chore: build with keda-tools:1.22.5

[pauldotyu]

Provide a description of what has been changed

This PR is to build keda container images with an updated version of keda-tools with latest version of Go to resolve CVE-2024-24790, CVE-2024-24789, and CVE-2024-24791. Related PR: kedacore/test-tools#169

Also bumping github.com/Azure/azure-sdk-for-go/sdk/azidentity to resolve CVE-2024-35255.

Checklist

• Changelog has been updated and is aligned with our changelog requirements
• Commits are signed with Developer Certificate of Origin (DCO - learn more)

Fixes #

• CVE-2024-24790
• CVE-2024-24789
• CVE-2024-24791
• CVE-2024-35255

Relates to #
kedacore/test-tools#169

[JorTurFer]

I guess that we need to bump the user version too:

I'd say that it's a good moment to bump go version, don't you think @zroubalik ?

[pauldotyu]

I guess that we need to bump the user version too:

I tested locally for both go 1.21 and go 1.22 set and it seemed to work fine either way.

Also, I think we should bump go version in the Devcontainer too, right?

keda/.devcontainer/Dockerfile

Line 6 in bb53516

FROM golang:1.21.9

[JorTurFer]

Also, I think we should bump go version in the Devcontainer too, right?

Yeah, you can check all the places to change here: https://github.com/kedacore/keda/pull/5734/files

[semgrep-app]

Semgrep found 1 no-sudo-in-dockerfile finding:

• .devcontainer/Dockerfile
  • L20-83 - Triage

Avoid using sudo in Dockerfiles. Running processes as a non-root user can help reduce the potential impact of configuration errors and security vulnerabilities.

_{Ignore this finding from no-sudo-in-dockerfile.}

[pauldotyu]

Also, I think we should bump go version in the Devcontainer too, right?

Yeah, you can check all the places to change here: https://github.com/kedacore/keda/pull/5734/files

In the Devcontainer's Dockerfile, I had to change the way go modules were installed. Bumping to 1.22.5 gave me errors about running go get outside of a module. So I had to use go install instead.

Also, after looking through the Devcontainer files, there seems to be a bit of code that could use some cleanup. For instance, in the Dockerfile I see that it configures a non-root user vscode but runs as root (probably for Docker CLI). Also, might be able to leverage devcontainer features in the devcontainer.json file to load some of the tooling instead of baking them all into the container. I can create an issue for this and work on cleaning this up if that's okay.

[JorTurFer]

I can create an issue for this and work on cleaning this up if that's okay

Yeah, let's do it

[pauldotyu]

I can create an issue for this and work on cleaning this up if that's okay

Yeah, let's do it

Sounds good! Anything else I need to do for this particular pull request?

[JorTurFer]

just solve merge conflicts please 🙏
@zroubalik , do you see any problem updating golang version for the release?

[pauldotyu]

Merge conflict has been resolved 😁

[semgrep-app]

Semgrep found 1 no-sudo-in-dockerfile finding:

• .devcontainer/Dockerfile
  • L20-81 - Triage

Avoid using sudo in Dockerfiles. Running processes as a non-root user can help reduce the potential impact of configuration errors and security vulnerabilities.

_{Ignore this finding from no-sudo-in-dockerfile.}

[semgrep-app]

Semgrep found 1 no-sudo-in-dockerfile finding:

• .devcontainer/Dockerfile
  • L20-81 - Triage

Avoid using sudo in Dockerfiles. Running processes as a non-root user can help reduce the potential impact of configuration errors and security vulnerabilities.

_{Ignore this finding from no-sudo-in-dockerfile.}

[qpetraroia]

Hi @JorTurFer,

Once this PR is merged, is it possible to cut a release for KEDA 2.14.1?

[JorTurFer]

We plan to ship v2.15 next week and I'd like to include the golang bump. Is it enough? We don't plan any other release for v2.14

[JorTurFer]

/run-e2e internal
Update: You can check the progress here

[JorTurFer]

/run-e2e azure
Update: You can check the progress here

[semgrep-app]

Semgrep found 1 no-sudo-in-dockerfile finding:

• .devcontainer/Dockerfile
  • L20-81 - Triage

Avoid using sudo in Dockerfiles. Running processes as a non-root user can help reduce the potential impact of configuration errors and security vulnerabilities.

_{Ignore this finding from no-sudo-in-dockerfile.}

[semgrep-app]

Semgrep found 1 no-sudo-in-dockerfile finding:

• .devcontainer/Dockerfile
  • L20-81 - Triage

Avoid using sudo in Dockerfiles. Running processes as a non-root user can help reduce the potential impact of configuration errors and security vulnerabilities.

_{Ignore this finding from no-sudo-in-dockerfile.}