Uploaded image for project: 'Couchbase Kubernetes'
  1. Couchbase Kubernetes
  2. K8S-2814

Incorrect/insecure Go version used for operator-certification base image

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Critical
    • None
    • None
    • build, operator
    • None
    • Build Team 2022 Sprint 16
    • 1

    Description

      We recently fixed up the handling of Go versions when invoking the build step ("make dist") for the K8S family products - see K8S-2729. However, this only corrects the build step. There's a separate step to create the Docker images from the artifacts in the "image" file which is created by the build step, as documented here: https://hub.internal.couchbase.com/confluence/display/CR/Grand+Unified+Build+and+Release+Process+for+Operator

      This step expects the "image" file to be completely self-contained, which means that no --build-arg arguments are passed to the "docker build" command. So any ARGs will be built with their default values. 

      The operator-certification Dockerfiles have an ARG GO_VERSION, and the base image is determined by that ARG. That GO_VERSION is not currently related to the Go version from the manifest which is used to build the binaries, which could lead to strange runtime behaviour. Also, right now GO_VERSION is 1.17.6, which is an EOL version - the corresponding base Docker images may not even be receiving security updates, which could lead to shipping images with known security vulnerabilities.

      Attachments

        Issue Links

          For Gerrit Dashboard: K8S-2814
          # Subject Branch Project Status CR V

          Activity

            People

              ceej Chris Hillery
              ceej Chris Hillery
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 2h
                  2h

                  Gerrit Reviews

                    There are no open Gerrit changes

                    PagerDuty