[release-ocm-2.15] ACM-31978: CVE-2026-32286 Upgrade PostgreSQL stack to pgx v5#10597
[release-ocm-2.15] ACM-31978: CVE-2026-32286 Upgrade PostgreSQL stack to pgx v5#10597shay23bra wants to merge 2 commits into
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@shay23bra: This pull request references ACM-31978 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
size/XL
openshift-ci
Bot
added
the
api-review
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## release-ocm-2.15 #10597 +/- ##
====================================================
- Coverage 43.66% 43.64% -0.02%
====================================================
Files 407 408 +1
Lines 70611 70640 +29
====================================================
Hits 30832 30832
- Misses 36999 37028 +29
Partials 2780 2780
🚀 New features to boost your workflow:
|
|
/test subsystem-aws |
1 similar comment
|
/test subsystem-aws |
|
/retest |
1 similar comment
|
/retest |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: gamli75, shay23bra The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/retest |
|
/lgtm |
|
Scheduling required tests: |
openshift-ci
Bot
added
the
needs-rebase
shay23bra
force-pushed
the
pgx-v5-migration-release-ocm-2.15
branch
from
7401536 to
dfabc69
Compare
openshift-ci
Bot
removed
lgtm
|
/override ci/prow/e2e-ai-operator-ztp-3masters |
1 similar comment
|
/override ci/prow/e2e-ai-operator-ztp-3masters |
|
/lgtm |
|
@gamli75: Overrode contexts on behalf of gamli75: ci/prow/e2e-ai-operator-ztp-3masters DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Scheduling required tests: |
|
@gamli75: Overrode contexts on behalf of gamli75: ci/prow/e2e-ai-operator-ztp-3masters DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/override ci/prow/e2e-ai-operator-disconnected-capi |
|
@gamli75: Overrode contexts on behalf of gamli75: ci/prow/e2e-ai-operator-disconnected-capi DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/override ci/prow/e2e-ai-operator-ztp-3masters |
|
@gamli75: Overrode contexts on behalf of gamli75: ci/prow/e2e-ai-operator-ztp-3masters DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/test verify-generated-code |
openshift-ci
Bot
added
the
needs-rebase
This branch moves assisted-service from jackc/pgx/v4 (via older GORM
postgres driver and transitive pgtype/pgconn) to the stack required by
newer openshift-online/ocm-sdk-go, and aligns GORM, DSN construction,
custom DB types, OCM error handling, and subsystem WireMock with that
reality.
Dependency upgrades (go.mod / go.sum + vendor)
-----------------------------------------------
- github.com/openshift-online/ocm-sdk-go: v0.1.205 -> v0.1.499
Brings in github.com/openshift-online/ocm-api-model/{clientapi,model}
v0.0.453 and other transitive updates (e.g. skratchdot/open-golang).
v0.1.499 is built for pgx v5; keeping ocm-sdk-go on v0.1.205 while
moving the rest of the tree to pgx v5 is not viable.
- PostgreSQL driver stack:
- gorm.io/driver/postgres: v1.3.5 -> v1.6.0 (uses pgx v5 under the hood)
- gorm.io/gorm: v1.25.8 -> v1.25.10
- Remove jackc/pgx/v4, pgconn, pgtype, pgio, chunkreader, pgproto3.
- Add jackc/pgx/v5 v5.6.0 and jackc/puddle/v2 (pool support).
- Bump jackc/pgservicefile to a release compatible with pgx v5.
- Drop replace github.com/jackc/pgx/v4 => v4.18.3 (no longer used).
- golang.org/x/sys minor bump on the branch (toolchain alignment).
Submodule go.mod hygiene (api/, client/, models/)
------------------------------------------------
- Remove unused indirect jackc/pgio and jackc/pgtype from api/go.mod and
client/go.mod.
- Remove github.com/jackc/pgtype and pgio from models/go.mod now that
models/custom.go no longer references pgtype.
Why ocm-sdk-go v0.1.499 matters for assisted-service
----------------------------------------------------
assisted-service uses pkg/ocm against accountsmgmt/v1 for:
- ClusterAuthorizations().Post() — create AMS subscription at register.
- Subscriptions().Subscription(id).Get() — read subscription.
- Subscriptions().Subscription(id).Update().Body(sub).SendContext() —
PATCH display name, console URL, external_cluster_id (OpenShift
cluster ID), and status Active.
- Subscriptions().Subscription(id).Delete().SendContext() — delete
subscription on cluster deregister.
Compared to v0.1.205, the newer SDK + ocm-api-model clientapi layer:
1) JSON encoding of API types (e.g. Subscription) is generated in
ocm-api-model/clientapi (jsoniter, explicit field-set bitmaps).
PATCH bodies always include a leading "kind" field and only the
fields the builder set. That affects HTTP fixtures (subsystem
WireMock) that matched only minimal JSON.
2) Subscription PATCH response handling: SendContext wraps the body in
a bufio.Reader and uses Peek(1). If the server returns an HTTP error
with an empty body, Peek hits io.EOF; the client returns with err == nil
while result.status is still 4xx/5xx, and never unmarshals an
errors.Error. assisted-service previously assumed "err != nil" for
failures. pkg/ocm.HandleOCMResponse now treats response.Status() >= 400
as failure even when err is nil (mirrors the intent of the generated
error path when a body exists).
3) Error responses are unmarshalled into github.com/openshift-online/ocm-sdk-go/errors
when the body is valid OCM "Error" JSON. Subsystem stubs that returned
a subscription-shaped JSON body with HTTP 401 caused unmarshalling /
downstream UTF-8 issues; stubs now return proper Error JSON for PATCH
failures (see wiremock_stubs.go).
Per-file / functional changes
-------------------------------
pkg/db/db.go
- Add LibpqDSN(host, port, user, password, database) and Config.LibpqDSN().
- Build a libpq keyword connection string with escaped user/password for
single quotes and backslashes.
- Append client_encoding=UTF8 so pgx v5 / GORM simple-query paths behave
predictably regardless of server client_encoding defaults.
cmd/main.go
- setupDB: use Options.DBConfig.LibpqDSN() instead of hand-rolled
host=... DSN (same semantics, safer quoting, UTF8).
internal/common/common_unitest_db.go
- getDBDSN: delegate to pkg/db.LibpqDSN for unit-test PostgreSQL so tests
use the same DSN rules as production.
models/custom.go
- Remove dependency on github.com/jackc/pgtype (pgx v4 era).
- IP/Subnet driver.Valuer: encode inet/cidr using netip and return textual
prefix strings PostgreSQL accepts.
- IP/Subnet sql.Scanner: accept netip.Prefix / *netip.Prefix as returned
by pgx v5 for inet/cidr, in addition to legacy []byte, string, net.IP,
*net.IPNet.
internal/bminventory/inventory.go
- InstallClusterInternal async goroutine: call storeOpenshiftClusterID
with asyncCtx instead of the outer request ctx so S3/object-store work
is not tied to an HTTP request deadline that can fire before AMS
integration completes.
internal/cluster/cluster.go
- HandlePreInstallError: sanitize installErr.Error() with
strings.ToValidUTF8 before persisting LastInstallationPreparation.Reason
and emitting events. OCM error bodies / parse paths can produce strings
that are not valid UTF-8; PostgreSQL text columns reject those writes.
pkg/ocm/utils.go
- HandleOCMResponse: after the existing err != nil handling, if response is
non-nil and Status() >= 400, return InfraError (401 mapping) for 4xx
and ApiError (503) for 5xx. Covers empty-body HTTP errors from newer
SendContext implementations.
subsystem/utils_test/wiremock_stubs.go
- subscriptionPatchWiremockResponse: for resStatus >= 400, return OCM
Error JSON so the SDK can UnmarshalErrorStatus; avoids subscription-
shaped 401 bodies and invalid UTF-8 in DB reasons.
- Subscription PATCH external_cluster_id: use matchesJsonPath on
$.external_cluster_id instead of equalToJson on a minimal template, so
stubs stay stable across SDK JSON field order/extra fields and reduce
ambiguous matching when many mappings exist.
- Add WireMock stubs for soft-timeouts org capability review and an
accounts_mgmt stub for the cluster-editor test user so authorization
flows match current API expectations.
shay23bra
force-pushed
the
pgx-v5-migration-release-ocm-2.15
branch
from
dfabc69 to
419ba78
Compare
openshift-ci
Bot
removed
lgtm
|
@shay23bra: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/lgtm |
4 participants
Backport of PR #10230 — upgrade PostgreSQL stack from pgx v4 to pgx v5.
Removes the deprecated
github.com/jackc/pgproto3/v2module which has unpatched CVEs.CVEs resolved
Strategy Selection
✓ Successful Strategy: Cherry-pick from master
Cherry-picked commit 420ef6b (MGMT-19930: upgrade PostgreSQL stack to pgx v5 and ocm-sdk-go v0.1.499) from master.
https://redhat.atlassian.net/browse/ACM-31978