Security fixes, Azure annotation guard, and version command

.github/linters/.golangci.yml

@@ -1,52 +1,76 @@
 ---
-#########################
-#########################
-## Golang Linter rules ##
-#########################
-#########################
+version: "2"
 
-# configure golangci-lint
-# see https://github.com/golangci/golangci-lint/blob/master/.golangci.example.yml
 run:
   timeout: 10m
-issues:
-  exclude-rules:
-    - path: _test\.go
-      linters:
-        - dupl
-        - gosec
-        - goconst
-    - linters:
-      - revive
-      text: "var-naming: don't use leading k"
-    - linters:
-      - staticcheck
-      text: "SA1019:"
+
 linters:
-  disable-all: true
+  default: none
   enable:
     - gosec
     - unconvert
-    - goimports
-    - gofmt
     - gocritic
     - govet
     - revive
     - staticcheck
-    - unconvert
     - unparam
     - unused
     - wastedassign
     - whitespace
-linters-settings:
-  errcheck:
-    # report about assignment of errors to blank identifier: `num, _ := strconv.Atoi(numStr)`;
-    # default is false: such cases aren't reported by default.
-    check-blank: true
-  gocritic:
-    disabled-checks:
-      - singleCaseSwitch
-      - appendAssign
-  revive:
-    ignore-generated-header: true
-    severity: warning
+  settings:
+    errcheck:
+      check-blank: true
+    gocritic:
+      disabled-checks:
+        - singleCaseSwitch
+        - appendAssign
+    revive:
+      rules:
+        - name: blank-imports
+          disabled: true
+        - name: context-as-argument
+          disabled: true
+        - name: error-strings
+          disabled: true
+        - name: exported
+          disabled: true
+        - name: package-comments
+          disabled: true
+        - name: redefines-builtin-id
+          disabled: true
+        - name: unexported-return
+          disabled: true
+        - name: unused-parameter
+          disabled: true
+        - name: var-declaration
+          disabled: true
+    staticcheck:
+      checks:
+        - "all"
+        - "-QF*"
+        - "-ST1005"
+        - "-ST1003"
+        - "-S1030"
+  exclusions:
+    rules:
+      - path: _test\.go
+        linters:
+          - dupl
+          - gosec
+          - goconst
+      - linters:
+          - revive
+        text: "var-naming: don't use leading k"
+      - linters:
+          - staticcheck
+        text: "SA1019:"
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+
+formatters:
+  enable:
+    - goimports
+    - gofmt

.github/linters/.hadolint.yaml

@@ -0,0 +1,2 @@
+ignored:
+  - DL3008

.github/workflows/go.yml

@@ -8,14 +8,55 @@ on:
     branches: [main]
 
 jobs:
-  go:
-    uses: openconfig/common-ci/.github/workflows/go.yml@v0.2.0
-    with:
-      coverage-excludes-regex: /cloudbuild
-      tests-excludes-regex: /cloudbuild
-      race-tests-excludes-regex: /cloudbuild
-      skip-race-tests: true
-      go-versions: "['1.21']"
+  build_and_test:
+    name: Build and Test
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        go: ['1.25']
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ matrix.go }}
+
+      - name: Get dependencies
+        run: go mod download
+
+      - name: Go Mod should be tidy
+        run: |
+          go mod tidy
+          diff -u <(echo -n) <(git diff)
+
+      - name: Build packages
+        run: go build -v ./...
+
+      - name: Run Tests
+        run: go test -v $(go list ./... | grep -E -v /cloudbuild)
+
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: '0'
+
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          args: --config=.github/linters/.golangci.yml
 
   linter:
     uses: openconfig/common-ci/.github/workflows/linter.yml@v0.2.0

Makefile

@@ -29,10 +29,14 @@ up: kind-start
 ## Destroy test environment
 down: kind-stop
 
+LDFLAGS := -s -w \
+	-X github.com/openconfig/kne/version.Version=$(TAG) \
+	-X github.com/openconfig/kne/version.Commit=$(COMMIT)
+
 .PHONY: build
 ## Build kne
 build:
-	CGO_ENABLED=0 go build -o $(KNE_CLI_BIN) -ldflags="-s -w" kne_cli/main.go
+	CGO_ENABLED=0 go build -o $(KNE_CLI_BIN) -ldflags="$(LDFLAGS)" kne_cli/main.go
 
 .PHONY: install
 ## Install kne cli binary to user's local bin dir

cmd/root.go

@@ -23,6 +23,7 @@ import (
 	"github.com/openconfig/kne/cmd/deploy"
 	"github.com/openconfig/kne/cmd/topology"
 	"github.com/openconfig/kne/topo"
+	"github.com/openconfig/kne/version"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 	"k8s.io/client-go/util/homedir"
@@ -64,9 +65,20 @@ environment.`,
 	root.AddCommand(topology.New())
 	root.AddCommand(deploy.NewDeploy())
 	root.AddCommand(deploy.NewTeardown())
+	root.AddCommand(newVersionCmd())
 	return root
 }
 
+func newVersionCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "version",
+		Short: "Print the version",
+		Run: func(cmd *cobra.Command, _ []string) {
+			fmt.Fprintln(cmd.OutOrStdout(), version.String())
+		},
+	}
+}
+
 func defaultCfgFile() string {
 	if home := homedir.HomeDir(); home != "" {
 		return filepath.Join(home, ".config", "kne", "config.yaml")

deploy/deploy.go

@@ -633,7 +633,7 @@ func (k *KindSpec) checkDependencies() error {
 
 func (k *KindSpec) create() error {
 	// Create a KNE dir under /tmp intended to hold files to be mounted into the kind cluster.
-	if err := os.MkdirAll("/tmp/kne", os.ModePerm); err != nil {
+	if err := os.MkdirAll("/tmp/kne", 0750); err != nil {
 		return err
 	}
 	if k.Recycle {

deploy/gobgp/Dockerfile

@@ -1,5 +1,14 @@
-FROM hfam/ubuntu:latest
+FROM ubuntu:24.04
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  curl \
+  ca-certificates \
+  && rm -rf /var/lib/apt/lists/*
 
 RUN curl -LO "https://github.com/osrg/gobgp/releases/download/v2.31.0/gobgp_2.31.0_linux_amd64.tar.gz" \
-&& tar -xzf gobgp_2.31.0_linux_amd64.tar.gz && chmod +x gobgpd  && chmod +x gobgp \
-&& mv gobgpd /usr/local/bin/gobgpd && mv gobgp /usr/local/bin/gobgp
+&& tar -xzf gobgp_2.31.0_linux_amd64.tar.gz && chmod +x gobgpd && chmod +x gobgp \
+&& mv gobgpd /usr/local/bin/gobgpd && mv gobgp /usr/local/bin/gobgp \
+&& rm -f gobgp_2.31.0_linux_amd64.tar.gz
+
+RUN groupadd -r kne && useradd -r -g kne -s /sbin/nologin kne
+USER kne

deploy/ubuntu/Dockerfile

@@ -1,15 +1,19 @@
-FROM ubuntu:latest
+FROM ubuntu:24.04
 
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
   curl \
   wget \
   iproute2 \
   iputils-ping \
   tcpdump \
   telnet \
   traceroute \
+  ca-certificates \
   && rm -rf /var/lib/apt/lists/*
 
 RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
 && chmod +x kubectl \
 && mv kubectl /usr/local/bin/kubectl
+
+RUN groupadd -r kne && useradd -r -g kne -s /sbin/nologin kne
+USER kne