[go: up one dir, main page]

Skip to content

Upgrade nginx-ingress to version v1.2.1 or higher because of new vulnerabilities in Nginx Ingress Controller

Summary

When dealing with a customer support ticket I've learned that several vulnerabilities with the Nginx Ingress Controller have been uncovered and disseminated so it's only normal for end user to want to upgrade to v1.2.1 that mitigates them.

We initially suggested to the enduser to just change the default tag in the chart and give that a go, but it turns out that we don't have the image in our registry (registry.gitlab.com/gitlab-org/cloud-native/mirror/images/ingress-nginx/controller) yes, which was visually validated by looking at https://gitlab.com/gitlab-org/cloud-native/mirror/images/container_registry/2146815.

So not only do we need to test and then change the version of Nginx Ingress Controller in the chart but we also have to make the image available in our registry.

The image is available at k8s.gcr.io/ingress-nginx/controller:v1.2.1 (sha256:5516d103a9c2ecc4f026efbd4b40662ce22dc1f824fb129ed121460aaa5c47f8)

Steps to reproduce

Trying to use the v1.2.1 tag for the Nginx Ingress Controller in the Gitlab chart will not result in the desired outcome. This should also probably be the default value as the original one was deemed unsafe.

Configuration used

(Please provide a sanitized version of the configuration used wrapped in a code block (```yaml))

controller:
  name: controller
  image:
    registry: k8s.gcr.io
    repository: registry.gitlab.com/gitlab-org/cloud-native/mirror/images/ingress-nginx/controller
    tag: "v1.2.1"
    digest: sha256:545cff00370f28363dad31e3b59a94ba377854d3a11f18988f5f9e56841ef9ef
    pullPolicy: IfNotPresent
    # www-data -> uid 101
    runAsUser: 101
    allowPrivilegeEscalation: true

Current behavior

Trying to use the v1.2.1 tag for the Nginx Ingress Controller in the Gitlab chart will not result in the desired outcome. This should also probably be the default value as the original one was deemed unsafe

Expected behavior

The default value for Nginx Ingress Controller should be set to v1.2.1. If not that, at least add the k8s.gcr.io/ingress-nginx/controller:v1.2.1 image to registry.gitlab.com/gitlab-org/cloud-native/mirror/images/ingress-nginx/controller.