Update kube and alpine images version to fix vulnerability

[ashutoshrathore]

No description provided.

[ashutoshrathore]

@ArnobKumarSaha @groundnuty can you please review and merge it?

[spideyfusion]

@groundnuty Mind merging this in to address security vulnerabilities?

[groundnuty]

@spideyfusion k8s-wait-for will be updated in December and after that, I plan to do a release every ~6 months.

[groundnuty]

@spideyfusion @ashutoshrathore I'm updating the dependencies and releasing the new version this week, but this constant race against vulnerabilities is too rapid for a biannual release cycle.

I researched using https://www.chainguard.dev images as they seem to be popular nowadays in devops circles.
My intention was to use their kubectl and reguild k8s-wait-for image with github workflows eg. weekly with pined kubectl version and updated dependences, but last year they disabled pulling images with any version but latest...

Do you have any recommendations/know the best practices on how to tackle the problem of vulnerability fixes in an automatic manner, but still maintaining stability of the tool?

[ashutoshrathore]

@spideyfusion @ashutoshrathore I'm updating the dependencies and releasing the new version this week, but this constant race against vulnerabilities is too rapid for a biannual release cycle.

I researched using https://www.chainguard.dev images as they seem to be popular nowadays in devops circles. My intention was to use their kubectl and reguild k8s-wait-for image with github workflows eg. weekly with pined kubectl version and updated dependences, but last year they disabled pulling images with any version but latest...

Do you have any recommendations/know the best practices on how to tackle the problem of vulnerability fixes in an automatic manner, but still maintaining stability of the tool?

I am not sure if there are any best practices or automated methods to keep this image up to date. However, if I have permission to maintain this repository, I can ensure the images are regularly updated. We pull this image into our Azure Container Registry and also scan it regularly using Defender. Also, this k8s-wait image is used in our organization by many applications. Therefore, it would be easier for me to address vulnerabilities here, as I already need to fix them in my container as well.

PS: Sorry for late reply, I was on paternity leave :)

[zlemisie]

hi, when can we expect the update?