Dockerfile: bump debian image to bullseye-20210927#13376
Dockerfile: bump debian image to bullseye-20210927#13376hexfusion merged 1 commit intoetcd-io:mainfrom
Conversation
| @@ -1,4 +1,5 @@ | |||
| FROM k8s.gcr.io/build-image/debian-base:buster-v1.4.0 | |||
| # TODO: move to k8s.gcr.io/build-image/debian-base:bullseye-v1.y.z when patched | |||
| FROM debian:bullseye-20210927 | |||
There was a problem hiding this comment.
The change would switch it to a potentially rate-limited registry (dockerhub), will that impact builds?
There was a problem hiding this comment.
This one got a bullseye tag: https://console.cloud.google.com/gcr/images/k8s-staging-build-image/global/debian-base (these are staging images that are not promoted yet)
There was a problem hiding this comment.
they do have bullseye-v1.0.0 which is still exposed to CVE-2021-3711. If there is a fix pending promotion we can consider that.
Codecov Report
@@ Coverage Diff @@
## main #13376 +/- ##
==========================================
- Coverage 71.31% 70.35% -0.96%
==========================================
Files 453 447 -6
Lines 38856 38032 -824
==========================================
- Hits 27709 26759 -950
- Misses 9114 9247 +133
+ Partials 2033 2026 -7
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report at Codecov.
|
spzala
left a comment
spzala
left a comment
There was a problem hiding this comment.
lgtm. The CI errors seems not related but we may want to re-run.
Thank you so much for quickly addressing CVEs @hexfusion
fixes: CVE-2021-3711, CVE-2021-35942, CVE-2019-9893 Signed-off-by: Sam Batschelet <[email protected]>
hexfusion
force-pushed
the
bump-base
branch
from
1e1f113 to
aab7829
Compare
6 participants
Debian buster has been replaced with bullseye v11.0 and is getting CVE fixes quicker. This PR moves us from buster to bullseye and also applies a hotfix for openssl to resolve
CVE-2021-3711.We recently moved to
k8s.gcr.io/build-image/debian-basefor our Debian base images to align with upstream k8s which just recently moved to bullseye[1]. The plan is to move back to this registry once these fixes are addressed. But as we are going to cut a new 3.5 release it seems prudent to improve our security profile now.fixes: CVE-2021-3711, CVE-2021-35942, CVE-2019-9893
CVE testing was done using trivy[2]
[1] kubernetes/kubernetes@531eb71
[2] https://github.com/aquasecurity/trivy
cc @gyuho @ptabor @hasbro17 @lilic @serathius