Skip to content

Replace kube-rbac-proxy sidecar with controller-runtime FilterProvider #502

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alebedev87 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Replace kube-rbac-proxy sidecar with controller-runtime FilterProvider #502

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
56 changes: 16 additions & 40 deletions bundle/manifests/external-dns-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -379,6 +379,18 @@ spec:
spec:
clusterPermissions:
- rules:
- apiGroups:
- authentication.k8s.io
resources:
- tokenreviews
verbs:
- create
- apiGroups:
- authorization.k8s.io
resources:
- subjectaccessreviews
verbs:
- create
- apiGroups:
- cloudcredential.openshift.io
resources:
Expand Down Expand Up @@ -435,18 +447,6 @@ spec:
- get
- list
- watch
- apiGroups:
- authentication.k8s.io
resources:
- tokenreviews
verbs:
- create
- apiGroups:
- authorization.k8s.io
resources:
- subjectaccessreviews
verbs:
- create
serviceAccountName: external-dns-operator
deployments:
- name: external-dns-operator
Expand All @@ -466,7 +466,8 @@ spec:
spec:
containers:
- args:
- --metrics-bind-address=127.0.0.1:8080
- --metrics-bind-address=:8443
- --metrics-tls-cert-dir=/var/run/secrets/serving-cert
- --operator-namespace=$(OPERATOR_NAMESPACE)
- --operand-namespace=$(OPERATOR_NAMESPACE)
- --externaldns-image=$(RELATED_IMAGE_EXTERNAL_DNS)
Expand All @@ -490,6 +491,8 @@ spec:
- containerPort: 9440
name: health-check
protocol: TCP
- containerPort: 8443
name: https
readinessProbe:
httpGet:
path: /readyz
Expand All @@ -510,33 +513,6 @@ spec:
seccompProfile:
type: RuntimeDefault
terminationMessagePolicy: FallbackToLogsOnError
- args:
- --secure-listen-address=0.0.0.0:8443
- --upstream=http://127.0.0.1:8080/
- --logtostderr=true
- --v=10
- --tls-cert-file=/var/run/secrets/serving-cert/tls.crt
- --tls-private-key-file=/var/run/secrets/serving-cert/tls.key
- --http2-disable
image: quay.io/openshift/origin-kube-rbac-proxy:latest
name: kube-rbac-proxy
ports:
- containerPort: 8443
name: https
resources:
requests:
cpu: 100m
memory: 20Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
terminationMessagePolicy: FallbackToLogsOnError
volumeMounts:
- mountPath: /var/run/secrets/serving-cert
name: metrics-cert
Expand Down
4 changes: 0 additions & 4 deletions config/default/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,7 @@ resources:
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
#- ../certmanager

# Protect the /metrics endpoint by putting it behind auth.
# If you want your controller-manager to expose the /metrics
# endpoint w/o any authn/z, please comment the following line.
patchesStrategicMerge:
- manager_auth_proxy_patch.yaml
- manager_webhook_patch.yaml
# Mount the controller config file for loading manager configurations
# through a ComponentConfig type
Expand Down
45 changes: 0 additions & 45 deletions config/default/manager_auth_proxy_patch.yaml
View file
Open in desktop

This file was deleted.

25 changes: 0 additions & 25 deletions config/default/manager_insecure_tls_auth_proxy_patch.yaml
View file
Open in desktop

This file was deleted.

15 changes: 14 additions & 1 deletion config/manager/manager.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,13 +32,17 @@ spec:
- name: external-dns-operator
image: quay.io/openshift/origin-external-dns-operator:latest
args:
- --metrics-bind-address=127.0.0.1:8080
- --metrics-bind-address=:8443
- --metrics-tls-cert-dir=/var/run/secrets/serving-cert
- --operator-namespace=$(OPERATOR_NAMESPACE)
- --operand-namespace=$(OPERATOR_NAMESPACE)
- --externaldns-image=$(RELATED_IMAGE_EXTERNAL_DNS)
- --trusted-ca-configmap=$(TRUSTED_CA_CONFIGMAP_NAME)
- --leader-elect
- --webhook-disable-http2
ports:
- containerPort: 8443
name: https
Comment thread
alebedev87 marked this conversation as resolved.
Comment on lines +43 to +45

@coderabbitai coderabbitai Bot Aug 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n -C 4 \
  'livenessProbe|readinessProbe|health-check|/healthz|/readyz' \
  --glob '*.yaml' --glob '*.yml' .

Repository: openshift/external-dns-operator

Length of output: 2763

🏁 Script executed:

cat -n config/manager/manager.yaml | head -60

Repository: openshift/external-dns-operator

Length of output: 2351

🏁 Script executed:

cat -n config/default/manager_webhook_patch.yaml

Repository: openshift/external-dns-operator

Length of output: 867

Add a liveness probe to the rendered Deployment.

The base manifest and webhook overlay define a readinessProbe but not a livenessProbe. Add livenessProbe to the same health-check port and endpoint as readinessProbe. Without it, the container cannot restart on hang or deadlock.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@config/manager/manager.yaml` around lines 44 - 46, Add a livenessProbe to the
rendered Deployment alongside the existing readinessProbe, reusing the same
health-check port and endpoint configuration. Keep the probe settings consistent
with the readiness check so hung or deadlocked containers can be restarted.

Source: Path instructions

terminationMessagePolicy: FallbackToLogsOnError
env:
- name: OPERATOR_NAMESPACE
Expand All @@ -63,4 +67,13 @@ spec:
requests:
cpu: 100m
memory: 30Mi
volumeMounts:
- mountPath: /var/run/secrets/serving-cert
name: metrics-cert
readOnly: true
volumes:
- name: metrics-cert
secret:
defaultMode: 420
secretName: external-dns-operator-metrics
Comment thread
coderabbitai[bot] marked this conversation as resolved.
serviceAccountName: external-dns-operator
17 changes: 0 additions & 17 deletions config/rbac/auth_proxy_role.yaml
View file
Open in desktop

This file was deleted.

12 changes: 0 additions & 12 deletions config/rbac/auth_proxy_role_binding.yaml
View file
Open in desktop

This file was deleted.

5 changes: 0 additions & 5 deletions config/rbac/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,7 @@ resources:
- role_binding.yaml
- leader_election_role.yaml
- leader_election_role_binding.yaml
# Comment the following 4 lines if you want to disable
# the auth proxy (https://github.com/brancz/kube-rbac-proxy)
# which protects your /metrics endpoint.
- auth_proxy_service.yaml
- auth_proxy_role.yaml
- auth_proxy_role_binding.yaml
- auth_proxy_client_clusterrole.yaml
- operand_role.yaml
- operand_rolebinding.yaml
Expand Down
12 changes: 12 additions & 0 deletions config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,18 @@ kind: ClusterRole
metadata:
name: external-dns-operator
rules:
- apiGroups:
- authentication.k8s.io
resources:
- tokenreviews
verbs:
- create
- apiGroups:
- authorization.k8s.io
resources:
- subjectaccessreviews
verbs:
- create
- apiGroups:
- cloudcredential.openshift.io
resources:
Expand Down
13 changes: 13 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ require (
)

require (
cel.dev/expr v0.19.1 // indirect

@coderabbitai coderabbitai Bot Aug 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

go mod verify
osv-scanner scan source -r .
go-licenses check ./...

awk '$0 ~ /\/\/ indirect$/ {print $1}' go.mod |
  while read -r module; do
    go mod why -m "$module"
  done

rg -n -i 'sbom|provenance|attest|sigstore|cosign|sign' \
  .github Makefile* Dockerfile* 2>/dev/null || true

Repository: openshift/external-dns-operator

Length of output: 3776

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- go.mod ---'
cat -n go.mod

printf '%s\n' '--- matching go.sum entries ---'
python3 - <<'PY'
from pathlib import Path
mods = []
for line in Path("go.mod").read_text().splitlines():
    parts = line.split()
    if len(parts) >= 2 and not line.lstrip().startswith(("module ", "go ", "toolchain ")):
        mods.append((parts[0], parts[1]))
sum_text = Path("go.sum").read_text() if Path("go.sum").exists() else ""
for mod, ver in mods:
    matches = [line for line in sum_text.splitlines()
               if line.startswith(f"{mod} {ver} ")]
    print(f"{mod} {ver}: {'; '.join(matches) if matches else 'MISSING'}")
PY

printf '%s\n' '--- release and dependency controls ---'
find .github -maxdepth 3 -type f -print 2>/dev/null | sort
rg -n -i 'sbom|provenance|attest|sigstore|cosign|sign|osv|license|go mod verify|vendor' \
  .github Makefile* Dockerfile* go.mod go.sum 2>/dev/null || true

Repository: openshift/external-dns-operator

Length of output: 28542

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- dependency provenance ---'
for module in \
  cel.dev/expr \
  github.com/google/cel-go \
  go.opentelemetry.io/otel/sdk \
  google.golang.org/grpc
do
  printf '\n[%s]\n' "$module"
  go mod why -m "$module" 2>&1 || true
done

printf '%s\n' '--- tracked release and dependency-control files ---'
git ls-files | rg '(^|/)(go\.mod|go\.sum|vendor/|\.github/|Makefile|Dockerfile|.*(sbom|provenance|attest|cosign|sigstore|sign).*)$' || true

printf '%s\n' '--- relevant vendored license files ---'
find vendor -type f \( -iname 'LICENSE*' -o -iname 'COPYING*' -o -iname 'NOTICE*' \) \
  2>/dev/null | rg 'cel|otel|grpc|google' || true

printf '%s\n' '--- exact checksum coverage for go.mod modules ---'
python3 - <<'PY'
from pathlib import Path
import re

text = Path("go.mod").read_text()
mods = []
in_require = False
for raw in text.splitlines():
    line = raw.strip()
    if line.startswith("require ("):
        in_require = True
        continue
    if in_require and line == ")":
        in_require = False
        continue
    if in_require:
        m = re.match(r"(\S+)\s+(\S+)", line)
        if m:
            mods.append(m.groups())

sums = Path("go.sum").read_text().splitlines()
missing = []
for mod, ver in mods:
    if not any(line.startswith(f"{mod} {ver} ") for line in sums):
        missing.append(f"{mod} {ver}")
print(f"module_entries={len(mods)} missing_checksums={len(missing)}")
for item in missing:
    print(item)
PY

Repository: openshift/external-dns-operator

Length of output: 13594

Vulnerable Dependency (CWE-1104)

Upgrade the production-reachable vulnerable dependencies.

github.com/google/cel-go v0.23.2 and go.opentelemetry.io/otel/sdk v1.33.0 are reachable from production packages and have OSV fixes at v0.29.0 and v1.40.0. Upgrade them before merge. google.golang.org/grpc v1.68.1 is reachable only through test/e2e in this graph.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 36, Update the production dependency versions for
github.com/google/cel-go to v0.29.0 and go.opentelemetry.io/otel/sdk to v1.40.0,
including any corresponding go.mod/go.sum entries required by the module graph.
Do not upgrade google.golang.org/grpc solely for the test/e2e-only reachability
noted in the review.

Source: Path instructions

@alebedev87 alebedev87 Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same reasoning as for otel/sdk. It's an indirect dependency which we will handle as part of the regular k8s/controller-runtime bump.

cloud.google.com/go/auth v0.13.0 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.6 // indirect
cloud.google.com/go/compute/metadata v0.6.0 // indirect
Expand All @@ -41,6 +42,7 @@ require (
github.com/Azure/go-autorest/autorest/to v0.3.0 // indirect
github.com/Azure/go-autorest/logger v0.2.1 // indirect
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 // indirect
Expand All @@ -53,6 +55,7 @@ require (
github.com/aws/smithy-go v1.25.1 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/blang/semver/v4 v4.0.0 // indirect
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
Expand All @@ -71,12 +74,14 @@ require (
github.com/gobuffalo/flect v1.0.3 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
github.com/google/cel-go v0.23.2 // indirect
github.com/google/gnostic-models v0.6.9 // indirect
github.com/google/s2a-go v0.1.8 // indirect
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
github.com/googleapis/gax-go/v2 v2.14.1 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
Expand All @@ -98,13 +103,18 @@ require (
github.com/spf13/afero v1.12.0 // indirect
github.com/spf13/cobra v1.9.1 // indirect
github.com/spf13/pflag v1.0.6 // indirect
github.com/stoewer/go-strcase v1.3.0 // indirect
github.com/x448/float16 v0.8.4 // indirect
github.com/xlab/treeprint v1.2.0 // indirect
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
go.opentelemetry.io/otel v1.33.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 // indirect
go.opentelemetry.io/otel/metric v1.33.0 // indirect
go.opentelemetry.io/otel/sdk v1.33.0 // indirect

@coderabbitai coderabbitai Bot Jun 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

curl -sS https://api.osv.dev/v1/query \
  -H 'Content-Type: application/json' \
  -d '{
    "package": {"ecosystem":"Go","name":"go.opentelemetry.io/otel/sdk"},
    "version":"1.33.0"
  }' | jq '{id: .id, aliases: .aliases, summary: .summary, affected: .affected}'

Repository: openshift/external-dns-operator

Length of output: 150

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Query OSV for ALL vulnerabilities in this package (not pinned to version)
curl -sS https://api.osv.dev/v1/query \
  -H 'Content-Type: application/json' \
  -d '{
    "package": {"ecosystem":"Go","name":"go.opentelemetry.io/otel/sdk"}
  }' | jq '.vulns[] | {id, aliases, summary, affected: (.affected[0] | {versions, ranges})}'

Repository: openshift/external-dns-operator

Length of output: 1413

🌐 Web query:

GO-2026-4394 vulnerability go.opentelemetry.io/otel/sdk

💡 Result:

GO-2026-4394 is a security vulnerability in the go.opentelemetry.io/otel/sdk package, identified by CVE-2026-24051 and GHSA-9h8m-3fm2-qjrq [1][2]. Vulnerability Details: The vulnerability is an Untrusted Search Path issue (CWE-426) affecting the resource detection code within the SDK [3][4]. Specifically, the SDK would execute system commands using a bare name, which allowed the PATH environment variable to be manipulated to point to a malicious binary [3][4]. By placing a malicious executable earlier in the search path, an attacker with local access could achieve arbitrary code execution in the context of the application [3][4]. Affected Versions and Fixes: The vulnerability was introduced in version 1.21.0 and addressed in version 1.40.0, which updated the SDK to use absolute paths for the affected commands [1][5][4]. Note on Related Vulnerabilities: A follow-up vulnerability, CVE-2026-39883 (GHSA-hfvc-g4fc-pqhx), was identified because the fix for GO-2026-4394 only addressed the issue for macOS/Darwin systems while leaving other BSD and Solaris platforms vulnerable [6][7]. That subsequent issue was fixed in version 1.43.0 [6]. Users are advised to upgrade to the latest available version of the SDK to ensure both issues are mitigated [6][8].

Citations:

Upgrade go.opentelemetry.io/otel/sdk to v1.43.0 or later before merge.

Line 115 pins go.opentelemetry.io/otel/sdk v1.33.0, which is vulnerable to GO-2026-4394 (CVE-2026-24051 / GHSA-9h8m-3fm2-qjrq). This PATH hijacking vulnerability enables arbitrary code execution in versions 1.21.0 through 1.39.0. While v1.40.0 fixes this issue, a follow-up vulnerability (CVE-2026-39883) was discovered in the same code path, fixed only in v1.43.0. Upgrade to v1.43.0 and refresh dependent OTLP modules to keep versions coherent.

🧰 Tools
🪛 OSV Scanner (2.3.8)

[HIGH] 115-115: go.opentelemetry.io/otel/sdk 1.33.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk

(GO-2026-4394)

[HIGH] 115-115: go.opentelemetry.io/otel/sdk 1.33.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

(GHSA-9h8m-3fm2-qjrq)

[HIGH] 115-115: go.opentelemetry.io/otel/sdk 1.33.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

(GHSA-hfvc-g4fc-pqhx)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 115, The go.opentelemetry.io/otel/sdk dependency is pinned to
v1.33.0 which contains security vulnerabilities that are only fixed in v1.43.0
or later. Update the go.opentelemetry.io/otel/sdk version from v1.33.0 to
v1.43.0 in the go.mod file. After updating, also refresh any dependent OTLP
modules that reference go.opentelemetry.io/otel/sdk to maintain version
coherence across all module dependencies.

Sources: Coding guidelines, Linters/SAST tools

@alebedev87 alebedev87 Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

otel/sdk is an indirect dependency needed by controller-runtime. Updating it alone is not the way we approach this normally. I will have to postpone this change to the next k8s/controller-runtime bump.

@coderabbitai coderabbitai Bot Aug 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@alebedev87, acknowledged. The vulnerability remains in the current dependency graph, but this update is out of scope for this pull request.

Please address it with the next Kubernetes/controller-runtime bump. Would you like me to create a follow-up GitHub issue?

✏️ Learnings added 
Learnt from: alebedev87
Repo: openshift/external-dns-operator PR: 502
File: go.mod:115-115
Timestamp: 2026-08-04T09:59:43.835Z
Learning: In the openshift/external-dns-operator repository, `go.opentelemetry.io/otel/sdk` is an indirect dependency required by `sigs.k8s.io/controller-runtime`. Maintain dependency version alignment by updating it with the next Kubernetes/controller-runtime bump instead of updating `otel/sdk` alone.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

You are interacting with an AI system.

@alebedev87 alebedev87 Aug 5, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would you like me to create a follow-up GitHub issue?

No, we'll do it later.

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@alebedev87, acknowledged. I will not create a follow-up issue.

You are interacting with an AI system.

go.opentelemetry.io/otel/trace v1.33.0 // indirect
go.opentelemetry.io/proto/otlp v1.4.0 // indirect
go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
Expand All @@ -121,6 +131,7 @@ require (
golang.org/x/tools v0.47.0 // indirect
golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8 // indirect
google.golang.org/grpc v1.68.1 // indirect
google.golang.org/protobuf v1.36.5 // indirect
Expand All @@ -131,9 +142,11 @@ require (
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/apiextensions-apiserver v0.33.0 // indirect
k8s.io/code-generator v0.33.0 // indirect
k8s.io/component-base v0.33.4 // indirect
k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7 // indirect
k8s.io/klog/v2 v2.130.1 // indirect
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
sigs.k8s.io/kustomize/api v0.17.3 // indirect
sigs.k8s.io/kustomize/cmd/config v0.14.2 // indirect
Expand Down
Loading