‎pkg/plugins/hybrid/v1alpha/scaffolds/internal/templates/dockerfile.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -52,12 +52,12 @@ COPY go.sum go.sum
5252
RUN go mod download
5353
5454
# Copy the go source
55-
COPY main.go main.go
55+
COPY cmd/ cmd/
5656
COPY api/ api/
5757
COPY controllers/ controllers/
5858
5959
# Build
60-
RUN GOOS=linux GOARCH=amd64 go build -a -o manager main.go
60+
RUN GOOS=linux GOARCH=amd64 go build -a -o manager cmd/main.go
6161
6262
FROM registry.access.redhat.com/ubi8/ubi-micro:8.7
6363

‎pkg/plugins/hybrid/v1alpha/scaffolds/internal/templates/main.go

+30-2
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,7 @@ var mainTemplate = `{{ .Boilerplate }}
189189
package main
190190
191191
import (
192+
"crypto/tls"
192193
"flag"
193194
"os"
194195
"runtime"
@@ -206,6 +207,9 @@ import (
206207
ctrl "sigs.k8s.io/controller-runtime"
207208
"sigs.k8s.io/controller-runtime/pkg/healthz"
208209
"sigs.k8s.io/controller-runtime/pkg/log/zap"
210+
"sigs.k8s.io/controller-runtime/pkg/webhook"
211+
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
212+
209213
%s
210214
)
211215
@@ -230,6 +234,8 @@ func main() {
230234
watchesPath string
231235
probeAddr string
232236
enableLeaderElection bool
237+
enableHTTP2 bool
238+
secureMetrics bool
233239
)
234240
235241
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
@@ -239,6 +245,10 @@ func main() {
239245
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
240246
"Enable leader election for controller manager. " +
241247
"Enabling this will ensure there is only one active controller manager.")
248+
flag.BoolVar(&secureMetrics, "metrics-secure", false,
249+
"Whether or not the metrics endpoint should be served securely")
250+
flag.BoolVar(&enableHTTP2, "enable-http2", false,
251+
"Whether or not HTTP/2 should be enabled for the metrics and webhook servers")
242252
{{- else }}
243253
var configFile string
244254
flag.StringVar(&configFile, "config", "",
@@ -255,10 +265,28 @@ func main() {
255265
ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
256266
257267
{{ if not .ComponentConfig }}
268+
disableHTTP2 := func(c *tls.Config) {
269+
setupLog.Info("disabling http/2")
270+
c.NextProtos = []string{"http/1.1"}
271+
}
272+
273+
tlsOpts := []func(*tls.Config){}
274+
if !enableHTTP2 {
275+
tlsOpts = append(tlsOpts, disableHTTP2)
276+
}
277+
278+
webhookServer := webhook.NewServer(webhook.Options{
279+
TLSOpts: tlsOpts,
280+
})
281+
258282
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
259283
Scheme: scheme,
260-
MetricsBindAddress: metricsAddr,
261-
Port: 9443,
284+
Metrics: metricsserver.Options{
285+
BindAddress: metricsAddr,
286+
SecureServing: secureMetrics,
287+
TLSOpts: tlsOpts,
288+
},
289+
WebhookServer: webhookServer,
262290
HealthProbeBindAddress: probeAddr,
263291
LeaderElection: enableLeaderElection,
264292
LeaderElectionID: leaderElectionID,

‎pkg/plugins/hybrid/v1alpha/scaffolds/internal/templates/makefile.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -112,11 +112,11 @@ help: ## Display this help.
112112
##@ Build
113113
.PHONY: build
114114
build: manifests generate fmt vet ## Build manager binary.
115-
go build -o bin/manager main.go
115+
go build -o bin/manager cmd/main.go
116116
117117
.PHONY: run
118118
run: manifests generate fmt vet ## Run against the configured Kubernetes cluster in ~/.kube/config
119-
go run ./main.go
119+
go run cmd/main.go
120120
121121
.PHONY: docker-build
122122
docker-build: ## Build docker image with the manager.

