Skip to content

Update Dex dependency #279

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mjudeikis merged 6 commits into from
Sep 15, 2025
Merged

Update Dex dependency #279

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
f11a0d9
bump Dex dependency
xrstf Aug 19, 2025
8f317e3
improve dex-related docs
xrstf Aug 19, 2025
9eaa45c
go mod tidy all modules
xrstf Aug 19, 2025
0579383
remove unused dependency
xrstf Aug 19, 2025
b17ea2d
make replace directives more visible
xrstf Aug 19, 2025
eb550fa
improve link
xrstf Aug 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,7 @@ KCP_VER := v0.28.0
KCP_BIN := kcp
KCP := $(TOOLS_GOBIN_DIR)/$(KCP_BIN)-$(KCP_VER)

DEX_VER := v2.41.1
DEX_VER := v2.43.1
DEX_BIN := dex
DEX := $(TOOLS_GOBIN_DIR)/$(DEX_BIN)-$(DEX_VER)

Expand Down Expand Up @@ -163,7 +163,7 @@ vendor: ## Vendor the dependencies
go mod vendor
.PHONY: vendor

tools: $(GOLANGCI_LINT) $(CONTROLLER_GEN) $(YAML_PATCH) $(GOTESTSUM) $(CODE_GENERATOR)
tools: $(GOLANGCI_LINT) $(CONTROLLER_GEN) $(YAML_PATCH) $(GOTESTSUM) $(CODE_GENERATOR)
.PHONY: tools

$(CONTROLLER_GEN):
Expand Down
2 changes: 1 addition & 1 deletion cli/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@ require (
golang.org/x/time v0.11.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 // indirect
google.golang.org/grpc v1.69.2 // indirect
google.golang.org/grpc v1.70.0 // indirect

@coderabbitai coderabbitai Bot Sep 15, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

grpc bump looks fine; verify single-version across modules.
Consistent with root and docs mods. Please run tidy across all modules and confirm a single picked grpc version.

🏁 Script executed:

#!/bin/bash
# Ensure all go.mod pick the same grpc version and are tidy
fd -H go.mod | while read -r mod; do
  (cd "$(dirname "$mod")" && go mod tidy -v >/dev/null 2>&1 || true && go list -m -f '{{.Path}} {{.Version}}' all | rg -n '^google.golang.org/grpc ' -n) | sed "s|^|$(dirname "$mod"): |"
done

Length of output: 990

Unify google.golang.org/grpc version across modules

  • Script output shows mixed grpc versions: cli + root = v1.70.0; kcp = v1.69.2; sdk/apis & sdk/client = v1.65.0.
  • go mod tidy also failed with "unknown revision v0.0.0" for several k8s.io modules — resolve those (correct versions or add replaces) so tidy can complete.
  • Action: run go mod tidy in kcp, sdk/apis, sdk/client (and root/cli), align all modules to a single grpc version (recommend root's v1.70.0 or your chosen version), commit updated go.mod/go.sum, then re-run the verification script to confirm a single picked grpc version.
🤖 Prompt for AI Agents 
In cli/go.mod around line 117, multiple modules use different
google.golang.org/grpc versions and go mod tidy fails due to k8s.io modules
referencing unknown revision v0.0.0; to fix, run go mod tidy in kcp, sdk/apis,
sdk/client, root and cli to surface errors, correct the k8s.io module versions
(or add explicit replace directives pointing to valid tags/commits) so tidy
completes, align all modules to a single grpc version (add/adjust require or
replace entries to pin google.golang.org/grpc to v1.70.0 across modules), commit
the updated go.mod and go.sum files, then re-run the verification script to
confirm only one grpc version is picked.

google.golang.org/protobuf v1.36.5 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
Expand Down
12 changes: 6 additions & 6 deletions cli/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,8 +226,8 @@ go.opentelemetry.io/otel/metric v1.33.0 h1:r+JOocAyeRVXD8lZpjdQjzMadVZp2M4WmQ+5W
go.opentelemetry.io/otel/metric v1.33.0/go.mod h1:L9+Fyctbp6HFTddIxClbQkjtubW6O9QS3Ann/M82u6M=
go.opentelemetry.io/otel/sdk v1.33.0 h1:iax7M131HuAm9QkZotNHEfstof92xM+N8sr3uHXc2IM=
go.opentelemetry.io/otel/sdk v1.33.0/go.mod h1:A1Q5oi7/9XaMlIWzPSxLRWOI8nG3FnzHJNbiENQuihM=
go.opentelemetry.io/otel/sdk/metric v1.31.0 h1:i9hxxLJF/9kkvfHppyLL55aW7iIJz4JjxTeYusH7zMc=
go.opentelemetry.io/otel/sdk/metric v1.31.0/go.mod h1:CRInTMVvNhUKgSAMbKyTMxqOBC0zgyxzW55lZzX43Y8=
go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
go.opentelemetry.io/otel/trace v1.33.0 h1:cCJuF7LRjUFso9LPnEAHJDB2pqzp+hbO8eu1qqW2d/s=
go.opentelemetry.io/otel/trace v1.33.0/go.mod h1:uIcdVUZMpTAmz0tI1z04GoVSezK37CbGV4fr1f2nBck=
go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
Expand Down Expand Up @@ -286,14 +286,14 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 h1:KAeGQVN3M9nD0/bQXnr/ClcEMJ968gUXJQ9pwfSynuQ=
google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80/go.mod h1:cc8bqMqtv9gMOr0zHg2Vzff5ULhhL2IXP4sbcn32Dro=
google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9 h1:9+tzLLstTlPTRyJTh+ah5wIMsBW5c4tQwGTN3thOW9Y=
google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9/go.mod h1:mqHbVIp48Muh7Ywss/AD6I5kNVKZMmAa/QEW58Gxp2s=
google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 h1:GVIKPyP/kLIyVOgOnTwFOrvQaQUzOzGMCxgFUOEmm24=
google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422/go.mod h1:b6h1vNKhxaSoEI+5jc3PJUCustfli/mRab7295pY7rw=
google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 h1:3UsHvIr4Wc2aW4brOaSCmcxh9ksica6fHEr8P1XhkYw=
google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
google.golang.org/grpc v1.70.0 h1:pWFv03aZoHzlRKHWicjsZytKAiYCtNS0dHbXnIdq7jQ=
google.golang.org/grpc v1.70.0/go.mod h1:ofIJqVKDXx/JiXrwr2IG4/zwdH9txy3IlF40RmcJSQw=
google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
Expand Down
15 changes: 6 additions & 9 deletions docs/content/setup/local-setup-with-kind.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,10 @@

This guide will walk you through setting up kube-bind between two Kubernetes clusters, where

**Backend cluster**:

* **Backend cluster**:
* Deploys dex, cert-manager and kube-bind/example-backend
* Provides kube-bind compatible backend for MangoDB resources

**App cluster**:

* **App cluster**:
* Provides an application consuming MangoDBs

## Pre-requisites
Expand All @@ -30,7 +27,7 @@ To install `kubectl-bind` plugin, please download the archive for your platform
> sudo sysctl fs.inotify.max_user_instances=512
> ```
>
> See https://kind.sigs.k8s.io/docs/user/known-issues/#pod-errors-due-to-too-many-open-files for more details.
> See the [kind documentation](https://kind.sigs.k8s.io/docs/user/known-issues/#pod-errors-due-to-too-many-open-files) for more details.

## Provider cluster

Expand Down Expand Up @@ -62,7 +59,7 @@ nodes:
- containerPort: 30080
hostPort: 8080
protocol: TCP
# DEX endpoint
# dex endpoint
- containerPort: 30556
hostPort: 5556
protocol: TCP
Expand All @@ -73,7 +70,7 @@ EOF_BackendClusterDefinition

### Step two: deploy an identity provider

kube-bind relies on OAuth2 for securely authenticating consumer and producer clusters. There are many ways to handle that in Kubernetes, for example with [DEX IDP](https://github.com/dexidp/dex). It depends on cert-manager, which we'll deploy first:
kube-bind relies on OAuth2 for securely authenticating consumer and producer clusters. There are many ways to handle that in Kubernetes, for example with [dex IDP](https://github.com/dexidp/dex). It depends on cert-manager, which we'll deploy first:

```sh
helm repo add jetstack https://charts.jetstack.io
Expand All @@ -85,7 +82,7 @@ helm install \
cert-manager jetstack/cert-manager
```

And now let's deploy DEX:
And now let's deploy dex:

```sh
helm repo add dex https://charts.dexidp.io
Expand Down
67 changes: 38 additions & 29 deletions docs/content/setup/quickstart.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,17 +27,19 @@ To run the current backend, there must be an OIDC issuer installed in place to d
the oauth2 workflow.

We use dex to manage OIDC, following the steps below you can run a local OIDC issuer using dex:

* First, clone the dex repo: `git clone https://github.com/dexidp/dex.git`
* `cd dex` and then build the dex binary `make build`
* The binary will be created in `bin/dex`
* Adjust the config file(`examples/config-dev.yaml`) for dex by specifying the server callback method:
```yaml
staticClients:
- id: kube-bind
redirectURIs:
- 'http://127.0.0.1:8080/callback'
name: 'Kube Bind'
```
```yaml
staticClients:
- id: kube-bind
redirectURIs:
- 'http://127.0.0.1:8080/callback'
name: 'Kube Bind'
secret: ZXhhbXBsZS1hcHAtc2VjcmV0
```
* Run dex: `./bin/dex serve examples/config-dev.yaml`

Next you should be able to run the backend. For it you need a kubernetes cluster (e.g. kind)
Expand All @@ -54,33 +56,38 @@ export KUBECONFIG=.kcp/provider.kubeconfig
kubectl ws create provider --enter
```

* apply the CRDs: `kubectl apply -f deploy/crd`
* apply the CRDs:

```shell
kubectl apply -f deploy/crd
```
* In order to populate binding list on website, we need a CRD with label `kube-bind.io/exported: true`. Apply example APIResourceSchema for the CRD: `kubectl apply -f deploy/examples/crd-mangodb.yaml`

```shell
kubectl apply -f deploy/crd
kubectl apply -f deploy/examples/crd-mangodb.yaml
kubectl apply -f deploy/examples/crd-foo.yaml
```
```shell
kubectl apply -f deploy/examples/crd-mangodb.yaml
kubectl apply -f deploy/examples/crd-foo.yaml
```

* start the backend binary with the right flags:
```shell
make build
bin/backend \
--oidc-issuer-client-secret=ZXhhbXBsZS1hcHAtc2VjcmV0 \
--oidc-issuer-client-id=kube-bind \
--oidc-issuer-url=http://127.0.0.1:5556/dex \
--oidc-callback-url=http://127.0.0.1:8080/callback \
--pretty-name="BigCorp.com" \
--namespace-prefix="kube-bind-" \
--cookie-signing-key=bGMHz7SR9XcI9JdDB68VmjQErrjbrAR9JdVqjAOKHzE= \
--cookie-encryption-key=wadqi4u+w0bqnSrVFtM38Pz2ykYVIeeadhzT34XlC1Y= \
--consumer-scope=cluster
```
```shell
make build

bin/backend \
--oidc-issuer-client-secret=ZXhhbXBsZS1hcHAtc2VjcmV0 \
--oidc-issuer-client-id=kube-bind \
--oidc-issuer-url=http://127.0.0.1:5556/dex \
--oidc-callback-url=http://127.0.0.1:8080/callback \
--pretty-name="BigCorp.com" \
--namespace-prefix="kube-bind-" \
--cookie-signing-key=bGMHz7SR9XcI9JdDB68VmjQErrjbrAR9JdVqjAOKHzE= \
--cookie-encryption-key=wadqi4u+w0bqnSrVFtM38Pz2ykYVIeeadhzT34XlC1Y= \
--consumer-scope=cluster
```
Comment on lines 71 to +85

@coderabbitai coderabbitai Bot Sep 15, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Example cookie keys trigger secret scanners; use placeholders.
These static values are flagged by gitleaks. Prefer placeholders and show how to generate them.

Apply:

-     --cookie-signing-key=bGMHz7SR9XcI9JdDB68VmjQErrjbrAR9JdVqjAOKHzE= \
-     --cookie-encryption-key=wadqi4u+w0bqnSrVFtM38Pz2ykYVIeeadhzT34XlC1Y= \
+     --cookie-signing-key=<BASE64_32_OR_64_BYTES> \
+     --cookie-encryption-key=<BASE64_16_24_OR_32_BYTES> \

Optionally add a note right below with openssl rand -base64 32.

🏁 Script executed:

#!/bin/bash
# Show any committed hard-coded demo secrets to update
rg -n 'ZXhhbXBsZS1hcHAtc2VjcmV0|cookie-(signing|encryption)-key=' docs -n

Length of output: 948

Replace demo secrets in docs with placeholders (triggers gitleaks)

Static demo secrets (OIDC client secret, cookie signing/encryption keys) are present and flagged by secret scanners; replace them with placeholders and show how to generate strong values.

Occurrences to update:

  • docs/content/setup/quickstart.md — lines 41, 76, 82–83, 87
  • docs/content/setup/local-setup-with-kind.md — lines 96, 169, 175–176

Apply:

-    secret: ZXhhbXBsZS1hcHAtc2VjcmV0
+    secret: <OIDC_CLIENT_SECRET>
...
-     --oidc-issuer-client-secret=ZXhhbXBsZS1hcHAtc2VjcmV0 \
+     --oidc-issuer-client-secret=<OIDC_CLIENT_SECRET> \
-     --cookie-signing-key=bGMHz7SR9XcI9JdDB68VmjQErrjbrAR9JdVqjAOKHzE= \
-     --cookie-encryption-key=wadqi4u+w0bqnSrVFtM38Pz2ykYVIeeadhzT34XlC1Y= \
+     --cookie-signing-key=<BASE64_32_OR_64_BYTES> \
+     --cookie-encryption-key=<BASE64_16_24_OR_32_BYTES> \

Add a one-line note showing generation commands, e.g.

  • openssl rand -base64 32 (generate 32 random bytes)
  • openssl rand -base64 16|24|32 (use 16/24/32 bytes for AES keys)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
* start the backend binary with the right flags:
```shell
make build
bin/backend \
--oidc-issuer-client-secret=ZXhhbXBsZS1hcHAtc2VjcmV0 \
--oidc-issuer-client-id=kube-bind \
--oidc-issuer-url=http://127.0.0.1:5556/dex \
--oidc-callback-url=http://127.0.0.1:8080/callback \
--pretty-name="BigCorp.com" \
--namespace-prefix="kube-bind-" \
--cookie-signing-key=bGMHz7SR9XcI9JdDB68VmjQErrjbrAR9JdVqjAOKHzE= \
--cookie-encryption-key=wadqi4u+w0bqnSrVFtM38Pz2ykYVIeeadhzT34XlC1Y= \
--consumer-scope=cluster
```
```shell
make build
bin/backend \
--oidc-issuer-client-secret=ZXhhbXBsZS1hcHAtc2VjcmV0 \
--oidc-issuer-client-id=kube-bind \
--oidc-issuer-url=http://127.0.0.1:5556/dex \
--oidc-callback-url=http://127.0.0.1:8080/callback \
--pretty-name="BigCorp.com" \
--namespace-prefix="kube-bind-" \
--cookie-signing-key=bGMHz7SR9XcI9JdDB68VmjQErrjbrAR9JdVqjAOKHzE= \
--cookie-encryption-key=wadqi4u+w0bqnSrVFtM38Pz2ykYVIeeadhzT34XlC1Y= \
--consumer-scope=cluster
```
* start the backend binary with the right flags:
🧰 Tools
🪛 Gitleaks (8.27.2)

[high] 82-82: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

(generic-api-key)

[high] 83-83: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

(generic-api-key)

🤖 Prompt for AI Agents 
In docs/content/setup/quickstart.md around lines 71 to 85 (and also update the
other occurrences listed: lines 41, 76, 82–83, 87 in this file and
docs/content/setup/local-setup-with-kind.md lines 96, 169, 175–176), remove the
hard-coded demo secrets and replace them with clear placeholders (e.g.
<OIDC_CLIENT_SECRET>, <COOKIE_SIGNING_KEY>, <COOKIE_ENCRYPTION_KEY>) in the
example backend command; add a single-line note near the example showing how to
generate strong values (suggest commands such as openssl rand -base64 32 and
openssl rand -base64 16|24|32) and mention which sizes to use for AES keys so
readers can generate secure keys instead of copying demo secrets.


where `ZXhhbXBsZS1hcHAtc2VjcmV0` matches the value of the dex config file.

The `--cookie-signing-key` and `--cookie-encryption-key` settings can be generated using:

```shell
$ openssl rand -base64 32
WQh88mNOY0Z3tLy1/WOud7qIEEBxz+POc4j8BsYenYo=
Expand All @@ -90,6 +97,7 @@ The `--cookie-signing-key` option is required and supports 32 and 64 byte length
The `--cookie-encryption-key` option is optional and supports byte lengths of 16, 24, 32 for AES-128, AES-192, or AES-256.

### Consumer

Now create consumer cluster:

```shell
Expand All @@ -101,17 +109,18 @@ Now create the APIServiceExportRequest:

```shell
./bin/kubectl-bind http://127.0.0.1:8080/exports --dry-run -o yaml > apiserviceexport.yaml

# This will wait for konnector to be ready. Once this gets running - start the konnector bellow
# IMPORTANT: Check namespace to be used!
# IMPORTANT: Check namespace to be used!
./bin/kubectl-bind apiservice --remote-kubeconfig .kcp/provider.kubeconfig -f apiserviceexport.yaml --skip-konnector --remote-namespace <namespace>

# run konnector in different terminal
export KUBECONFIG=.kcp/admin.kubeconfig
go run ./cmd/konnector/ --lease-namespace default
```


