ci: replace unverified test binary downloads with setup-envtest - #488
ci: replace unverified test binary downloads with setup-envtest#488sozercan wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Pull request overview
Updates CI to avoid directly downloading and installing Kubernetes-related test binaries via curl by switching the test workflow to provision envtest assets using setup-envtest, reducing supply-chain risk from unverified artifacts.
Changes:
- Replaced manual
curl/tarinstallation ofkubebuilder/kube-apiserver/kubectl/etcdwithsetup-envtest use. - Provisioned envtest binaries into
${HOME}/kubebuilder/binand exportedKUBEBUILDER_ASSETSfor tests to consume.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/workflow.yaml | Reworks the test workflow’s envtest binary setup to use setup-envtest and sets KUBEBUILDER_ASSETS. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 1/1 changed files
- Comments generated: 2
| sudo mv kubernetes/server/bin/kube-apiserver /usr/local/kubebuilder/bin/kube-apiserver && \ | ||
| sudo mv kubernetes/server/bin/kubectl /usr/local/kubebuilder/bin/kubectl && \ | ||
| sudo mv etcd-v${ETCD_VERSION}-$(go env GOOS)-$(go env GOARCH)/etcd /usr/local/kubebuilder/bin/etcd | ||
| go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest |
There was a problem hiding this comment.
go install ...@latest makes the workflow non-reproducible and can unexpectedly change behavior (or break) when a new setup-envtest release is published. Pin setup-envtest to a specific version (or commit) so CI runs are deterministic and easier to audit.
| go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest | |
| go install sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.20.2 |
There was a problem hiding this comment.
I agree here - it should not be latest.
| sudo mv etcd-v${ETCD_VERSION}-$(go env GOOS)-$(go env GOARCH)/etcd /usr/local/kubebuilder/bin/etcd | ||
| go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest | ||
| mkdir -p "${HOME}/kubebuilder/bin" | ||
| "$HOME/go/bin/setup-envtest" use "${KUBERNETES_VERSION}" --bin-dir "${HOME}/kubebuilder/bin" -p path |
There was a problem hiding this comment.
The step assumes the installed binary is at $HOME/go/bin/setup-envtest, but go install can write to a different location when GOPATH/GOBIN are configured differently. Consider invoking setup-envtest via $(go env GOPATH)/bin/setup-envtest or just setup-envtest from PATH to make the workflow more robust across runners.
| "$HOME/go/bin/setup-envtest" use "${KUBERNETES_VERSION}" --bin-dir "${HOME}/kubebuilder/bin" -p path | |
| "$(go env GOPATH)/bin/setup-envtest" use "${KUBERNETES_VERSION}" --bin-dir "${HOME}/kubebuilder/bin" -p path |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c669ceb26e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "$HOME/go/bin/setup-envtest" use "${KUBERNETES_VERSION}" --bin-dir "${HOME}/kubebuilder/bin" -p path | ||
| echo "KUBEBUILDER_ASSETS=${HOME}/kubebuilder/bin" >> "$GITHUB_ENV" |
There was a problem hiding this comment.
setup-envtest use ... -p path prints the version-specific directory that actually contains kube-apiserver, etcd, and kubectl (the tool’s README explicitly says to use -p path to get the directory). This step discards that output and sets KUBEBUILDER_ASSETS to ${HOME}/kubebuilder/bin, which is only the store root; envtest then resolves binaries as ${KUBEBUILDER_ASSETS}/<name> and will not search nested k8s/<version-platform>/ folders, so the make test job will fail when starting envtest.
Useful? React with 👍 / 👎.
JaydipGabani
left a comment
JaydipGabani
left a comment
There was a problem hiding this comment.
ci is failing because of fetching latest envtest -
go: sigs.k8s.io/controller-runtime/tools/setup-envtest@latest: sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.0.0-20260405152528-6210f847b2c1 requires go >= 1.26.0 (running go 1.25.8; GOTOOLCHAIN=local)
| sudo mv kubernetes/server/bin/kube-apiserver /usr/local/kubebuilder/bin/kube-apiserver && \ | ||
| sudo mv kubernetes/server/bin/kubectl /usr/local/kubebuilder/bin/kubectl && \ | ||
| sudo mv etcd-v${ETCD_VERSION}-$(go env GOOS)-$(go env GOARCH)/etcd /usr/local/kubebuilder/bin/etcd | ||
| go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest |
There was a problem hiding this comment.
I agree here - it should not be latest.
| sudo mv etcd-v${ETCD_VERSION}-$(go env GOOS)-$(go env GOARCH)/etcd /usr/local/kubebuilder/bin/etcd | ||
| go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest | ||
| mkdir -p "${HOME}/kubebuilder/bin" | ||
| "$HOME/go/bin/setup-envtest" use "${KUBERNETES_VERSION}" --bin-dir "${HOME}/kubebuilder/bin" -p path |
Signed-off-by: Sertac Ozercan <sozercan@gmail.com>
c669ceb to
3de6044
Compare
Motivation
testworkflow downloaded multiple executables (kubebuilder,kube-apiserver,kubectl,etcd) withcurland installed them without checksum or signature verification, creating a supply-chain risk if upstream artifacts or transport are compromised.Description
curl/tar/chmod/mvinstallation sequence from.github/workflows/workflow.yamland replaced it withsetup-envtestprovisioning.go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latestand invokedsetup-envtest useto fetch envtest binaries into a local directory.${HOME}/kubebuilder/binand exportedKUBEBUILDER_ASSETSintoGITHUB_ENVso the existing test step continues to find envtest binaries.Testing
go test ./...in this environment which timed out (EXIT:124), and the workflow file change was validated by inspecting the modifiedworkflow.yamllines to ensure the unverified downloads were removed andsetup-envtestis used instead.Codex Task