[release/1.6] Bump google.golang.org/grpc to v1.58.3#9408
[release/1.6] Bump google.golang.org/grpc to v1.58.3#9408estesp merged 2 commits intocontainerd:release/1.6from
Conversation
The package has multiple improvements and bug fixes. Signed-off-by: Kazuyoshi Kato <katokazu@amazon.com> (cherry picked from commit d063597) Signed-off-by: Austin Vazquez <macedonv@amazon.com>
Upgrade google.golang.org/grpc to v1.58.3 in preparation for upgrading OTel, which has a dependency on the latest version. See also: containerd#9281. Signed-off-by: Milas Bowman <milas.bowman@docker.com> (cherry picked from commit 856d105) Signed-off-by: Austin Vazquez <macedonv@amazon.com>
|
Hi @austinvazquez. Thanks for your PR. I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@thaJeztah, I wanted to get your thoughts on this. Should the change also include intermediate updates as well? e.g. should I backport the update of google.golang.org/grpc to v1.56.3? |
|
curious why @thaJeztah hit some issue or needed to change the replace rules, but this set of commits seems to be passing CI without those changes? Other than that this seems like the right set of updates to get to latest gRPC with the CVE fixes |
|
Good question; I just tried on my branch if I put back the replace rules that I removed, and that resulted in; go mod tidy
github.com/containerd/containerd/services/server imports
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc tested by
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc.test imports
google.golang.org/grpc/interop imports
golang.org/x/oauth2/google imports
cloud.google.com/go/compute/metadata: ambiguous import: found package cloud.google.com/go/compute/metadata in multiple modules:
cloud.google.com/go v0.81.0 (/go/pkg/mod/cloud.google.com/go@v0.81.0/compute/metadata)
cloud.google.com/go/compute/metadata v0.2.3 (/go/pkg/mod/cloud.google.com/go/compute/metadata@v0.2.3)Full log; DetailsThe starting point of my PR had some differences though, and some dependencies were updated since, so I wonder if any of those changes (or perhaps changes elsewhere) fixed that issue, or perhaps the newer grpc version made that problem go away? diff --git a/old-go.mod b/go.mod
index ac7e55731..b764f7e07 100644
--- a/old-go.mod
+++ b/go.mod
@@ -16,7 +16,7 @@ require (
github.com/containerd/go-runc v1.0.0
github.com/containerd/imgcrypt v1.1.4
github.com/containerd/log v0.1.0
- github.com/containerd/nri v0.1.0
+ github.com/containerd/nri v0.1.1
github.com/containerd/ttrpc v1.1.2
github.com/containerd/typeurl v1.0.2
github.com/containerd/zfs v1.1.0
@@ -63,9 +63,9 @@ require (
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.3.0
go.opentelemetry.io/otel/sdk v1.3.0
go.opentelemetry.io/otel/trace v1.3.0
- golang.org/x/net v0.13.0
+ golang.org/x/net v0.17.0
golang.org/x/sync v0.1.0
- golang.org/x/sys v0.10.0
+ golang.org/x/sys v0.13.0
google.golang.org/grpc v1.50.1
google.golang.org/protobuf v1.28.1
gotest.tools/v3 v3.5.0
@@ -87,7 +87,7 @@ require (
github.com/cilium/ebpf v0.7.0 // indirect
github.com/containers/ocicrypt v1.1.3 // indirect
github.com/cpuguy83/go-md2man/v2 v2.0.0 // indirect
- github.com/emicklei/go-restful v2.9.5+incompatible // indirect
+ github.com/emicklei/go-restful v2.16.0+incompatible // indirect
github.com/go-logr/logr v1.2.2 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/godbus/dbus/v5 v5.0.6 // indirect
@@ -117,10 +117,10 @@ require (
go.opencensus.io v0.23.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.3.0 // indirect
go.opentelemetry.io/proto/otlp v0.11.0 // indirect
- golang.org/x/crypto v0.11.0 // indirect
+ golang.org/x/crypto v0.14.0 // indirect
golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f // indirect
- golang.org/x/term v0.10.0 // indirect
- golang.org/x/text v0.11.0 // indirect
+ golang.org/x/term v0.13.0 // indirect
+ golang.org/x/text v0.13.0 // indirect
golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21 // indirect |
It's not strictly needed; the reason I usually prefer (where possible) to backport changes from master;
Especially 3. can be quite important; missing the related changes may not always result in a compilation failure, or even a failure in CI (perhaps tests are not yet in the release branch). Having to look at the original PR reduces the risk that such changes are overlooked. 4. can be relevant as well (although it becomes more complicated the more an (LTS) branch diverges from main); I've have multiple cases where a fix went into a release branch, but was forgotten in the main branch. As a result the "next release" effectively had a regression ("Oh! This fix never went into main"). |
I hit this as well and needed to follow https://stackoverflow.com/a/74689094/633961 to resolve the ambiguous import error.
Thanks that makes sense. I think this would check those boxes, but let me know if you would like more paper trail here. Happy to help run it down more.
+1, definitely felt that here with the dependencies. It eventually shook out but was not a simple apply diff in the beginning. 😅 |
Oh! That's a good one, yes, I recall now that I had other repositories where I ran into something like this. The TL;DR is that Sometimes the trick is to remove all |
|
/ok-to-test |
|
Opened #9438 which forced gRPC update to 1.58.x; leaving in draft as I think we should merge this and then I can rebase as I was trying to isolate the OTel backport from |
Issue: N/A
Description:
Trying my hand to see if I can make some progress on updating gRPC in release/1.6.
Backports #7325
Backports #9281
Related to #9285
Testing:
Fork CI run: https://github.com/austinvazquez/containerd/actions/runs/6946804473