Revert "ci: run on self-hosted runners (#1174)" #1184
Conversation
This reverts commit ca4b25a.
WalkthroughThe pull request updates the CI/CD configuration and Docker Compose files. In the GitHub Actions integration test workflow, the execution environment for both test jobs is changed from a self-hosted runner to GitHub’s standard Ubuntu environment. Additionally, the MinIO service image tag is upgraded in two Docker Compose files, and the pull policy for the quest service is removed in another Docker Compose file. These changes focus solely on configuration updates without modifying the underlying service logic. Changes
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
⏰ Context from checks skipped due to timeout of 90000ms (8)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
.github/workflows/integration-test.yaml(2 hunks)docker-compose-distributed-test-with-kafka.yaml(0 hunks)docker-compose-distributed-test.yaml(0 hunks)docker-compose-test-with-kafka.yaml(1 hunks)docker-compose-test.yaml(1 hunks)
💤 Files with no reviewable changes (2)
- docker-compose-distributed-test.yaml
- docker-compose-distributed-test-with-kafka.yaml
⏰ Context from checks skipped due to timeout of 90000ms (10)
- GitHub Check: Build Default x86_64-pc-windows-msvc
- GitHub Check: Build Default aarch64-apple-darwin
- GitHub Check: Build Default x86_64-apple-darwin
- GitHub Check: Build Kafka aarch64-apple-darwin
- GitHub Check: Build Default aarch64-unknown-linux-gnu
- GitHub Check: Build Kafka x86_64-unknown-linux-gnu
- GitHub Check: Quest Smoke and Load Tests for Standalone deployments
- GitHub Check: coverage
- GitHub Check: Build Default x86_64-unknown-linux-gnu
- GitHub Check: Quest Smoke and Load Tests for Distributed deployments
🔇 Additional comments (3)
.github/workflows/integration-test.yaml (1)
14-14: LGTM! Runner change aligns with revert objective.The change from self-hosted to GitHub-hosted runners is consistent with the PR's goal of reverting PR #1174.
Please ensure that:
- The GitHub-hosted runners have sufficient resources for these integration tests
- No self-hosted runner-specific configurations or secrets were being used
Also applies to: 26-26
docker-compose-test.yaml (1)
61-86: Removal of pull_policy may affect test reliability.Removing
pull_policy: alwaysmeans Docker will use its default caching behavior, which could potentially use stale images.Consider if this might affect test reliability, especially when testing against latest builds of the quest image.
docker-compose-test-with-kafka.yaml (1)
6-6: LGTM! Changes are consistent with docker-compose-test.yaml.The modifications mirror those in docker-compose-test.yaml, maintaining consistency across test configurations:
- Same MinIO version rollback
- Same removal of quest service's pull_policy
Also applies to: 67-91
docker-compose-test.yaml
Outdated
| @@ -3,7 +3,7 @@ networks: | |||
|
|
|||
| services: | |||
| minio: | |||
| image: minio/minio:RELEASE.2025-02-03T21-03-04Z | |||
| image: minio/minio:RELEASE.2023-02-10T18-48-39Z | |||
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Verify MinIO version compatibility.
Rolling back to an older MinIO version (2023-02-10) could impact functionality. Please ensure this version:
- Meets the project's requirements
- Has no known security vulnerabilities
🌐 Web query:
Are there any known security vulnerabilities in MinIO RELEASE.2023-02-10T18-48-39Z?
💡 Result:
MinIO RELEASE.2023-02-10T18-48-39Z contains multiple critical security vulnerabilities that have been actively exploited in attacks:
Known Vulnerabilities
-
CVE-2023-28432 (CVSS 7.5)
Security feature bypass allowing attackers to:- Retrieve sensitive environment variables including
MINIO_ROOT_PASSWORD[2][5][8] - Access admin credentials through API endpoints[5][8]
- Retrieve sensitive environment variables including
-
CVE-2023-28434 (CVSS 8.8)
Remote Code Execution vulnerability enabling:- Unauthorized command execution via crafted HTTP requests[2][5]
- Replacement of MinIO binaries with malicious versions[2][5][8]
These vulnerabilities were fixed in RELEASE.2023-03-20T20-16-18Z and added to CISA's Known Exploited Vulnerabilities Catalog[4][7]. Attack chains using these CVEs have been observed:
http://vulnerable.minIO.server/?alive=[malicious_command]
http://vulnerable.minIO.server/anything?alive=[RCE_payload]Allows full server compromise when chained together[2][5][8].
