Backport the CVE patch from the upstream: https://github.com/kubernetes/kubernetes.git
Signed-off-by: Zhixiong Chi <[email protected]> --- .../kubernetes/kubernetes/CVE-2020-8555.patch | 324 ++++++++++++++++++ .../kubernetes/kubernetes_git.bb | 1 + 2 files changed, 325 insertions(+) create mode 100644 recipes-containers/kubernetes/kubernetes/CVE-2020-8555.patch diff --git a/recipes-containers/kubernetes/kubernetes/CVE-2020-8555.patch b/recipes-containers/kubernetes/kubernetes/CVE-2020-8555.patch new file mode 100644 index 0000000..c6f8e24 --- /dev/null +++ b/recipes-containers/kubernetes/kubernetes/CVE-2020-8555.patch @@ -0,0 +1,324 @@ +From 830811b331c47b9b03c60f9156cea02698fa9e20 Mon Sep 17 00:00:00 2001 +From: Michelle Au <[email protected]> +Date: Thu, 2 Apr 2020 13:47:56 -0700 +Subject: [PATCH] Clean up event messages for errors. + +Change-Id: Ib70b50e676b917c4d976f32ee7a19f8fc63b6bc6 + +CVE: CVE-2020-8555 +Upstream-Status: Backport [https://github.com/kubernetes/kubernetes.git branch: release-1.16] +Signed-off-by: Zhixiong Chi <[email protected]> +--- + src/import/pkg/volume/glusterfs/glusterfs.go | 30 +++++++---- + src/import/pkg/volume/quobyte/quobyte.go | 13 ++++- + src/import/pkg/volume/scaleio/sio_client.go | 71 ++++++++++++++++++-------- + src/import/pkg/volume/storageos/storageos_util.go | 12 +++-- + 4 files changed, 91 insertions(+), 35 deletions(-) + +diff --git a/src/import/pkg/volume/glusterfs/glusterfs.go b/src/import/pkg/volume/glusterfs/glusterfs.go +index 52ff8cb1328..dd543c4625b 100644 +--- a/src/import/pkg/volume/glusterfs/glusterfs.go ++++ b/src/import/pkg/volume/glusterfs/glusterfs.go +@@ -672,8 +672,9 @@ func (d *glusterfsVolumeDeleter) Delete() error { + err = cli.VolumeDelete(volumeID) + if err != nil { + if dstrings.TrimSpace(err.Error()) != errIDNotFound { +- klog.Errorf("failed to delete volume %s: %v", volumeName, err) +- return fmt.Errorf("failed to delete volume %s: %v", volumeName, err) ++ // don't log error details from client calls in events ++ klog.V(4).Infof("failed to delete volume %s: %v", volumeName, err) ++ return fmt.Errorf("failed to delete volume: see kube-controller-manager.log for details") + } + klog.V(2).Infof("volume %s not present in heketi, ignoring", volumeName) + } +@@ -818,7 +819,9 @@ func (p *glusterfsVolumeProvisioner) CreateVolume(gid int) (r *v1.GlusterfsPersi + volumeReq := &gapi.VolumeCreateRequest{Size: sz, Name: customVolumeName, Clusters: clusterIDs, Gid: gid64, Durability: p.volumeType, GlusterVolumeOptions: p.volumeOptions, Snapshot: snaps} + volume, err := cli.VolumeCreate(volumeReq) + if err != nil { +- return nil, 0, "", fmt.Errorf("failed to create volume: %v", err) ++ // don't log error details from client calls in events ++ klog.V(4).Infof("failed to create volume: %v", err) ++ return nil, 0, "", fmt.Errorf("failed to create volume: see kube-controller-manager.log for details") + } + klog.V(1).Infof("volume with size %d and name %s created", volume.Size, volume.Name) + volID = volume.Id +@@ -839,7 +842,8 @@ func (p *glusterfsVolumeProvisioner) CreateVolume(gid int) (r *v1.GlusterfsPersi + if err != nil { + deleteErr := cli.VolumeDelete(volume.Id) + if deleteErr != nil { +- klog.Errorf("failed to delete volume: %v, manual deletion of the volume required", deleteErr) ++ // don't log error details from client calls in events ++ klog.V(4).Infof("failed to delete volume: %v, manual deletion of the volume required", deleteErr) + } + klog.V(3).Infof("failed to update endpoint, deleting %s", endpoint) + err = kubeClient.CoreV1().Services(epNamespace).Delete(epServiceName, nil) +@@ -957,7 +961,9 @@ func parseSecret(namespace, secretName string, kubeClient clientset.Interface) ( + func getClusterNodes(cli *gcli.Client, cluster string) (dynamicHostIps []string, err error) { + clusterinfo, err := cli.ClusterInfo(cluster) + if err != nil { +- return nil, fmt.Errorf("failed to get cluster details: %v", err) ++ // don't log error details from client calls in events ++ klog.V(4).Infof("failed to get cluster details: %v", err) ++ return nil, fmt.Errorf("failed to get cluster details: see kube-controller-manager.log for details") + } + + // For the dynamically provisioned volume, we gather the list of node IPs +@@ -966,7 +972,9 @@ func getClusterNodes(cli *gcli.Client, cluster string) (dynamicHostIps []string, + for _, node := range clusterinfo.Nodes { + nodeInfo, err := cli.NodeInfo(string(node)) + if err != nil { +- return nil, fmt.Errorf("failed to get host ipaddress: %v", err) ++ // don't log error details from client calls in events ++ klog.V(4).Infof("failed to get host ipaddress: %v", err) ++ return nil, fmt.Errorf("failed to get host ipaddress: see kube-controller-manager.log for details") + } + ipaddr := dstrings.Join(nodeInfo.NodeAddRequest.Hostnames.Storage, "") + dynamicHostIps = append(dynamicHostIps, ipaddr) +@@ -1210,8 +1218,9 @@ func (plugin *glusterfsPlugin) ExpandVolumeDevice(spec *volume.Spec, newSize res + //Check the existing volume size + currentVolumeInfo, err := cli.VolumeInfo(volumeID) + if err != nil { +- klog.Errorf("error when fetching details of volume %s: %v", volumeName, err) +- return oldSize, err ++ // don't log error details from client calls in events ++ klog.V(4).Infof("error when fetching details of volume %s: %v", volumeName, err) ++ return oldSize, fmt.Errorf("failed to get volume info %s: see kube-controller-manager.log for details", volumeName) + } + if int64(currentVolumeInfo.Size) >= requestGiB { + return newSize, nil +@@ -1223,8 +1232,9 @@ func (plugin *glusterfsPlugin) ExpandVolumeDevice(spec *volume.Spec, newSize res + // Expand the volume + volumeInfoRes, err := cli.VolumeExpand(volumeID, volumeExpandReq) + if err != nil { +- klog.Errorf("failed to expand volume %s: %v", volumeName, err) +- return oldSize, err ++ // don't log error details from client calls in events ++ klog.V(4).Infof("failed to expand volume %s: %v", volumeName, err) ++ return oldSize, fmt.Errorf("failed to expand volume: see kube-controller-manager.log for details") + } + klog.V(2).Infof("volume %s expanded to new size %d successfully", volumeName, volumeInfoRes.Size) + newVolumeSize := resource.MustParse(fmt.Sprintf("%dGi", volumeInfoRes.Size)) +diff --git a/src/import/pkg/volume/quobyte/quobyte.go b/src/import/pkg/volume/quobyte/quobyte.go +index 3cfc7a800ec..f7e0e31e63b 100644 +--- a/src/import/pkg/volume/quobyte/quobyte.go ++++ b/src/import/pkg/volume/quobyte/quobyte.go +@@ -17,6 +17,7 @@ limitations under the License. + package quobyte + + import ( ++ "errors" + "fmt" + "os" + "path/filepath" +@@ -416,7 +417,9 @@ func (provisioner *quobyteVolumeProvisioner) Provision(selectedNode *v1.Node, al + + vol, sizeGB, err := manager.createVolume(provisioner, createQuota) + if err != nil { +- return nil, err ++ // don't log error details from client calls in events ++ klog.V(4).Infof("CreateVolume failed: %v", err) ++ return nil, errors.New("CreateVolume failed: see kube-controller-manager.log for details") + } + pv := new(v1.PersistentVolume) + metav1.SetMetaDataAnnotation(&pv.ObjectMeta, util.VolumeDynamicallyCreatedByKey, "quobyte-dynamic-provisioner") +@@ -451,7 +454,13 @@ func (deleter *quobyteVolumeDeleter) Delete() error { + manager := &quobyteVolumeManager{ + config: cfg, + } +- return manager.deleteVolume(deleter) ++ err = manager.deleteVolume(deleter) ++ if err != nil { ++ // don't log error details from client calls in events ++ klog.V(4).Infof("DeleteVolume failed: %v", err) ++ return errors.New("DeleteVolume failed: see kube-controller-manager.log for details") ++ } ++ return nil + } + + // Parse API configuration (url, username and password) out of class.Parameters. +diff --git a/src/import/pkg/volume/scaleio/sio_client.go b/src/import/pkg/volume/scaleio/sio_client.go +index bc9b9868f7b..2f8c652dd8b 100644 +--- a/src/import/pkg/volume/scaleio/sio_client.go ++++ b/src/import/pkg/volume/scaleio/sio_client.go +@@ -126,8 +126,9 @@ func (c *sioClient) init() error { + Username: c.username, + Password: c.password}, + ); err != nil { +- klog.Error(log("client authentication failed: %v", err)) +- return err ++ // don't log error details from client calls in events ++ klog.V(4).Infof(log("client authentication failed: %v", err)) ++ return errors.New("client authentication failed") + } + + // retrieve system +@@ -214,8 +215,9 @@ func (c *sioClient) CreateVolume(name string, sizeGB int64) (*siotypes.Volume, e + } + createResponse, err := c.client.CreateVolume(params, c.storagePool.Name) + if err != nil { +- klog.Error(log("failed to create volume %s: %v", name, err)) +- return nil, err ++ // don't log error details from client calls in events ++ klog.V(4).Infof(log("failed to create volume %s: %v", name, err)) ++ return nil, errors.New("failed to create volume: see kubernetes logs for details") + } + return c.Volume(sioVolumeID(createResponse.ID)) + } +@@ -243,8 +245,9 @@ func (c *sioClient) AttachVolume(id sioVolumeID, multipleMappings bool) error { + volClient.Volume = &siotypes.Volume{ID: string(id)} + + if err := volClient.MapVolumeSdc(params); err != nil { +- klog.Error(log("failed to attach volume id %s: %v", id, err)) +- return err ++ // don't log error details from client calls in events ++ klog.V(4).Infof(log("failed to attach volume id %s: %v", id, err)) ++ return errors.New("failed to attach volume: see kubernetes logs for details") + } + + klog.V(4).Info(log("volume %s attached successfully", id)) +@@ -269,7 +272,9 @@ func (c *sioClient) DetachVolume(id sioVolumeID) error { + volClient := sio.NewVolume(c.client) + volClient.Volume = &siotypes.Volume{ID: string(id)} + if err := volClient.UnmapVolumeSdc(params); err != nil { +- return err ++ // don't log error details from client calls in events ++ klog.V(4).Infof(log("failed to detach volume id %s: %v", id, err)) ++ return errors.New("failed to detach volume: see kubernetes logs for details") + } + return nil + } +@@ -287,7 +292,9 @@ func (c *sioClient) DeleteVolume(id sioVolumeID) error { + volClient := sio.NewVolume(c.client) + volClient.Volume = vol + if err := volClient.RemoveVolume("ONLY_ME"); err != nil { +- return err ++ // don't log error details from client calls in events ++ klog.V(4).Infof(log("failed to remove volume id %s: %v", id, err)) ++ return errors.New("failed to remove volume: see kubernetes logs for details") + } + return nil + } +@@ -306,8 +313,9 @@ func (c *sioClient) IID() (string, error) { + } + sdc, err := c.sysClient.FindSdc("SdcGUID", guid) + if err != nil { +- klog.Error(log("failed to retrieve sdc info %s", err)) +- return "", err ++ // don't log error details from client calls in events ++ klog.V(4).Infof(log("failed to retrieve sdc info %s", err)) ++ return "", errors.New("failed to retrieve sdc info: see kubernetes logs for details") + } + c.instanceID = sdc.Sdc.ID + klog.V(4).Info(log("retrieved instanceID %s", c.instanceID)) +@@ -472,12 +480,15 @@ func (c *sioClient) WaitForDetachedDevice(token string) error { + // *********************************************************************** + func (c *sioClient) findSystem(sysname string) (sys *siotypes.System, err error) { + if c.sysClient, err = c.client.FindSystem("", sysname, ""); err != nil { +- return nil, err ++ // don't log error details from clients in events ++ klog.V(4).Infof(log("failed to find system %q: %v", sysname, err)) ++ return nil, errors.New("failed to find system: see kubernetes logs for details") + } + systems, err := c.client.GetInstance("") + if err != nil { +- klog.Error(log("failed to retrieve instances: %v", err)) +- return nil, err ++ // don't log error details from clients in events ++ klog.V(4).Infof(log("failed to retrieve instances: %v", err)) ++ return nil, errors.New("failed to retrieve instances: see kubernetes logs for details") + } + for _, sys = range systems { + if sys.Name == sysname { +@@ -493,8 +504,9 @@ func (c *sioClient) findProtectionDomain(pdname string) (*siotypes.ProtectionDom + if c.sysClient != nil { + protectionDomain, err := c.sysClient.FindProtectionDomain("", pdname, "") + if err != nil { +- klog.Error(log("failed to retrieve protection domains: %v", err)) +- return nil, err ++ // don't log error details from clients in events ++ klog.V(4).Infof(log("failed to retrieve protection domains: %v", err)) ++ return nil, errors.New("failed to retrieve protection domains: see kubernetes logs for details") + } + c.pdClient.ProtectionDomain = protectionDomain + return protectionDomain, nil +@@ -508,8 +520,9 @@ func (c *sioClient) findStoragePool(spname string) (*siotypes.StoragePool, error + if c.pdClient != nil { + sp, err := c.pdClient.FindStoragePool("", spname, "") + if err != nil { +- klog.Error(log("failed to retrieve storage pool: %v", err)) +- return nil, err ++ // don't log error details from clients in events ++ klog.V(4).Infof(log("failed to retrieve storage pool: %v", err)) ++ return nil, errors.New("failed to retrieve storage pool: see kubernetes logs for details") + } + c.spClient.StoragePool = sp + return sp, nil +@@ -519,14 +532,32 @@ func (c *sioClient) findStoragePool(spname string) (*siotypes.StoragePool, error + } + + func (c *sioClient) getVolumes() ([]*siotypes.Volume, error) { +- return c.client.GetVolume("", "", "", "", true) ++ volumes, err := c.client.GetVolume("", "", "", "", true) ++ if err != nil { ++ // don't log error details from clients in events ++ klog.V(4).Infof(log("failed to get volumes: %v", err)) ++ return nil, errors.New("failed to get volumes: see kubernetes logs for details") ++ } ++ return volumes, nil + } + func (c *sioClient) getVolumesByID(id sioVolumeID) ([]*siotypes.Volume, error) { +- return c.client.GetVolume("", string(id), "", "", true) ++ volumes, err := c.client.GetVolume("", string(id), "", "", true) ++ if err != nil { ++ // don't log error details from clients in events ++ klog.V(4).Infof(log("failed to get volumes by id: %v", err)) ++ return nil, errors.New("failed to get volumes by id: see kubernetes logs for details") ++ } ++ return volumes, nil + } + + func (c *sioClient) getVolumesByName(name string) ([]*siotypes.Volume, error) { +- return c.client.GetVolume("", "", "", name, true) ++ volumes, err := c.client.GetVolume("", "", "", name, true) ++ if err != nil { ++ // don't log error details from clients in events ++ klog.V(4).Infof(log("failed to get volumes by name: %v", err)) ++ return nil, errors.New("failed to get volumes by name: see kubernetes logs for details") ++ } ++ return volumes, nil + } + + func (c *sioClient) getSdcPath() string { +diff --git a/src/import/pkg/volume/storageos/storageos_util.go b/src/import/pkg/volume/storageos/storageos_util.go +index c7f430ea5d4..d62cae66788 100644 +--- a/src/import/pkg/volume/storageos/storageos_util.go ++++ b/src/import/pkg/volume/storageos/storageos_util.go +@@ -128,8 +128,9 @@ func (u *storageosUtil) CreateVolume(p *storageosProvisioner) (*storageosVolume, + + vol, err := u.api.VolumeCreate(opts) + if err != nil { +- klog.Errorf("volume create failed for volume %q (%v)", opts.Name, err) +- return nil, err ++ // don't log error details from client calls in events ++ klog.V(4).Infof("volume create failed for volume %q (%v)", opts.Name, err) ++ return nil, errors.New("volume create failed: see kube-controller-manager.log for details") + } + return &storageosVolume{ + ID: vol.ID, +@@ -294,7 +295,12 @@ func (u *storageosUtil) DeleteVolume(d *storageosDeleter) error { + Namespace: d.volNamespace, + Force: true, + } +- return u.api.VolumeDelete(opts) ++ if err := u.api.VolumeDelete(opts); err != nil { ++ // don't log error details from client calls in events ++ klog.V(4).Infof("volume deleted failed for volume %q in namespace %q: %v", d.volName, d.volNamespace, err) ++ return errors.New("volume delete failed: see kube-controller-manager.log for details") ++ } ++ return nil + } + + // Get the node's device path from the API, falling back to the default if not +-- +2.17.0 + diff --git a/recipes-containers/kubernetes/kubernetes_git.bb b/recipes-containers/kubernetes/kubernetes_git.bb index c378ccc..e96b7d6 100644 --- a/recipes-containers/kubernetes/kubernetes_git.bb +++ b/recipes-containers/kubernetes/kubernetes_git.bb @@ -14,6 +14,7 @@ SRC_URI = "git://github.com/kubernetes/kubernetes.git;branch=release-1.16;name=k file://0001-fix-compiling-failure-execvp-bin-bash-Argument-list-.patch \ file://CVE-2020-8551.patch \ file://CVE-2020-8552.patch \ + file://CVE-2020-8555.patch \ " DEPENDS += "rsync-native \ -- 2.17.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#49641): https://lists.yoctoproject.org/g/yocto/message/49641 Mute This Topic: https://lists.yoctoproject.org/mt/74890057/21656 Group Owner: [email protected] Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
