Repository navigation
Sync with flant/shell-operator (alpine 3.23 base) and drop perl-utils - #5
Merged
Merged
Conversation
…t#956) Signed-off-by: Roman Berezkin <roman.berezkin@flant.com>
Sync the fork with upstream ccd0f3e (flant flant#956), which moves the image from the pinned deckhouse container-factory base (alpine 3.22.2) to golang:1.26.4-alpine3.23 and alpine:3.23. Keep our yq and kubectl. Drop perl-utils: perl 5.42.2 carries 2 Critical CVEs with no fix. The aws-tagging-operator hooks switch from shasum to busybox sha1sum (same output) in the charts PR that bumps appVersion to this build. Wiz (local build, linux/amd64): 0 Critical / 0 High. Current j4 image: 20 Critical / 85 High. PTEUDO-4980 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The rebase added controller-runtime v0.25.2 for certwatcher, which pulled k8s.io/* to v0.37.0. That breaks the upstream `make generate` check (it wants kubectl v1.37.0) and is newer than our clusters (1.35-1.36). Use the controller-runtime version upstream already has (v0.23.3, which includes certwatcher) and go back to upstream's k8s.io v0.35.8. go.mod is now upstream's plus the direct controller-runtime and go-logr requirements. make generate: no changes. Tests pass. Wiz on the image: 0 Critical / 0 High.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Merge upstream flant/shell-operator
ccd0f3e(flant#956) into this fork and dropperl-utilsfrom the runtime image.What this PR does / why we need it
The current image is built on an old pinned base (alpine 3.22.2) and has many Critical/High CVEs (python3, rsync, openssh, openssl, curl, perl).
main(ccd0f3e). The fork was one commit behind. That commit moves the Dockerfile togolang:1.26.4-alpine3.23+alpine:3.23(jq from apk) and adds an image architecture check, hook-log handling inpkg/executor, and a PR-onlyimages.yamlworkflow.perl-utils: perl has Critical CVEs with no fix. Its only consumer (shasumin the aws-tagging-operator hooks) switches to busyboxsha1sum, which gives the same output.go mod verifyOK).controller-runtimev0.23.3 (already used upstream, includes certwatcher) instead of v0.25.2, sok8s.io/*go back to v0.35.8 and match kubectl v1.35.8 (make generatepasses).How tested
go build(linux),go vetandgo testfor./pkg/executor/... ./pkg/webhook/...: OK.Special notes for your reviewer
shasum. Consumers must switch tosha1sumbefore or together with adopting it.