mirror of
https://github.com/vmware-tanzu/velero.git
synced 2026-09-28 02:44:19 +00:00
Fix CVE-2020-29652 and CVE-2020-26160 (#4315)
Bump up restic to v0.12.1 to fix CVE-2020-26160. Bump up module "github.com/vmware-tanzu/crash-diagnostics" to v0.3.7 to fix CVE-2020-29652. The "github.com/vmware-tanzu/crash-diagnostics" updates client-go to v0.22.2 which introduces several break changes, this commit updates the related codes as well Signed-off-by: Wenkai Yin(尹文开) <yinw@vmware.com>
This commit is contained in:
Wenkai Yin(尹文开)
@@ -205,8 +205,10 @@ spec:
|
||||
are expanded using the container''s environment.
|
||||
If a variable cannot be resolved, the
|
||||
reference in the input string will be
|
||||
unchanged. The $(VAR_NAME) syntax can
|
||||
be escaped with a double $$, ie: $$(VAR_NAME).
|
||||
unchanged. Double $$ are reduced to a
|
||||
single $, which allows for escaping the
|
||||
$(VAR_NAME) syntax: i.e. "$$(VAR_NAME)"
|
||||
will produce the string literal "$(VAR_NAME)".
|
||||
Escaped references will never be expanded,
|
||||
regardless of whether the variable exists
|
||||
or not. Cannot be updated. More info:
|
||||
@@ -221,12 +223,14 @@ spec:
|
||||
references $(VAR_NAME) are expanded using
|
||||
the container''s environment. If a variable
|
||||
cannot be resolved, the reference in the
|
||||
input string will be unchanged. The $(VAR_NAME)
|
||||
syntax can be escaped with a double $$,
|
||||
ie: $$(VAR_NAME). Escaped references will
|
||||
never be expanded, regardless of whether
|
||||
the variable exists or not. Cannot be
|
||||
updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell'
|
||||
input string will be unchanged. Double
|
||||
$$ are reduced to a single $, which allows
|
||||
for escaping the $(VAR_NAME) syntax: i.e.
|
||||
"$$(VAR_NAME)" will produce the string
|
||||
literal "$(VAR_NAME)". Escaped references
|
||||
will never be expanded, regardless of
|
||||
whether the variable exists or not. Cannot
|
||||
be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell'
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
@@ -244,17 +248,19 @@ spec:
|
||||
value:
|
||||
description: 'Variable references
|
||||
$(VAR_NAME) are expanded using the
|
||||
previous defined environment variables
|
||||
previously defined environment variables
|
||||
in the container and any service
|
||||
environment variables. If a variable
|
||||
cannot be resolved, the reference
|
||||
in the input string will be unchanged.
|
||||
The $(VAR_NAME) syntax can be escaped
|
||||
with a double $$, ie: $$(VAR_NAME).
|
||||
Escaped references will never be
|
||||
expanded, regardless of whether
|
||||
the variable exists or not. Defaults
|
||||
to "".'
|
||||
Double $$ are reduced to a single
|
||||
$, which allows for escaping the
|
||||
$(VAR_NAME) syntax: i.e. "$$(VAR_NAME)"
|
||||
will produce the string literal
|
||||
"$(VAR_NAME)". Escaped references
|
||||
will never be expanded, regardless
|
||||
of whether the variable exists or
|
||||
not. Defaults to "".'
|
||||
type: string
|
||||
valueFrom:
|
||||
description: Source for the environment
|
||||
@@ -804,6 +810,30 @@ spec:
|
||||
required:
|
||||
- port
|
||||
type: object
|
||||
terminationGracePeriodSeconds:
|
||||
description: Optional duration in seconds
|
||||
the pod needs to terminate gracefully
|
||||
upon probe failure. The grace period
|
||||
is the duration in seconds after the
|
||||
processes running in the pod are sent
|
||||
a termination signal and the time
|
||||
when the processes are forcibly halted
|
||||
with a kill signal. Set this value
|
||||
longer than the expected cleanup time
|
||||
for your process. If this value is
|
||||
nil, the pod's terminationGracePeriodSeconds
|
||||
will be used. Otherwise, this value
|
||||
overrides the value provided by the
|
||||
pod spec. Value must be non-negative
|
||||
integer. The value zero indicates
|
||||
stop immediately via the kill signal
|
||||
(no opportunity to shut down). This
|
||||
is a beta field and requires enabling
|
||||
ProbeTerminationGracePeriod feature
|
||||
gate. Minimum value is 1. spec.terminationGracePeriodSeconds
|
||||
is used if unset.
