Compile kind with go 1.25.6 to address CVE-2025-61726

[Konstantinov-Innokentii]

What should be cleaned up or changed
Compile the official kind image using Go 1.25.6.

Why is this needed
This is required to address CVE-2025-61726.
The current kind release (v0.31.0) appears to be compiled with Go 1.25.0, which causes Docker Scout to report a HIGH severity vulnerability.

[BenTheElder]

We will but ... appeasing CVE scanners for downstream compliance is not a top priority and has other options (you can readily build kind from source with a different go version if necessary).

The referenced CVE only allows a user of kind to self-DOS because any URL query params are user-specified. Other net/url usage has no query params.

The only network bound code in kind binary is downloading Kubernetes releases, which ordinarily have no query params. If the user manually specifies a complete URL to the CLI, they can include query parameters, but that is readily mitigated by ... not specifying excessive query paramaters.

kind should NEVER be operated with untrusted user input, you are spawning privileged containers in order to run kubernetes.

We I have been focused on getting this patched in Kubernetes where there are applicable CVE fixes (IMHO): kubernetes/kubernetes#136258, kubernetes/kubernetes#136257, ... https://kubernetes.slack.com/archives/CJH2GBF7Y (https://slack.k8s.io for open invite)

In that case, some other CVEs patched by this go version may potentially really impact kind (via Kubernetes binaries, not via kind itself), though again, exposing kind instances to untrusted input is highly inadvisable.

When those releases are available, we'll look at publishing pre-built kind images, but you can also use:
https://kind.sigs.k8s.io/docs/user/quick-start/#building-images

for that part

For the kind cli, you can also use:
https://kind.sigs.k8s.io/docs/user/quick-start/#installing-from-source

[Konstantinov-Innokentii]

@BenTheElder Thanks for a quick answer!
No pressure on that, I built kind from source to make docker scout happy, but it will be nice to stop doing this eventually.
Have a good weekends!

[BenTheElder]

Thanks! 🙏

I think first up we'll have to circle back to #4086, this fell off into the holidays as non-pressing, but it means we have a backlog of updating some of the images.

kind is relatively streamlined for go bumps otherwise, I have it consolidated to typically a one line change for all binaries we ship that are not from debian packages. Kubernetes/Kubernetes is still more involved, but I've been working on it intermittently and some of the ideas have been ported over (.go-version ... semi obsoleted by GOTOOLCHAIN now).

I think we will:

1. Get kubernetes/kubernetes landed with go upgrades.
2. Sort out pickup containerd 2.2.1 and bookworm #4086 or start reverting previous changes.
3. Bump .go-version and then pickup the images.

[BenTheElder]

#4103 will cover it along with the rest

[BenTheElder]

we unstuck kubernetes go bumps, so probably we'll get tags there we can pickup soon

[BenTheElder]

well, kubernetes releases aren't ready yet, still getting that unblocked, helping how I can

but everything from kind @ HEAD is updated

[BenTheElder]

Go 1.25.7 is out now, whee. I've been working on the kubernetes/kubernetes updates again, and also a plan to streamline them:
https://docs.google.com/document/d/10HujH6PL0ez3vviA03I01_mbJWs9Xp99gIDWnnNXyco/edit?tab=t.0
(shared with dev@kubernetes.io, unfortunately I can't make it truly public, but that group is the open to join kubernetes developer community mailinglist ... )

[Konstantinov-Innokentii]

Hi @BenTheElder, thanks for the updates!
Am I right, that some work is happening around this in the k8s community and eventually it will allow you to re-compile kind?

[BenTheElder]

kind itself is already updated, but if you're finding issues in docker-scout then presumably it is scanning the contents of the images, which contain Kubernetes builds from unmodified upstream source since we are the Kubernetes project ourselves. Those binaries will use whatever go version Kubernetes is using.

I've sent PRs upstream for that part.

[Konstantinov-Innokentii]

@BenTheElder Thanks! Am I getting it right, that v0.31.0 is complied with go 1.25.6 now?

[BenTheElder]

@BenTheElder Thanks! Am I getting it right, that v0.31.0 is complied with go 1.25.6 now?

No, release builds are reproducible, we will not modify existing release binaries. If you would like v0.31.0 with go 1.25.6 you can build custom locally.

HEAD is updated, so the next release will be updated.

But we have not cut a release, because the binaries from Kubernetes are not updateable yet anyhow, and these bugs don't really meaningfully impact the core kind binary as opposed to what is in the node images.

[BenTheElder]

For 1.25.6 + kubernetes anyhow, there is a new pre-built image in #4111

For all strictly kind-project-origin images and builds, they will be at 1.25.7 in the same PR.

I am out for the next week and won't have a release cut, also not sure if it even makes sense without the kubernetes/kubernetes releases.

@aojea @stmcginnis