upgrade sdk to use kube-rbac-proxy:v0.7.0 instead of kube-rbac-proxy:v0.5.0

[camilamacedo86]

Describe the problem

Helm/Ansible/GO operators are using the image kube-rbac-proxy:v0.5.0. This image is not rootless and raises security concerns. This image is built from https://github.com/brancz/kube-rbac-proxy/. The project https://github.com/brancz/kube-rbac-proxy/ was updates and its 0.7.0 will provide an image that address these concerns.

Describe the solution you'd like.

• V2+ and V3 plugins in upstream using an image built with the version 0.7.0 and these changes addressed
• bump new kb version/commit after the sparkles: upgrade gcr.io/kubebuilder/kube-rbac-proxy from v0.5.0 to v0.7.0 kubernetes-sigs/kubebuilder#1686 get merged
• check if the new commit/patch brings some cange/fixes that should be a patch for ansible and helm (note that from the current version of the common config manifests used for both until the commit it might have other bug fixes. So, it is important check it as well for we are able to address them)
• update the kube-rbac-proxy version for ansible/helm templates
• All SDK shell scripts which are using pulling the version 0.5.0 also should be updated.

[camilamacedo86]

It is blocked by : kubernetes-sigs/kubebuilder#1785

[estroz]

@camilamacedo86 why does that kubebuilder issue block an image tag upgrade for anisble and helm?

[camilamacedo86]

HI @estroz,

Because we need to have the image in the google cloud. Otherwise we are unable to pull that. I already raised it twice in the Kubebuilder, Controller Runtime, and Controller Tools Meeting.

The kube-rbac-proxy images provided by Kubebuilder are running pods as root which brings a high-security concern over the projects which are using it. The solution is already in place but we need help from who has permission to build and push images for 0.7.0 and 0.8.0 releases in https://console.cloud.google.com/gcr/images/kubebuilder/GLOBAL/kube-rbac-proxy?gcrImageListsize=30.

The ultimate solution is to automate this process until its author is able to do the donation. However, the automation will not push the releases made already any away. Also, to be able to do that is required to have access to the cloud and the project to set it up which makes the goal very hard to get done by the community.

These images have been built and pushed manually (It was checked with @solly already). The issue: kubernetes-sigs/kubebuilder#1785 is for we have the images there and update the kubebuilder scaffold after that we can update the Ansible/Helm scaffold as well.

Why it is important we have the latest release for and update the kubebuilder scaffolds to use it as soon as possible?

The latest images contain a fix brancz/kube-rbac-proxy#86 to make the images rootless to solve critical security concerns. More info: kubernetes-sigs/kubebuilder#1637

Because of this, I am flagging it is a priority and adding to the milestone 1.5.0.

c/c @jmrodri @asmacdo @varshaprasad96

[estroz]

Alternative: why doesn't kubebuilder use the upstream image quay.io/brancz/kube-rbac-proxy?

[camilamacedo86]

The problem is to ship an image that we. or google has no control off. Indeed for downstream we might are building and storing our image.

c/c @jmrodri