Skip to content

Commit

Permalink
upgrade to latest dependencies (#429)
Browse files Browse the repository at this point in the history 
bumping knative.dev/eventing 6a695cb...0dadfd9:
  > 0dadfd9 [release-1.11] Scheduler: fix reserved replicas handling, blocking autoscaler and overcommitted pods (# 7374)
  > c1626f1 [release-1.11] Update dependencies (# 7362)
  > 46cc775 [release-1.11] TLS certificate rotation tests (# 7103) (# 7346)
bumping knative.dev/networking 75dcd54...a595805:
  > a595805 Run ./hack/update-deps.sh --upgrade --release 1.11 (# 878)
bumping knative.dev/serving f60eb32...4ff7168:
  > 4ff7168 [release-1.11] bump x/net to v0.17 (# 14516)
  > fb9129c Leave a comment which will trigger a new dot release (# 14500)
bumping knative.dev/pkg bd99f2f...56bfe0d:
  > 56bfe0d [release-1.11] [CVE-2023-44487] Disable http2 for webhooks (# 2875)

Signed-off-by: Knative Automation <[email protected]>
  • Loading branch information
@knative-automation
knative-automation authored Oct 24, 2023
1 parent 0fae5e8 commit 0c7ef0a
Show file tree
Hide file tree
Showing 4 changed files with 34 additions and 16 deletions.
8 changes: 4 additions & 4 deletions go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,10 @@ require (
k8s.io/api v0.26.5
k8s.io/apimachinery v0.26.5
k8s.io/client-go v0.26.5
knative.dev/eventing v0.38.4
knative.dev/eventing v0.38.5
knative.dev/hack v0.0.0-20230712131415-ddae80293c43
knative.dev/pkg v0.0.0-20231011193800-bd99f2f98be7
knative.dev/serving v0.38.1
knative.dev/pkg v0.0.0-20231023150739-56bfe0dd9626
knative.dev/serving v0.38.2
)

require (
Expand Down Expand Up @@ -105,7 +105,7 @@ require (
k8s.io/klog/v2 v2.80.2-0.20221028030830-9ae4992afb54 // indirect
k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect
k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2 // indirect
knative.dev/networking v0.0.0-20230718160410-75dcd54d9510 // indirect
knative.dev/networking v0.0.0-20231012062757-a5958051caf8 // indirect
sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
sigs.k8s.io/yaml v1.3.0 // indirect
Expand Down
16 changes: 8 additions & 8 deletions go.sum
View file
Original file line number Diff line number Diff line change
Expand Up @@ -770,16 +770,16 @@ k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+O
k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4=
k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2 h1:GfD9OzL11kvZN5iArC6oTS7RTj7oJOIfnislxYlqTj8=
k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
knative.dev/eventing v0.38.4 h1:eH059bfeLilj2xAN6V7XXOh3wqzz5ssoMS/CIJpJfmk=
knative.dev/eventing v0.38.4/go.mod h1:ct8t+v6nmp1kFCy6ngkDWIEvnjJDNDoKptrfnQVh+z8=
knative.dev/eventing v0.38.5 h1:NvSy3lek9IbLLWEot36NyAfNv7VkJNl38F1ItVL0D6s=
knative.dev/eventing v0.38.5/go.mod h1:g+iAS+KBRSKULEPqoVnseMkObDeq3SJhqefbuIu8zY8=
knative.dev/hack v0.0.0-20230712131415-ddae80293c43 h1:3SE06uNfSFGm/5XS+0trbyCUpgsOaBeyhPQU8FPNFz8=
knative.dev/hack v0.0.0-20230712131415-ddae80293c43/go.mod h1:yk2OjGDsbEnQjfxdm0/HJKS2WqTLEFg/N6nUs6Rqx3Q=
knative.dev/networking v0.0.0-20230718160410-75dcd54d9510 h1:eNbWjEkbtGjCqK5TB4S0CjSSDd4PvyXm+w7bM9/zce4=
knative.dev/networking v0.0.0-20230718160410-75dcd54d9510/go.mod h1:Vngl91M++hqgoGNIjCii7MXnsEeN3kRbGC1aodhFqbk=
knative.dev/pkg v0.0.0-20231011193800-bd99f2f98be7 h1:y3qbfYX1SuSr/1ysXvKfpV8q/kCwWLWieCUgAhBUHmQ=
knative.dev/pkg v0.0.0-20231011193800-bd99f2f98be7/go.mod h1:g+UCgSKQ2f15kHYu/V3CPtoKo5F1x/2Y1ot0NSK7gA0=
knative.dev/serving v0.38.1 h1:ALKyyKA1Xf083Es2SOE8HeCy/vFhFWE6TcHNxurDf5k=
knative.dev/serving v0.38.1/go.mod h1:3/KPMVdVOZSHdrRhvelLuxuO+Ftln2ZTKq8R3gUu6Gw=
knative.dev/networking v0.0.0-20231012062757-a5958051caf8 h1:oZMbAAXyiDZUYoQ4qEjL6uxXrL1xBVfEyQJx8sP0XEg=
knative.dev/networking v0.0.0-20231012062757-a5958051caf8/go.mod h1:XwZwqJoLZR92N6F/sj8lHxttnry/Kiz+OgG8+uVuYn0=
knative.dev/pkg v0.0.0-20231023150739-56bfe0dd9626 h1:qFE+UDBRg6cpF5LbA0sv1XK4XZ36Z7aTRCa+HcuxnNQ=
knative.dev/pkg v0.0.0-20231023150739-56bfe0dd9626/go.mod h1:g+UCgSKQ2f15kHYu/V3CPtoKo5F1x/2Y1ot0NSK7gA0=
knative.dev/serving v0.38.2 h1:xxxC5JUwHzzssSeEWYs9DcuXlNtV9RHMX/VIlHlqa+M=
knative.dev/serving v0.38.2/go.mod h1:/eWvWu4qo7+tkfc7FemNXcCtb3W8FNk1tCqAKC12WPo=
rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
Expand Down
18 changes: 18 additions & 0 deletions vendor/knative.dev/pkg/webhook/webhook.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,17 @@ type Options struct {
// ControllerOptions encapsulates options for creating a new controller,
// including throttling and stats behavior.
ControllerOptions *controller.ControllerOptions

// EnableHTTP2 enables HTTP2 for webhooks.
// Mitigate CVE-2023-44487 by disabling HTTP2 by default until the Go
// standard library and golang.org/x/net are fully fixed.
// Right now, it is possible for authenticated and unauthenticated users to
// hold open HTTP2 connections and consume huge amounts of memory.
// See:
// * https://github.com/kubernetes/kubernetes/pull/121120
// * https://github.com/kubernetes/kubernetes/issues/121197
// * https://github.com/golang/go/issues/63417#issuecomment-1758858612
EnableHTTP2 bool
}

// Operation is the verb being operated on
Expand Down Expand Up @@ -237,12 +248,19 @@ func (wh *Webhook) Run(stop <-chan struct{}) error {
QuietPeriod: wh.Options.GracePeriod,
}

// If TLSNextProto is not nil, HTTP/2 support is not enabled automatically.
nextProto := map[string]func(*http.Server, *tls.Conn, http.Handler){}
if wh.Options.EnableHTTP2 {
nextProto = nil
}

server := &http.Server{
ErrorLog: log.New(&zapWrapper{logger}, "", 0),
Handler: drainer,
Addr: fmt.Sprint(":", wh.Options.Port),
TLSConfig: wh.tlsConfig,
ReadHeaderTimeout: time.Minute, //https://medium.com/a-journey-with-go/go-understand-and-mitigate-slowloris-attack-711c1b1403f6
TLSNextProto: nextProto,
}

var serve = server.ListenAndServe
Expand Down
8 changes: 4 additions & 4 deletions vendor/modules.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -956,7 +956,7 @@ k8s.io/utils/net
k8s.io/utils/pointer
k8s.io/utils/strings/slices
k8s.io/utils/trace
# knative.dev/eventing v0.38.4
# knative.dev/eventing v0.38.5
## explicit; go 1.19
knative.dev/eventing/pkg/adapter/v2
knative.dev/eventing/pkg/adapter/v2/test
Expand Down Expand Up @@ -1006,12 +1006,12 @@ knative.dev/eventing/pkg/observability/client
# knative.dev/hack v0.0.0-20230712131415-ddae80293c43
## explicit; go 1.18
knative.dev/hack
# knative.dev/networking v0.0.0-20230718160410-75dcd54d9510
# knative.dev/networking v0.0.0-20231012062757-a5958051caf8
## explicit; go 1.18
knative.dev/networking/pkg/apis/networking
knative.dev/networking/pkg/apis/networking/v1alpha1
knative.dev/networking/pkg/config
# knative.dev/pkg v0.0.0-20231011193800-bd99f2f98be7
# knative.dev/pkg v0.0.0-20231023150739-56bfe0dd9626
## explicit; go 1.18
knative.dev/pkg/apis
knative.dev/pkg/apis/duck
Expand Down Expand Up @@ -1075,7 +1075,7 @@ knative.dev/pkg/webhook/psbinding
knative.dev/pkg/webhook/resourcesemantics
knative.dev/pkg/webhook/resourcesemantics/defaulting
knative.dev/pkg/webhook/resourcesemantics/validation
# knative.dev/serving v0.38.1
# knative.dev/serving v0.38.2
## explicit; go 1.18
knative.dev/serving/pkg/apis/autoscaling
knative.dev/serving/pkg/apis/autoscaling/v1alpha1
Expand Down

0 comments on commit 0c7ef0a

Please sign in to comment.