Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

update debian-base to buster-v1.3.0 for CVEs #98401

Merged
merged 3 commits into from Jan 27, 2021
Merged

update debian-base to buster-v1.3.0 for CVEs #98401

merged 3 commits into from Jan 27, 2021

Conversation

pacoxu
Copy link
Member

@pacoxu pacoxu commented Jan 26, 2021 •
edited

What type of PR is this?
/kind feature
Continuation of kubernetes/k8s.io#1555 @justaugustus .

What this PR does / why we need it:

  • debian-base to buster-v1.3.0
  • debian-iptables to buster-v1.4.0
  • etcd to 3.4.13-2 (need update after etcd image promote)

images: Build debian-iptables:buster-v1.4.0

releng: Promote debian-base v1.3.0 images

Which issue(s) this PR fixes:

Fixes #97320

Special notes for your reviewer:

Addresses:

Does this PR introduce a user-facing change?:

- base-images: Update to debian-iptables:buster-v1.4.0
  - Uses iptables 1.8.5
- base-images: Update to debian-base:buster-v1.3.0
- cluster/images/etcd: Build etcd:3.4.13-2 image
  - Uses debian-base:buster-v1.3.0

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

@pacoxu
update debian-base to buster-v1.3.0 for CVEs
f76be69 
Signed-off-by: pacoxu <paco.xu@daocloud.io>
@k8s-ci-robot k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Jan 26, 2021
@k8s-ci-robot k8s-ci-robot added area/release-eng Issues or PRs related to the Release Engineering subproject sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. and removed do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Jan 26, 2021
@pacoxu
update debian-iptables to buster-v1.4.0 for base change
03048e8 
Signed-off-by: pacoxu <paco.xu@daocloud.io>
@k8s-ci-robot k8s-ci-robot added area/test sig/testing Categorizes an issue or PR as relevant to SIG Testing. labels Jan 26, 2021
@justaugustus
Copy link
Member

Wonderful. Thanks for doing this!
@pacoxu -- just a note for future... please check-in with the @kubernetes/release-engineering team before issuing image updates, just to ensure we don't duplicate work (e.g., this was on my list today 🙃 )

/lgtm
/approve
/assign @dims

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jan 26, 2021
@wenjiaswe
Copy link
Contributor

wenjiaswe commented Jan 26, 2021 •
edited

etcd revision part looks good to me. Thanks!
/lgtm
/approve
cc @ptabor

@pacoxu
Copy link
Member Author

pacoxu commented Jan 26, 2021 •
edited

@justaugustus Sorry for that. I start from #97320. At first the debian-base image is not ready and I found that you have promoted the Debian-base image days ago when I updated the metadata-concealment image in #97789 and learned the image-promote process.

Indeed, there are two extra image updates PR from me.

I will check-in with the @kubernetes/release-engineering team next time.
Sorry if I mess up your plan.

@dims
Copy link
Member

dims commented Jan 26, 2021

/approve

@justaugustus
Copy link
Member

I will check-in with the @kubernetes/release-engineering team next time.
Sorry if I mess up your plan.

To be clear, you're saving me work, so I'm appreciative! 💕

@dims
Copy link
Member

dims commented Jan 26, 2021

/assign @mkumatag

@leilajal
Copy link
Contributor

/remove-sig api-machinery

@k8s-ci-robot k8s-ci-robot removed the sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. label Jan 26, 2021
@mkumatag
Copy link
Member

/lgtm
/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims, justaugustus, mkumatag, pacoxu, wenjiaswe

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 27, 2021
@pacoxu
Copy link
Member Author

pacoxu commented Jan 27, 2021

/triage accepted

@k8s-ci-robot k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Jan 27, 2021
@pacoxu
Copy link
Member Author

pacoxu commented Jan 27, 2021

/priority critical-urgent
As kubernetes/k8s.io#1555

@k8s-ci-robot k8s-ci-robot added priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now. and removed needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Jan 27, 2021
@k8s-ci-robot k8s-ci-robot merged commit a8e8193 into kubernetes:master Jan 27, 2021
@k8s-ci-robot k8s-ci-robot added this to the v1.21 milestone Jan 27, 2021
@hakman
Copy link
Member

hakman commented Jan 27, 2021

@justaugustus Sorry to intrude with some somehow related issue.
I was hoping that this will fix also the architecture in the metadata for kube-proxy images distributed as .tar files, like:
https://storage.googleapis.com/kubernetes-release-dev/ci/v1.21.0-alpha.2.25+15252db5f232e4/bin/linux/arm64/kube-proxy.tar

For this one at least, the metadata still shows amd64 as architecture:

% docker load -i kube-proxy.tar                                                                                  
Loaded image: k8s.gcr.io/kube-proxy-arm64:v1.21.0-alpha.2.25_15252db5f232e4

% docker inspect --format='{{.Architecture}}' k8s.gcr.io/kube-proxy-arm64:v1.21.0-alpha.2.25_15252db5f232e4                     
amd64

These images are sideloaded by kOps for e2e tests and containerd refuses to load them without proper architecture:
https://testgrid.k8s.io/kops-misc#kops-aws-arm64-ci

@justaugustus
Copy link
Member

@hakman -- @saschagrunert is working on this in kubernetes/k8s.io#1580 / kubernetes/release#1877.

Slack discussion here: https://kubernetes.slack.com/archives/CJH2GBF7Y/p1611750991071700

@pacoxu
Copy link
Member Author

pacoxu commented Jan 27, 2021

@justaugustus thanks for the information. feel free to ping me if any help is needed

@pacoxu
Copy link
Member Author

pacoxu commented Jan 27, 2021 •
edited

So need I revert this PR？ @justaugustus

Or just wait for next version.

@saschagrunert
Copy link
Member

So need I revert this PR？ @justaugustus

Or just wait for next version.

No need to revert, we just update as usual if all images got promoted :)

@justaugustus justaugustus mentioned this pull request Jan 29, 2021
Merged
dghubble added a commit to poseidon/kubelet that referenced this pull request Jan 29, 2021
@dghubble
Update debian-iptables base from v1.3.0 to v1.5.0
33444ce 
* kubernetes/kubernetes#98401
* kubernetes/release#1877
* kubernetes/kubernetes#98526
@dghubble dghubble mentioned this pull request Jan 29, 2021
Merged
This was referenced Feb 2, 2021
Closed
Closed
@github-actions github-actions bot mentioned this pull request Feb 3, 2021
Open
@pacoxu pacoxu mentioned this pull request Mar 30, 2021
Merged
@pacoxu pacoxu deleted the debian-base/1.3.0 branch June 23, 2021 05:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lavalamp lavalamp Awaiting requested review from lavalamp

@wenjiaswe wenjiaswe Awaiting requested review from wenjiaswe

Assignees

@dims dims

@justaugustus justaugustus

@mkumatag mkumatag

@wenjiaswe wenjiaswe

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/release-eng Issues or PRs related to the Release Engineering subproject area/test cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
None yet
Milestone
v1.21
Development

Successfully merging this pull request may close these issues.

Update apt to version 1.8.2.2 in debian base image
9 participants
@pacoxu @justaugustus @wenjiaswe @dims @leilajal @mkumatag @k8s-ci-robot @hakman @saschagrunert