|
||||
format: int64
|
||||
type: integer
|
||||
timeoutSeconds:
|
||||
description: 'Number of seconds after
|
||||
which the probe times out. Defaults
|
||||
@@ -1006,6 +1036,30 @@ spec:
|
||||
required:
|
||||
- port
|
||||
type: object
|
||||
terminationGracePeriodSeconds:
|
||||
description: Optional duration in seconds
|
||||
the pod needs to terminate gracefully
|
||||
upon probe failure. The grace period
|
||||
is the duration in seconds after the
|
||||
processes running in the pod are sent
|
||||
a termination signal and the time
|
||||
when the processes are forcibly halted
|
||||
with a kill signal. Set this value
|
||||
longer than the expected cleanup time
|
||||
for your process. If this value is
|
||||
nil, the pod's terminationGracePeriodSeconds
|
||||
will be used. Otherwise, this value
|
||||
overrides the value provided by the
|
||||
pod spec. Value must be non-negative
|
||||
integer. The value zero indicates
|
||||
stop immediately via the kill signal
|
||||
(no opportunity to shut down). This
|
||||
is a beta field and requires enabling
|
||||
ProbeTerminationGracePeriod feature
|
||||
gate. Minimum value is 1. spec.terminationGracePeriodSeconds
|
||||
is used if unset.
|
||||
format: int64
|
||||
type: integer
|
||||
timeoutSeconds:
|
||||
description: 'Number of seconds after
|
||||
which the probe times out. Defaults
|
||||
@@ -1017,7 +1071,7 @@ spec:
|
||||
resources:
|
||||
description: 'Compute Resources required
|
||||
by this container. Cannot be updated.
|
||||
More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/'
|
||||
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
|
||||
properties:
|
||||
limits:
|
||||
additionalProperties:
|
||||
@@ -1028,7 +1082,7 @@ spec:
|
||||
x-kubernetes-int-or-string: true
|
||||
description: 'Limits describes the maximum
|
||||
amount of compute resources allowed.
|
||||
More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/'
|
||||
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
|
||||
type: object
|
||||
requests:
|
||||
additionalProperties:
|
||||
@@ -1043,12 +1097,14 @@ spec:
|
||||
a container, it defaults to Limits
|
||||
if that is explicitly specified, otherwise
|
||||
to an implementation-defined value.
|
||||
More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/'
|
||||
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
|
||||
type: object
|
||||
type: object
|
||||
securityContext:
|
||||
description: 'Security options the pod should
|
||||
run with. More info: https://kubernetes.io/docs/concepts/policy/security-context/
|
||||
description: 'SecurityContext defines the
|
||||
security options the container should
|
||||
be run with. If set, the fields of SecurityContext
|
||||
override the equivalent fields of PodSecurityContext.
|
||||
More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/'
|
||||
properties:
|
||||
allowPrivilegeEscalation:
|
||||
@@ -1217,6 +1273,25 @@ spec:
|
||||
is the name of the GMSA credential
|
||||
spec to use.
|
||||
type: string
|
||||
hostProcess:
|
||||
description: HostProcess determines
|
||||
if a container should be run as
|
||||
a 'Host Process' container. This
|
||||
field is alpha-level and will
|
||||
only be honored by components
|
||||
that enable the WindowsHostProcessContainers
|
||||
feature flag. Setting this field
|
||||
without the feature flag will
|
||||
result in errors when validating
|
||||
the Pod. All of a Pod's containers
|
||||
must have the same effective HostProcess
|
||||
value (it is not allowed to have
|
||||
a mix of HostProcess containers
|
||||
and non-HostProcess containers). In
|
||||
addition, if HostProcess is true
|
||||
then HostNetwork must also be
|
||||
set to true.
|
||||
type: boolean
|
||||
runAsUserName:
|
||||
description: The UserName in Windows
|
||||
to run the entrypoint of the container
|
||||
@@ -1369,6 +1444,30 @@ spec:
|
||||
required:
|
||||
- port
|
||||
type: object
|
||||
terminationGracePeriodSeconds:
|
||||
description: Optional duration in seconds
|
||||
the pod needs to terminate gracefully
|
||||
upon probe failure. The grace period
|
||||
is the duration in seconds after the
|
||||
processes running in the pod are sent
|
||||
a termination signal and the time
|
||||
when the processes are forcibly halted
|
||||
with a kill signal. Set this value
|
||||
longer than the expected cleanup time
|
||||
for your process. If this value is
|
||||
nil, the pod's terminationGracePeriodSeconds
|
||||
will be used. Otherwise, this value
|
||||
overrides the value provided by the
|
||||
pod spec. Value must be non-negative
|
||||
integer. The value zero indicates
|
||||
stop immediately via the kill signal
|
||||
(no opportunity to shut down). This
|
||||
is a beta field and requires enabling
|
||||
ProbeTerminationGracePeriod feature
|
||||
gate. Minimum value is 1. spec.terminationGracePeriodSeconds
|
||||
is used if unset.
