Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace base image to ubi #767

Closed
jpkrohling opened this issue Nov 15, 2019 · 6 comments · Fixed by #924
Closed

Replace base image to ubi #767

jpkrohling opened this issue Nov 15, 2019 · 6 comments · Fixed by #924
Labels
enhancement New feature or request good first issue Good for newcomers

Comments

@jpkrohling
Copy link
Contributor

The current CentOS base image seems to have some vulnerabilities, according to Quay:

image

https://quay.io/repository/jaegertracing/jaeger-operator/manifest/sha256:0f33e0ea725448c52f74cb47a27391749868c888ad4a1f3d553c7bc31a8a28a7?tab=vulnerabilities

Changing the base image to registry.access.redhat.com/ubi8/ubi seems to be a valid fix:

image

https://quay.io/repository/jpkroehling/jaeger-operator/manifest/sha256:e46a408f7496618b8923cf996dbad37d8b9c52b646eb0a97195ca01600f26226?tab=vulnerabilities

The ubi-minimal seems to be the default base image for new operators.

@pavolloffay: we started using the centos image because of the TLS cert generation as part of the ES provisioning. I think we talked about replacing that with regular Go code, instead of relying on openssl. Do you still want to do that? If so, this change here could come after your change, so that we use ubi-minimal, which lacks dnf. Otherwise, we could just use ubi instead.

@jpkrohling jpkrohling added enhancement New feature or request good first issue Good for newcomers labels Nov 15, 2019
@objectiser
Copy link
Contributor

+1 , although can you use registry.redhat.io instead of registry.access.redhat.com.

@pavolloffay
Copy link
Member

+1 on using ubi.

I would like to keep the scrip until ECL switches to golang based solution.

@jpkrohling
Copy link
Contributor Author

I would like to keep the scrip until ECL switches to golang based solution.

Are they switching to golang at all?

@pavolloffay
Copy link
Member

I don't think that will happen any time soon.

@jpkrohling jpkrohling added needs-triage New issues, in need of classification and removed needs-triage New issues, in need of classification labels Dec 16, 2019
@amila-ku
Copy link
Contributor

amila-ku commented Feb 6, 2020

@jpkrohling would like to work on this. If it is agreed to use ubi will start to work on this.

@jpkrohling
Copy link
Contributor Author

I think there's nothing preventing us from using ubi instead of centos, so, it's yours, @amila-ku!

This was referenced Feb 24, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request good first issue Good for newcomers
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants