search

kubernetes-sigs / ip-masq-agent

Manage IP masquerade on nodes
Apache License 2.0
217 stars 70 forks source link

Bump iptables-distroless to v0.2.0 #98

Closed MrHohn closed 1 year ago

MrHohn commented 1 year ago

Update to use the latest iptables-distroless base image to pick up CVE fixes. Ref https://github.com/kubernetes/release/pull/2831 and https://github.com/kubernetes/release/pull/2667.

/assign@ jingyuanliang

k8s-ci-robot commented 1 year ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: MrHohn

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/kubernetes-sigs/ip-masq-agent/blob/master/OWNERS)~~ [MrHohn] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
jingyuanliang commented 1 year ago

Oh by the way, distroless-iptables is still bringing in the same CVEs that you tried to fix in 2.9.1, because of gorunner.

MrHohn commented 1 year ago

Oh by the way, distroless-iptables is still bringing in the same CVEs that you tried to fix in 2.9.1, because of gorunner.

Confirmed that is the case. Let's hold this PR and wait for a fixed distroless-iptables image. /hold

jingyuanliang commented 1 year ago

It's now already bumped to 0.2.0 but it's likely we'll need another bump for https://github.com/kubernetes/release/issues/2909 - maybe we can reuse this PR for that.

k8s-ci-robot commented 1 year ago

PR needs rebase.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
MrHohn commented 1 year ago

@jingyuanliang Thanks for your recent efforts on updating the dependency. Let me close this PR for the time being and will have a new one raised when needed.