DROP: Upgrade go version to 1.22.2

[ChristianZaccaria]

Why are these changes needed?

• This change is required to resolve CVEs found in older go versions.
• CVE-2023-45288 affects net/http from the Go standard library in versions below 1.21.9 and below 1.22.2.
• This upgrade should be propagated to downstream branches rhoai-2.8, rhoai-2.10, and rhoai-2.11.
• This upgrade will also be made on CPaaS in KubeRay's Dockerfile for each of the mentioned branches above.

Related issue number

Jira: rhoai-2.8 https://issues.redhat.com/browse/RHOAIENG-8674
Jira: rhoai-2.10 https://issues.redhat.com/browse/RHOAIENG-8624
Jira: rhoai-2.11 https://issues.redhat.com/browse/RHOAIENG-8657

CPaaS

2.10: https://gitlab.cee.redhat.com/data-hub/rhods-cpaas-midstream/-/merge_requests/2343
2.8: will do after confirmation
2.11: will do after confirmation

Checks

• I've made sure the tests are passing.
• Testing Strategy
  • Unit tests
  • Manual tests
  • This PR is not tested :(

[astefanutti]

Do we have a solution in place to update downstream builds already?

[ChristianZaccaria]

@astefanutti working on that atm.

Planning on using the same strategy performed for Kueue: https://gitlab.cee.redhat.com/data-hub/rhods-cpaas-midstream/-/merge_requests/2315/diffs

However, I think I'm having an issue with building this odh/kuberay image with go 1.22.2, saying formatting should be 1.22. Checking if this is just my local environment. I think we shouldn't go below 1.22.2 to address the CVEs.

invalid go version '1.22.2': must match format 1.23

[ChristianZaccaria]

I forgot to update the Dockerfiles of course. - I made the update in this PR just now.

I have ran the RayJob tests on OpenShift:

With the last test failing, but that is expected.

[astefanutti]

That looks good overall, just a couple of questions:

• Why 1.22.2 and not 1.22.3?
• Should it be a DROP instead of a PATCH?

[ChristianZaccaria]

@astefanutti

1. I believe we are limited to using up-to go 1.22.2 as the image in CPaaS contains 1.22.2 and not 1.22.3
   registry-proxy.engineering.redhat.com/rh-osbs/openshift-golang-builder:v1.22.
   Slack Thread

2. I think it could be a DROP commit, but made it a PATCH to avoid accidental drops. But, you're right, a DROP commit makes more sense. - Updated

[astefanutti]

@ChristianZaccaria Thanks.