OCPBUGS-82495: 4.23 rebase 3.6.10 by dusk125 · Pull Request #368 · openshift/etcd

dusk125 · 2026-04-09T17:24:34Z

❯ ./bin/etcd --version
etcd Version: 3.6.10
Git SHA: 29e8bb5
Go Version: go1.25.8
Go OS/Arch: darwin/arm64

…st negative revision Signed-off-by: Marek Siarkowicz <siarkowicz@google.com>

…ry-pick-20693-to-release-3.6 [release-3.6] Reject watch request with -1 revision to prevent invalid resync behavior on uncompacted etcd and make rangeEvents safe against negative revision.

When EOF is encountered during TLS handshake, it is still logged as a warning. This seems excessive and not really useful. This patch ensures EOF is logged on debug only. Signed-off-by: Ondra Kupka <okupka@redhat.com>

…ry-pick-20568-to-release-3.6 [release-3.6] server/embed: Log EOF on DEBUG in TLS handshake

Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>

Signed-off-by: hwdef <hwdefcom@outlook.com>

[release-3.6] Bump go to 1.24.9

Adds two test cases for the member promote operation when auth is enabled. In the first case, the member promote request is submitted to the leader, and in the second case it's submitted to the follower. The leader case succeeds. In the other case, the follower forwards the promote request to the leader. But, the forwarded request fails due to a bug. The logs on the leader include this message: ``` failed to promote a member ``` as well as the error: ``` auth: user name is empty ``` Signed-off-by: xUser5000 <abdallahar1974@gmail.com>

When auth is enabled, sending a promotion request to a follower node was failing because the auth token was not being propagated when the follower forwards the request to the leader. Signed-off-by: xUser5000 <abdallahar1974@gmail.com>

Signed-off-by: xUser5000 <abdallahar1974@gmail.com>

…ry-pick-20792-to-release-3.6 [release-3.6] etcdserver: Fix: cannot promote member from follower when auth is enabled

…move learner issue Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>

Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>

…ry-pick-20894-to-release-3.6 [release-3.6] Fix the issue that `--force-new-cluster` can't clean up learner after creating v2 snapshot

Signed-off-by: ronaldngounou <ronald.ngounou@yahoo.com>

…12410 [release-3.6] Bump from go1.24.9 to go1.24.10

Signed-off-by: mingl1 <minglin.me@gmail.com>

…ry-pick-20887-to-release-3.6 [release-3.6] fix duplicate metrics collector registration attempted

Signed-off-by: Ivan Valdes <iv@a.ki>

Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>

[release-3.6] Print token fingerprint instead of the original tokens in log messages

Signed-off-by: hwdef <hwdefcom@outlook.com>

[release-3.6] Bump go to 1.24.11

Addresses CVE-2025-47914, CVE-2025-58181. Signed-off-by: Ivan Valdes <ivan@vald.es>

[release-3.6] dependency: Bump golang.org/x/crypto from 0.36.0 to 0.45.0

Signed-off-by: joshjms <joshjms1607@gmail.com>

Addresses CVE-2025-47914, CVE-2025-58181. Signed-off-by: Ivan Valdes <ivan@vald.es>

Running genproto fails with: % (cd tools/mod && 'go' 'install' 'golang.org/x/tools/cmd/goimports') stderr: /home/prow/go/pkg/mod/golang.org/x/tools@v0.38.0/cmd/goimports/goimports.go:23:2: missing go.sum entry for module providing package golang.org/x/telemetry/counter (imported by golang.org/x/tools/cmd/goimports); to add: stderr: go get golang.org/x/tools/cmd/goimports@v0.38.0 FAIL: (code:1): % (cd tools/mod && 'go' 'install' 'golang.org/x/tools/cmd/goimports') Failed to install tool 'golang.org/x/tools/cmd/goimports' Signed-off-by: Ivan Valdes <ivan@vald.es>

Signed-off-by: Wei Fu <fuweid89@gmail.com> (cherry picked from commit 9386ac8) Signed-off-by: Wei Fu <fuweid89@gmail.com>

[release-3.6] server/etcdserver: guard unauthenticated endpoints with auth checks

[release-3.6] server/etcdserver: enforce auth checks for nested txn ops

Addresses CVE-2026-33186. Signed-off-by: Ivan Valdes <ivan@vald.es>

Signed-off-by: Wei Fu <fuweid89@gmail.com> (cherry picked from commit fe4b891) Signed-off-by: Wei Fu <fuweid89@gmail.com>

[3.6] tests/integration: fix flaky testcase

[release-3.6] Bump google.golang.org/grpc from v1.75.0 to 1.79.3

Signed-off-by: Ivan Valdes <iv@a.ki>

Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>

Ideally we should bump gonum.org/v1/plot. But it hasn't bump to golang.org/x/image@v0.38.0 yet Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>

[release-3.6] Bump golang.org/x/image to v0.38.0 to resolve GO-2026-4815

…ry-pick-21528-to-release-3.6 [release-3.6] Fix etcdctl endpoint command with option --cluster when auth is enabled

In some environments, etcd members do not have stable hostnames or IP addresses. During maintenance, all etcd nodes may be replaced, resulting in new hostnames and IPs for every member. In that case, clients such as Patroni can lose access to the cluster entirely if they are not allowed to refresh the member list. Allow non-admin users to fetch the member list so they can rediscover updated member endpoints after such topology changes. Signed-off-by: Wei Fu <fuweid89@gmail.com> (cherry picked from commit a2987fd) Signed-off-by: Wei Fu <fuweid89@gmail.com>

…n-admin-user-to-list-members [release-3.6] etcdserver: allow non-admin to fetch member list and alarms

Signed-off-by: Ivan Valdes <iv@a.ki>

coderabbitai · 2026-04-09T17:24:44Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 24390f43-4e7f-4703-ba50-939456d15f74

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci · 2026-04-09T17:25:33Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dusk125

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [dusk125]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2026-04-09T18:21:14Z

@dusk125: This pull request references Jira Issue OCPBUGS-82495, which is invalid:

expected Jira Issue OCPBUGS-82495 to depend on a bug targeting a version in 4.24.0 and in one of the following states: MODIFIED, ON_QA, VERIFIED, but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

❯ ./bin/etcd --version
etcd Version: 3.6.10
Git SHA: 29e8bb5
Go Version: go1.25.8
Go OS/Arch: darwin/arm64

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-04-10T00:30:48Z

@dusk125: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/configmap-scale	`d39bc8b`	link	true	`/test configmap-scale`
ci/prow/unit	`d39bc8b`	link	true	`/test unit`
ci/prow/e2e-aws-ovn-upgrade	`d39bc8b`	link	true	`/test e2e-aws-ovn-upgrade`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

serathius and others added 30 commits September 23, 2025 17:47

Reject watch request with -1 revision and make rangeEvents safe again…

3bb4470

…st negative revision Signed-off-by: Marek Siarkowicz <siarkowicz@google.com>

Merge pull request etcd-io#20707 from k8s-infra-cherrypick-robot/cher…

4790130

…ry-pick-20693-to-release-3.6 [release-3.6] Reject watch request with -1 revision to prevent invalid resync behavior on uncompacted etcd and make rangeEvents safe against negative revision.

server/embed: Log EOF on DEBUG in TLS handshake

ee85ed3

When EOF is encountered during TLS handshake, it is still logged as a warning. This seems excessive and not really useful. This patch ensures EOF is logged on debug only. Signed-off-by: Ondra Kupka <okupka@redhat.com>

Merge pull request etcd-io#20749 from k8s-infra-cherrypick-robot/cher…

3bbdd68

…ry-pick-20568-to-release-3.6 [release-3.6] server/embed: Log EOF on DEBUG in TLS handshake

Fix endpoint status not retuning the correct storage quota

4973fd4

Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>

Merge pull request etcd-io#20790 from ahrtr/20251012_quota_3.6

4dfe6c1

Bump go to 1.24.9

1e02301

Signed-off-by: hwdef <hwdefcom@outlook.com>

Merge pull request etcd-io#20801 from hwdef/release-36-bump-go1249

9d7222c

[release-3.6] Bump go to 1.24.9

etcdserver: follow convention to extract auth token in cluster_util.go

76ee0bc

Signed-off-by: xUser5000 <abdallahar1974@gmail.com>

tests: use WaitLeader() in memberPromoteWithAuth()

db6be4c

Signed-off-by: xUser5000 <abdallahar1974@gmail.com>

Merge pull request etcd-io#20874 from k8s-infra-cherrypick-robot/cher…

52b2948

…ry-pick-20792-to-release-3.6 [release-3.6] etcdserver: Fix: cannot promote member from follower when auth is enabled

Add an e2e test cases to reproduce the '--force-new-cluster' can't re…

7d3fc02

…move learner issue Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>

Fix the '--force-new-cluster' can't clean up learners issue

523100b

Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>

Merge pull request etcd-io#20896 from k8s-infra-cherrypick-robot/cher…

d1a3bee

…ry-pick-20894-to-release-3.6 [release-3.6] Fix the issue that `--force-new-cluster` can't clean up learner after creating v2 snapshot

Bump from go1.24.9 to go1.24.10

2c0db32

Signed-off-by: ronaldngounou <ronald.ngounou@yahoo.com>

Merge pull request etcd-io#20901 from ronaldngounou/release36-bump-go…

88b9794

…12410 [release-3.6] Bump from go1.24.9 to go1.24.10

v3rpc: add and use getServerMetrics() with global metricsServerCached

145d927

Signed-off-by: mingl1 <minglin.me@gmail.com>

Merge pull request etcd-io#20905 from k8s-infra-cherrypick-robot/cher…

0745315

…ry-pick-20887-to-release-3.6 [release-3.6] fix duplicate metrics collector registration attempted

version: bump up to 3.6.6

d2809cf

Signed-off-by: Ivan Valdes <iv@a.ki>

Print token fingerprint instead of the original tokens in log messages

554dc70

Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>

Merge pull request etcd-io#20941 from ahrtr/20251117_tokens_3.6

f185ce6

[release-3.6] Print token fingerprint instead of the original tokens in log messages

Bump go to 1.24.11

97141e1

Signed-off-by: hwdef <hwdefcom@outlook.com>

Merge pull request etcd-io#20998 from hwdef/release36-bump-go-12411

dbaf5cf

[release-3.6] Bump go to 1.24.11

dependency: Bump golang.org/x/net from 0.38.0 to 0.45.0

61af088

Addresses CVE-2025-47914, CVE-2025-58181. Signed-off-by: Ivan Valdes <ivan@vald.es>

Merge pull request etcd-io#21024 from ivanvc/release-3.6-x-net-0.45.0

6bfd01c

[release-3.6] dependency: Bump golang.org/x/crypto from 0.36.0 to 0.45.0

version: bump up to 3.6.7

e838ef1

Signed-off-by: joshjms <joshjms1607@gmail.com>

dependency: Bump golang.org/x/crypto from 0.42.0 to 0.45.0

f767aa2

Addresses CVE-2025-47914, CVE-2025-58181. Signed-off-by: Ivan Valdes <ivan@vald.es>

fuweid and others added 17 commits March 18, 2026 13:33

tests: update test for auth

68551b3

Signed-off-by: Wei Fu <fuweid89@gmail.com> (cherry picked from commit 9386ac8) Signed-off-by: Wei Fu <fuweid89@gmail.com>

Merge commit from fork

2363b86

[release-3.6] server/etcdserver: guard unauthenticated endpoints with auth checks

Merge commit from fork

8f45f52

[release-3.6] server/etcdserver: enforce auth checks for nested txn ops

dependency: Bump google.golang.org/grpc from v1.75.0 to 1.79.3

f899801

Addresses CVE-2026-33186. Signed-off-by: Ivan Valdes <ivan@vald.es>

tests/integration: fix flaky testcase

1526350

Signed-off-by: Wei Fu <fuweid89@gmail.com> (cherry picked from commit fe4b891) Signed-off-by: Wei Fu <fuweid89@gmail.com>

Merge pull request etcd-io#21497 from fuweid/3.6-weifu-donotreview

2a8cd59

[3.6] tests/integration: fix flaky testcase

Merge pull request etcd-io#21501 from ivanvc/release-3.6-grpc-go-1.79.3

d2fd011

[release-3.6] Bump google.golang.org/grpc from v1.75.0 to 1.79.3

version: bump up to 3.6.9

85651fa

Signed-off-by: Ivan Valdes <iv@a.ki>

Fix etcdctl endpoint command with option --cluster when auth is enabled

e0f7af4

Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>

Bump golang.org/x/image to v0.38.0 to resolve GO-2026-4815

f2173cd

Ideally we should bump gonum.org/v1/plot. But it hasn't bump to golang.org/x/image@v0.38.0 yet Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>

Merge pull request etcd-io#21531 from ahrtr/20260327_dep

e841e10

[release-3.6] Bump golang.org/x/image to v0.38.0 to resolve GO-2026-4815

Merge pull request etcd-io#21530 from k8s-infra-cherrypick-robot/cher…

8a1830c

…ry-pick-21528-to-release-3.6 [release-3.6] Fix etcdctl endpoint command with option --cluster when auth is enabled

Merge pull request etcd-io#21549 from etcd-io/cherry-pick-36/allow-no…

83bb20d

…n-admin-user-to-list-members [release-3.6] etcdserver: allow non-admin to fetch member list and alarms

version: bump up to 3.6.10

db8d13a

Signed-off-by: Ivan Valdes <iv@a.ki>

Merge branch 'openshift-4.23' into HEAD

307d917

UPSTREAM: <drop>: manually resolve conflicts

29e8bb5

openshift-ci bot requested review from Elbehery and hasbro17 April 9, 2026 17:25

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 9, 2026

dusk125 changed the title ~~NOJIRA: 4.23 rebase 4.6.10~~ OCPBUGS-82495: 4.23 rebase 3.6.10 Apr 9, 2026

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Apr 9, 2026

DOWNSTREAM: <drop>: update images

d39bc8b

dusk125 force-pushed the 4.23-rebase-4.6.10 branch 2 times, most recently from a1dbefa to d39bc8b Compare April 9, 2026 19:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-82495: 4.23 rebase 3.6.10#368

OCPBUGS-82495: 4.23 rebase 3.6.10#368
dusk125 wants to merge 97 commits intoopenshift:openshift-4.23from
dusk125:4.23-rebase-4.6.10

dusk125 commented Apr 9, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Apr 9, 2026 •

edited

Loading

Review skipped

Uh oh!

openshift-ci bot commented Apr 9, 2026

Uh oh!

openshift-ci-robot commented Apr 9, 2026

Uh oh!

openshift-ci bot commented Apr 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

16 participants

Conversation

dusk125 commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

openshift-ci bot commented Apr 9, 2026

Uh oh!

openshift-ci-robot commented Apr 9, 2026

Uh oh!

openshift-ci bot commented Apr 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

16 participants

dusk125 commented Apr 9, 2026 •

edited

Loading

coderabbitai bot commented Apr 9, 2026 •

edited

Loading