bump operator-sdk version to v1.42.2#356
Conversation
Update OPERATOR_SDK_VERSION in Makefile and the base image in Dockerfile from v1.40.0 to v1.42.2. Assisted by: Claude Signed-off-by: James Marshall <jamarsha@redhat.com>
📝 WalkthroughWalkthroughThe ChangesVersion Bump to v1.42.2
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
Dockerfile (1)
1-23:⚠️ Potential issue | 🟠 Major | ⚡ Quick winSet an explicit non-root runtime user in the image.
The Dockerfile does not declare
USER; runtime identity is implicitly inherited from the base image and can regress with upstream image changes. Set a fixed non-root user/group explicitly after file copy/install steps.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfile` around lines 1 - 23, The Dockerfile lacks an explicit USER directive, which means the runtime identity is inherited from the base image and could change with upstream updates. Add a USER directive after all the COPY and RUN commands (and before the ENTRYPOINT) to explicitly set a fixed non-root user and group. This ensures the container runs with a consistent, secure identity regardless of base image changes.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Makefile`:
- Line 51: The Makefile downloads operator binaries at lines 158 and 174 and
executes them with chmod +x without performing any integrity verification,
creating a supply-chain security risk. Add SHA256 checksum validation or cosign
signature verification immediately after downloading the operator binary at each
of these locations (lines 158 and 174) and before executing the chmod +x
command. The verification should validate the downloaded binary against a known
checksum or signature to ensure the binary has not been tampered with before it
is made executable and used.
---
Outside diff comments:
In `@Dockerfile`:
- Around line 1-23: The Dockerfile lacks an explicit USER directive, which means
the runtime identity is inherited from the base image and could change with
upstream updates. Add a USER directive after all the COPY and RUN commands (and
before the ENTRYPOINT) to explicitly set a fixed non-root user and group. This
ensures the container runs with a consistent, secure identity regardless of base
image changes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: f709bba4-6f81-4b72-957e-81c0fd0713b6
📒 Files selected for processing (2)
DockerfileMakefile
| # Set the Operator SDK version to use. By default, what is installed on the system is used. | ||
| # This is useful for CI or a project to utilize a specific version of the operator-sdk toolkit. | ||
| OPERATOR_SDK_VERSION ?= v1.40.0 | ||
| OPERATOR_SDK_VERSION ?= v1.42.2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, locate and inspect the Makefile
fd -t f "Makefile$" | head -5Repository: ansible/eda-server-operator
Length of output: 80
🏁 Script executed:
# Once we have the Makefile, examine the specific lines mentioned
wc -l Makefile && echo "---" && sed -n '45,55p' Makefile && echo "---" && sed -n '155,165p' Makefile && echo "---" && sed -n '170,180p' MakefileRepository: ansible/eda-server-operator
Length of output: 1192
🏁 Script executed:
# Search for checksum or signature verification patterns in the Makefile
rg -i "(checksum|sha256|signature|cosign|verify|gpg)" MakefileRepository: ansible/eda-server-operator
Length of output: 53
🏁 Script executed:
# Check the full context around the download sections and look for any supporting files
cat -n Makefile | sed -n '145,185p'Repository: ansible/eda-server-operator
Length of output: 1718
🏁 Script executed:
# Check if there are any checksum files or verification scripts in the repo
fd -t f "(sha256|checksum|.*sums.*)" . --exclude ".git" | head -20Repository: ansible/eda-server-operator
Length of output: 53
Add checksum/signature verification for downloaded operator binaries.
Line 51 changes the fetched release version, but the download paths (Lines 158 and 174) execute binaries without integrity verification. This leaves CI/local builds exposed to supply-chain tampering. Add SHA256 checksum validation or cosign signature verification before chmod +x.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Makefile` at line 51, The Makefile downloads operator binaries at lines 158
and 174 and executes them with chmod +x without performing any integrity
verification, creating a supply-chain security risk. Add SHA256 checksum
validation or cosign signature verification immediately after downloading the
operator binary at each of these locations (lines 158 and 174) and before
executing the chmod +x command. The verification should validate the downloaded
binary against a known checksum or signature to ensure the binary has not been
tampered with before it is made executable and used.
jamesmarshall24
requested review from
dsavineau,
lucas-benedito and
rooftopcellist
1 participant
Bump operator-sdk from v1.40.0 to v1.42.2. Updates
OPERATOR_SDK_VERSIONin Makefile and the base image in Dockerfile.Summary by CodeRabbit