Upgrade nginx-ingress to version v1.2.1 or higher because of new vulnerabilities in Nginx Ingress Controller
Summary
When dealing with a customer support ticket I've learned that several vulnerabilities with the Nginx Ingress Controller have been uncovered and disseminated so it's only normal for end user to want to upgrade to v1.2.1 that mitigates them.
We initially suggested to the enduser to just change the default tag in the chart and give that a go, but it turns out that we don't have the image in our registry (registry.gitlab.com/gitlab-org/cloud-native/mirror/images/ingress-nginx/controller
) yes, which was visually validated by looking at https://gitlab.com/gitlab-org/cloud-native/mirror/images/container_registry/2146815.
So not only do we need to test and then change the version of Nginx Ingress Controller in the chart but we also have to make the image available in our registry.
The image is available at k8s.gcr.io/ingress-nginx/controller:v1.2.1
(sha256:5516d103a9c2ecc4f026efbd4b40662ce22dc1f824fb129ed121460aaa5c47f8
)
Steps to reproduce
Trying to use the v1.2.1
tag for the Nginx Ingress Controller in the Gitlab chart will not result in the desired outcome. This should also probably be the default value as the original one was deemed unsafe.
Configuration used
(Please provide a sanitized version of the configuration used wrapped in a code block (```yaml))
controller:
name: controller
image:
registry: k8s.gcr.io
repository: registry.gitlab.com/gitlab-org/cloud-native/mirror/images/ingress-nginx/controller
tag: "v1.2.1"
digest: sha256:545cff00370f28363dad31e3b59a94ba377854d3a11f18988f5f9e56841ef9ef
pullPolicy: IfNotPresent
# www-data -> uid 101
runAsUser: 101
allowPrivilegeEscalation: true
Current behavior
Trying to use the v1.2.1
tag for the Nginx Ingress Controller in the Gitlab chart will not result in the desired outcome. This should also probably be the default value as the original one was deemed unsafe
Expected behavior
The default value for Nginx Ingress Controller should be set to v1.2.1
. If not that, at least add the k8s.gcr.io/ingress-nginx/controller:v1.2.1
image to registry.gitlab.com/gitlab-org/cloud-native/mirror/images/ingress-nginx/controller
.