From 109be1a3cc0aea5c528a03e0feda57334b7b8732 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 5 Dec 2022 13:09:18 +0100 Subject: [PATCH] Replaced wait-for-it image to resolve security issues This image was also outdated (no recent releases) and contains whole bunch of vulnerabilities Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 6 +++--- charts/spire/templates/agent-daemonset.yaml | 2 +- charts/spire/values.yaml | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 93e3c84..989f437 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -128,9 +128,9 @@ Kubernetes: `>=1.21.0-0` | spire.clusterName | string | `"example-cluster"` | | | spire.trustDomain | string | `"example.org"` | | | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | -| waitForIt.image.registry | string | `"gcr.io"` | | -| waitForIt.image.repository | string | `"spiffe-io/wait-for-it"` | | -| waitForIt.image.version | string | `""` | | +| waitForIt.image.registry | string | `"cgr.dev"` | | +| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | | +| waitForIt.image.version | string | `"latest-20221215"` | | | waitForIt.resources | object | `{}` | | | workloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | | workloadRegistrar.image.registry | string | `"gcr.io"` | | diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml index 895fa2b..0c0d394 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/templates/agent-daemonset.yaml @@ -31,7 +31,7 @@ spec: # from https://github.com/lqhl/wait-for-it image: {{ template "spire.image" .Values.waitForIt }} imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }} - args: ["-t", "30", "{{ include "spire.fullname" . }}-server:8081"] + args: ["-t", "30", "-h", "{{ include "spire.fullname" . }}-server", "-p", "8081"] resources: {{- toYaml .Values.waitForIt.resources | nindent 12 }} {{- with .Values.agent.nodeSelector }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index ca38ff0..7b22dff 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -3,10 +3,10 @@ fullnameOverride: "" waitForIt: image: - registry: gcr.io - repository: spiffe-io/wait-for-it + registry: cgr.dev + repository: chainguard/wait-for-it pullPolicy: IfNotPresent - version: "" + version: latest-20221215 resources: {} workloadRegistrar: