Skip to content

CORS-4524: Enable GCP custom universe domain support for CCO #1068

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
patrickdillon wants to merge 6 commits into
base: master
Choose a base branch
from
Open

CORS-4524: Enable GCP custom universe domain support for CCO #1068

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8155da6
GCP: Set Universe Domain for clients
patrickdillon Jul 16, 2026
c284a20
GCP: Support domain-scoped service account formatting
patrickdillon Jul 16, 2026
aeb83ab
GCP: update deprecated CredentialsFromJSON
patrickdillon Jul 16, 2026
8e30284
go.mod: include latest google api packages
patrickdillon Jul 16, 2026
67bacb8
vendor: bump google api packages
patrickdillon Jul 16, 2026
5def0d7
Dockerfile.local: bump go to 1.26
patrickdillon Jul 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
2 changes: 1 addition & 1 deletion Dockerfile.local
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM golang:1.21 AS builder
FROM golang:1.26 AS builder
Comment thread
coderabbitai[bot] marked this conversation as resolved.

@coderabbitai coderabbitai Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major

Pin the non-Red Hat builder image by digest.

golang:1.26 is mutable, so local builds can consume unreviewed image contents over time. Replace it with golang:1.26@sha256:<verified-digest>. This repeats the previously withdrawn finding, but the current path instruction explicitly requires digest pinning.

🧰 Tools
🪛 Trivy (0.72.0)

[error] 1-1: Image user should not be 'root'

Specify at least 1 USER command in Dockerfile with non-root user as argument

Rule: DS-0002

Learn more

(IaC/Dockerfile)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile.local` at line 1, Update the builder image reference in the
Dockerfile’s FROM instruction to pin golang:1.26 using the verified sha256
digest, preserving the existing builder stage name.

Source: Path instructions

WORKDIR /go/src/github.com/openshift/cloud-credential-operator
COPY . .
ENV GO_PACKAGE github.com/openshift/cloud-credential-operator
Expand Down
40 changes: 20 additions & 20 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,11 +51,11 @@ require (
github.com/stretchr/testify v1.11.1
github.com/tidwall/gjson v1.18.0
golang.org/x/mod v0.36.0
golang.org/x/oauth2 v0.35.0
golang.org/x/time v0.14.0
google.golang.org/api v0.252.0
google.golang.org/genproto v0.0.0-20251020155222-88f65dc88635
google.golang.org/grpc v1.79.3
golang.org/x/oauth2 v0.36.0
golang.org/x/time v0.15.0
google.golang.org/api v0.288.0
google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7
google.golang.org/grpc v1.82.0

@coderabbitai coderabbitai Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
osv-scanner scan source -r .

Repository: openshift/cloud-credential-operator

Length of output: 2760

🌐 Web query:

GHSA-hrxh-6v49-42gf google.golang.org/grpc v1.82.0 OSV

💡 Result:

GHSA-hrxh-6v49-42gf is a high-severity security advisory affecting the google.golang.org/grpc library [1][2]. It covers multiple vulnerabilities identified in the gRPC-Go implementation, specifically within the xDS RBAC authorization engine and the HTTP/2 transport server [2]. The vulnerabilities addressed are: 1. xDS RBAC Authorization Bypass (Fail-Open): Occurs when translating xDS RBAC policies containing Metadata or RequestedServerName fields [2]. 2. HTTP/2 Rapid Reset Denial of Service (DoS) Bypass: Involves a bypass of existing HTTP/2 Rapid Reset mitigations during client-initiated stream resets, leading to high CPU consumption [2]. 3. xDS RBAC Engine Server Panic: A DoS vulnerability triggered when parsing crafted xDS RBAC policies that include NOT rules around unsupported fields [2]. All affected versions of google.golang.org/grpc prior to 1.82.1 are vulnerable [3][1]. The issue is resolved in version 1.82.1, and users are advised to upgrade to this version or later to mitigate these risks [2][4].

Citations:

Upgrade google.golang.org/grpc to 1.82.1 or later. v1.82.0 is affected by GHSA-hrxh-6v49-42gf; bump to a patched release and update go.sum.

🧰 Tools
🪛 OSV Scanner (2.4.0)

[HIGH] 58-58: google.golang.org/grpc 1.82.0: gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

(GHSA-hrxh-6v49-42gf)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 58, Update the google.golang.org/grpc dependency from v1.82.0
to v1.82.1 or a later patched release, then regenerate go.sum so its checksums
match the upgraded module.

Sources: Path instructions, Linters/SAST tools

gopkg.in/yaml.v3 v3.0.1
k8s.io/api v0.35.2
k8s.io/apimachinery v0.35.2
Expand All @@ -73,14 +73,14 @@ require (
require (
cel.dev/expr v0.25.1 // indirect
cloud.google.com/go v0.123.0 // indirect
cloud.google.com/go/auth v0.17.0 // indirect
cloud.google.com/go/auth v0.20.0 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
cloud.google.com/go/compute/metadata v0.9.0 // indirect
cloud.google.com/go/monitoring v1.24.3 // indirect
github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/managementgroups/armmanagementgroups v1.2.0 // indirect
github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0 // indirect
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
Expand All @@ -102,12 +102,12 @@ require (
github.com/blang/semver/v4 v4.0.0 // indirect
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
github.com/creack/pty v1.1.24 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
github.com/envoyproxy/go-control-plane/envoy v1.37.0 // indirect
github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
github.com/evanphx/json-patch v5.9.11+incompatible // indirect
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
github.com/fatih/color v1.18.0 // indirect
Expand Down Expand Up @@ -145,10 +145,10 @@ require (
github.com/google/go-querystring v1.1.0 // indirect
github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 // indirect
github.com/google/s2a-go v0.1.9 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
github.com/googleapis/gax-go/v2 v2.15.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.17 // indirect
github.com/googleapis/gax-go/v2 v2.22.0 // indirect
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
github.com/hinshun/vt10x v0.0.0-20220301184237-5011da428d02 // indirect
Expand Down Expand Up @@ -194,9 +194,9 @@ require (
github.com/x448/float16 v0.8.4 // indirect
go.mongodb.org/mongo-driver v1.17.6 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
go.opentelemetry.io/contrib/detectors/gcp v1.43.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
go.opentelemetry.io/otel v1.44.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 // indirect
Expand All @@ -205,7 +205,7 @@ require (
go.opentelemetry.io/otel/sdk v1.44.0 // indirect
go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect
go.opentelemetry.io/otel/trace v1.44.0 // indirect
go.opentelemetry.io/proto/otlp v1.7.1 // indirect
go.opentelemetry.io/proto/otlp v1.9.0 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/crypto v0.53.0 // indirect
Expand All @@ -217,9 +217,9 @@ require (
golang.org/x/text v0.38.0 // indirect
golang.org/x/tools v0.45.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
google.golang.org/protobuf v1.36.10 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 // indirect
google.golang.org/protobuf v1.36.11 // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
Expand Down
Loading