CSM CSM 1.15.2 updates

.gitignore

@@ -11,4 +11,6 @@ gofsutil/
 .idea
 .vscode
 *.log
+csm-common.mk
 go-code-tester
+vendor/

Dockerfile

@@ -11,33 +11,90 @@
 # limitations under the License
 
 # some arguments that must be supplied
-ARG GOPROXY
 ARG GOIMAGE
 ARG BASEIMAGE
-ARG DIGEST
 
 # Stage to build the driver
 FROM $GOIMAGE as builder
-ARG GOPROXY
 RUN mkdir -p /go/src
 COPY ./ /go/src/
+
 WORKDIR /go/src/
-RUN CGO_ENABLED=0 \
-    make build
+RUN make build
 
 # Stage to build the driver image
-FROM $BASEIMAGE AS final
-ENTRYPOINT ["/csi-vxflexos.sh"]
-# copy in the driver
-COPY --from=builder /go/src/csi-vxflexos /
-COPY "csi-vxflexos.sh" /
-RUN chmod +x /csi-vxflexos.sh
+FROM registry.access.redhat.com/ubi9/ubi@sha256:b07f5c75ad9669fa90a3aab2ccd4eb85d5a862265b09a695997ebe2be699bd20 AS final
+
+# CVE remediation: update all packages to latest security fixes
+# Addresses: CVE-2025-32462, CVE-2025-68973, CVE-2024-10963, CVE-2025-6965,
+#            CVE-2026-3497, CVE-2024-12718, CVE-2025-4517, CVE-2026-28417, CVE-2026-33412
+RUN dnf upgrade --security -y && \
+    dnf clean all
+
+# Explicit upgrades for available high CVE fixes:
+# CVE-2026-34982 (vim-minimal) -> fixed in 2:8.2.2637-23.el9_7.3
+# CVE-2026-4878  (libcap)      -> fixed in 2.48-10.el9_7.1
+RUN dnf upgrade -y vim-minimal libcap && \
+    dnf clean all
+
+# Install required packages with security fixes
+RUN dnf install -y \
+    python3-3.9.* \
+    openssh-8.* \
+    gnupg2-2.3.* \
+    sqlite-3.* \
+    && dnf clean all
+
+# Install packages available from standard UBI repositories
+RUN dnf install -y \
+    acl \
+    bzip2 \
+    gnutls \
+    gzip \
+    hostname \
+    kmod \
+    libaio \
+    libuuid \
+    libxcrypt-compat \
+    nettle \
+    numactl \
+    openssl \
+    rpm \
+    systemd \
+    tar \
+    util-linux \
+    which \
+    && dnf clean all
+
+# Install packages that are only available from full RHEL repositories.
+# These packages (device-mapper-multipath, e2fsprogs, libblockdev, nfs-utils,
+# nfs4-acl-tools, xfsprogs) are not shipped in any UBI repo.
+# The Dell internal RHEL mirror is configured inline, used to install, then removed
+# so no subscription artefacts remain in the final image layer.
+RUN printf '[rhel-9-baseos]\nname=RHEL 9 BaseOS\nbaseurl=http://rhel-update.cec.lab.emc.com/rhel-9-for-x86_64-baseos-rpms\ngpgcheck=0\nsslverify=0\nenabled=1\n\n[rhel-9-appstream]\nname=RHEL 9 AppStream\nbaseurl=http://rhel-update.cec.lab.emc.com/rhel-9-for-x86_64-appstream-rpms\ngpgcheck=0\nsslverify=0\nenabled=1\n' > /etc/yum.repos.d/dell-rhel.repo && \
+    dnf install -y \
+    device-mapper-multipath \
+    e2fsprogs \
+    libblockdev \
+    nfs-utils \
+    nfs4-acl-tools \
+    xfsprogs \
+    && dnf clean all && \
+    rm -f /etc/yum.repos.d/dell-rhel.repo
+
 LABEL vendor="Dell Technologies" \
     maintainer="Dell Technologies" \
     name="csi-powerflex" \
     summary="CSI Driver for Dell EMC PowerFlex" \
     description="CSI Driver for provisioning persistent storage from Dell EMC PowerFlex" \
-    release="1.15.0" \
-    version="2.15.0" \
+    release="1.15.2" \
+    version="2.15.2" \
     license="Apache-2.0"
+
+# copy in the driver
+COPY --from=builder /go/src/csi-vxflexos /
+COPY "csi-vxflexos.sh" /
+RUN chmod +x /csi-vxflexos.sh
 COPY ./licenses /licenses
+
+ENTRYPOINT ["/csi-vxflexos.sh"]

Makefile

@@ -18,30 +18,35 @@ help:
 	@echo "integration-test - Runs the integration tests. Requires access to an array"
 	@echo "push             - Pushes the built container to a target registry"
 	@echo "unit-test        - Runs the unit tests"
+	@echo "vendor 			- Downloads a vendor list (local copy) of repositories required to compile the repo."
 	@echo
 	@make -s overrides-help
 
 # Clean the build
 clean:
 	rm -f core/core_generated.go
 	rm -f semver.mk
+	rm -rf csm-common.mk
+	rm -rf vendor
 	go clean
 
-# Dependencies
-dependencies:
+generate:
 	go generate
-	go run core/semver/semver.go -f mk >semver.mk
+	go run core/semver/semver.go -f mk > semver.mk
+
+vendor:
+	GOPRIVATE=github.com go mod vendor
 
 # Build the driver locally
-build: dependencies
-	CGO_ENABLED=0 GOOS=linux GO111MODULE=on go build
+build: generate
+	CGO_ENABLED=0 GOOS=linux GO111MODULE=on go build -mod=vendor  
 
 # Generates the docker container (but does not push)
-docker: dependencies
+docker: generate vendor
 	make -f docker.mk docker
 
 # Generates the docker container with no cache (but does not push)
-docker-no-cache: dependencies
+docker-no-cache: generate vendor
 	make -f docker.mk docker-no-cache
 
 # Pushes container to the repository
@@ -60,23 +65,6 @@ integration-test:
 check:
 	@scripts/check.sh ./provider/ ./service/
 
-.PHONY: actions action-help
-actions: ## Run all GitHub Action checks that run on a pull request creation
-	@echo "Running all GitHub Action checks for pull request events..."
-	@act -l | grep -v ^Stage | grep pull_request | grep -v image_security_scan | awk '{print $$2}' | while read WF; do \
-		echo "Running workflow: $${WF}"; \
-		act pull_request --no-cache-server --platform ubuntu-latest=ghcr.io/catthehacker/ubuntu:act-latest --job "$${WF}"; \
-	done
-
 go-code-tester:
 	curl -o go-code-tester -L https://raw.githubusercontent.com/dell/common-github-actions/main/go-code-tester/entrypoint.sh \
 	&& chmod +x go-code-tester
-
-action-help: ## Echo instructions to run one specific workflow locally
-	@echo "GitHub Workflows can be run locally with the following command:"
-	@echo "act pull_request --no-cache-server --platform ubuntu-latest=ghcr.io/catthehacker/ubuntu:act-latest --job <jobid>"
-	@echo ""
-	@echo "Where '<jobid>' is a Job ID returned by the command:"
-	@echo "act -l"
-	@echo ""
-	@echo "NOTE: if act is not installed, it can be downloaded from https://github.com/nektos/act"

README.md

@@ -1,3 +1,20 @@
+# :lock: **Important Notice**
+Starting with the release of **Container Storage Modules v1.16.0**, this repository will no longer be maintained as an open source project. Future development will continue under a closed source model. This change reflects our commitment to delivering even greater value to our customers by enabling faster innovation and more deeply integrated features with the Dell storage portfolio.<br>
+For existing customers using Dell’s Container Storage Modules, you will continue to receive:
+* **Ongoing Support & Community Engagement**<br>
+       You will continue to receive high-quality support through Dell Support and our community channels. Your experience of engaging with the Dell community remains unchanged.
+* **Streamlined Deployment & Updates**<br>
+        Deployment and update processes will remain consistent, ensuring a smooth and familiar experience.
+* **Access to Documentation & Resources**<br>
+       All documentation and related materials will remain publicly accessible, providing transparency and technical guidance.
+* **Continued Access to Current Open Source Version**<br>
+       The current open-source version will remain available under its existing license for those who rely on it.
+
+Moving to a closed source model allows Dell’s development team to accelerate feature delivery and enhance integration across our Enterprise Kubernetes Storage solutions ultimately providing a more seamless and robust experience.<br>
+We deeply appreciate the contributions of the open source community and remain committed to supporting our customers through this transition.<br>
+
+For questions or access requests, please contact the maintainers via [Dell Support](https://www.dell.com/support/kbdoc/en-in/000188046/container-storage-interface-csi-drivers-and-container-storage-modules-csm-how-to-get-support).
+
 # CSI Driver for Dell PowerFlex
 
 [![Go Report Card](https://goreportcard.com/badge/github.com/dell/csi-vxflexos?style=flat-square)](https://goreportcard.com/report/github.com/dell/csi-vxflexos)
@@ -49,4 +66,3 @@ Also, if the `X_CSI_VXFLEXOS_SDCGUID` environment variable is not set, the drive
 ## Documentation
 For more detailed information on the driver, please refer to [Container Storage Modules documentation](https://dell.github.io/csm-docs/).
 
-

core/semver/semver.go

@@ -362,7 +362,7 @@ var OSExit = func(code int) {
 // GetExitError is a wrapper around exec.ExitError
 var GetExitError = func(err error) (e *exec.ExitError, ok bool) {
 	e, ok = err.(*exec.ExitError)
-	return
+	return e, ok
 }
 
 // GetStatusError is a wrapper around syscall.WaitStatus

core/semver/semver_test.go

@@ -299,7 +299,7 @@ func TestErrorExit(t *testing.T) {
 		return
 	}
 	// call the test again with INVOKE_ERROR_EXIT=1 so the errorExit function is invoked and we can check the return code
-	cmd := exec.Command(os.Args[0], "-test.run=TestErrorExit") // #nosec G204
+	cmd := exec.Command(os.Args[0], "-test.run=TestErrorExit") // #nosec G204,G702
 	cmd.Env = append(os.Environ(), "INVOKE_ERROR_EXIT=1")
 
 	stderr, err := cmd.StderrPipe()

dell-csi-helm-installer/README.md

@@ -36,7 +36,7 @@ This project provides the following capabilitites, each one is discussed in deta
 
 
 Most of these usages require the creation/specification of a values file. These files specify configuration settings that are passed into the driver and configure it for use. To create one of these files, the following steps should be followed:
-1. Download a template file for the driver to a new location, naming this new file is at the users discretion. The template files are always found at `https://github.com/dell/helm-charts/raw/csi-vxflexos-2.15.0/charts/csi-vxflexos/values.yaml`
+1. Download a template file for the driver to a new location, naming this new file is at the users discretion. The template files are always found at `https://github.com/dell/helm-charts/raw/csi-vxflexos-2.15.2/charts/csi-vxflexos/values.yaml`
 2. Edit the file such that it contains the proper configuration settings for the specific environment. These files are yaml formatted so maintaining the file structure is important.
 
 For example, to create a values file for the PowerFlex driver the following steps can be executed
@@ -45,7 +45,7 @@ For example, to create a values file for the PowerFlex driver the following step
 cd dell-csi-helm-installer
 
 # download the template file
- wget -O my-vxflexos-settings.yaml  https://github.com/dell/helm-charts/raw/csi-vxflexos-2.15.0/charts/csi-vxflexos/values.yaml
+ wget -O my-vxflexos-settings.yaml  https://github.com/dell/helm-charts/raw/csi-vxflexos-2.15.2/charts/csi-vxflexos/values.yaml
 
 # edit the newly created values file
 vi my-vxflexos-settings.yaml

dell-csi-helm-installer/csi-install.sh

@@ -20,8 +20,8 @@ PROG="${0}"
 NODE_VERIFY=1
 VERIFY=1
 MODE="install"
-DEFAULT_DRIVER_VERSION="v2.15.0"
-DRIVERVERSION="csi-vxflexos-2.15.0"
+DEFAULT_DRIVER_VERSION="v2.15.2"
+DRIVERVERSION="csi-vxflexos-2.15.2"
 WATCHLIST=""
 
 # export the name of the debug log, so child processes will see it

dell-csi-helm-installer/csi-offline-bundle.md

@@ -84,7 +84,7 @@ For example, here is the output of a request to build an offline bundle for the
    quay.io/dell/container-storage-modules/csi-powermax:v2.15.0
    quay.io/dell/container-storage-modules/csi-powerstore:v2.15.0
    quay.io/dell/container-storage-modules/csi-unity:v2.15.0
-   quay.io/dell/container-storage-modules/csi-vxflexos:v2.15.0
+   quay.io/dell/container-storage-modules/csi-vxflexos:v2.15.2
    quay.io/dell/container-storage-modules/csm-authorization-sidecar:v1.14.0
    quay.io/dell/container-storage-modules/csm-metrics-powerflex:v1.12.0
    quay.io/dell/container-storage-modules/csm-metrics-powerscale:v1.9.0

dell-csi-helm-installer/csi-offline-bundle.sh

@@ -236,7 +236,7 @@ DRIVER="csi-vxflexos"
 SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
 REPODIR="$( dirname "${SCRIPTDIR}" )"
 
-DRIVERVERSION="csi-vxflexos-2.15.0"
+DRIVERVERSION="csi-vxflexos-2.15.2"
 
 while getopts "cprv:h" opt; do
   case $opt in

docker.mk

@@ -21,14 +21,15 @@ docker: download-csm-common
 	@echo "Building: $(REGISTRY)/$(IMAGENAME):$(IMAGETAG)"
 	$(BUILDER) build --pull $(NOCACHE) -t "$(REGISTRY)/$(IMAGENAME):$(IMAGETAG)" --target $(BUILDSTAGE) --build-arg GOPROXY --build-arg BASEIMAGE=$(CSM_BASEIMAGE) --build-arg GOIMAGE=$(DEFAULT_GOIMAGE)  .
 
-docker-no-cache: download-csm-common
+docker-no-cache:
 	@echo "Building with --no-cache ..."
 	@make docker NOCACHE=--no-cache
 
 push:
 	@echo "Pushing: $(REGISTRY)/$(IMAGENAME):$(IMAGETAG)"
 	$(BUILDER) push "$(REGISTRY)/$(IMAGENAME):$(IMAGETAG)"
 
-
 download-csm-common:
-	curl -O -L https://raw.githubusercontent.com/dell/csm/main/config/csm-common.mk
+	git clone --depth 1 git@github.com:dell/csm.git temp-repo
+	cp temp-repo/config/csm-common.mk .
+	rm -rf temp-repo

go.mod

@@ -6,26 +6,26 @@ module github.com/dell/csi-vxflexos/v2
 go 1.25
 
 require (
+	github.com/dell/dell-csi-extensions/common v1.9.1-0.20250930070920-a5efa6761ce1
+	github.com/dell/dell-csi-extensions/podmon v1.9.1-0.20250930070920-a5efa6761ce1
+	github.com/dell/dell-csi-extensions/replication v1.12.1-0.20250930070920-a5efa6761ce1
+	github.com/dell/dell-csi-extensions/volumeGroupSnapshot v1.8.1
+	github.com/dell/gocsi v1.15.1-0.20250930113136-950340479c4e
+	github.com/dell/gofsutil v1.20.1-0.20250930113120-64ce760f715a
+	github.com/dell/goscaleio v1.21.1-0.20250930120611-ef836f9c4afa
 	github.com/apparentlymart/go-cidr v1.1.0
 	github.com/container-storage-interface/spec v1.6.0
 	github.com/cucumber/godog v0.15.0
-	github.com/dell/dell-csi-extensions/common v1.9.0
-	github.com/dell/dell-csi-extensions/podmon v1.9.0
-	github.com/dell/dell-csi-extensions/replication v1.12.0
-	github.com/dell/dell-csi-extensions/volumeGroupSnapshot v1.8.1
-	github.com/dell/gocsi v1.15.0
-	github.com/dell/gofsutil v1.20.0
-	github.com/dell/goscaleio v1.21.0
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
 	github.com/kubernetes-csi/csi-lib-utils v0.11.0
 	github.com/sirupsen/logrus v1.9.3
-	github.com/spf13/viper v1.20.0
-	github.com/stretchr/testify v1.11.0
-	golang.org/x/net v0.43.0
-	google.golang.org/grpc v1.75.0
-	google.golang.org/protobuf v1.36.6
+	github.com/spf13/viper v1.21.0
+	github.com/stretchr/testify v1.11.1
+	golang.org/x/net v0.48.0
+	google.golang.org/grpc v1.79.3
+	google.golang.org/protobuf v1.36.10
 	k8s.io/api v0.34.0
 	k8s.io/apimachinery v0.34.0
 	k8s.io/client-go v0.34.0
@@ -61,14 +61,14 @@ require (
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/sagikazarmark/locafero v0.7.0 // indirect
-	github.com/sourcegraph/conc v0.3.0 // indirect
-	github.com/spf13/afero v1.12.0 // indirect
-	github.com/spf13/cast v1.7.1 // indirect
-	github.com/spf13/pflag v1.0.9 // indirect
+	github.com/sagikazarmark/locafero v0.11.0 // indirect
+	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
@@ -79,13 +79,13 @@ require (
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sys v0.36.0 // indirect
-	golang.org/x/term v0.34.0 // indirect
-	golang.org/x/text v0.28.0 // indirect
+	golang.org/x/oauth2 v0.34.0 // indirect
+	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/term v0.38.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
 	golang.org/x/time v0.9.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect