SECURITY: nginx-ingress needs to be updated to 0.26.1

[Jay Kuri]

nginx versions prior to 1.16 contain a number of security vulnerabilities. The version of nginx that is used in the current nginx-ingress controller for charmed k8s 1.15 and 1.16 uses a vulnerable version (nginx 1.15.x)

We are using nginx-ingress-controller 0.22

This has been addressed in the most recent version, 0.26.1

We should update to use the version of nginx-ingress-controller that does not suffer from these vulnerabilities.

Crossreference:

https://github.com/kubernetes/ingress-nginx/issues/4577
https://github.com/kubernetes/ingress-nginx/pull/4440

and

https://quay.io/repository/kubernetes-ingress-controller/nginx-ingress-controller?tab=tags

[Mike Wilson (knobby)]

I'm not trying to derail this bug as we do need to upgrade to 0.26.1, but I'm curious about the claim to running 0.22. I see 0.25.1 in our charms for x86. Are you using a different architecture or charm revision?

[Kevin W Monroe (kwmonroe)]

0.26.1 has made it into the default registry:

https://rocks.canonical.com:5000/v2/cdk/kubernetes-ingress-controller/nginx-ingress-controller-amd64/tags/list

Until the charm ingress handler is updated, you can manually configure your workers to use the new image:

juju config kubernetes-worker nginx-image='rocks.canonical.com:443/cdk/kubernetes-ingress-controller/nginx-ingress-controller-amd64:0.26.1'

[Kevin W Monroe (kwmonroe)]

Up for review in:

https://github.com/charmed-kubernetes/charm-kubernetes-worker/pull/38