search

kedacore / keda

KEDA is a Kubernetes-based Event Driven Autoscaling component. It provides event driven scale for any container running in Kubernetes
https://keda.sh
Apache License 2.0
8.38k stars 1.06k forks source link

Upgrade KEDA to use Debian 12 Distroless #5800

Closed jhawkins1 closed 4 weeks ago

jhawkins1 commented 4 months ago

Proposal

Since Debian 12 Distroless is available, as well as, the latest releases of Kubernetes and many of the Kubernetes related projects have moved to Debian 12, we would request that KEDA move to Debian 12 Distroless. The other benefit of moving to Debian 12 is there is a population of current and future Operating Systems Vulnerabilities (CVEs) that Debian is not addressing in Debian 11 but only Debian 12.

Use-Case

Alignment of OS to other Kubernetes related Projects. Reduces fan-out of multiple OSes or different versions of OSes across components. Potential benefits as to being able to obtain OS patches for vulnerabilities where Debian has decided only to fix in latest LTS release.

Is this a feature you are interested in implementing yourself?

No

Anything else?

No response

kady1711 commented 3 months ago

Following up on the proposal for migrating KEDA to Debian 12 Distroless. This move is crucial for ensuring KEDA aligns with the broader Kubernetes ecosystem, which has largely transitioned to Debian 12. Additionally, the migration to Debian 12 Distroless would address the concern of operating system vulnerabilities (CVEs) that Debian has chosen not to fix in Debian 11 but only in Debian 12.

The benefits of this migration include improved alignment with Kubernetes-related projects, reduced complexity in managing multiple OS versions, and enhanced security through access to OS patches for vulnerabilities addressed exclusively in the latest LTS release.

Could you please provide an update on the status of this proposal? Specifically, it would be helpful to know if there is a targeted release date or version number by which this migration is expected to be completed.

This information is vital for our planning and ensures that we can maintain a secure and consistent environment across our deployments.

zroubalik commented 3 months ago

This proposal is sound, are you willing to contribute this?

stale[bot] commented 1 month ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. Thank you for your contributions.

stale[bot] commented 4 weeks ago

This issue has been automatically closed due to inactivity.