-
Notifications
You must be signed in to change notification settings - Fork 359
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Upgrade CNI plugins from v1.1.1 to v1.3.0 #5747
Upgrade CNI plugins from v1.1.1 to v1.3.0 #5747
Conversation
This will use a more recent build of the plugin binaries, and reduce the number of CVEs reported by security scanners. Signed-off-by: Antonin Bas <abas@vmware.com>
Unfortunately, we can still get critical / high CVEs reported, because even this tag is not super recent and the binaries were built using an older Go version (1.20.4):
The only option would be to use our own build for the plugins that we use, which may be worth considering... |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LTGM
Failed to build Windows image since the base-windows image does not exist with the new CNI binary. https://github.com/antrea-io/antrea/actions/runs/7010302755/job/19071011048?pr=5747 |
@wenyingd Is the base Windows image maintained by Antrea? If yes, which part need to be updated for CNI upgrade? |
I noticed there is already a PR to change the golang version containernetworking/plugins#982 two weeks ago, but no progress yet. |
Yes, it is maintained by antrea, the Dockerfile is https://github.com/antrea-io/antrea/blob/main/build/images/base-windows/Dockerfile. I'm afraid it is not automatically update according to the configurations changes, which means we may need to manually push the image? @XinShuYang @tnqn can confirm it. |
@wenyingd I can build the image, we have a workflow for that |
/test-all |
This will use a more recent build of the plugin binaries, and reduce the number of CVEs reported by security scanners.