Bug 2089973

Summary:	bump libs to k8s 1.24 for OCP 4.11
Product:	OpenShift Container Platform	Reporter:	Jonathan Dobson <jdobson>
Component:	Storage	Assignee:	Jonathan Dobson <jdobson>
Storage sub component:	Operators	QA Contact:	Wei Duan <wduan>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	medium
Priority:	medium
Version:	4.11
Target Milestone:	---
Target Release:	4.11.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-08-10 11:14:04 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jonathan Dobson 2022-05-24 20:45:57 UTC

We need to update our operators to use OCP 4.11 / kubernetes 1.24 libraries

Bump k8s.io/*, client-go, library-go, openshift-api, operator-sdk, controller-runtime.
Bump prometheus/client_golang for CVE-2022-21698 fixes.

To fix CVE-2020-26160, add this to go.mod of all operators that import jwt-go:
replace github.com/dgrijalva/jwt-go => github.com/golang-jwt/jwt v3.2.1+incompatible

Repos to update:

local-storage-operator
alibaba-disk-csi-driver-operator
aws-ebs-csi-driver-operator
aws-efs-csi-driver-operator
azure-disk-csi-driver-operator
azure-file-csi-driver-operator
cluster-csi-snapshot-controller-operator
cluster-storage-operator
gcp-pd-csi-driver-operator
ibm-vpc-block-csi-driver-operator
ovirt-csi-driver-operator
vmware-vsphere-csi-driver-operator
vsphere-problem-detector
openstack-cinder-csi-driver-operator
csi-driver-manila-operator

Note:
Most of these have a dependency on the library-go bump, which means we're dependent on https://github.com/openshift/library-go/pull/1356, and that PR is (I think) dependent on the 1.24 k8s rebase.

Comment 4 Wei Duan 2022-06-09 06:30:47 UTC

Some PR are verified in other BZ and will update status when all finished.

Comment 6 Wei Duan 2022-06-17 02:56:02 UTC

Checked regression test result looks okay.
Also check oVirt and Manila ci looks okay.

Update status to VERIFIED.

Comment 7 errata-xmlrpc 2022-08-10 11:14:04 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: OpenShift Container Platform 4.11.0 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:5069