BMO & Ironic & Ironic-Inspector fail Clair scans for high risk vulnerabilities

[eak13]

Describe the bug
Clair scans have identified several high risk vulnerabilities in BMO, Ironic-Inspector & Ironic. See attached for details.
This is being tracked via metal3-io/ironic-image#266.
This is a tracking issue to ensure that the images used by Airshipctl are updated once the vulnerabilities have been resolved.

Steps To Reproduce
Run Clair scan against the images.

Expected behavior
No high risk security vulnerabilities are found.

ironic-inspector-2e2774c-2021-05-31_15-55-34.txt
baremetal-operator-3871acb-2021-05-31_15-58-59.txt
ironic-a69281a-2021-05-31_15-58-24.txt

[sshiba]

Hi Andrew, assign this issue to me. Thanks.

[sshiba]

The metal3-io/ironic-inspector:latest image still didn't pass the test.
See https://jenkins-nc.wnv2b.cci.att.com/job/images/job/open-images/1415/console

The quay.io registry also detected vulnerabilities. See https://quay.io/repository/metal3-io/ironic-inspector/manifest/sha256:7bb3423b81f8d316463727af25ec70591bf8e984b5cf93634c98657aeb214e6e?tab=vulnerabilities

The metal3-io/ironic:latest image still didn't pass the test.
See https://jenkins-nc.wnv2b.cci.att.com/job/images/job/open-images/1414/console

The quay.io registry also detected vulnerabilities. See https://quay.io/repository/metal3-io/ironic/manifest/sha256:ac4ab57f937dbef11c0fb317b7005d63a534c8b3ef4efd0407d5bf6f868b8c13?tab=vulnerabilities

The metal3-io/baremetal-operator:latest image has passed the test. See https://jenkins-nc.wnv2b.cci.att.com/job/images/job/open-images/1413/console

[eak13]

@SirishaGopigiri can you please also comment here so I can update assignment? Thanks!

[SirishaGopigiri]

Please assign this to me, thank you!

[SirishaGopigiri]

The quay.io/metal3-io/baremetal-operator:capm3-v0.5.0 image is passing the clair scan and the manifests are updated to use it as part of capi and capm3 uplift #518
Other images are still failing with vulnerability issues, needs to be fixed from upstream metal3 community.

[mattmceuen]

I left a note in PS 804834, but bringing it up here so it doesn't get lost: I think we need to build an update ironic-python-agent (ipa) image, to match the version of ironic that we're updating to. However the patchset appears to also be adding an additional image for the same thing, so I think we need to sort out 1) why did we build that image ourselves, 2) do we want to keep building it, 3) if so, we need to build an updated one to match the new BMO/Ironic.

We may have built our own as an alternative to pinning to to a moving :master tag.

[eak13]

Closing as https://review.opendev.org/c/airship/airshipctl/+/804834 has merged which should resolve the CVE issues. If we need to do something different with the IPA image, then we can open a separate issue for it.