Skip to content

How to fix image vulnerabilities

1. Overview

Use the Jenkins job scan the image to view detailed vulnerabilities information. For example: img_1 We only need to fix critical level vulnerabilities.

2. How to fix it

There are two ways for fix vulnerabilities which use offical latest image tag and sync code rebuild new image.

2.1 Use offical latest image tag

If a new version of the image is officially updated and the vulnerability is fixed, the image can be directly sync to ECR.

2.1.1 Sync image to ECR

Configure in ecr-repo. After uploading, you can scan again to confirm whether there are critical-level vulnerabilities. - Reference case 

  - name: thirdparty/vpa-updater
    extImage: registry.k8s.io/autoscaling/vpa-updater
    extImageTags:
    - "1.1.2"
When the PR is merged, the image will be pushed to ECR.

2.2 Pull code and rebuild image

If the official image has not been updated, or the new image still has vulnerabilities, we need to pull the code locally to fix it, and then rebuild the image.

2.2.1 Write Dockerfile

Pull the code of the version to be fixed, perform targeted fix based on the results of the Jenkins job scan, then write the Dockerfile and rebuild the image. - Take the part one as an example: 

FROM --platform=linux/amd64 golang:1.22.5-alpine as builder

ENV GOPATH /gopath/
...
CMD ["--v=4", "--stderrthreshold=info"]

2.2.2 Push image to ECR

Configure the Dockerfile in thirdparty-images repo, and add tag in external-images.yaml. - external-images.yaml 

  - name: vpa-updater
    extImage: registry.k8s.io/autoscaling/vpa-updater
    buildImageTag: "0.12.0"
When all PR checks pass and merge, the image will be uploaded to ECR. The Jenkins job will push the new image to ecr with name platform/thirdparty/:_. So, first you need to check if the image repo exists in ecr.yaml. If it does not exist, you need to run the onboarding pipeline to create the ecr repo at first. Please refer to the PR for details.

2.2.3 Scan again has no vulnerabilities

Finally, the image is pushed to the ECR location and tag is platform/thirdparty/vpa-updater:0.12.0_32bb565 img