[refarch] eks/external-dns chart version

[AleksandrMatveev]

Hi guys! Our recent reference architecture received from you has the chart version of external-dns set to 6.13.1. The latest available version is 8.7.5 - is there anything preventing a more updated version? I'm asking because 6.13.1 has a critical vulnerability CVE-2024-2961.

@mtb-xt JFYI

[GabisCampana]

@dudymas

[Benbentwo]

Hey @AleksandrMatveev, great question, usually charts are pretty safe to upgrade, the common things to look out for are API changes - such as now using an operator or a different kube version of a k8s resource. Upgrading usually won't have that problem assuming your k8s cluster is up to date with latest available.

External DNS from bitnami has an upgrading section.

To 8.7.0

This version introduces image verification for security purposes. To disable it, set global.security.allowInsecureImages to true. More details at GitHub Issue.

To 7.0.0

This major bump changes the following security defaults:

• runAsGroup is changed from 0 to 1001
• readOnlyRootFilesystem is set to true
• resourcesPreset is changed from none to the minimum size working in our test suites (NOTE: resourcesPreset is not meant for production usage, but resources adapted to your use case).
• global.compatibility.openshift.adaptSecurityContext is changed from disabled to auto.
  This could potentially break any customization or init scripts used in your deployment. If this is the case, change the default values to the previous ones.

overall it looks like it should be a painless upgrade, we just haven't had the availability to test. I recommend going for it, with the notes above as a reference if anything stops pulling or working - it should be a simple values.yaml change to fix it. My guess is the defaults are fine though.

[Benbentwo]

Going to close this as I think you probably were able to upgrade, let me know (and reopen) if you ran into issues. We'll try to update our docs and refarch to use latest external-dns