Create mangoDB object:

```bash
kubectl create -f deploy/examples/mangodb.yaml
```
```
2 changes: 1 addition & 1 deletion docs/generators/cli-doc/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@ require (
golang.org/x/time v0.11.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 // indirect
google.golang.org/grpc v1.69.2 // indirect
google.golang.org/grpc v1.70.0 // indirect
google.golang.org/protobuf v1.36.5 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
Expand Down
8 changes: 4 additions & 4 deletions docs/generators/cli-doc/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,8 +230,8 @@ go.opentelemetry.io/otel/metric v1.33.0 h1:r+JOocAyeRVXD8lZpjdQjzMadVZp2M4WmQ+5W
go.opentelemetry.io/otel/metric v1.33.0/go.mod h1:L9+Fyctbp6HFTddIxClbQkjtubW6O9QS3Ann/M82u6M=
go.opentelemetry.io/otel/sdk v1.33.0 h1:iax7M131HuAm9QkZotNHEfstof92xM+N8sr3uHXc2IM=
go.opentelemetry.io/otel/sdk v1.33.0/go.mod h1:A1Q5oi7/9XaMlIWzPSxLRWOI8nG3FnzHJNbiENQuihM=
go.opentelemetry.io/otel/sdk/metric v1.31.0 h1:i9hxxLJF/9kkvfHppyLL55aW7iIJz4JjxTeYusH7zMc=
go.opentelemetry.io/otel/sdk/metric v1.31.0/go.mod h1:CRInTMVvNhUKgSAMbKyTMxqOBC0zgyxzW55lZzX43Y8=
go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
go.opentelemetry.io/otel/trace v1.33.0 h1:cCJuF7LRjUFso9LPnEAHJDB2pqzp+hbO8eu1qqW2d/s=
go.opentelemetry.io/otel/trace v1.33.0/go.mod h1:uIcdVUZMpTAmz0tI1z04GoVSezK37CbGV4fr1f2nBck=
go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
Expand Down Expand Up @@ -296,8 +296,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 h1:
google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422/go.mod h1:b6h1vNKhxaSoEI+5jc3PJUCustfli/mRab7295pY7rw=
google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 h1:3UsHvIr4Wc2aW4brOaSCmcxh9ksica6fHEr8P1XhkYw=
google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
google.golang.org/grpc v1.70.0 h1:pWFv03aZoHzlRKHWicjsZytKAiYCtNS0dHbXnIdq7jQ=
google.golang.org/grpc v1.70.0/go.mod h1:ofIJqVKDXx/JiXrwr2IG4/zwdH9txy3IlF40RmcJSQw=
google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
Expand Down
42 changes: 20 additions & 22 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,27 @@ replace (
github.com/kube-bind/kube-bind/sdk/client => ./sdk/client
)

// Matches multicluster-runtime v0.21.0-alpha.8
replace (
github.com/google/cel-go => github.com/google/cel-go v0.22.0
github.com/kcp-dev/apimachinery/v2 => github.com/kcp-dev/apimachinery/v2 v2.0.1-0.20250728122101-adbf20db3e51
github.com/kcp-dev/multicluster-provider => github.com/mjudeikis/kcp-multicluster-provider v0.0.0-20250818102159-3d31cbb06ebe
k8s.io/api => k8s.io/api v0.33.0
Comment on lines +17 to +18

@coderabbitai coderabbitai Bot Sep 15, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Don’t ship with personal forks in replace.

Both multicluster-provider and multicluster-runtime are redirected to personal forks. That’s a supply‑chain and long‑term maintenance risk. Revert to upstream or justify with a temporary branch and follow‑up issue to remove before release.

Apply this diff (unless there’s a blocking upstream bug and an issue is linked):

 replace (
   github.com/google/cel-go => github.com/google/cel-go v0.23.2
   github.com/kcp-dev/apimachinery/v2 => github.com/kcp-dev/apimachinery/v2 v2.0.1-0.20250728122101-adbf20db3e51
-  github.com/kcp-dev/multicluster-provider => github.com/mjudeikis/kcp-multicluster-provider v0.0.0-20250818102159-3d31cbb06ebe
+  # keep upstream unless absolutely necessary
+  # github.com/kcp-dev/multicluster-provider => github.com/mjudeikis/kcp-multicluster-provider v0.0.0-20250818102159-3d31cbb06ebe
   …
-  //sigs.k8s.io/multicluster-runtime => sigs.k8s.io/multicluster-runtime v0.20.4-alpha.7
-  sigs.k8s.io/multicluster-runtime => github.com/mjudeikis/sigs-multicluster-runtime v0.0.0-20250818101434-d8ebc45e169b
+  # sigs.k8s.io/multicluster-runtime => github.com/mjudeikis/sigs-multicluster-runtime v0.0.0-20250818101434-d8ebc45e169b
 )

If forks are required, add a comment with the upstream issue/PR and a TODO to revert.

Also applies to: 27-29

🤖 Prompt for AI Agents 
In go.mod around lines 17-18 (and also check related replaces at lines 27-29),
the file contains replace directives pointing to personal forks
(github.com/mjudeikis/*), which must not be shipped; either revert these replace
directives to the upstream modules (remove or change them to the official module
paths/versions) or, if a fork is temporarily required due to a blocking upstream
bug, add an explicit comment above each replace linking the upstream issue/PR
and a TODO to remove the fork before release; update the go.mod accordingly and
ensure a follow-up issue is created and referenced in the comment.

k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.33.0
k8s.io/apimachinery => k8s.io/apimachinery v0.33.0
k8s.io/apiserver => k8s.io/apiserver v0.33.0
k8s.io/cli-runtime => k8s.io/cli-runtime v0.33.0
k8s.io/client-go => k8s.io/client-go v0.33.0
k8s.io/code-generator => k8s.io/code-generator v0.33.0
k8s.io/component-base => k8s.io/component-base v0.33.0
sigs.k8s.io/controller-runtime => sigs.k8s.io/controller-runtime v0.21.0
//sigs.k8s.io/multicluster-runtime => sigs.k8s.io/multicluster-runtime v0.20.4-alpha.7
sigs.k8s.io/multicluster-runtime => github.com/mjudeikis/sigs-multicluster-runtime v0.0.0-20250818101434-d8ebc45e169b
)
Comment on lines +13 to +29

@coderabbitai coderabbitai Bot Sep 15, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Avoid version skew: replace downgrades K8s and cel-go below required versions.

Your replace block pins k8s.io/* to v0.33.0 while require uses v0.33.3, and forces cel-go v0.22.0 while indirect requires v0.23.2. This will cause subtle ABI drift and harder-to-debug build issues. Align them.

Apply this diff to match the require set:

 replace (
-  github.com/google/cel-go => github.com/google/cel-go v0.22.0
+  github.com/google/cel-go => github.com/google/cel-go v0.23.2
   github.com/kcp-dev/apimachinery/v2 => github.com/kcp-dev/apimachinery/v2 v2.0.1-0.20250728122101-adbf20db3e51
   github.com/kcp-dev/multicluster-provider => github.com/mjudeikis/kcp-multicluster-provider v0.0.0-20250818102159-3d31cbb06ebe
-  k8s.io/api => k8s.io/api v0.33.0
-  k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.33.0
-  k8s.io/apimachinery => k8s.io/apimachinery v0.33.0
-  k8s.io/apiserver => k8s.io/apiserver v0.33.0
-  k8s.io/cli-runtime => k8s.io/cli-runtime v0.33.0
-  k8s.io/client-go => k8s.io/client-go v0.33.0
-  k8s.io/code-generator => k8s.io/code-generator v0.33.0
-  k8s.io/component-base => k8s.io/component-base v0.33.0
+  k8s.io/api => k8s.io/api v0.33.3
+  k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.33.0
+  k8s.io/apimachinery => k8s.io/apimachinery v0.33.3
+  k8s.io/apiserver => k8s.io/apiserver v0.33.0
+  k8s.io/cli-runtime => k8s.io/cli-runtime v0.32.0
+  k8s.io/client-go => k8s.io/client-go v0.33.3
+  k8s.io/code-generator => k8s.io/code-generator v0.33.0
+  k8s.io/component-base => k8s.io/component-base v0.33.0
 )

Also applies to: 54-61, 102-103

🤖 Prompt for AI Agents 
In go.mod around lines 13 to 29, the replace block pins k8s.io/* modules to
v0.33.0 and github.com/google/cel-go to v0.22.0 which downgrades them relative
to the required versions and can cause ABI/version skew; update the replace
entries to match the require set (e.g., set k8s.io/api, apimachinery, apiserver,
client-go, cli-runtime, code-generator, component-base, apiextensions-apiserver
to v0.33.3 and set github.com/google/cel-go to v0.23.2) and make the same
alignment for the other mentioned ranges (lines 54-61 and 102-103) so replaces
no longer force older versions than the module requires.


require (
github.com/coreos/go-oidc v2.3.0+incompatible
github.com/dexidp/dex/api/v2 v2.1.0
github.com/dexidp/dex/api/v2 v2.3.0
github.com/evanphx/json-patch/v5 v5.9.11
github.com/google/go-cmp v0.7.0
github.com/gorilla/mux v1.8.0
Expand All @@ -31,7 +49,7 @@ require (
github.com/stretchr/testify v1.10.0
github.com/vmihailenco/msgpack/v4 v4.3.12
golang.org/x/oauth2 v0.29.0
google.golang.org/grpc v1.69.2
google.golang.org/grpc v1.70.0

@coderabbitai coderabbitai Bot Sep 15, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

gRPC 1.70.0: check transitive consistency (genproto/protobuf) and duplicate versions.

Avoid mixed gRPC trees across submodules. Ensure genproto/protobuf versions are compatible and that cli/ and docs/ modules match.

Run:

If mismatches exist, align all go.mod files and re‑tidy.

🏁 Script executed:

#!/bin/bash
# quick consistency check across go.mod files
fd -a go.mod | xargs -I{} sh -c "echo '--- {}'; sed -n '/google.golang.org\\/grpc/p' {} ; sed -n '/google.golang.org\\/protobuf/p' {}; sed -n '/google.golang.org\\/genproto/p' {}"

Length of output: 1818

Align gRPC / genproto / protobuf versions across modules

Detected concrete mismatches — action required:

  • kcp/go.mod has google.golang.org/grpc v1.69.2 while root, cli, and docs use v1.70.0.
  • sdk/client/go.mod has google.golang.org/protobuf v1.35.1 while others use v1.36.5.
  • root go.mod lists google.golang.org/genproto v0.0.0-202402... while cli/docs/kcp reference google.golang.org/genproto/googleapis/* at 202501... (inconsistent genproto entries).

Fix: pick canonical versions (e.g., grpc v1.70.0, protobuf v1.36.5), update kcp and sdk/client (and/or root) to match, consolidate/remove duplicate genproto entries, then run go mod tidy across affected modules.

🤖 Prompt for AI Agents 
In go.mod around line 52 (google.golang.org/grpc v1.70.0) and across the repo
(kcp/go.mod, sdk/client/go.mod, root go.mod, cli and docs modules), gRPC,
protobuf and genproto versions are inconsistent; pick canonical versions (e.g.,
google.golang.org/grpc v1.70.0 and google.golang.org/protobuf v1.36.5), update
kcp/go.mod and sdk/client/go.mod (and/or root) to those versions,
consolidate/remove duplicate google.golang.org/genproto entries so all modules
reference the same genproto version, then run go mod tidy in each affected
module to regenerate go.sum and ensure builds are consistent.

gopkg.in/headzoo/surf.v1 v1.0.1
k8s.io/api v0.33.3
k8s.io/apiextensions-apiserver v0.33.0
Expand All @@ -49,8 +67,6 @@ require (
sigs.k8s.io/yaml v1.4.0
)

replace cloud.google.com/go => cloud.google.com/go v0.100.2

require (
cel.dev/expr v0.19.1 // indirect
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
Expand Down Expand Up @@ -167,21 +183,3 @@ require (
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
)

// Matches multicluster-runtime v0.21.0-alpha.8
replace (
github.com/google/cel-go => github.com/google/cel-go v0.22.0
github.com/kcp-dev/apimachinery/v2 => github.com/kcp-dev/apimachinery/v2 v2.0.1-0.20250728122101-adbf20db3e51
github.com/kcp-dev/multicluster-provider => github.com/mjudeikis/kcp-multicluster-provider v0.0.0-20250818102159-3d31cbb06ebe
k8s.io/api => k8s.io/api v0.33.0
k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.33.0
k8s.io/apimachinery => k8s.io/apimachinery v0.33.0
k8s.io/apiserver => k8s.io/apiserver v0.33.0
