gitea_admin/svcforge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: kubectl v1.35.3 -> v1.36.2 to clear CVE-2026-35469
ci / lint (push) Successful in 36s
Details
ci / unit (push) Successful in 1m40s
Details
ci / types (push) Successful in 1m49s
Details
ci / dockerfile (push) Successful in 44s
Details
ci / security (push) Successful in 1m50s
Details
ci / chart (push) Successful in 1m10s
Details
ci / integration (push) Successful in 1m39s
Details
ci / image (api) (push) Successful in 6m16s
Details
ci / image (reconciler) (push) Successful in 7m32s
Details
ci / image (worker) (push) Failing after 6m36s
Details
ci / bump (push) Has been skipped
Details

Browse Source 
trivy took the worker image from 39 findings (2 CRITICAL) to 18 (0 CRITICAL)
after the previous bump. The residue is kubectl's vendored deps: k8s v1.35.x
pins github.com/moby/spdystream v0.5.0, and the fix is in 0.5.1. v1.36.2 vendors
0.5.1.

One minor ahead of the v1.35.3 API server, which is inside kubectl's supported
+/-1 window. reconciler was already green because it ships helm only.
This commit is contained in:
Nguyen Minh Phuc
2026-07-18 12:43:36 +00:00
parent a51227d952
commit a59d3848ae
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/worker/Dockerfile
+7 -2
View File
@@ -46,7 +46,7 @@ COPY --from=builder --chown=10001:10001 /app /app
# (spdystream, fixed in 0.5.1) — trivy fails the build on them and is right to. # (spdystream, fixed in 0.5.1) — trivy fails the build on them and is right to.
# Deliberately 3.x: helm 4 is a breaking change and is not a CVE fix. # Deliberately 3.x: helm 4 is a breaking change and is not a CVE fix.
COPY --from=alpine/helm:3.21.3@sha256:35da09ba0716fc7c3cd63b6b31ee380a9c7662e95f29ab0e4ae962420afd315b /usr/bin/helm /usr/local/bin/helm COPY --from=alpine/helm:3.21.3@sha256:35da09ba0716fc7c3cd63b6b31ee380a9c7662e95f29ab0e4ae962420afd315b /usr/bin/helm /usr/local/bin/helm
# kubectl 1.35.3 from the OFFICIAL registry.k8s.io image, replacing # kubectl 1.36.2 from the OFFICIAL registry.k8s.io image, replacing
# bitnamilegacy/kubectl:1.31.2. Two reasons, either sufficient: # bitnamilegacy/kubectl:1.31.2. Two reasons, either sufficient:
# - CVEs: the bitnami image is Go 1.22.9 and ships containerd < 1.7.29 (HIGH # - CVEs: the bitnami image is Go 1.22.9 and ships containerd < 1.7.29 (HIGH
# CVE-2024-25621) along with the same crypto/tls and grpc CRITICALs as helm above. # CVE-2024-25621) along with the same crypto/tls and grpc CRITICALs as helm above.
@@ -55,7 +55,12 @@ COPY --from=alpine/helm:3.21.3@sha256:35da09ba0716fc7c3cd63b6b31ee380a9c7662e95f
# bitnamilegacy publishes no 1.35 tag. registry.k8s.io/kubectl is the upstream-maintained # bitnamilegacy publishes no 1.35 tag. registry.k8s.io/kubectl is the upstream-maintained
# image, is a manifest list with linux/arm64 (this cluster is Ampere), and puts the binary # image, is a manifest list with linux/arm64 (this cluster is Ampere), and puts the binary
# at /bin/kubectl rather than bitnami's /opt/bitnami path. # at /bin/kubectl rather than bitnami's /opt/bitnami path.
COPY --from=registry.k8s.io/kubectl:v1.35.3@sha256:8dad99b604a2c0bafe17f53cadf78482d6f667a6da687f385508f5f4e4696d37 /bin/kubectl /usr/local/bin/kubectl #
# 1.36.2 rather than 1.36.x-matching-the-cluster: k8s v1.35.x vendors
# github.com/moby/spdystream v0.5.0, which carries CVE-2026-35469 (HIGH, fixed in
# 0.5.1). v1.36.2 vendors 0.5.1. trivy blocks the release on it, correctly. One
# minor ahead of the v1.35.3 API server is inside kubectl's supported +/-1 window.
COPY --from=registry.k8s.io/kubectl:v1.36.2@sha256:b0d792e0d8dfb9bb1b922b78b23137e2a34bb6f9667640353a9d2aadd1fd7761 /bin/kubectl /usr/local/bin/kubectl
ENV PATH="/app/.venv/bin:$PATH" \ ENV PATH="/app/.venv/bin:$PATH" \
PYTHONUNBUFFERED=1 \ PYTHONUNBUFFERED=1 \