Recommended Action
Immediate upgrade to at least RELEASE.2023-03-20T20-16-18Z is required. Later versions like RELEASE.2024-01-31T20-20-33Z contain additional security fixes including privilege escalation patches[3][6].
For legacy deployments, implement network restrictions:
# Block public access to MinIO API ports (9000/9001 by default)
iptables -A INPUT -p tcp --dport 9000:9001 -j DROPThis version has been vulnerable for over 12 months with public exploits available since April 2023[2][5]. Unpatched systems risk complete data exposure and server takeover through documented attack vectors[8].
Citations:
- 1: https://vuxml.freebsd.org/freebsd/index.html
- 2: https://thehackernews.com/2023/09/hackers-exploit-minio-storage-system.html
- 3: https://osv.dev/vulnerability/CVE-2024-24747
- 4: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?f%5B0%5D=vendor_project%3A790&f%5B1%5D=vendor_project%3A799&f%5B2%5D=vendor_project%3A817&f%5B3%5D=vendor_project%3A842&f%5B4%5D=vendor_project%3A846&f%5B5%5D=vendor_project%3A874&f%5B6%5D=vendor_project%3A887&f%5B7%5D=vendor_project%3A897&f%5B8%5D=vendor_project%3A917&f%5B9%5D=vendor_project%3A920&f%5B10%5D=vendor_project%3A932&f%5B11%5D=vendor_project%3A934&f%5B12%5D=vendor_project%3A945&f%5B13%5D=vendor_project%3A1007&f%5B14%5D=vendor_project%3A1151&f%5B15%5D=vendor_project%3A1168&f%5B16%5D=vendor_project%3A1249&page=1
- 5: https://www.bleepingcomputer.com/news/security/hackers-exploit-minio-storage-system-to-breach-corporate-networks/
- 6: https://github.com/minio/minio/releases
- 7: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?f%5B0%5D=vendor_project%3A799&f%5B1%5D=vendor_project%3A817&f%5B2%5D=vendor_project%3A818&f%5B3%5D=vendor_project%3A842&f%5B4%5D=vendor_project%3A848&f%5B5%5D=vendor_project%3A854&f%5B6%5D=vendor_project%3A859&f%5B7%5D=vendor_project%3A875&f%5B8%5D=vendor_project%3A887&f%5B9%5D=vendor_project%3A908&f%5B10%5D=vendor_project%3A910&f%5B11%5D=vendor_project%3A917&f%5B12%5D=vendor_project%3A920&f%5B13%5D=vendor_project%3A927&f%5B14%5D=vendor_project%3A932&f%5B15%5D=vendor_project%3A936&f%5B16%5D=vendor_project%3A945&f%5B17%5D=vendor_project%3A1168&f%5B18%5D=vendor_project%3A1172&page=1
- 8: https://blog.min.io/security-advisory-stackedcves/
- 9: https://docs.replicated.com/release-notes/rn-kubernetes-installer
- 10: can't list files in web console minio/console#2635
Security Issue: Outdated MinIO Version in docker-compose-test.yaml
- The specified MinIO image (
minio/minio:RELEASE.2023-02-10T18-48-39Z) is known to have multiple critical security vulnerabilities (e.g., CVE-2023-28432 and CVE-2023-28434). - These vulnerabilities enable sensitive information exposure and remote code execution.
- The issues were resolved starting with RELEASE.2023-03-20T20-16-18Z; hence, an upgrade is strongly recommended.
This reverts commit ca4b25a.
Fixes #XXXX.
Description
This PR has:
Summary by CodeRabbit