k8s.io/cli-runtime => k8s.io/cli-runtime v0.33.0
k8s.io/client-go => k8s.io/client-go v0.33.0
k8s.io/code-generator => k8s.io/code-generator v0.33.0
k8s.io/component-base => k8s.io/component-base v0.33.0
sigs.k8s.io/controller-runtime => sigs.k8s.io/controller-runtime v0.21.0
//sigs.k8s.io/multicluster-runtime => sigs.k8s.io/multicluster-runtime v0.20.4-alpha.7
sigs.k8s.io/multicluster-runtime => github.com/mjudeikis/sigs-multicluster-runtime v0.0.0-20250818101434-d8ebc45e169b
)
12 changes: 6 additions & 6 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,8 +33,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/dexidp/dex/api/v2 v2.1.0 h1:V7XTnG2HM2bqWZMABDQpf4EA6F+0jWPsv9pGaUIDo+k=
github.com/dexidp/dex/api/v2 v2.1.0/go.mod h1:s91/6CI290JhYN1F8aiRifLF71qRGLVZvzq68uC6Ln4=
github.com/dexidp/dex/api/v2 v2.3.0 h1:gv79YqTBTGU6z/QE3RNFzlS6KrPRUudVUN8o858gpCc=
github.com/dexidp/dex/api/v2 v2.3.0/go.mod h1:y9As69T4WZOERCS/CfB9D8Dbb12tafU9ywv2ZZLf4EI=
github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
github.com/emicklei/go-restful/v3 v3.12.1 h1:PJMDIM/ak7btuL8Ex0iYET9hxM3CI2sjZtzpL63nKAU=
Expand Down Expand Up @@ -275,8 +275,8 @@ go.opentelemetry.io/otel/metric v1.33.0 h1:r+JOocAyeRVXD8lZpjdQjzMadVZp2M4WmQ+5W
go.opentelemetry.io/otel/metric v1.33.0/go.mod h1:L9+Fyctbp6HFTddIxClbQkjtubW6O9QS3Ann/M82u6M=
go.opentelemetry.io/otel/sdk v1.33.0 h1:iax7M131HuAm9QkZotNHEfstof92xM+N8sr3uHXc2IM=
go.opentelemetry.io/otel/sdk v1.33.0/go.mod h1:A1Q5oi7/9XaMlIWzPSxLRWOI8nG3FnzHJNbiENQuihM=
go.opentelemetry.io/otel/sdk/metric v1.31.0 h1:i9hxxLJF/9kkvfHppyLL55aW7iIJz4JjxTeYusH7zMc=
go.opentelemetry.io/otel/sdk/metric v1.31.0/go.mod h1:CRInTMVvNhUKgSAMbKyTMxqOBC0zgyxzW55lZzX43Y8=
go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
go.opentelemetry.io/otel/trace v1.33.0 h1:cCJuF7LRjUFso9LPnEAHJDB2pqzp+hbO8eu1qqW2d/s=
go.opentelemetry.io/otel/trace v1.33.0/go.mod h1:uIcdVUZMpTAmz0tI1z04GoVSezK37CbGV4fr1f2nBck=
go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
Expand Down Expand Up @@ -357,8 +357,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 h1:
google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422/go.mod h1:b6h1vNKhxaSoEI+5jc3PJUCustfli/mRab7295pY7rw=
google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 h1:3UsHvIr4Wc2aW4brOaSCmcxh9ksica6fHEr8P1XhkYw=
google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
google.golang.org/grpc v1.70.0 h1:pWFv03aZoHzlRKHWicjsZytKAiYCtNS0dHbXnIdq7jQ=
google.golang.org/grpc v1.70.0/go.mod h1:ofIJqVKDXx/JiXrwr2IG4/zwdH9txy3IlF40RmcJSQw=
google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
Expand Down
4 changes: 2 additions & 2 deletions hack/dex-config-dev.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,8 +93,8 @@ grpc:
oauth2:
# use ["code", "token", "id_token"] to enable implicit flow for web-only clients
# responseTypes: [ "code" ] # also allowed are "token" and "id_token"
# By default, Dex will ask for approval to share data with application
# (approval for sharing data from connected IdP to Dex is separate process on IdP)
# By default, dex will ask for approval to share data with application
# (approval for sharing data from connected IdP to dex is separate process on IdP)
skipApprovalScreen: true
# If only one authentication method is enabled, the default behavior is to
# go directly to it. For connected IdPs, this redirects the browser away
Expand Down
2 changes: 1 addition & 1 deletion hack/kind-example-setup/backend-cluster.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ nodes:
- containerPort: 30080
hostPort: 8080
protocol: TCP
# DEX endpoint
# dex endpoint
- containerPort: 30556
hostPort: 5556
protocol: TCP
Expand Down
Loading