Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Align knative/serving version across Modelmesh repositories #483

Open
spolti opened this issue Jan 25, 2024 · 5 comments
Open

Align knative/serving version across Modelmesh repositories #483

spolti opened this issue Jan 25, 2024 · 5 comments
Assignees
Labels
bug Something isn't working

Comments

@spolti
Copy link
Contributor

spolti commented Jan 25, 2024

Describe the bug

Recently we had 2 CVEs in the knative/serving component which led us to update it to a newer version that would require k8s dependencies to be bumped to 0.27.x., but it is incompatible with controller-runtime 0.14.x.

For this reason, to be able to update the knative/serving to a newer version we had to pin down the k8s version to 0.26.x.

There are two vulnerabilities that are fixed by bumping Knative to 0.39.3:

To property update it, we would need, first, address #481 to not need to pin the k8s version, once it is updated, we can revert the replace tag changes and start using k8s 0.27.x

@spolti spolti added the bug Something isn't working label Jan 25, 2024
@spolti spolti self-assigned this Jan 25, 2024
@spolti
Copy link
Contributor Author

spolti commented Jan 25, 2024

Affected repositories:

  • KServe
  • modelmesh-serving

@ckadner
Copy link
Member

ckadner commented Jan 25, 2024

There are two vulnerabilities that are fixed by bumping Knative to 0.39.3:

And

They all describe the same vulnerability, however.


The Snyk and CVE reports recommend several "safe" versions to upgrade to. However, that list is not exhaustive. In fact the fix knative/serving#14523 for the vulnerability was back-ported to several release streams:

@spolti
Copy link
Contributor Author

spolti commented Feb 1, 2024

Ideally, we should be using the latest 0.3X.x, right?

@ckadner
Copy link
Member

ckadner commented Feb 14, 2024

Ideally, we should be using the latest 0.3X.x, right?

Well, possibly, yes, but we do need to pick the (latest) knative/serving version that aligns with the selected KServe version, Go version, etc

@spolti
Copy link
Contributor Author

spolti commented Feb 14, 2024

Indeed.
I'll take a look on this and share it here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants