NVIDIA / holodeck

46%

main: 48%

LAST BUILD ON BRANCH pull-request/656

branch: pull-request/656

CHANGE BRANCH

x

Reset

Sync Branches

• pull-request/656
• block-on-cloud-init
• chore/ignore_toon
• chore/remove-codeowners
• cleanup_cmd
• defaultcalicoexistingerror
• dependabot/docker/main/golang-1.25-bookworm
• dependabot/docker/main/golang-1.25.1-bookworm
• dependabot/docker/main/golang-1.25.2-bookworm
• dependabot/docker/main/golang-1.25.3-bookworm
• dependabot/docker/main/golang-1.25.4-bookworm
• dependabot/docker/main/golang-1.25.5-bookworm
• dependabot/docker/main/golang-1.25.6-bookworm
• dependabot/docker/main/golang-1.25.7-bookworm
• dependabot/docker/main/golang-1.26.0-bookworm
• dependabot/github_actions/main/actions/checkout-5
• dependabot/github_actions/main/actions/checkout-6
• dependabot/github_actions/main/actions/setup-go-6
• dependabot/github_actions/main/actions/upload-artifact-5
• dependabot/github_actions/main/actions/upload-artifact-6
• dependabot/github_actions/main/aws-actions/configure-aws-credentials-5
• dependabot/github_actions/main/aws-actions/configure-aws-credentials-6
• dependabot/github_actions/main/github/codeql-action-4
• dependabot/github_actions/main/golangci/golangci-lint-action-9
• dependabot/go_modules/golang.org/x/crypto-0.45.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-1.55.8
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2-1.36.4
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2-1.36.5
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2-1.36.6
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2-1.37.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2-1.37.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2-1.37.2
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2-1.38.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2-1.38.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2-1.39.3
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2-1.39.4
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2-1.41.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2-1.41.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.29.15
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.29.16
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.29.17
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.29.18
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.30.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.30.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.30.2
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.30.3
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.31.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.31.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.31.10
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.31.11
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.31.12
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.31.13
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.31.14
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.31.15
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.31.2
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.31.3
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.31.4
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.31.5
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.31.6
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.31.7
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.31.8
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.31.9
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.32.5
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.32.6
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/config-1.32.7
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.224.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.225.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.225.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.225.2
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.226.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.227.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.228.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.229.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.230.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.231.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.232.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.233.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.233.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.234.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.235.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.236.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.237.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.238.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.239.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.240.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.241.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.242.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.243.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.244.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.245.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.245.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.245.2
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.246.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.247.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.247.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.248.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.249.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.250.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.251.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.254.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.255.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.256.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.257.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.257.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.257.2
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.258.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.258.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.259.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.276.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.277.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.279.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.279.2
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.280.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.281.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.282.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.283.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.284.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.285.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.286.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.287.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ec2-1.288.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.59.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.59.2
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.59.3
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.60.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.60.2
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.61.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.61.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.62.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.63.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.63.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.63.2
