Merge pull request #304 from andyzhangx/cve-3.0

fix: CVE issues in image build on release-3.0

Dockerfile

@@ -12,17 +12,15 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM k8s.gcr.io/build-image/debian-base:bullseye-v1.0.0
+FROM k8s.gcr.io/build-image/debian-base:bullseye-v1.1.0
 
-# Architecture for bin folder
 ARG ARCH
-
+ARG binary=./bin/${ARCH}/nfsplugin
-# Copy nfsplugin from build _output directory
+COPY ${binary} /nfsplugin
-COPY bin/${ARCH}/nfsplugin /nfsplugin
 
 RUN apt update && apt-mark unhold libcap2
-RUN clean-install ca-certificates mount nfs-common
+RUN clean-install ca-certificates mount nfs-common netbase
 # install updated packages to fix CVE issues
-RUN clean-install libssl1.1 libgssapi-krb5-2 libk5crypto3 libkrb5-3 libkrb5support0
+RUN clean-install libgmp10 bsdutils libssl1.1 openssl libc6 libc-bin libsystemd0 libudev1
 
 ENTRYPOINT ["/nfsplugin"]

charts/index.yaml

@@ -3,7 +3,7 @@ entries:
   csi-driver-nfs:
   - apiVersion: v1
     appVersion: latest
-    created: "2021-11-29T05:33:58.291335863Z"
+    created: "2021-12-04T14:14:45.161037914Z"
     description: CSI NFS Driver for Kubernetes
     digest: d915fea55b4c764a1534754048210835ff42834c4c787768293b02272b5331f7
     name: csi-driver-nfs
@@ -11,21 +11,21 @@ entries:
     - https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts/latest/csi-driver-nfs-v3.0.0.tgz
     version: v3.0.0
   - apiVersion: v1
-    appVersion: latest
+    appVersion: v3.0.0
-    created: "2021-11-29T05:33:58.293553676Z"
+    created: "2021-12-04T14:14:45.16202812Z"
     description: CSI NFS Driver for Kubernetes
-    digest: 360f0c7737201103c6248f1df93f44271bec501322c6a2b848e267b121abf9ae
+    digest: cfb3811336cdc846fb6b11c093e7f4aa0e0e8b2f8b77b7768af2f46354145113
     name: csi-driver-nfs
     urls:
     - https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts/v3.0.0/csi-driver-nfs-v3.0.0.tgz
     version: v3.0.0
   - apiVersion: v1
     appVersion: v2.0.0
-    created: "2021-11-29T05:33:58.292906172Z"
+    created: "2021-12-04T14:14:45.161380116Z"
     description: CSI NFS Driver for Kubernetes
     digest: f537a133eaa965f1c053ffac130f82c9b2b624e1f8bd42937c9c48818464eaac
     name: csi-driver-nfs
     urls:
     - https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts/v2.0.0/csi-driver-nfs-v2.0.0.tgz
     version: v2.0.0
-generated: "2021-11-29T05:33:58.290504458Z"
+generated: "2021-12-04T14:14:45.160131608Z"

charts/v3.0.0/csi-driver-nfs/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v1
-appVersion: latest
+appVersion: v3.0.0
 description: CSI NFS Driver for Kubernetes
 name: csi-driver-nfs
 version: v3.0.0

hack/release-image.sh

@@ -21,6 +21,7 @@ if [[ "$#" -lt 1 ]]; then
   exit 1
 fi
 
+export OUTPUT_TYPE=registry
 export REGISTRY_NAME="$1"
 export REGISTRY=$REGISTRY_NAME.azurecr.io
 export IMAGENAME=public/k8s/csi/nfs-csi

hack/verify-helm-chart.sh

@@ -49,7 +49,7 @@ if [[ -z "$(command -v jq)" ]]; then
 fi
 
 # jq-equivalent for yaml
-pip install yq
+pip install yq --ignore-installed PyYAML
 
 # Extract images from csi-nfs-controller.yaml
 expected_csi_provisioner_image="$(cat ${PKG_ROOT}/deploy/csi-nfs-controller.yaml | yq -r .spec.template.spec.containers[0].image | head -n 1)"