Skip to content

Update k8s.io/kube-openapi digest to 865597e #1583

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
red-hat-konflux wants to merge 1 commit into
base: main
Choose a base branch
from
+3 −3
Open

Update k8s.io/kube-openapi digest to 865597e #1583

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,6 +164,6 @@ require (
gopkg.in/inf.v0 v0.9.1 // indirect
k8s.io/apiextensions-apiserver v0.35.4 // indirect
k8s.io/klog/v2 v2.140.0 // indirect
k8s.io/kube-openapi v0.0.0-20260427204847-8949caaa1199 // indirect
k8s.io/kube-openapi v0.0.0-20260603220949-865597e52e25 // indirect

@coderabbitai coderabbitai Bot Jun 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Check for security advisories for k8s.io/kube-openapi

# Check for GitHub security advisories
gh api graphql -f query='
{
  securityVulnerabilities(first: 10, ecosystem: GO, package: "k8s.io/kube-openapi") {
    nodes {
      advisory {
        summary
        severity
        publishedAt
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}'

# Verify the commit exists in the repository
echo "Checking if commit 865597e52e25 exists..."
gh api repos/kubernetes/kube-openapi/commits/865597e52e25 --jq '.sha, .commit.author.date, .commit.message' 2>&1

Repository: openshift/lightspeed-operator

Length of output: 371

🌐 Web query:

k8s.io/kube-openapi commit 865597e52e25 changelog security

💡 Result:

I couldn’t locate any source that ties the specific kube-openapi commit 865597e52e25 to a changelog entry or a security fix. What I did find: a recent kube-openapi update in Kubernetes that mentions “key changes upstream” (including an escaping bugfix for JSON-Pointer-reserved characters in generated schema/component names) in PR #138741, but that PR’s referenced kube-openapi revision is b7f5293f4787—not 865597e52e25—and the snippets available don’t mention security implications. Security-related material I found for kube-openapi is general (e.g., the repo’s SECURITY.md and an OpenAPI V3 security requirements PR), but it’s not associated with commit 865597e52e25. So, based on the evidence available from the searches, I can’t confidently answer what security/changelog item 865597e52e25 corresponds to. If you can share the full 40-char commit hash (or a link to the commit/compare view), I can try again and specifically map it to the relevant kube-openapi changelog/security note(s).

Citations:

🌐 Web query:

k8s.io/kube-openapi compatibility with kubernetes 0.35.4

💡 Result:

For Kubernetes v0.35.4, compatibility is achieved by using the kube-openapi version that Kubernetes itself vendors/depends on for that release. In the v0.35.4 line, the kube-apiserver (and related components) depend on k8s.io/kube-openapi at v0.0.0-20250910181357-589584f1c912 [1][2]. In other words: kube-openapi is not “version-compatible” across arbitrary Kubernetes versions; you should align kube-openapi to the Kubernetes release’s expected module version (above) to avoid OpenAPI generation/aggregation mismatches. What this means in practice 1) If you are building extension API servers or clients: match kube-openapi to the Kubernetes branch/release you’re targeting (for k8s 0.35.4, use the kube-openapi commit/version listed above) [1][2]. 2) If you mix versions (kube-openapi newer/older than what kube-apiserver expects), you can hit OpenAPI backward-incompatibility issues—e.g., kube-openapi changes around how model names are generated for OpenAPI v2 aggregation can be backward-incompatible and require Kubernetes-side bumps / kube-openapi bumps [3][4]. Source-backed anchor for Kubernetes OpenAPI generation The kube-apiserver’s OpenAPI handler imports kube-openapi packages (k8s.io/kube-openapi/pkg/util and pkg/validation/spec), so kube-apiserver and kube-openapi must be kept in lockstep for that Kubernetes release series [2].

Citations:

Fix k8s.io/kube-openapi alignment with Kubernetes v0.35.4 (go.mod line 167)

  • Commit 865597e52e25 exists in kubernetes/kube-openapi (dated 2026-06-03).
  • GitHub security advisory lookup for k8s.io/kube-openapi returns no reported advisories for the queried package.
  • Compatibility risk: Kubernetes v0.35.4 is reported to use k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912, but this PR pins v0.0.0-20260603220949-865597e52e25 while keeping k8s.io/api, k8s.io/apimachinery, and k8s.io/client-go at v0.35.4. Align kube-openapi to the v0.35.4 expected module version (or bump the full Kubernetes dependency set together) to avoid OpenAPI aggregation/generation mismatches.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 167, go.mod pins k8s.io/kube-openapi at commit 865597e52e25
which is out of sync with the other Kubernetes modules (k8s.io/api,
k8s.io/apimachinery, k8s.io/client-go) at v0.35.4; update the
k8s.io/kube-openapi entry to the version Kubernetes v0.35.4 expects
(v0.0.0-20250910181357-589584f1c912) or, alternatively, bump all
Kubernetes-related modules together to a consistent release; modify the
k8s.io/kube-openapi module version string in go.mod (the k8s.io/kube-openapi
line) so it matches the chosen approach and then run go mod tidy to regenerate
go.sum and ensure module graph consistency.

sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
)
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -530,8 +530,8 @@ k8s.io/client-go v0.35.4 h1:DN6fyaGuzK64UvnKO5fOA6ymSjvfGAnCAHAR0C66kD8=
k8s.io/client-go v0.35.4/go.mod h1:2Pg9WpsS4NeOpoYTfHHfMxBG8zFMSAUi4O/qoiJC3nY=
k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
k8s.io/kube-openapi v0.0.0-20260427204847-8949caaa1199 h1:sWu4Td5mgJlwunsUydnhKEAfNUHM7hm1wfKEQmD7G5c=
k8s.io/kube-openapi v0.0.0-20260427204847-8949caaa1199/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
k8s.io/kube-openapi v0.0.0-20260603220949-865597e52e25 h1:mPMaPMpBij2V1Wv/fR+HW124vVGXXvOSS9ver/9yjWs=
k8s.io/kube-openapi v0.0.0-20260603220949-865597e52e25/go.mod h1:V/QaCUYDa+0QpcHhVVc5l99Uz56wEMEXBSj9oCDkNDY=
k8s.io/utils v0.0.0-20260507154919-ff6756f316d2 h1:wU4tMEhLGgIbLvXQb1cfN+EcM0wf7zC6CPF+C79jroc=
k8s.io/utils v0.0.0-20260507154919-ff6756f316d2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
sigs.k8s.io/controller-runtime v0.23.3 h1:VjB/vhoPoA9l1kEKZHBMnQF33tdCLQKJtydy4iqwZ80=
Expand Down