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.64.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.64.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.64.2
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.64.3
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.65.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.66.0
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.66.1
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.66.2
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.67.6
• dependabot/go_modules/main/github.com/aws/aws-sdk-go-v2/service/ssm-1.67.8
• dependabot/go_modules/main/github.com/onsi/ginkgo/v2-2.24.0
• dependabot/go_modules/main/github.com/onsi/ginkgo/v2-2.25.0
• dependabot/go_modules/main/github.com/onsi/ginkgo/v2-2.25.3
• dependabot/go_modules/main/github.com/onsi/ginkgo/v2-2.26.0
• dependabot/go_modules/main/github.com/onsi/ginkgo/v2-2.27.3
• dependabot/go_modules/main/github.com/onsi/ginkgo/v2-2.27.4
• dependabot/go_modules/main/github.com/onsi/ginkgo/v2-2.27.5
• dependabot/go_modules/main/github.com/onsi/ginkgo/v2-2.28.1
• dependabot/go_modules/main/github.com/onsi/gomega-1.38.0
• dependabot/go_modules/main/github.com/onsi/gomega-1.38.1
• dependabot/go_modules/main/github.com/onsi/gomega-1.38.2
• dependabot/go_modules/main/github.com/onsi/gomega-1.38.3
• dependabot/go_modules/main/github.com/onsi/gomega-1.39.0
• dependabot/go_modules/main/github.com/onsi/gomega-1.39.1
• dependabot/go_modules/main/github.com/pkg/sftp-1.13.10
• dependabot/go_modules/main/github.com/stretchr/testify-1.11.0
• dependabot/go_modules/main/github.com/stretchr/testify-1.11.1
• dependabot/go_modules/main/github.com/urfave/cli/v2-2.27.7
• dependabot/go_modules/main/golang.org/x/crypto-0.39.0
• dependabot/go_modules/main/golang.org/x/crypto-0.40.0
• dependabot/go_modules/main/golang.org/x/crypto-0.41.0
• dependabot/go_modules/main/golang.org/x/crypto-0.42.0
• dependabot/go_modules/main/golang.org/x/crypto-0.43.0
• dependabot/go_modules/main/golang.org/x/crypto-0.46.0
• dependabot/go_modules/main/golang.org/x/crypto-0.47.0
• dependabot/go_modules/main/golang.org/x/crypto-0.48.0
• dependabot/go_modules/main/k8sio-47abe080f4
• dependabot/go_modules/main/k8sio-80a87f12e3
• dependabot/go_modules/main/k8sio-d807757c60
• dependabot/go_modules/main/k8sio-dbd9998f0c
• dependabot/go_modules/main/k8sio-e5ff8d028a
• dependabot/go_modules/main/k8sio-f4d5b31de9
• dependabot/go_modules/main/sigs.k8s.io/controller-runtime-0.22.1
• dependabot/go_modules/main/sigs.k8s.io/controller-runtime-0.22.2
• dependabot/go_modules/main/sigs.k8s.io/controller-runtime-0.22.3
• dependabot/go_modules/main/sigs.k8s.io/controller-runtime-0.23.0
• dependabot/go_modules/main/sigs.k8s.io/controller-runtime-0.23.1
• dependabot/go_modules/main/sigs.k8s.io/yaml-1.5.0
• dependabot/go_modules/main/sigs.k8s.io/yaml-1.6.0
• devel/toolkit
• docs
• e2e-badge
• feat/562-multinode-cluster
• feat/563-cli-crud-operations
• feat/564-idempotent-templates
• feat/566-nct-multiple-sources
• feat/568-ami-os-mapping
• feat/571-test-coverage
• feat/571-test-coverage-phase3
• feat/aws-provider-tests
• feat/aws-retry-logic
• feat/docs-new-commands
• feat/elb-nlb-integration
• feat/issue-567-docs-tests
• feat/issue-567-driver-sources
• feat/issue-567-provenance
• feat/issue-567-runtime-sources
• feat/provision-validate-tests
• fix/586-source-dest-check-single-node
• fix/address-ignored-errors
• fix/arm64-ami-arch-validation
• fix/arm64-cluster-arch-propagation
• fix/arm64-kubernetes-arch-default
• fix/arm64-nvidia-driver-cuda-repo
• fix/cleanup-context-timeout
• fix/cleanup-partial-failures
• fix/cleanup-signal-goroutine
• fix/cluster-error-chain
• fix/cluster-join-credentials
• fix/cluster-shell-injection
• fix/connect-or-die
• fix/context-timeouts-create
• fix/error-wrapping-pkg
• fix/instance-id-errors
• fix/kubeconfig-file-permissions
• fix/kubeconfig-ssh-leak
• fix/logger-active-cancels
• fix/logger-per-invocation-context
• fix/nlb-error-handling
• fix/phase0-critical-bugs
• fix/phase1-security-concurrency
• fix/phase2-refactoring-tests
• fix/phase3-longterm-improvements
• fix/provisioner-kind-config
• fix/provisioner-ssh-leaks
• fix/retry-count-message
• fix/retry-jitter-nil
• fix/scp-mkdir-error
• fix/security-group-cidr
• fix/security-group-fallback
• fix/ssh-host-key-consistency
• fix/ssh-provider-nil-panic
• fix/ssh-tofu-cli-commands
• fix/template-input-validation
• fix/tofu-race-condition
• fix_create
• fix_ips
• fix_nvdriver_branch
• get_ip
• github-project-management
• main
• pull-request/382
• pull-request/383
• pull-request/384
• pull-request/385
• pull-request/388
• pull-request/398
• pull-request/407
• pull-request/413
• pull-request/416
• pull-request/418
• pull-request/422
• pull-request/423
• pull-request/424
• pull-request/425
• pull-request/426
• pull-request/432
• pull-request/433
• pull-request/434
• pull-request/435
• pull-request/436
• pull-request/443
• pull-request/444
• pull-request/459
• pull-request/460
• pull-request/463
• pull-request/464
• pull-request/466
• pull-request/470
• pull-request/473
• pull-request/491
• pull-request/492
• pull-request/497
• pull-request/498
• pull-request/499
• pull-request/500
• pull-request/501
• pull-request/502
• pull-request/503
• pull-request/504
• pull-request/511
• pull-request/513
• pull-request/516
• pull-request/517
• pull-request/541
• pull-request/543
• pull-request/552
• pull-request/553
• pull-request/561
• pull-request/570
• pull-request/576
• pull-request/577
• pull-request/578
• pull-request/584
• pull-request/585
• pull-request/588
• pull-request/589
• pull-request/592
• pull-request/593
• pull-request/594
• pull-request/597
• pull-request/599
• pull-request/608
• pull-request/609
• pull-request/610
• pull-request/611
• pull-request/612
• pull-request/613
• pull-request/614
• pull-request/615
• pull-request/616
• pull-request/617
• pull-request/618
• pull-request/621
• pull-request/622
• pull-request/623
• pull-request/624
• pull-request/625
• pull-request/628
• pull-request/629
• pull-request/630
• pull-request/631
• pull-request/634
• pull-request/635
• pull-request/637
• pull-request/640
• pull-request/641
• pull-request/642
• pull-request/643
• pull-request/644
• pull-request/645
• pull-request/646
• pull-request/647
• pull-request/648
• pull-request/649
• pull-request/650
• pull-request/651
• pull-request/652
• pull-request/653
• pull-request/654
• pull-request/655
• pull-request/657
• pull-request/659
• pull-request/660
• pull-request/661
• pull-request/662
• pull-request/663
• pull-request/664
• release-0.2
• revert_aws-actions
• v0212

Build # 21963089057

Build Type

push

github

Committed by ArangoGutierrez

Commit Message

fix(security): validate node labels and IPs before shell interpolation

User-controlled label keys/values from YAML config were directly
interpolated into kubectl commands via fmt.Sprintf, enabling command
injection. Add label validation against Kubernetes label pattern.
Also validate PrivateIP with net.ParseIP before grep interpolation.

Audit findings #17 (MEDIUM), #18 (MEDIUM).

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

Run Details

0 of 5 new or added lines in 1 file covered. (0.0%)

2289 of 4988 relevant lines covered (45.89%)

0.51 hits per line