Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade all Kubernetes dependencies #374

Closed
erikgb opened this issue Jul 19, 2022 · 3 comments
Closed

Upgrade all Kubernetes dependencies #374

erikgb opened this issue Jul 19, 2022 · 3 comments

Comments

@erikgb
Copy link
Contributor

erikgb commented Jul 19, 2022

What would you like to be added:

Upgrade all Kubernetes dependencies to version 1.24 including controller-runtime to version 0.12.

I had a look at this, but it seems like a complex task that require more experience with the code-base than I currently have. There has been a lot of changes in envtest that require the bootstrapping of the envtest clusters to be rewritten.

CC: @kensipe @iblancasa

Why is this needed:

Scanning kuttl with a vulnerability scanner like Trivy, shows that we have quite a few vulnerabilities in our dependency tree. I had a look at this, and to me it seems like most of them are rooted in the fact that we depend on old Kubernetes dependencies versions that are not maintained anymore (EOL).

We currently depend on K8s 1.20, and I also think it is about time to upgrade this. K8s 1.20 is long passed EOL, and with the upcoming K8s 1.25 some APIs are removed - which are still used in kuttl.

@iblancasa
Copy link
Collaborator

Is there anything pending about this issue?

@erikgb
Copy link
Contributor Author

erikgb commented Sep 8, 2022

@iblancasa Thanks a million for your great work in bumping dependencies! This looks great now! I just scanned current main branch with trivy:

D:~/projects/github/kuttl $ trivy filesystem .
2022-09-08T21:23:20.681+0200    INFO    Vulnerability scanning is enabled
2022-09-08T21:23:20.681+0200    INFO    Secret scanning is enabled
2022-09-08T21:23:20.681+0200    INFO    If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2022-09-08T21:23:20.681+0200    INFO    Please see also https://aquasecurity.github.io/trivy/v0.31.3/docs/secret/scanning/#recommendation for faster secret detection
2022-09-08T21:23:20.735+0200    INFO    Number of language-specific files: 1
2022-09-08T21:23:20.735+0200    INFO    Detecting gomod vulnerabilities...
D:~/projects/github/kuttl $ 

Closing issue as resolved by #375.

@erikgb erikgb closed this as completed Sep 8, 2022
@kensipe
Copy link
Member

kensipe commented Sep 8, 2022

thanks @erikgb and @iblancasa great to see

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants