Upgrade debian-base to 0.3.1 for CVEs #67026

satyasm · 2018-08-06T17:37:57Z

What this PR does / why we need it:
Upgrade debian-base to 0.3.1 in response to CVE fixes in debian-base

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:
Bumps up the version number of related components.

Release note:

Bump up version number of debian-base, debian-hyperkube-base and debian-iptables. 
Also updates dependencies of users of debian-base. 
debian-base version 0.3.1 is already available.

satyasm · 2018-08-06T17:38:25Z

/assign @ixdy . Reopened PR for #66942.

MrHohn · 2018-08-06T17:39:04Z

/ok-to-test

satyasm · 2018-08-06T17:43:13Z

/assign @ixdy

mkumatag · 2018-08-07T04:03:17Z

/lgtm

cblecker

/lgtm cancel
/hold

cblecker · 2018-08-07T07:30:35Z

build/debian-hyperkube-base/Makefile

@@ -19,11 +19,11 @@

 REGISTRY?=staging-k8s.gcr.io
 IMAGE?=debian-hyperkube-base
-TAG=0.10
+TAG=0.11


Has this image been pushed?

$ docker pull k8s.gcr.io/debian-hyperkube-base-amd64:0.11 Error response from daemon: manifest for k8s.gcr.io/debian-hyperkube-base-amd64:0.11 not found

hm, though this is a different pattern than what we've done with CVE-only rebuilds in the past.

in those cases, we've either pushed over the existing tag, or added a revision number (if pushing over the existing tag wasn't possible).

I guess I have a slight preference for naming this 0.10.1 instead of 0.11, since there shouldn't really be any functional differences.

cblecker · 2018-08-07T07:33:09Z

build/debian-iptables/Makefile

@@ -16,7 +16,7 @@

 REGISTRY?="staging-k8s.gcr.io"
 IMAGE=debian-iptables
-TAG=v10
+TAG=v11


Has this image been pushed?

$ docker pull k8s.gcr.io/debian-iptables-amd64:v11 Error response from daemon: manifest for k8s.gcr.io/debian-iptables-amd64:v11 not found

this one is trickier, since v10.1 makes no sense. v10-r2? bleh.

though we did have a v5.1. (also a v5, and a v5.0?)

satyasm · 2018-08-07T17:50:29Z

/cc @tallclair

@cblecker not sure what you are expecting here. My understanding of the process is as follows when we want to upgrade debian base.

Do a PR for the newer version and once merged build and push the new tag.
Once image from 1 is available, do a PR (this one) for the all the dependents of debian-base and once merged, build and push the new tags.
Once images from 2 is available, do a PR of the dependent images from 2 and once merged, build and push the new tags.
Once images from 3 are available, do the final update of the installation manifests and add-ons to refer to the updated tags.

In this case, due to some oversight, a PR for 1 was not done but the image was pushed. So I'm doing the back fill of the tag update for 1 as part of this PR. So the upgraded images for debian-iptables and debian-base-hyperkube will be built and pushed once this PR is approved and merged.

cblecker · 2018-08-07T18:01:16Z

I'll defer to @ixdy on the proper order. IIRC, we build/push, then PR. Either way, I'd like to see this documented more.

tallclair · 2018-08-07T18:40:45Z

I don't think the order is well defined. What matters is:

Update the FROM base image tag (locally)
Build & Push the image
Update the manifests to the new tag (& merge)

The parts that don't matter are:

when the changes from (1) get merged - This is just in order to reflect the current state in the open source. I'd prefer to do this before (2), so that the pushed image is always built from merged code.
updating the tag - This is purely symbolic, as our image promotion process ends up relabeling the image. The ordering here doesn't matter, so to decrease the number of PRs, I'd prefer to do this in the same PR as the above.

Given this, I think the current PR looks good.

ixdy · 2018-08-08T23:19:39Z

Right, in the past I would often cheat and build/push images before they were merged into master, which would result in fewer PRs.

