Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update the kube-rbac-proxy image version from 0.13.0 to 0.14.1 (latest) #1437

Closed
3 tasks done
soumyadeep-paul-ibm opened this issue Jun 2, 2023 · 0 comments · Fixed by #1438
Closed
3 tasks done

Comments

@soumyadeep-paul-ibm
Copy link
Contributor

Please confirm the following

  • I agree to follow this project's code of conduct.
  • I have checked the current issues for duplicates.
  • I understand that the AWX Operator is open source software provided for free and that I might not receive a timely response.

Bug Summary

The awx-operator-controller-manager uses kube-rbac-proxy version 0.13.0
Which has multiple vulnerabilities as following :

CVE-2022-27191
CVE-2022-27664
CVE-2022-41723
CVE-2022-41721
CVE-2022-30632
CVE-2022-27664
CVE-2022-2880
CVE-2022-32190
CVE-2022-30631
CVE-2023-24534
CVE-2022-2879
CVE-2022-30633
CVE-2022-30635
CVE-2023-24536
CVE-2022-30630
CVE-2022-41725
CVE-2022-28131
CVE-2022-32189
CVE-2022-41724
CVE-2022-41715
CVE-2022-41723
CVE-2022-41716
CVE-2023-24537

Please update the operator to use the latest version of the image which to my understanding is 0.14.1

Regards

AWX Operator version

2.2.1

AWX version

22.3.0

Kubernetes platform

openshift

Kubernetes/Platform version

4.12.16

Modifications

no

Steps to reproduce

Install AWX operator latest version i.e 2.2.1

Expected results

Latest image should include all the latest images of the components.

Actual results

While the version 2.2.1 was released just 2 weeks back, it is still using gcr.io/kubebuilder/kube-rbac-proxy:v0.13.0 , which is 11 months old.
Whereas gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1 is 8 weeks old

Additional information

No response

Operator Logs

No response

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant