[PLT-4154] Fix vulnerabilities: cloud-provisioner 0.17.0-0.8.5#911
Open
iamjanr wants to merge 16 commits into
Open
[PLT-4154] Fix vulnerabilities: cloud-provisioner 0.17.0-0.8.5#911iamjanr wants to merge 16 commits into
iamjanr wants to merge 16 commits into
Conversation
- Calico v3.30.2 → v3.32.0 + tigera-operator v1.38.5 → v1.42.0 (UBI 8→9, 644 Medium) - cert-manager v1.19.1 → v1.20.2 (Go 1.26.2, 85 Medium) - FluxCD flux-cli v2.7.5 → v2.8.7, helm-ctrl v1.4.5 → v1.5.4, kustomize-ctrl v1.7.3 → v1.8.5, source-ctrl v1.7.4 → v1.8.4 (CVE-2026-45022, 74+ Medium) - flux chart 2.17.2 → 2.18.3, tigera-operator chart v3.30.2 → v3.32.0, cert-manager chart v1.19.1 → v1.20.2
Update hardcoded chart/image versions to match DEPENDENCIES: - provider.go, aws.go, azure.go, gcp.go: cert-manager v1.19.1→v1.20.2, tigera-operator chart v3.30.2→v3.32.0, flux2 chart 2.17.2→2.18.3 - upgrade-provisioner.py: CALICOCTL 3.30.2→3.32.0, CONTROLLER v1.38.5→v1.42.0, cert-manager v1.19.1→v1.20.2, flux2 2.17.2→2.18.3, tigera-operator v3.30.2→v3.32.0
- CAPI v1.10.8 → v1.10.10 - CAPA v2.9.2 → v2.9.3 - CAPZ v1.21.1 → v1.21.3 Reduces Go stdlib CVEs in upstream images. CAPG stays on Stratio fork (no upstream update).
…dep bumps - toolchain go1.25.10 in go.mod + .tool-versions (eliminates stdlib Critical/High) - grpc v1.61.0 → v1.79.3, protobuf v1.31.0 → v1.36.10 - docker/docker v25.0.6 → v27.1.1 (via containers/common v0.60.4) - containers/image/v5 v5.29.2 → v5.32.2, runc v1.1.12 → v1.2.8 - jwt/v5 v5.0.0 → v5.2.2, x/crypto v0.42.0 → v0.46.0 - azidentity v1.4.0 → v1.8.2, ulikunitz/xz v0.5.11 → v0.5.15 Result: 39 findings → 6 (3H+2M+1L in docker/docker, no upstream fix available)
…lux/Tigera templates - pkg/commons/cluster.go: capi v1.10.8→v1.10.10, capa v2.9.2→v2.9.3, capz v1.21.1→v1.21.3 - flux2-helm-values.tmpl: flux-cli v2.7.5→v2.8.7, helm v1.4.5→v1.5.4, kustomize v1.7.3→v1.8.5, source v1.7.4→v1.8.4 - tigera-operator-helm-values.tmpl: tigera v1.38.5→v1.42.0
…for k8s 1.32 compatibility Calico v3.32.0: chart removed crds/ directory (commit 8b19114) — helm install fails without pre-applying crd.projectcalico.org.v1 companion chart. v3.31.5 is the last version with CRDs bundled in the chart. Deferred to 0.9. FluxCD 2.18.3: flux-cli v2.8.x hardcodes k8s >=1.33.0-0 in check --pre. v2.7.5 (chart 2.17.2) requires >=1.32.0-0. Controller images (helm v1.5.4, kustomize v1.8.5, source v1.8.4) kept at bumped versions — they do not carry the version check. Verified: EKS cluster eks-cl02 with k8s v1.32.13 installs successfully with all components at expected versions.
Calico v3.31.5, tigera-operator v1.40.8, cert-manager v1.20.2, FluxCD controllers v1.5.4/v1.8.5/v1.8.4, CAPI v1.10.10, CAPA v2.9.3, CAPZ v1.21.3, cluster-operator 0.6.2, cloud-provisioner 0.17.0-0.8.5, coredns v1.12.1
alopez-stratio
approved these changes
May 21, 2026
tperez-stratio
requested changes
May 27, 2026
Collaborator
tperez-stratio
left a comment
tperez-stratio
left a comment
There was a problem hiding this comment.
@iamjanr te paso un cambio y unos comentarios. Gracias.
…c formatting - common-images.adoc (EN): remove spurious :v3.31.5 tag from whisker, whisker-backend and goldmane image names — version belongs only in the version column, consistent with all other calico entries - upgrade.adoc (ES): apply suggested formatting *_Charts_* (bold+italic)
Resolve merge conflicts keeping PLT-4154-0.8.5 versions: - pkg/commons/cluster.go: CAPI v1.10.10, CAPA v2.9.3, CAPZ v1.21.3 - upgrade.adoc (EN/ES): cert-manager v1.20.2, flux2 2.18.3, tigera-operator v3.32.0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan
Jira: PLT-4154