It's probably better to separate these steps, though, especially since automation (which is something we eventually want) would probably require it.

hence
/lgtm

satyasm · 2018-08-08T23:36:33Z

/retest

satyasm · 2018-08-08T23:37:21Z

Thanks @ixdy, btw since I'm not sure, does the hold need to be removed?

ixdy · 2018-08-08T23:45:06Z

@satyasm yes, though can we maybe rename those tags to .1 instead of +1?

satyasm · 2018-08-08T23:46:34Z

yup, can do that if that makes more sense. Will update the PR.

satyasm · 2018-08-08T23:51:38Z

@ixdy updated debian-hyperkube-base to 0.10.1 and debian-iptables to v10.1 instead of 0.11 and v11 respectively.

ixdy · 2018-08-09T00:10:32Z

/lgtm

ixdy · 2018-08-09T00:11:27Z

/hold cancel

k8s-ci-robot · 2018-08-09T00:12:29Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ixdy, mkumatag, satyasm

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~build/OWNERS~~ [ixdy]
~~test/images/OWNERS~~ [ixdy]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

satyasm · 2018-08-09T01:11:36Z

/retest

k8s-github-robot · 2018-08-09T02:44:56Z

/test all [submit-queue is verifying that this PR is safe to merge]

k8s-ci-robot · 2018-08-09T02:59:59Z

@satyasm: The following test failed, say /retest to rerun them all:

Test name	Commit	Details	Rerun command
pull-kubernetes-integration	`025a0b3`	link	`/test pull-kubernetes-integration`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

k8s-github-robot · 2018-08-09T03:52:59Z

Automatic merge from submit-queue (batch tested with PRs 67026, 62945, 66917). If you want to cherry-pick this change to another branch, please follow the instructions here.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Update to use debian-base:0.3.2 **What this PR does / why we need it**: uses the fixed debian-base image from #67222. Also includes a small fix for a bug in the debian-base Makefile that I introduced in that same PR. This is basically a rehash of #67026. **Release note**: ```release-note NONE ```

Automatic merge from submit-queue (batch tested with PRs 67396, 67097, 67395, 67365, 67099). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Update to debian-iptables v10.1 and hyperkube-base 0.10.1 **What this PR does / why we need it**: these images are based on the `debian-base` 0.3.2 images, which include CVE fixes (#67026) and permission fixes of the qemu-ARCH-static helper binary (#67026, #67283). **Release note**: ```release-note NONE ```

…67222-#67283-#67365-upstream-release-1.10 Automatic merge from submit-queue. release-1.10: update to debian-base 0.3.2, debian-iptables v10.1 and hyperkubebase 0.10.1 Cherry pick of #67026 #67222 #67283 #67365 on release-1.10. #67026: Upgrade debian-base to 0.3.1 for CVEs #67222: ensure qemu-ARCH-static binary is world readable and #67283: Add missing tmpdir path to chmod #67365: Update to debian-iptables v10.1 and hyperkube-base 0.10.1

neolit123 · 2018-08-24T03:06:04Z

/sig release
(?)

…67222-#67283-#67365-upstream-release-1.9 release-1.9: update to debian-base 0.3.2, debian-iptables v10.2 and hyperkube-base 0.10.2

…67222-#67283-#67365-upstream-release-1.11 release-1.11: update to debian-base 0.3.2, debian-iptables v10.2 and hyperkube-base 0.10.2

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Aug 6, 2018

k8s-ci-robot requested review from cblecker and mkumatag August 6, 2018 17:38

k8s-ci-robot removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 6, 2018

k8s-ci-robot assigned ixdy Aug 6, 2018

satyasm mentioned this pull request Aug 6, 2018

Upgrade debian-base to 0.3.1 for CVEs #66942

Closed

BenTheElder mentioned this pull request Aug 7, 2018

update kind to debian base 0.3.1 image for CVEs kubernetes/test-infra#8962

Merged

k8s-ci-robot assigned mkumatag Aug 7, 2018

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 7, 2018

k8s-ci-robot assigned cblecker Aug 7, 2018

cblecker reviewed Aug 7, 2018

View reviewed changes

k8s-ci-robot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. and removed lgtm "Looks good to me", indicates that a PR is ready to be merged. labels Aug 7, 2018

k8s-ci-robot requested a review from tallclair August 7, 2018 17:50

k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Aug 8, 2018

satyasm force-pushed the upgrade_debian_base branch from b611058 to 7f70aed Compare August 8, 2018 23:49

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed lgtm "Looks good to me", indicates that a PR is ready to be merged. labels Aug 8, 2018

Upgrade debian-base to 0.3.1 for CVEs

025a0b3

satyasm force-pushed the upgrade_debian_base branch from 7f70aed to 025a0b3 Compare August 8, 2018 23:50

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 9, 2018

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 9, 2018

k8s-github-robot merged commit 508e8bc into kubernetes:master Aug 9, 2018

ixdy mentioned this pull request Aug 9, 2018

hyperkube-base: perform magic COPY incantation to make apt-get update work properly #67215

Closed

satyasm mentioned this pull request Aug 9, 2018

Fix permissions of qemu-ARCH-static in debian-base and other images #67222

Merged

ixdy mentioned this pull request Aug 10, 2018

Update to use debian-base:0.3.2 #67283

Merged

ixdy mentioned this pull request Aug 14, 2018

Update to debian-iptables v10.1 and hyperkube-base 0.10.1 #67365

Merged

k8s-ci-robot added the sig/release Categorizes an issue or PR as relevant to SIG Release. label Aug 24, 2018

k8s-ci-robot referenced this pull request Sep 26, 2018

Merge pull request #67463 from ixdy/automated-cherry-pick-of-#67026-#…

695f6bd

…67222-#67283-#67365-upstream-release-1.9 release-1.9: update to debian-base 0.3.2, debian-iptables v10.2 and hyperkube-base 0.10.2

k8s-ci-robot referenced this pull request Oct 4, 2018

Merge pull request #67460 from ixdy/automated-cherry-pick-of-#67026-#…

e920cf3

…67222-#67283-#67365-upstream-release-1.11 release-1.11: update to debian-base 0.3.2, debian-iptables v10.2 and hyperkube-base 0.10.2

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Upgrade debian-base to 0.3.1 for CVEs #67026

Upgrade debian-base to 0.3.1 for CVEs #67026

satyasm commented Aug 6, 2018 •

edited

Loading

satyasm commented Aug 6, 2018

MrHohn commented Aug 6, 2018

satyasm commented Aug 6, 2018

mkumatag commented Aug 7, 2018

cblecker left a comment

cblecker Aug 7, 2018 •

edited

Loading

ixdy Aug 8, 2018

cblecker Aug 7, 2018

ixdy Aug 8, 2018

ixdy Aug 8, 2018

satyasm commented Aug 7, 2018

cblecker commented Aug 7, 2018

tallclair commented Aug 7, 2018

ixdy commented Aug 8, 2018

satyasm commented Aug 8, 2018

satyasm commented Aug 8, 2018

ixdy commented Aug 8, 2018

satyasm commented Aug 8, 2018

satyasm commented Aug 8, 2018

ixdy commented Aug 9, 2018

ixdy commented Aug 9, 2018

k8s-ci-robot commented Aug 9, 2018

satyasm commented Aug 9, 2018

k8s-github-robot commented Aug 9, 2018

k8s-ci-robot commented Aug 9, 2018

k8s-github-robot commented Aug 9, 2018

neolit123 commented Aug 24, 2018

Upgrade debian-base to 0.3.1 for CVEs #67026

Upgrade debian-base to 0.3.1 for CVEs #67026

Conversation

satyasm commented Aug 6, 2018 • edited Loading

satyasm commented Aug 6, 2018

MrHohn commented Aug 6, 2018

satyasm commented Aug 6, 2018

mkumatag commented Aug 7, 2018

cblecker left a comment

Choose a reason for hiding this comment

cblecker Aug 7, 2018 • edited Loading

Choose a reason for hiding this comment

ixdy Aug 8, 2018

Choose a reason for hiding this comment

cblecker Aug 7, 2018

Choose a reason for hiding this comment

ixdy Aug 8, 2018

Choose a reason for hiding this comment

ixdy Aug 8, 2018

Choose a reason for hiding this comment

satyasm commented Aug 7, 2018

cblecker commented Aug 7, 2018

tallclair commented Aug 7, 2018

ixdy commented Aug 8, 2018

satyasm commented Aug 8, 2018

satyasm commented Aug 8, 2018

ixdy commented Aug 8, 2018

satyasm commented Aug 8, 2018

satyasm commented Aug 8, 2018

ixdy commented Aug 9, 2018

ixdy commented Aug 9, 2018

k8s-ci-robot commented Aug 9, 2018

satyasm commented Aug 9, 2018

k8s-github-robot commented Aug 9, 2018

k8s-ci-robot commented Aug 9, 2018

k8s-github-robot commented Aug 9, 2018

neolit123 commented Aug 24, 2018

satyasm commented Aug 6, 2018 •

edited

Loading

cblecker Aug 7, 2018 •

edited

Loading