Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update kube and alpine images version to fix vulnerability #77

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

ashutoshrathore
Copy link

No description provided.

@ashutoshrathore ashutoshrathore marked this pull request as draft October 15, 2024 19:13
@ashutoshrathore ashutoshrathore marked this pull request as ready for review October 15, 2024 19:15
@ashutoshrathore
Copy link
Author

@ArnobKumarSaha @groundnuty can you please review and merge it?

@spideyfusion
Copy link

@groundnuty Mind merging this in to address security vulnerabilities?

@groundnuty
Copy link
Owner

@spideyfusion k8s-wait-for will be updated in December and after that, I plan to do a release every ~6 months.

@groundnuty
Copy link
Owner

@spideyfusion @ashutoshrathore I'm updating the dependencies and releasing the new version this week, but this constant race against vulnerabilities is too rapid for a biannual release cycle.

I researched using https://www.chainguard.dev images as they seem to be popular nowadays in devops circles.
My intention was to use their kubectl and reguild k8s-wait-for image with github workflows eg. weekly with pined kubectl version and updated dependences, but last year they disabled pulling images with any version but latest...

Do you have any recommendations/know the best practices on how to tackle the problem of vulnerability fixes in an automatic manner, but still maintaining stability of the tool?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants