fix: downgrade k8s.io libs to v0.34.1 to fix istiod startup panic (1.28.1) - #41
Merged
Merged
Conversation
与 istio-1.28 分支同款修复（istio-1.28 见 PR #40）：CVE 修复把 prometheus/prometheus 升到 v0.311.3，连带将 k8s.io 系列拉到 v0.35.3； k8s 1.35 默认构建不再提供生成类型的 ProtoMessage() 方法（gogo 移除 过渡期，需 opt-in 构建标签），而 1.28 的 operator values proto 仍引用 k8s.io.api.core.v1 类型，istiod 初始化 sidecar injector 解析 values 时 protobuf 描述符懒加载 panic，启动即崩溃。 修复： - k8s.io 系列回退 v0.34.1（bump 前原版本，与上游 release-1.28 一致） - prometheus 以 replace 钉 v0.305.3（3.5 LTS，同样修复 CVE-2026-42154/40179/42151/44903 且不强拉 k8s v0.35） - 保留 grpc v1.82.1 及其余全部 CVE 升级 - 新增回归测试：解析含 k8s Affinity 字段的 values 不应 panic Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: 王然 <ranwang@alauda.io>
与 istio-1.28 分支同款调整（详见 PR #40）：v0.305.3(3.5 LTS) 语义上 已修复 CVE-2026-42151/40179/44903，但 trivy DB 对 Go module 只收录 0.311.3 一条修复线，线性比较下 v0.305.3 仍被判 vulnerable，镜像扫描 无法清零。改为 prometheus v0.311.3 + replace 钉 k8s.io 三件套 v0.34.1 （replace 不参与 MVS 传递），istiod 启动 panic 修复保持不变。 1.28 分支同方案已完成端到端验证：流水线镜像 trivy 扫描 prometheus CVE 清零，业务集群部署后 istiod 正常、注入/xDS/数据面功能无影响。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: 王然 <ranwang@alauda.io>
chinaran
added a commit
that referenced
this pull request
Jul 29, 2026
1.28.6-asm-r4 事故（prometheus v0.311.3 连带拉 k8s.io v0.35.3，k8s 1.35 移除生成类型默认 ProtoMessage()，istio 1.28 values proto 未解耦，istiod 启动即 panic）复盘回写到事故第一现场的本 skill： - tidy 后审查 k8s.io 等基础库连带升级面，超上游钉定必须回钉 - 1.28 系 prometheus 必须 v0.311.3 + replace 钉 k8s.io 三件套 v0.34.1 （v0.305.3 LTS 语义已修但被 trivy DB 线性区间否决，实测无法清零） - 落位版本以扫描器修复候选为准，勿基于 advisory 原文换修复分支； 偏离候选时推流水线前先本地 trivy 预扫 - go.mod 变更提交前跑 values/inject 最小运行时单测，拦截启动 panic 此前这批教训误写入 sail-operator 仓库同名 skill（该 skill 按仓库隔离， 在本仓库工作时不可见），本次迁至此处，sail-operator 侧同步修剪为 通用原则 + 交叉引用。修复参照 #40/#41/#42。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: 王然 <ranwang@alauda.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
与 istio-1.28 的 #40 同款修复，根因分析与验证详见该 PR。
go test ./pkg/kube/inject/全量通过🤖 Generated with Claude Code