security(runner): kubectl v1.32.13 -> v1.36.2, Go builder 1.26.5 - #541
Merged
Conversation
….26.5 The nudgebee-agent image's 37 fixable Trivy findings (20 HIGH) are almost entirely in the bundled kubectl binary: upstream builds the 1.32 line on Go 1.24.13, whose stale stdlib (21 CVEs) and x/net v0.30 (12 CVEs) ship inside the prebuilt binary — our own agent binary's deps are already current. Bump kubectl to v1.36.2 (current stable, built on Go 1.26.4) and the agent builder to golang:1.26.5-alpine with GOTOOLCHAIN=local (fixes the stdlib pair CVE-2026-39822 HIGH / CVE-2026-42505 present in 1.26.4). Residual after this: only the industry-wide Go 1.26.4 stdlib pair inside kubectl, which clears when upstream rebuilds on 1.26.5. kubectl's CLI surface used by kubectl_command_executor (pkg/kube/exec.go) is stable across these versions; the official version-skew policy applies to cluster API interactions, which the executor's read/exec commands tolerate.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the runner's Dockerfile to use Go 1.26.5 to address security vulnerabilities, sets GOTOOLCHAIN=local, and upgrades kubectl to v1.36.2 to reduce Trivy findings. Feedback points out that upgrading kubectl to v1.36.2 may violate the Kubernetes version skew policy in older clusters, and suggests building kubectl from source with the patched Go toolchain as an alternative.
Contributor
|
📦 Image Tags Updated |
blue4209211
approved these changes
Jul 17, 2026
1 task
blue4209211
pushed a commit
that referenced
this pull request
Jul 17, 2026
…#542) - nudgebee-agent -> 2026-07-17T04-32-36_5d6b67de (from #541: kubectl v1.36.2 + Go 1.26.5 builder — clears 35 of the image's 37 fixable Trivy findings, incl. 20 HIGH; residual is the Go 1.26.4 stdlib pair + vendored x/net inside upstream's kubectl build, which clears when upstream K8s rebuilds) - application-profiler-{bpf,...} -> 4f4b455 (all profiler flavors rebuilt on Go 1.26.5, clearing the stdlib pair CVE-2026-39822 HIGH / CVE-2026-42505) Chart 0.1.13 -> 0.1.14.
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The
nudgebee-agentimage's 37 fixable Trivy findings (20 HIGH) are almost entirely in the bundled kubectl binary, not our code: upstream builds the kubectl 1.32 line on Go 1.24.13, whose stale stdlib (21 CVEs) andx/net v0.30(12 CVEs) ship inside the prebuilt binary. The agent's own go.mod deps are already current (x/net 0.55, oauth2 0.36, spdystream 0.5.1).go versionon the release binary. Note the runner's k8s.io libs are already v0.36.x, so the bundled kubectl now matches the client library line.golang:1.26.5-alpine(digest-pinned) +GOTOOLCHAIN=local— fixes the stdlib pair CVE-2026-39822 (HIGH) / CVE-2026-42505 in our own binary.Residual after this: only the industry-wide Go 1.26.4 stdlib pair inside upstream's kubectl build; clears when upstream rebuilds on 1.26.5.
How Has This Been Tested?
go build ./...clean insidegolang:1.26.5-alpine(CGO_ENABLED=0, GOTOOLCHAIN=local)