Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Patch CVE-2016-8859 in alpine based images #42936

Merged
merged 1 commit into from
Mar 23, 2017
Merged

Patch CVE-2016-8859 in alpine based images #42936

merged 1 commit into from
Mar 23, 2017

Conversation

timstclair
Copy link 

Patch CVE-2016-8859 in alpine based images:
- gcr.io/google-containers/cluster-proportional-autoscaler-amd64
- gcr.io/google-containers/dnsmasq-metrics-amd64
- gcr.io/google-containers/etcd-empty-dir-cleanup
- gcr.io/google-containers/kube-addon-manager
- gcr.io/google-containers/kube-dnsmasq-amd64

/cc @ixdy @bowei @MrHohn

@timstclair timstclair added this to the v1.5 milestone Mar 11, 2017
@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Mar 11, 2017
@k8s-github-robot k8s-github-robot added do-not-merge DEPRECATED. Indicates that a PR should not merge. Label can only be manually applied/removed. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. release-note Denotes a PR that will be considered when it comes time to generate release notes. labels Mar 11, 2017
@k8s-reviewable
Copy link

This change is Reviewable

@timstclair timstclair assigned mwielgus and unassigned jessfraz Mar 11, 2017
@bowei
Copy link
Member

bowei commented Mar 13, 2017

/assign bowei

@bowei
Copy link
Member

bowei commented Mar 13, 2017

/approve /lgtm

@bowei
Copy link
Member

bowei commented Mar 13, 2017

@k8s-bot gce etcd3 e2e test this
@k8s-bot cvm gce e2e test this
@k8s-bot gci gce e2e test this

@roberthbailey
Copy link
Contributor

this seems reasonable but i'm not sure why it's 5 commits. can you squash?

@timstclair
Copy link
Author

Keeping the commits separate made it easier to manage the selective cherrypicks across branches. I can squash though.

MrHohn
MrHohn reviewed Mar 14, 2017
View reviewed changes
cluster/addons/dns-horizontal-autoscaler/dns-horizontal-autoscaler.yaml
@@ -31,7 +31,7 @@ spec:
spec:
containers:
- name: autoscaler
image: gcr.io/google_containers/cluster-proportional-autoscaler-amd64:1.0.0
image: gcr.io/google_containers/cluster-proportional-autoscaler-amd64:1.1.0-r2
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, forgot to mention, please remove --mode=linear flag for the autoscaler container. I aggressively deprecated this flag in 1.1.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

@falenn
Copy link

falenn commented Mar 14, 2017 via email

@tallclair
Patch CVE-2016-8859 in alpine based images
54a2243 
Bump gcr.io/google_containers/cluster-proportional-autoscaler-amd64 to 1.1.0-r2
Bump gcr.io/google-containers/dnsmasq-metrics-amd64 to 1.0.1
Bump gcr.io/google-containers/etcd-empty-dir-cleanup to 0.0.2
Bump gcr.io/google-containers/kube-addon-manager to v6.1.1
Bump gcr.io/google_containers/kube-dnsmasq-amd64 to 1.4.1
@mwielgus
Copy link
Contributor

This PR has no LGTM and approve.

@timstclair can you get one?

@timstclair
Copy link
Author

@zmerlynn Could you please approve this cherrypick too?

@roberthbailey
Copy link
Contributor

Is this PR directly on the 1.5 branch? Do we have a corresponding CVE fix on master & 1.6?

@zmerlynn
Copy link
Member

@timstclair: If this is a manual cherry-pick, can you at least reference the pulls you're picking somewhere (like the top comment)?

@timstclair
Copy link
Author

Corresponding PRs:

This is a PR directly on the 1.5 branch. Before I squashed the commits, some were manually cherrypicked from one branch to another. The automatic cherrypick process can't be used since different branches are on different releases of the addons.

@zmerlynn
Copy link
Member

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 21, 2017
@k8s-github-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bowei, timstclair, zmerlynn

Needs approval from an approver in each of these OWNERS Files:

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

@k8s-github-robot k8s-github-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 21, 2017
@mwielgus mwielgus added the cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. label Mar 23, 2017
@mwielgus mwielgus added cherrypick-candidate and removed do-not-merge DEPRECATED. Indicates that a PR should not merge. Label can only be manually applied/removed. labels Mar 23, 2017
@k8s-github-robot
Copy link

Automatic merge from submit-queue

@k8s-github-robot k8s-github-robot merged commit eacda95 into kubernetes:release-1.5 Mar 23, 2017
@k8s-cherrypick-bot
Copy link

Commit found in the "release-1.5" branch appears to be this PR. Removing the "cherrypick-candidate" label. If this is an error find help to get your PR picked.

This was referenced Sep 11, 2020
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@MrHohn MrHohn MrHohn left review comments

Assignees

@zmerlynn zmerlynn

@mwielgus mwielgus

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
v1.5
Development

Successfully merging this pull request may close these issues.

None yet