fluent / fluent-operator

Operate Fluent Bit and Fluentd in the Kubernetes way - Previously known as FluentBit Operator
Apache License 2.0
554 stars 227 forks source link

bug: Security: CVEs in suggested (EOL) image for fluentd #1166

Open max-allan opened 1 month ago

max-allan commented 1 month ago

Describe the issue

From the helm values file:

    repository: "kubesphere/fluentd"
    tag: "v1.15.3"

That image has (according to Grype) a lot of vulnerabilities:

 3 critical, 5 high, 22 medium, 1 low, 0 negligible

Also, fluentd 1.15.3 is EOL.

Anywhere that image is referenced will need updating, not just that location in the chart.

In addition, fluent-bit 2.2.2 is EOL in a few weeks time.

To Reproduce

See the values file

Expected behavior

Current/supported versions of fluentd and fluent-bit are used by default.

Your Environment

- Fluent Operator version: 2.8.0
- Container Runtime: any
- Operating system: any
- Kernel version: any

How did you install fluent operator?

Helm

Additional context

No response

benjaminhuo commented 1 month ago

@max-allan Good point, we do need hands to upgrade and test new version of fluentd and fluentbit