debian-base: purge libsystemd0 to eliminate CVE false-positives

[ixdy]

What type of PR is this?
/kind cleanup

What this PR does / why we need it: we already purge systemd and systemd-sysv from the debian-base container, since we don't use them, but libsystemd0 is still part of the image, which is causing false CVE alerts from the GCR Container Analysis service.

Does this PR introduce a user-facing change?:

Images based on debian-base no longer include the libsystemd0 package. This should have no user-facing impact.
Additionally, the addon-manager image is updated to use kubectl v1.11.3.

I don't expect this change to have any user-facing changes. We'll need to be more cautious once we update debian-iptables and debian-hyperkube-base; there shouldn't be any issues, but hyperkube in particular has surprised me before.

/assign @ihmccreery @awly @tallclair

[awly]

/lgtm
Thanks for cleaning this up!

[ixdy]

/sig release

[ixdy]

/hold

I forgot to add the sig, but I've already promoted the debian-base image, so I'm going to bump the child images in this PR too.

[ixdy]

@MrHohn does this version of kubectl still make sense? or should we bump to 1.11.x?

[MrHohn]

Thanks for adding me, bumping to 1.11.x sounds good to me.

[ixdy]

updated to kubectl v1.11.3.

[ixdy]

pushed a commit bumping the debian-base references, PTAL.

[awly]

why not v10.3 ?

[ixdy]

I generally reserve the .N bumps for rebases of the existing image. We actually removed a package here.

[awly]

/lgtm

[ixdy]

/assign @zmerlynn

for cluster/ approval

[ixdy]

/retest

[zmerlynn]

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ixdy, zmerlynn

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• build/OWNERS [ixdy,zmerlynn]
• cluster/OWNERS [zmerlynn]
• test/OWNERS [ixdy,zmerlynn]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ixdy]

/hold cancel

[Random-Liu]

This actually breaks node-problem-detector. :P kubernetes/node-problem-detector#232

Is there any other way to fix the CVE?

I can install the libsystemd0 back when building node-problem-detector for now.

[ixdy]

I'd rather not add libsystemd back to the base image, since we don't need it in the core kubernetes images.

If you need it in your image, you should be able to add it back with clean-install.