Skip to content

upgrade CRIOCredentialProviderConfig to v1 #6220

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
QiWang19 wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

upgrade CRIOCredentialProviderConfig to v1 #6220

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
47 changes: 30 additions & 17 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,20 +37,20 @@ require (
github.com/onsi/gomega v1.38.2
github.com/opencontainers/go-digest v1.0.0
github.com/openshift-eng/openshift-tests-extension v0.0.0-20260127124016-0fed2b824818
github.com/openshift/api v0.0.0-20260603130340-1ad2ac3eb53d
github.com/openshift/api v0.0.0-20260619095050-5346161d1bf2
github.com/openshift/client-go v0.0.0-20260603140539-6892dc3e1ffc
github.com/openshift/library-go v0.0.0-20260303171201-5d9eb6295ff6
github.com/openshift/runtime-utils v0.0.0-20230921210328-7bdb5b9c177b
github.com/prometheus/client_golang v1.23.2
github.com/rs/zerolog v1.34.0
github.com/spf13/cobra v1.10.0
github.com/spf13/pflag v1.0.9
github.com/spf13/pflag v1.0.10
github.com/stretchr/testify v1.11.1
github.com/tidwall/gjson v1.18.0
github.com/tidwall/sjson v1.2.5
github.com/vincent-petithory/dataurl v1.0.0
github.com/vmware/govmomi v0.45.1
golang.org/x/net v0.48.0
golang.org/x/net v0.50.0
golang.org/x/time v0.11.0
google.golang.org/grpc v1.79.3
k8s.io/api v0.35.1
Expand All @@ -63,7 +63,7 @@ require (
k8s.io/kubectl v0.35.0
k8s.io/kubelet v0.35.0
k8s.io/kubernetes v1.35.0
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2
sigs.k8s.io/controller-runtime v0.23.0
sigs.k8s.io/controller-runtime/tools/setup-envtest v0.0.0-20240522175850-2e9781e9fc60
)
Expand Down Expand Up @@ -122,6 +122,17 @@ require (
github.com/go-openapi/runtime v0.28.0 // indirect
github.com/go-openapi/spec v0.21.0 // indirect
github.com/go-openapi/strfmt v0.23.0 // indirect
github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
github.com/go-openapi/swag/conv v0.25.4 // indirect
github.com/go-openapi/swag/fileutils v0.25.4 // indirect
github.com/go-openapi/swag/jsonname v0.25.4 // indirect
github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
github.com/go-openapi/swag/loading v0.25.4 // indirect
github.com/go-openapi/swag/mangling v0.25.4 // indirect
github.com/go-openapi/swag/netutils v0.25.4 // indirect
github.com/go-openapi/swag/stringutils v0.25.4 // indirect
github.com/go-openapi/swag/typeutils v0.25.4 // indirect
github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
github.com/go-openapi/validate v0.24.0 // indirect
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
Expand Down Expand Up @@ -232,7 +243,7 @@ require (
sigs.k8s.io/kustomize/api v0.20.1 // indirect
sigs.k8s.io/kustomize/kyaml v0.20.1 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
)

