Dockerfile: bump debian image to bullseye-20210927 #13376
Conversation
| @@ -1,4 +1,5 @@ | |||
| FROM k8s.gcr.io/build-image/debian-base:buster-v1.4.0 | |||
| # TODO: move to k8s.gcr.io/build-image/debian-base:bullseye-v1.y.z when patched | |||
| FROM debian:bullseye-20210927 | |||
There was a problem hiding this comment.
The change would switch it to a potentially rate-limited registry (dockerhub), will that impact builds?
There was a problem hiding this comment.
This one got a bullseye tag: https://console.cloud.google.com/gcr/images/k8s-staging-build-image/global/debian-base (these are staging images that are not promoted yet)
There was a problem hiding this comment.
they do have bullseye-v1.0.0 which is still exposed to CVE-2021-3711. If there is a fix pending promotion we can consider that.
There was a problem hiding this comment.
Working on this here: kubernetes/release#2371
Codecov Report
@@ Coverage Diff @@
## main #13376 +/- ##
==========================================
- Coverage 71.31% 70.35% -0.96%
==========================================
Files 453 447 -6
Lines 38856 38032 -824
==========================================
- Hits 27709 26759 -950
- Misses 9114 9247 +133
+ Partials 2033 2026 -7
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report at Codecov.
|
There was a problem hiding this comment.
lgtm. The CI errors seems not related but we may want to re-run.
Thank you so much for quickly addressing CVEs @hexfusion
fixes: CVE-2021-3711, CVE-2021-35942, CVE-2019-9893 Signed-off-by: Sam Batschelet <sbatsche@redhat.com>
hexfusion
force-pushed
the
bump-base
branch
from
1e1f113 to
aab7829
Compare
Debian buster has been replaced with bullseye v11.0 and is getting CVE fixes quicker. This PR moves us from buster to bullseye and also applies a hotfix for openssl to resolve
CVE-2021-3711.We recently moved to
k8s.gcr.io/build-image/debian-basefor our Debian base images to align with upstream k8s which just recently moved to bullseye[1]. The plan is to move back to this registry once these fixes are addressed. But as we are going to cut a new 3.5 release it seems prudent to improve our security profile now.fixes: CVE-2021-3711, CVE-2021-35942, CVE-2019-9893
CVE testing was done using trivy[2]
[1] kubernetes/kubernetes@531eb71
[2] https://github.com/aquasecurity/trivy
cc @gyuho @ptabor @hasbro17 @lilic @serathius