Replace io.ReadAll with safeio.ReadAllLimit

Replace io.ReadAll with safeio.ReadAllLimit so that custom-vet-check.sh
[^1] doesn't complain when cilium-cli gets merged with cilium repo [^2].

For Cilium pod logs, set the limit to 1GB. 1GB of Cilium pod logs ought
to be enough for anybody.

[^1]: https://github.com/cilium/cilium/blob/main/contrib/scripts/custom-vet-check.sh
[^2]: cilium/design-cfps#9

Signed-off-by: Michi Mutsuzaki <[email protected]>

cli/version.go

@@ -5,11 +5,11 @@ package cli
 
 import (
 	"fmt"
-	"io"
 	"net/http"
 	"runtime"
 	"strings"
 
+	"github.com/cilium/cilium/pkg/safeio"
 	"github.com/spf13/cobra"
 
 	"github.com/cilium/cilium-cli/defaults"
@@ -22,7 +22,7 @@ func getLatestStableVersion() string {
 	}
 	defer resp.Body.Close()
 
-	b, err := io.ReadAll(resp.Body)
+	b, err := safeio.ReadAllLimit(resp.Body, safeio.KB)
 	if err != nil {
 		return "unknown"
 	}

k8s/client.go

@@ -18,6 +18,12 @@ import (
 	"time"
 
 	"github.com/blang/semver/v4"
+	"github.com/cilium/cilium/api/v1/models"
+	ciliumv2 "github.com/cilium/cilium/pkg/k8s/apis/cilium.io/v2"
+	ciliumv2alpha1 "github.com/cilium/cilium/pkg/k8s/apis/cilium.io/v2alpha1"
+	ciliumClientset "github.com/cilium/cilium/pkg/k8s/client/clientset/versioned"
+	"github.com/cilium/cilium/pkg/safeio"
+	"github.com/cilium/cilium/pkg/versioncheck"
 	"helm.sh/helm/v3/pkg/action"
 	"helm.sh/helm/v3/pkg/cli/output"
 	appsv1 "k8s.io/api/apps/v1"
@@ -44,12 +50,6 @@ import (
 	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
 	"k8s.io/client-go/transport/spdy"
 
-	"github.com/cilium/cilium/api/v1/models"
-	ciliumv2 "github.com/cilium/cilium/pkg/k8s/apis/cilium.io/v2"
-	ciliumv2alpha1 "github.com/cilium/cilium/pkg/k8s/apis/cilium.io/v2alpha1"
-	ciliumClientset "github.com/cilium/cilium/pkg/k8s/client/clientset/versioned"
-	"github.com/cilium/cilium/pkg/versioncheck"
-
 	"github.com/cilium/cilium-cli/defaults"
 )
 
@@ -320,8 +320,8 @@ func (c *Client) CiliumLogs(ctx context.Context, namespace, pod string, since ti
 	}
 	defer podLogs.Close()
 
-	log, err := io.ReadAll(podLogs)
-	if err != nil {
+	log, err := safeio.ReadAllLimit(podLogs, safeio.GB)
+	if err != nil && !errors.Is(err, safeio.ErrLimitReached) {
 		return "", fmt.Errorf("error reading log: %w", err)
 	}
 
@@ -827,7 +827,7 @@ func stream(conn httpstream.Connection, port uint16, handler func(io.ReadWriteCl
 	errorDone := make(chan error)
 	go func() {
 		defer close(errorDone)
-		message, err := io.ReadAll(errorStream)
+		message, err := safeio.ReadAllLimit(errorStream, safeio.KB)
 		switch {
 		case err != nil:
 			errorDone <- fmt.Errorf("reading from error stream: %w", err)

sysdump/sysdump_test.go

@@ -19,6 +19,7 @@ import (
 	"github.com/cilium/cilium/api/v1/models"
 	ciliumv2 "github.com/cilium/cilium/pkg/k8s/apis/cilium.io/v2"
 	ciliumv2alpha1 "github.com/cilium/cilium/pkg/k8s/apis/cilium.io/v2alpha1"
+	"github.com/cilium/cilium/pkg/safeio"
 	"github.com/stretchr/testify/assert"
 	appsv1 "k8s.io/api/apps/v1"
 	batchv1 "k8s.io/api/batch/v1"
@@ -184,7 +185,7 @@ func TestKVStoreTask(t *testing.T) {
 	})
 	fd, err := os.Open(path.Join(collector.sysdumpDir, "kvstore-heartbeat.json"))
 	assert.NoError(err)
-	data, err := io.ReadAll(fd)
+	data, err := safeio.ReadAllLimit(fd, safeio.KB)
 	assert.NoError(err)
 	assert.Equal([]byte("{}"), data)
 }

vendor/modules.txt

@@ -211,6 +211,7 @@ github.com/cilium/cilium/pkg/policy/types
 github.com/cilium/cilium/pkg/promise
 github.com/cilium/cilium/pkg/rate
 github.com/cilium/cilium/pkg/rate/metrics
+github.com/cilium/cilium/pkg/safeio
 github.com/cilium/cilium/pkg/safetime
 github.com/cilium/cilium/pkg/service/store
 github.com/cilium/cilium/pkg/slices