⬆️ Update quay.io/kairos/kairos-init Docker tag to v0.7.2 (#3980)

renovate[bot] · mauromorales · web-flow · commit 8b632e245268 · 2026-03-16T15:34:54.000+01:00
* ⬆️ Update quay.io/kairos/kairos-init Docker tag to v0.7.1 * Disable OSV Scanner The scanner is currently only pointing issues from the tests, which don't get shipped and while we might still want to address it should not stop a release. Relates to #3985 Signed-off-by: Mauro Morales <contact@mauromorales.com> * bump kairos-init v0.7.3 Signed-off-by: Mauro Morales <contact@mauromorales.com> * filter GO-2026-4479 in grype Signed-off-by: Mauro Morales <contact@mauromorales.com> * temporarily pin the factory action Signed-off-by: Mauro Morales <contact@mauromorales.com> * bump kairos-factory-action to v1.0.2 Signed-off-by: Mauro Morales <contact@mauromorales.com> * ignore for edgevpn because it is not possible to bump Signed-off-by: Mauro Morales <contact@mauromorales.com> * pin test cluster for encryption tests Signed-off-by: Mauro Morales <contact@mauromorales.com> * keep test close to the one in the challenger Signed-off-by: Mauro Morales <contact@mauromorales.com> --------- Signed-off-by: Mauro Morales <contact@mauromorales.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Mauro Morales <contact@mauromorales.com>
diff --git a/.github/encryption-tests.sh b/.github/encryption-tests.sh
@@ -6,7 +6,8 @@ set -ex
 # This is where sealed volumes are created.
 
 GINKGO_NODES="${GINKGO_NODES:-1}"
-K3S_IMAGE="rancher/k3s:v1.34.1-k3s1"
+K3S_IMAGE="rancher/k3s:v1.26.1-k3s1"
+CERT_MANAGER_VERSION="v1.16.5"
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 CLUSTER_NAME=$(echo $RANDOM | md5sum | head -c 10; echo;)
 
@@ -41,18 +42,9 @@ if [ "$LABEL" != "local-encryption" ]; then
   #k3d image import -c "$CLUSTER_NAME" quay.io/kairos/kcrypt-challenger:latest
 
   # Install cert manager
-  kubectl apply -f https://github.com/jetstack/cert-manager/releases/latest/download/cert-manager.yaml
-
-  # Wait for cert-manager pods to be running first (more reliable than deployment condition)
-  echo "Waiting for cert-manager pods to be ready..."
-  kubectl wait --for=condition=Ready pod --timeout=5m -n cert-manager --all || {
-    echo "Cert-manager pods failed to become ready. Current pod status:"
-    kubectl get pods -n cert-manager
-    kubectl describe pods -n cert-manager
-    exit 1
-  }
+  kubectl apply -f "https://github.com/jetstack/cert-manager/releases/download/${CERT_MANAGER_VERSION}/cert-manager.yaml"
 
-  # Then wait for deployments to be available (this ensures the webhook is actually serving)
+  # Wait for cert-manager deployments to become available
   echo "Waiting for cert-manager deployments to be available..."
   kubectl wait --for=condition=Available deployment --timeout=2m -n cert-manager --all
 
@@ -68,6 +60,7 @@ if [ "$LABEL" != "local-encryption" ]; then
 
   # Install the challenger server kustomization
   kubectl apply -k "$SCRIPT_DIR/../tests/assets/encryption/"
+  kubectl wait --for=condition=Available deployment/kcrypt-controller-controller-manager -n default --timeout=2m
 
   # 10.0.2.2 is where the vm sees the host
   # https://stackoverflow.com/a/6752280
diff --git a/.github/workflows/image-master-arm.yaml b/.github/workflows/image-master-arm.yaml
@@ -17,7 +17,7 @@ concurrency:
 jobs:
   build:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@31c48e122b28e00fbc83c3ed0b632e0118511ffd # v1.0.2
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}
diff --git a/.github/workflows/image-master.yaml b/.github/workflows/image-master.yaml
@@ -16,7 +16,7 @@ concurrency:
 jobs:
   build:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@31c48e122b28e00fbc83c3ed0b632e0118511ffd # v1.0.2
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}
diff --git a/.github/workflows/image-pr-arm.yaml b/.github/workflows/image-pr-arm.yaml
@@ -14,7 +14,7 @@ concurrency:
 jobs:
   build:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@31c48e122b28e00fbc83c3ed0b632e0118511ffd # v1.0.2
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}
diff --git a/.github/workflows/image-pr.yaml b/.github/workflows/image-pr.yaml
@@ -14,7 +14,7 @@ concurrency:
 jobs:
   build:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@31c48e122b28e00fbc83c3ed0b632e0118511ffd # v1.0.2
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
@@ -0,0 +1,18 @@
+name: OSV-Scanner PR Scan
+
+# Change "main" to your default branch if you use a different name, i.e. "master"
+on:
+  # Temporarily disabled on CI while tracked in:
+  # https://github.com/kairos-io/kairos/issues/3985
+  workflow_dispatch:
+
+permissions:
+  # Require writing security events to upload SARIF file to security tab
+  security-events: write
+  # Only need to read contents
+  contents: read
+  actions: read
+
+jobs:
+  scan-pr:
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@2a387edfbe02a11d856b89172f6e978100177eb4" # v2.3.2
diff --git a/.github/workflows/release-arm.yaml b/.github/workflows/release-arm.yaml
@@ -8,7 +8,7 @@ permissions: read-all
 jobs:
   core:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@31c48e122b28e00fbc83c3ed0b632e0118511ffd # v1.0.2
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}
@@ -84,7 +84,7 @@ jobs:
           echo "kubernetes_versions=$kubernetes_versions" >> $GITHUB_OUTPUT
   standard:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@31c48e122b28e00fbc83c3ed0b632e0118511ffd # v1.0.2
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -8,7 +8,7 @@ permissions: read-all
 jobs:
   core:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@31c48e122b28e00fbc83c3ed0b632e0118511ffd # v1.0.2
     permissions:
       id-token: write  # OIDC support
       contents: write
@@ -103,7 +103,7 @@ jobs:
 
   standard-k3s:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@31c48e122b28e00fbc83c3ed0b632e0118511ffd # v1.0.2
     needs:
       - get-k3s-versions
     permissions:
@@ -143,7 +143,7 @@ jobs:
       release: true
   standard-k0s:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@31c48e122b28e00fbc83c3ed0b632e0118511ffd # v1.0.2
     needs:
       - get-k0s-versions
     permissions:
diff --git a/.github/workflows/uki.yaml b/.github/workflows/uki.yaml
@@ -16,7 +16,7 @@ concurrency:
 jobs:
   build:
     name: ${{ matrix.base_image }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@34a4d60415833c98869d13b6968fa93c3fc1dcb0 # v1.0.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@31c48e122b28e00fbc83c3ed0b632e0118511ffd # v1.0.2
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}
diff --git a/.grype.yaml b/.grype.yaml
@@ -9,8 +9,16 @@
 # as grype is not always correct
 # So we ignore all the kernel vulnerabilities as grype is not fully reliable
 ignore:
+  # Go vulnerabilities
+  - vulnerability: GO-2026-4479
+    reason: "pion/dtls/v2 is unmaintained with no fix available; only used by optional WebRTC transport in libp2p"
+
   # Affected standard images
   - vulnerability: CVE-2025-68121
     package:
       name: stdlib
       location: /usr/bin/k3s
+  - vulnerability: CVE-2025-68121
+    package:
+      name: stdlib
+      location: /usr/bin/edgevpn
diff --git a/images/Dockerfile b/images/Dockerfile
@@ -1,5 +1,5 @@
 ARG BASE_IMAGE=ubuntu:20.04
-ARG KAIROS_INIT=v0.7.0
+ARG KAIROS_INIT=v0.7.3
 
 FROM quay.io/kairos/kairos-init:${KAIROS_INIT} AS kairos-init
 
diff --git a/tests/assets/encryption/challenger-patch.yaml b/tests/assets/encryption/challenger-patch.yaml
@@ -8,6 +8,8 @@ spec:
   template:
     spec:
       containers:
+        - name: kube-rbac-proxy
+          $patch: delete
         - name: manager
           image: quay.io/kairos/kcrypt-challenger:v0.12.1
           imagePullPolicy: IfNotPresent