|
||||
format: int64
|
||||
type: integer
|
||||
timeoutSeconds:
|
||||
description: 'Number of seconds after
|
||||
which the probe times out. Defaults
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -202,12 +202,14 @@ spec:
|
||||
is not provided. Variable references $(VAR_NAME)
|
||||
are expanded using the container''s environment.
|
||||
If a variable cannot be resolved, the reference
|
||||
in the input string will be unchanged. The
|
||||
$(VAR_NAME) syntax can be escaped with a
|
||||
double $$, ie: $$(VAR_NAME). Escaped references
|
||||
will never be expanded, regardless of whether
|
||||
the variable exists or not. Cannot be updated.
|
||||
More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell'
|
||||
in the input string will be unchanged. Double
|
||||
$$ are reduced to a single $, which allows
|
||||
for escaping the $(VAR_NAME) syntax: i.e.
|
||||
"$$(VAR_NAME)" will produce the string literal
|
||||
"$(VAR_NAME)". Escaped references will never
|
||||
be expanded, regardless of whether the variable
|
||||
exists or not. Cannot be updated. More info:
|
||||
https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell'
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
@@ -218,12 +220,14 @@ spec:
|
||||
references $(VAR_NAME) are expanded using
|
||||
the container''s environment. If a variable
|
||||
cannot be resolved, the reference in the
|
||||
input string will be unchanged. The $(VAR_NAME)
|
||||
syntax can be escaped with a double $$,
|
||||
ie: $$(VAR_NAME). Escaped references will
|
||||
never be expanded, regardless of whether
|
||||
the variable exists or not. Cannot be updated.
|
||||
More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell'
|
||||
input string will be unchanged. Double $$
|
||||
are reduced to a single $, which allows
|
||||
for escaping the $(VAR_NAME) syntax: i.e.
|
||||
"$$(VAR_NAME)" will produce the string literal
|
||||
"$(VAR_NAME)". Escaped references will never
|
||||
be expanded, regardless of whether the variable
|
||||
exists or not. Cannot be updated. More info:
|
||||
https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell'
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
@@ -240,17 +244,19 @@ spec:
|
||||
type: string
|
||||
value:
|
||||
description: 'Variable references $(VAR_NAME)
|
||||
are expanded using the previous defined
|
||||
environment variables in the container
|
||||
and any service environment variables.
|
||||
If a variable cannot be resolved,
|
||||
the reference in the input string
|
||||
will be unchanged. The $(VAR_NAME)
|
||||
syntax can be escaped with a double
|
||||
$$, ie: $$(VAR_NAME). Escaped references
|
||||
will never be expanded, regardless
|
||||
of whether the variable exists or
|
||||
not. Defaults to "".'
|
||||
are expanded using the previously
|
||||
defined environment variables in the
|
||||
container and any service environment
|
||||
variables. If a variable cannot be
|
||||
resolved, the reference in the input
|
||||
string will be unchanged. Double $$
|
||||
are reduced to a single $, which allows
|
||||
for escaping the $(VAR_NAME) syntax:
|
||||
i.e. "$$(VAR_NAME)" will produce the
|
||||
string literal "$(VAR_NAME)". Escaped
|
||||
references will never be expanded,
|
||||
regardless of whether the variable
|
||||
exists or not. Defaults to "".'
|
||||
type: string
|
||||
valueFrom:
|
||||
description: Source for the environment
|
||||
@@ -792,6 +798,29 @@ spec:
|
||||
required:
|
||||
- port
|
||||
type: object
|
||||
terminationGracePeriodSeconds:
|
||||
description: Optional duration in seconds
|
||||
the pod needs to terminate gracefully
|
||||
upon probe failure. The grace period
|
||||
is the duration in seconds after the
|
||||
processes running in the pod are sent
|
||||
a termination signal and the time when
|
||||
the processes are forcibly halted with
|
||||
a kill signal. Set this value longer
|
||||
than the expected cleanup time for your
|
||||
process. If this value is nil, the pod's
|
||||
terminationGracePeriodSeconds will be
|
||||
used. Otherwise, this value overrides
|
||||
the value provided by the pod spec.
|
||||
Value must be non-negative integer.
|
||||
The value zero indicates stop immediately
|
||||
via the kill signal (no opportunity
|
||||
to shut down). This is a beta field
|
||||
and requires enabling ProbeTerminationGracePeriod
|
||||
feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds
|
||||
is used if unset.