‎testdata/hybrid/memcached-operator/Dockerfile

+2-2
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,12 @@ COPY go.sum go.sum
1010
RUN go mod download
1111

1212
# Copy the go source
13-
COPY main.go main.go
13+
COPY cmd/ cmd/
1414
COPY api/ api/
1515
COPY controllers/ controllers/
1616

1717
# Build
18-
RUN GOOS=linux GOARCH=amd64 go build -a -o manager main.go
18+
RUN GOOS=linux GOARCH=amd64 go build -a -o manager cmd/main.go
1919

2020
FROM registry.access.redhat.com/ubi8/ubi-micro:8.7
2121

‎testdata/hybrid/memcached-operator/Makefile

+2-2
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,11 @@ help: ## Display this help.
3939
##@ Build
4040
.PHONY: build
4141
build: manifests generate fmt vet ## Build manager binary.
42-
go build -o bin/manager main.go
42+
go build -o bin/manager cmd/main.go
4343

4444
.PHONY: run
4545
run: manifests generate fmt vet ## Run against the configured Kubernetes cluster in ~/.kube/config
46-
go run ./main.go
46+
go run cmd/main.go
4747

4848
.PHONY: docker-build
4949
docker-build: ## Build docker image with the manager.

‎testdata/hybrid/memcached-operator/cmd/main.go

+30-3
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ limitations under the License.
1717
package main
1818

1919
import (
20+
"crypto/tls"
2021
"flag"
2122
"os"
2223
"runtime"
@@ -34,6 +35,8 @@ import (
3435
ctrl "sigs.k8s.io/controller-runtime"
3536
"sigs.k8s.io/controller-runtime/pkg/healthz"
3637
"sigs.k8s.io/controller-runtime/pkg/log/zap"
38+
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
39+
"sigs.k8s.io/controller-runtime/pkg/webhook"
3740

3841
cachev1alpha1 "github.com/example/memcached-operator/api/v1alpha1"
3942
"github.com/example/memcached-operator/internal/controller"
@@ -61,6 +64,8 @@ func main() {
6164
watchesPath string
6265
probeAddr string
6366
enableLeaderElection bool
67+
enableHTTP2 bool
68+
secureMetrics bool
6469
)
6570

6671
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
@@ -70,6 +75,10 @@ func main() {
7075
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
7176
"Enable leader election for controller manager. "+
7277
"Enabling this will ensure there is only one active controller manager.")
78+
flag.BoolVar(&secureMetrics, "metrics-secure", false,
79+
"Whether or not the metrics endpoint should be served securely")
80+
flag.BoolVar(&enableHTTP2, "enable-http2", false,
81+
"Whether or not HTTP/2 should be enabled for the metrics and webhook servers")
7382
opts := zap.Options{
7483
Development: true,
7584
}
@@ -78,10 +87,28 @@ func main() {
7887

7988
ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
8089

90+
disableHTTP2 := func(c *tls.Config) {
91+
setupLog.Info("disabling http/2")
92+
c.NextProtos = []string{"http/1.1"}
93+
}
94+
95+
tlsOpts := []func(*tls.Config){}
96+
if !enableHTTP2 {
97+
tlsOpts = append(tlsOpts, disableHTTP2)
98+
}
99+
100+
webhookServer := webhook.NewServer(webhook.Options{
101+
TLSOpts: tlsOpts,
102+
})
103+
81104
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
82-
Scheme: scheme,
83-
MetricsBindAddress: metricsAddr,
84-
Port: 9443,
105+
Scheme: scheme,
106+
Metrics: metricsserver.Options{
107+
BindAddress: metricsAddr,
108+
SecureServing: secureMetrics,
109+
TLSOpts: tlsOpts,
110+
},
111+
WebhookServer: webhookServer,
85112
HealthProbeBindAddress: probeAddr,
86113
LeaderElection: enableLeaderElection,
87114
LeaderElectionID: leaderElectionID,

‎testdata/hybrid/memcached-operator/go.mod

+11-11
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ go 1.20
55
require (
66
github.com/onsi/ginkgo/v2 v2.13.0
77
github.com/onsi/gomega v1.30.0
8-
github.com/operator-framework/helm-operator-plugins v0.1.1
8+
github.com/operator-framework/helm-operator-plugins v0.1.2
99
k8s.io/apimachinery v0.28.5
1010
k8s.io/client-go v0.28.5
1111
sigs.k8s.io/controller-runtime v0.16.3
@@ -60,7 +60,7 @@ require (
6060
github.com/google/gnostic-models v0.6.8 // indirect
6161
github.com/google/go-cmp v0.6.0 // indirect
6262
github.com/google/gofuzz v1.2.0 // indirect
63-
github.com/google/pprof v0.0.0-20230510103437-eeec1cb781c3 // indirect
63+
github.com/google/pprof v0.0.0-20230907193218-d3ddc7976beb // indirect
6464
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
6565
github.com/google/uuid v1.3.1 // indirect
6666
github.com/gorilla/mux v1.8.0 // indirect
@@ -83,7 +83,7 @@ require (
8383
github.com/mattn/go-colorable v0.1.13 // indirect
8484
github.com/mattn/go-isatty v0.0.17 // indirect
8585
github.com/mattn/go-runewidth v0.0.14 // indirect
86-
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
86+
github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
8787
github.com/mitchellh/copystructure v1.2.0 // indirect
8888
github.com/mitchellh/go-wordwrap v1.0.1 // indirect
8989
github.com/mitchellh/reflectwalk v1.0.2 // indirect
@@ -100,10 +100,10 @@ require (
100100
github.com/operator-framework/operator-lib v0.12.0 // indirect
101101
github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
102102
github.com/pkg/errors v0.9.1 // indirect
103-
github.com/prometheus/client_golang v1.16.0 // indirect
104-
github.com/prometheus/client_model v0.4.0 // indirect
105-
github.com/prometheus/common v0.44.0 // indirect
106-
github.com/prometheus/procfs v0.10.1 // indirect
103+
github.com/prometheus/client_golang v1.18.0 // indirect
104+
github.com/prometheus/client_model v0.5.0 // indirect
105+
github.com/prometheus/common v0.45.0 // indirect
106+
github.com/prometheus/procfs v0.12.0 // indirect
107107
github.com/rivo/uniseg v0.4.2 // indirect
108108
github.com/rubenv/sql-migrate v1.5.2 // indirect
109109
github.com/russross/blackfriday/v2 v2.1.0 // indirect
@@ -127,13 +127,13 @@ require (
127127
golang.org/x/crypto v0.17.0 // indirect
128128
golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
129129
golang.org/x/net v0.17.0 // indirect
130-
golang.org/x/oauth2 v0.11.0 // indirect
131-
golang.org/x/sync v0.3.0 // indirect
130+
golang.org/x/oauth2 v0.12.0 // indirect
131+
golang.org/x/sync v0.4.0 // indirect
132132
golang.org/x/sys v0.15.0 // indirect
133133
golang.org/x/term v0.15.0 // indirect
134134
golang.org/x/text v0.14.0 // indirect
135135
golang.org/x/time v0.3.0 // indirect
136-
golang.org/x/tools v0.12.0 // indirect
136+
golang.org/x/tools v0.14.0 // indirect
137137
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
138138
google.golang.org/appengine v1.6.7 // indirect
139139
google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 // indirect
@@ -157,5 +157,5 @@ require (
157157
sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3 // indirect
158158
sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3 // indirect
159159
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
160-
sigs.k8s.io/yaml v1.3.0 // indirect
160+
sigs.k8s.io/yaml v1.4.0 // indirect
161161
)

0 commit comments

Comments
 (0)