WIP - CVE-2023-44487: Mitigate HTTP/2 Rapid Reset

[adambkaplan]

Update base golang version and grpc dependency to mitigate CVE-2023-44487 (HTTP/2 Rapid Reset) denial of service attack. grpc is an indirect dependency used in our Kubernetes client libraries. Overall risk for the operator is low, since the operator's typical deployment does not expose an HTTP server that is reachable over the internet (it does deploy a Prometheus metrics server, but that should not be exposed to the general internet).

Changes

Submitter Checklist

• Includes tests if functionality changed/was added
• Includes docs if changes are user-facing
• Set a kind label on this PR
• Release notes block has been filled in, or marked NONE

See the contributor guide
for details on coding conventions, github and prow interactions, and the code review process.

Release Notes

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from adambkaplan. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[adambkaplan]

/close

No substantial differences between this an #157. Will create a separate PR for updating golang to 1.20.

[openshift-ci]

@adambkaplan: Closed this PR.

In response to this:

/close

No substantial differences between this an #157. Will create a separate PR for updating golang to 1.20.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.