|
||||
format: int64
|
||||
type: integer
|
||||
timeoutSeconds:
|
||||
description: 'Number of seconds after
|
||||
which the probe times out. Defaults
|
||||
@@ -991,6 +1020,29 @@ spec:
|
||||
required:
|
||||
- port
|
||||
type: object
|
||||
terminationGracePeriodSeconds:
|
||||
description: Optional duration in seconds
|
||||
the pod needs to terminate gracefully
|
||||
upon probe failure. The grace period
|
||||
is the duration in seconds after the
|
||||
processes running in the pod are sent
|
||||
a termination signal and the time when
|
||||
the processes are forcibly halted with
|
||||
a kill signal. Set this value longer
|
||||
than the expected cleanup time for your
|
||||
process. If this value is nil, the pod's
|
||||
terminationGracePeriodSeconds will be
|
||||
used. Otherwise, this value overrides
|
||||
the value provided by the pod spec.
|
||||
Value must be non-negative integer.
|
||||
The value zero indicates stop immediately
|
||||
via the kill signal (no opportunity
|
||||
to shut down). This is a beta field
|
||||
and requires enabling ProbeTerminationGracePeriod
|
||||
feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds
|
||||
is used if unset.
|
||||
format: int64
|
||||
type: integer
|
||||
timeoutSeconds:
|
||||
description: 'Number of seconds after
|
||||
which the probe times out. Defaults
|
||||
@@ -1002,7 +1054,7 @@ spec:
|
||||
resources:
|
||||
description: 'Compute Resources required by
|
||||
this container. Cannot be updated. More
|
||||
info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/'
|
||||
info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
|
||||
properties:
|
||||
limits:
|
||||
additionalProperties:
|
||||
@@ -1013,7 +1065,7 @@ spec:
|
||||
x-kubernetes-int-or-string: true
|
||||
description: 'Limits describes the maximum
|
||||
amount of compute resources allowed.
|
||||
More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/'
|
||||
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
|
||||
type: object
|
||||
requests:
|
||||
additionalProperties:
|
||||
@@ -1027,12 +1079,14 @@ spec:
|
||||
If Requests is omitted for a container,
|
||||
it defaults to Limits if that is explicitly
|
||||
specified, otherwise to an implementation-defined
|
||||
value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/'
|
||||
value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
|
||||
type: object
|
||||
type: object
|
||||
securityContext:
|
||||
description: 'Security options the pod should
|
||||
run with. More info: https://kubernetes.io/docs/concepts/policy/security-context/
|
||||
description: 'SecurityContext defines the
|
||||
security options the container should be
|
||||
run with. If set, the fields of SecurityContext
|
||||
override the equivalent fields of PodSecurityContext.
|
||||
More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/'
|
||||
properties:
|
||||
allowPrivilegeEscalation:
|
||||
@@ -1197,6 +1251,24 @@ spec:
|
||||
is the name of the GMSA credential
|
||||
spec to use.
|
||||
type: string
|
||||
hostProcess:
|
||||
description: HostProcess determines
|
||||
if a container should be run as
|
||||
a 'Host Process' container. This
|
||||
field is alpha-level and will only
|
||||
be honored by components that enable
|
||||
the WindowsHostProcessContainers
|
||||
feature flag. Setting this field
|
||||
without the feature flag will result
|
||||
in errors when validating the Pod.
|
||||
All of a Pod's containers must have
|
||||
the same effective HostProcess value
|
||||
(it is not allowed to have a mix
|
||||
of HostProcess containers and non-HostProcess
|
||||
containers). In addition, if HostProcess
|
||||
is true then HostNetwork must also
|
||||
be set to true.
|
||||
type: boolean
|
||||
runAsUserName:
|
||||
description: The UserName in Windows
|
||||
to run the entrypoint of the container
|
||||
@@ -1346,6 +1418,29 @@ spec:
|
||||
required:
|
||||
- port
|
||||
type: object
|
||||
terminationGracePeriodSeconds:
|
||||
description: Optional duration in seconds
|
||||
the pod needs to terminate gracefully
|
||||
upon probe failure. The grace period
|
||||
is the duration in seconds after the
|
||||
processes running in the pod are sent
|
||||
a termination signal and the time when
|
||||
the processes are forcibly halted with
|
||||
a kill signal. Set this value longer
|
||||
than the expected cleanup time for your
|
||||
process. If this value is nil, the pod's
|
||||
terminationGracePeriodSeconds will be
|
||||
used. Otherwise, this value overrides
|
||||
the value provided by the pod spec.
|
||||
Value must be non-negative integer.
|
||||
The value zero indicates stop immediately
|
||||
via the kill signal (no opportunity
|
||||
to shut down). This is a beta field
|
||||
and requires enabling ProbeTerminationGracePeriod
|
||||
feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds
|
||||
is used if unset.
|
||||
format: int64
|
||||
type: integer
|
||||
timeoutSeconds:
|
||||
description: 'Number of seconds after
|
||||
which the probe times out. Defaults
|
||||
|
||||
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user