Repository navigation
chore(kamaji): bump system/kamaji images to current upstream release #2885
Description
Bump the system/kamaji package to the latest upstream release.
The currently pinned images carry outdated packages with published security fixes: libpython3.13-minimal (5), libexpat (3), libgnutls30 (2), libgssapi-krb5-2, sqlite-libs, curl, libgcrypt20, libcap2, nghttp2-libs, stdlib — 17 known CVEs total.
Routine maintenance bump: verify with helm template / helm lint and a dev-cluster deploy.
Activity
lexfrei commentedon Jun 24, 2026
Closed the bump attempt in #3013 -- here is the disposition for this issue.
The CVE list here was scanned against a Debian/Alpine image, but the shipped kamaji image is distroless/static: trivy reports 0 OS-package vulnerabilities on the pinned digest, so 16 of the 17 CVEs (libpython, libexpat, gnutls, krb5, sqlite, curl, libgcrypt, nghttp2, ...) are not present. The only real one is the Go stdlib CVE (go1.26.3 -> 1.26.4), which a plain rebuild on the current golang:1.26 closes -- no kamaji version bump required.
A bump is also actively harmful right now: the current edge line vendors a k8s v1.36 kubeadm that breaks tenant apiserver-to-kubelet authorization (details in #3013; upstream clastix/kamaji#1171 / #1172).
Plan: rebuild 26.3.5-edge on the current golang:1.26 + distroless base and re-pin the digest, which closes the stdlib CVE so this issue can close. The image's real remaining Go-module exposure (x/net needs 0.55.0, x/crypto needs 0.52.0) is not closed by any kamaji tag <= 26.6.4 and will be tracked separately.
fix(kamaji): close Go stdlib and module CVEs in the shipped binary (c…
fix(kamaji): backport datastore unused-deletion deadlock fix (clastix…