Drop YAML v2 support

[sagikazarmark]

Preflight Checklist

• I have searched the issue tracker for an issue that matches the one I want to file, without success.

Problem Description

YAML v2 has not been updated for a long time and it contains vulnerabilities (eg. CVE-2022-28948)

Proposed Solution

Since YAML v3 became the default, we should consider dropping YAML v2.

Alternatives Considered

YAML v2 could be moved to an external library.

Additional Information

YAML v3 is not fully backward compatible with v2, so we should wait couple months for feedback to make sure it's working as expected.

[wzalazar]

Hi @sagikazarmark seems we need to update the YAML v2 at least to the v2.2.8 due to this vulnerability reported by dependabot CVE-2019-11254

https://github.com/spf13/viper/blob/master/go.sum#L898-L902

Issue description:

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

Is there any possibility to do that?

Thanks in advance ;)

[sagikazarmark]

@wzalazar YAML v2 will be upgraded to 2.4 in the next version.