require (
Expand Down Expand Up @@ -270,7 +281,7 @@ require (
github.com/docker/docker-credential-helpers v0.9.3 // indirect
github.com/docker/go-connections v0.5.0 // indirect
github.com/docker/go-units v0.5.0 // indirect
github.com/emicklei/go-restful/v3 v3.12.2 // indirect
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
github.com/ettle/strcase v0.2.0 // indirect
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
github.com/fatih/color v1.18.0 // indirect
Expand All @@ -281,7 +292,7 @@ require (
github.com/go-logr/logr v1.4.3 // indirect
github.com/go-openapi/jsonpointer v0.21.0 // indirect
github.com/go-openapi/jsonreference v0.21.0 // indirect
github.com/go-openapi/swag v0.23.1 // indirect
github.com/go-openapi/swag v0.25.4 // indirect
github.com/go-toolsmith/astcast v1.1.0 // indirect
github.com/go-toolsmith/astcopy v1.1.0 // indirect
github.com/go-toolsmith/astequal v1.2.0 // indirect
Expand Down Expand Up @@ -314,7 +325,6 @@ require (
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/jgautheron/goconst v1.7.1 // indirect
github.com/jingyugao/rowserrcheck v1.1.1 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/julz/importas v0.2.0 // indirect
github.com/kisielk/errcheck v1.8.0 // indirect
Expand All @@ -325,7 +335,6 @@ require (
github.com/ldez/tagliatelle v0.5.0 // indirect
github.com/leonklingele/grouper v1.1.2 // indirect
github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec // indirect
github.com/mailru/easyjson v0.9.0 // indirect
github.com/maratori/testpackage v1.1.1 // indirect
github.com/matoous/godox v0.0.0-20230222163458-006bad1f9d26 // indirect
github.com/mattn/go-colorable v0.1.13 // indirect
Expand Down Expand Up @@ -393,25 +402,25 @@ require (
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
go4.org v0.0.0-20200104003542-c7e774b10ea0 // indirect
golang.org/x/crypto v0.46.0
golang.org/x/crypto v0.48.0
golang.org/x/exp v0.0.0-20250103183323-7d7fa50e5329
golang.org/x/exp/typeparams v0.0.0-20241108190413-2d47ceb2692f // indirect
golang.org/x/mod v0.30.0 // indirect
golang.org/x/mod v0.33.0 // indirect
golang.org/x/oauth2 v0.34.0 // indirect
golang.org/x/sync v0.19.0
golang.org/x/sys v0.40.0
golang.org/x/term v0.38.0 // indirect
golang.org/x/text v0.32.0 // indirect
golang.org/x/tools v0.39.0 // indirect
golang.org/x/sys v0.41.0
golang.org/x/term v0.40.0 // indirect
golang.org/x/text v0.34.0 // indirect
golang.org/x/tools v0.42.0 // indirect
google.golang.org/protobuf v1.36.10 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0
gopkg.in/yaml.v3 v3.0.1
honnef.co/go/tools v0.5.1 // indirect
k8s.io/apiserver v0.35.1
k8s.io/klog/v2 v2.130.1
k8s.io/klog/v2 v2.140.0
k8s.io/kube-aggregator v0.35.1 // indirect
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
k8s.io/kube-openapi v0.0.0-20260519202549-bbf5c5577288 // indirect
mvdan.cc/gofumpt v0.7.0 // indirect
mvdan.cc/unparam v0.0.0-20240528143540-8a5130ca722f // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
Expand Down Expand Up @@ -454,3 +463,7 @@ replace (
k8s.io/sample-cli-plugin => github.com/openshift/kubernetes/staging/src/k8s.io/sample-cli-plugin v0.0.0-20260305123649-d18f3f005eaa
k8s.io/sample-controller => github.com/openshift/kubernetes/staging/src/k8s.io/sample-controller v0.0.0-20260305123649-d18f3f005eaa
)

replace github.com/openshift/api => github.com/QiWang19/api v0.0.0-20260622144140-c85beac32742

@coderabbitai coderabbitai Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify QiWang19 fork authorization and changes vs. official upstream.

# 1. Check if forks exist and are accessible
echo "=== Checking fork accessibility ==="
curl -s -I https://github.com/QiWang19/api | head -1
curl -s -I https://github.com/QiWang19/client-go | head -1

# 2. Compare fork commit hashes with official upstream (basic sanity check)
echo "=== Fork metadata (if accessible via GitHub API) ==="
gh repo view QiWang19/api --json owner,description,updatedAt 2>/dev/null || echo "Unable to fetch fork info via gh CLI"
gh repo view QiWang19/client-go --json owner,description,updatedAt 2>/dev/null || echo "Unable to fetch fork info via gh CLI"

# 3. Search the codebase for any documentation or comments about the fork usage
echo "=== Searching for fork justification in codebase ==="
rg -i "qiwang19|fork.*api|fork.*client-go" --type md --type txt --type go -n 2>/dev/null || echo "No fork justification found in comments/docs"

Repository: openshift/machine-config-operator

Length of output: 680

🏁 Script executed:

# Check git history of go.mod to understand when/why replace directives were added
git log --oneline -20 -- go.mod

# Get more details on recent go.mod changes
git log -p --max-count=1 -- go.mod | head -100

# Check if there's any PR or issue reference in commit messages
git log --grep="QiWang19\|fork.*api\|fork.*client-go\|openshift.*api\|openshift.*client-go" -i --oneline -20

# Search for any documentation files that might explain the fork strategy
find . -type f \( -name "README*" -o -name "CONTRIBUTING*" -o -name "*.md" \) -exec grep -l "QiWang19\|fork.*strategy" {} \;

Repository: openshift/machine-config-operator

Length of output: 224

🏁 Script executed:

# Check go.mod line 467-469 context - see before/after the replace directives
sed -n '460,475p' go.mod

# Look for any comments or docs about these specific versions
rg "QiWang19|v0.0.0-20260619|v0.0.0-20260603" -A 3 -B 3

Repository: openshift/machine-config-operator

Length of output: 1038

🌐 Web query:

QiWang19 OpenShift api client-go fork GitHub official

💡 Result:

Qi Wang (GitHub username: QiWang19) is a software engineer at Red Hat who frequently contributes to the OpenShift ecosystem [1][2]. While GitHub user QiWang19 has a repository named "client-go" [3][4], it is a fork of the official OpenShift Go client library, openshift/client-go. There is no indication that QiWang19 maintains an "official" alternative to the canonical library; rather, the repository is a personal fork used for development or testing purposes [3][4]. The official, canonical Go client for OpenShift is maintained in the openshift/client-go repository under the official OpenShift GitHub organization. Developers and users should rely on the official openshift/client-go repository for production use, as personal forks are not maintained as official distribution points [3].

Citations:

Replace directives redirect official OpenShift packages to personal development forks—unacceptable for production code.

Lines 467–469 add replace directives pointing github.com/openshift/{api,client-go} to github.com/QiWang19/{api,client-go}. Investigation confirms these are personal development forks maintained by a Red Hat engineer, not official OpenShift packages. External guidance explicitly states personal forks "should NOT be used for production" and are "not maintained as official distribution points."

Using personal forks in production go.mod via replace directives introduces:

  • Supply-chain risk: Personal forks bypass official release processes, governance, and maintenance guarantees.
  • Maintenance risk: Commits in personal forks may not be reviewed or validated by OpenShift maintainers.
  • Licensing/support concerns: Production builds should depend on official packages with clear support channels.

No documented justification exists in the codebase, git history, or commit messages for this decision.

Before merge, you must:

  1. Explain the business requirement for using personal forks instead of official openshift/api and openshift/client-go.
  2. If staging/development is needed, isolate to development/test builds; production must use official packages.
  3. Document the decision and any upstream blocker or PR context if applicable.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 467, Remove the replace directives that point
github.com/openshift/api and github.com/openshift/client-go to personal
development forks maintained by QiWang19. Instead, use the official OpenShift
packages directly in the go.mod file. If personal development forks are
absolutely necessary for development or testing purposes, isolate them to
development-only or test-specific build configurations rather than including
them in the main go.mod that affects production builds. Additionally, document
in a comment, PR description, or architecture decision record the business
justification for any necessary deviations from official packages, including any
upstream blockers or context that requires using non-official sources.

Source: Path instructions


replace github.com/openshift/client-go => github.com/QiWang19/client-go v0.0.0-20260623024724-64bcee5935da
Loading