Pin k8s.io/kuberenetes + dependency bumps #706

dereknola · 2025-06-09T17:06:55Z

#704 is in a broken state and I lack permissions to fix it. Opening this PR instead.

Changes

Pin k8s.io/kubernetes to match the rest of the k8s dependencies
Keep go 1.23.0 the above issue was causing go to be bumped when it should not be.

Validation

make works locally

k8s-ci-robot · 2025-06-09T17:07:05Z

Hi @dereknola. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

dereknola · 2025-06-09T17:21:37Z

go.mod

-	k8s.io/kubernetes v1.30.12
-	k8s.io/utils v0.0.0-20230726121419-3b25d923346b
+	k8s.io/klog/v2 v2.130.1
+	k8s.io/kubernetes v1.33.1


Not actually a bump, as most of these are pinned via replacement calls below.

Could you please change it to v1.30.12?

…j-x2gw CoreDNS v1.11.3 vulnerability in github.com/coredns/coredns. Upstream fix in progress at kubernetes/dns#706. Marking as pending-upstream-fix while waiting for PR to be merged and new release.

…j-x2gw (#19083) CoreDNS v1.11.3 vulnerability in github.com/coredns/coredns. Upstream fix in progress at kubernetes/dns#706. Marking as pending-upstream-fix while waiting for PR to be merged and new release.

DamianSawicki

I think it would suffice to pin k8s.io/kubernetes and then rely on dependabot, but if it's time sensitive, we can leave it this way for the last time.

Also, I was hoping that we can get rid of pinning entirely and rely on dependabot bumping minor versions of non-k8s dependencies and patch versions of k8s.io dependencies, but the discussion on #709 seems to suggest that we can't get away without pinning if we want to control the kubernetes minor (historically we haven't, but @dereknola seems to be in favor of it recently). CC: @Michcioperz

DamianSawicki · 2025-06-30T09:54:55Z

go.mod

+	go.etcd.io/etcd/client/v2 v2.305.21
+	go.etcd.io/etcd/client/v3 v3.6.0
+	golang.org/x/net v0.40.0
+	k8s.io/api v0.32.3


Can we get rid of these (or restore them to v.0.30.12)? They seem to be pinned anyway.

k8s.io/api v0.32.3 k8s.io/apimachinery v0.32.3 k8s.io/client-go v0.32.3 ... k8s.io/kubernetes v1.33.1

I tried myself restoring them to v.0.30.12/v1.30.12, but go mod tidy bumps api, apimachinery, and client-go back to v0.32.3. It's seems possible to downgrade kubernetes, though.

go.mod

dereknola · 2025-06-30T17:01:44Z

@DamianSawicki I'm on board with letting dependabot handle things and moving towards the latest versions of k8s. I would support that once this PR is merged, you open new PR that ensures all currently pinned k8s dependencies are removed, and a move to v1.33.XX/v0.33.XX across the board. Dependabot can then take over any future bumps.

DamianSawicki

/ok-to-test

I'm on board with letting dependabot handle things and moving towards the latest versions of k8s.

Cool, thanks a lot for sharing your perspective here!

I would support that once this PR is merged, you open new PR that ensures all currently pinned k8s dependencies are removed, and a move to v1.33.XX/v0.33.XX across the board.

Moving to v1.33.XX/v0.33.XX may involve some non-trivial changes, so we'd need to see who will have time to work on it.

DamianSawicki · 2025-07-07T09:24:01Z

go.mod

+	go.etcd.io/etcd/client/v2 v2.305.21
+	go.etcd.io/etcd/client/v3 v3.6.0
+	golang.org/x/net v0.40.0
+	k8s.io/api v0.32.3


I tried myself restoring them to v.0.30.12/v1.30.12, but go mod tidy bumps api, apimachinery, and client-go back to v0.32.3. It's seems possible to downgrade kubernetes, though.

DamianSawicki · 2025-07-07T09:24:58Z

go.mod

-	k8s.io/kubernetes v1.30.12
-	k8s.io/utils v0.0.0-20230726121419-3b25d923346b
+	k8s.io/klog/v2 v2.130.1
+	k8s.io/kubernetes v1.33.1


Could you please change it to v1.30.12?

dereknola · 2025-07-08T19:56:34Z

Explicitly bumped the require dependency versions.

go.mod

Bumps the non-k8s group with 13 updates: | Package | From | To | | --- | --- | --- | | [github.com/coredns/coredns](https://github.com/coredns/coredns) | `1.11.3` | `1.12.2` | | [github.com/miekg/dns](https://github.com/miekg/dns) | `1.1.63` | `1.1.66` | | [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.36.1` | `1.36.2` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.19.1` | `1.22.0` | | [github.com/vishvananda/netlink](https://github.com/vishvananda/netlink) | `1.1.0` | `1.3.1` | | [go.etcd.io/etcd/api/v3](https://github.com/etcd-io/etcd) | `3.5.18` | `3.6.0` | | [go.etcd.io/etcd/client/pkg/v3](https://github.com/etcd-io/etcd) | `3.5.18` | `3.6.0` | | [go.etcd.io/etcd/client/v2](https://github.com/etcd-io/etcd) | `2.305.18` | `2.305.21` | | [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd) | `3.5.18` | `3.6.0` | | [golang.org/x/net](https://github.com/golang/net) | `0.38.0` | `0.40.0` | | [k8s.io/klog/v2](https://github.com/kubernetes/klog) | `2.120.1` | `2.130.1` | | [k8s.io/utils](https://github.com/kubernetes/utils) | `0.0.0-20230726121419-3b25d923346b` | `0.0.0-20241104100929-3ea5e8cea738` | Pin k8s.io/kubernetes as well to v1.30.12 Signed-off-by: Derek Nola <[email protected]> Make regular k8s dependencies explicitly v0.32.12 Signed-off-by: Derek Nola <[email protected]>

DamianSawicki

/lgtm
/approve

Thanks for your patience!

k8s-ci-robot · 2025-07-18T19:05:16Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: DamianSawicki, dereknola

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [DamianSawicki]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 9, 2025

k8s-ci-robot requested review from DamianSawicki and MrHohn June 9, 2025 17:07

k8s-ci-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Jun 9, 2025

dereknola force-pushed the pin_k8s_dep branch from a60ea23 to 7c6f4a8 Compare June 9, 2025 17:19

dereknola commented Jun 9, 2025

View reviewed changes

jamie-albert mentioned this pull request Jun 10, 2025

kubernetes-dns-node-cache: add pending-upstream-fix for GHSA-cvx7-x8pj-x2gw wolfi-dev/advisories#19083

Merged

dereknola mentioned this pull request Jun 27, 2025

Bump Coredns version to include PR https://github.com/coredns/coredns… #709

Closed

DamianSawicki requested changes Jun 30, 2025

View reviewed changes

DamianSawicki mentioned this pull request Jun 30, 2025

Bump the non-k8s group with 13 updates #711

Closed

dereknola force-pushed the pin_k8s_dep branch from 7c6f4a8 to 3e96b85 Compare June 30, 2025 16:59

DamianSawicki reviewed Jul 7, 2025

View reviewed changes

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 7, 2025

dereknola force-pushed the pin_k8s_dep branch from 3e96b85 to dc8b8d0 Compare July 8, 2025 19:56

DamianSawicki reviewed Jul 18, 2025

View reviewed changes

go.mod Outdated Show resolved Hide resolved

dereknola force-pushed the pin_k8s_dep branch from dc8b8d0 to a8dd421 Compare July 18, 2025 15:57

dereknola force-pushed the pin_k8s_dep branch from a8dd421 to 2a29f49 Compare July 18, 2025 16:02

DamianSawicki approved these changes Jul 18, 2025

View reviewed changes

k8s-ci-robot assigned DamianSawicki Jul 18, 2025

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 18, 2025

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 18, 2025

k8s-ci-robot merged commit 025e0c3 into kubernetes:master Jul 18, 2025
3 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Pin k8s.io/kuberenetes + dependency bumps #706

Pin k8s.io/kuberenetes + dependency bumps #706

dereknola commented Jun 9, 2025 •

edited

Loading

Uh oh!

k8s-ci-robot commented Jun 9, 2025

Uh oh!

dereknola Jun 9, 2025 •

edited

Loading

Uh oh!

DamianSawicki Jul 7, 2025

Uh oh!

DamianSawicki left a comment

Uh oh!

DamianSawicki Jun 30, 2025

Uh oh!

DamianSawicki Jul 7, 2025

Uh oh!

Uh oh!

dereknola commented Jun 30, 2025

Uh oh!

DamianSawicki left a comment

Uh oh!

DamianSawicki Jul 7, 2025

Uh oh!

DamianSawicki Jul 7, 2025

Uh oh!

dereknola commented Jul 8, 2025

Uh oh!

Uh oh!

DamianSawicki left a comment

Uh oh!

k8s-ci-robot commented Jul 18, 2025

Uh oh!

Uh oh!

Uh oh!

Pin k8s.io/kuberenetes + dependency bumps #706

Pin k8s.io/kuberenetes + dependency bumps #706

Conversation

dereknola commented Jun 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Validation

Uh oh!

k8s-ci-robot commented Jun 9, 2025

Uh oh!

dereknola Jun 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DamianSawicki Jul 7, 2025

Choose a reason for hiding this comment

Uh oh!

DamianSawicki left a comment

Choose a reason for hiding this comment

Uh oh!

DamianSawicki Jun 30, 2025

Choose a reason for hiding this comment

Uh oh!

DamianSawicki Jul 7, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dereknola commented Jun 30, 2025

Uh oh!

DamianSawicki left a comment

Choose a reason for hiding this comment

Uh oh!

DamianSawicki Jul 7, 2025

Choose a reason for hiding this comment

Uh oh!

DamianSawicki Jul 7, 2025

Choose a reason for hiding this comment

Uh oh!

dereknola commented Jul 8, 2025

Uh oh!

Uh oh!

DamianSawicki left a comment

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Jul 18, 2025

Uh oh!

Uh oh!

Uh oh!

dereknola commented Jun 9, 2025 •

edited

Loading

dereknola Jun 9, 2025 •

edited

Loading