Change:
A number of addon images have CVEs that have been fixed in the upstream base images. We should update these images before the final 1.7 release. cc
There are no sig labels on this issue. Please by:<br(1) mentioning a sig: <br(2) specifying the label manually: <br<brNote: method (1) will trigger a notification to the team. You can find the team list and label list
/cc
cc
The new image appears to have removed . I'm not sure if this was expected, but it caused at least fluentd to stop working on COS (). This might also affect kubeproxy, which uses (a derivative of ).
also the metadata-proxy, prometheus-to-sd, the fluentd-event-exporter, and ip-masq-agent.
anything more to do for this issue?
yes, I need to get merged and update those images again. I also need to bump a few other images (dns and ip-masq-agent).
should be the last update needed.

Discussion:
docker_pull( name = "debian-iptables-amd64", <del> digest = "sha256:bfc7cc030258f53495b5dacf1e1d750db9b8687577a8648a3c8e245f8d7d2c52",  # v7 </del> <ins> digest = "sha256:bc20977ac38abfb43071b4c61c4b7edb30af894c05eb06758dd61d05118d2842",  # v7 </ins> registry = "gcr.io", repository = "google-containers/debian-iptables-amd64", )

optional: true containers: - name: kubedns <del> image: gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.2 </del> <ins> image: gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.3 </ins> resources: # TODO: Set memory limits when we've profiled the container for large # clusters, then set request = limit to keep this container in

- name: kube-dns-config mountPath: /kube-dns-config - name: dnsmasq <del> image: gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.2 </del> <ins> image: gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.3 </ins> livenessProbe: httpGet: path: /healthcheck/dnsmasq

- name: kube-dns-config mountPath: /etc/k8s/dns/dnsmasq-nanny - name: sidecar <del> image: gcr.io/google_containers/k8s-dns-sidecar-amd64:1.14.2 </del> <ins> image: gcr.io/google_containers/k8s-dns-sidecar-amd64:1.14.3 </ins> livenessProbe: httpGet: path: /metrics

containers: # TODO: Add resources in 1.8 - name: event-exporter <del> image: gcr.io/google-containers/event-exporter:v0.1.0 </del> <ins> image: gcr.io/google-containers/event-exporter:v0.1.0-r2 </ins> command: - '/event-exporter' - name: prometheus-to-sd-exporter <del> image: gcr.io/google-containers/prometheus-to-sd:v0.1.2 </del> <ins> image: gcr.io/google-containers/prometheus-to-sd:v0.1.2-r2 </ins> command: - /monitor - --component=event_exporter

hostNetwork: true containers: - name: fluentd-gcp <del> image: gcr.io/google-containers/fluentd-gcp:2.0.5 </del> <ins> image: gcr.io/google-containers/fluentd-gcp:2.0.7 </ins> # If fluentd consumes its own logs, the following situation may happen: # fluentd fails to send a chunk to the server => writes it to the log => # tries to send this message to the server => fails to send a chunk and so on.

hostNetwork: true containers: - name: ip-masq-agent <del> image: gcr.io/google-containers/ip-masq-agent-amd64:v2.0.1 </del> <ins> image: gcr.io/google-containers/ip-masq-agent-amd64:v2.0.2 </ins> resources: limits: cpu: 100m

dnsPolicy: Default containers: - name: metadata-proxy <del> image: gcr.io/google-containers/metadata-proxy:0.1.1 </del> <ins> image: gcr.io/google-containers/metadata-proxy:0.1.2 </ins> imagePullPolicy: Always securityContext: privileged: true

path: /run/xtables.lock ` <del> KubeDNSVersion = "1.14.2" </del> <ins> KubeDNSVersion = "1.14.3" </ins> KubeDNSDeployment = `