Skip to content

Commit 0166818

Browse files
addetzaddetz
authored
docs: add instructions from sec advisory 1 to 8 (#9415)
* docs: add instructions from sec advisory 1 to 8 * Apply suggestions from code review * docs: fix formatting * docs: update SHA for airgap-palette-nginx * docs: update SHA for airgap-vertex-nginx * docs: add update sentence * docs: add update sentence * docs: slight rephrase * Apply suggestions from code review * ci: auto-formatting prettier issues
1 parent 9d1eaea commit 0166818

File tree

1 file changed

+294
-14
lines changed

1 file changed

+294
-14
lines changed

‎docs/docs-content/security-bulletins/security-advisories/security-advisories.md‎

Lines changed: 294 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,8 @@ Nginx controller has been deprecated by the upstream provider, and we are in the
4141
controller. Until the migration to Traefik ingress is complete, we will be upgrading Nginx controller to version 1.13.7,
4242
which will remediate this vulnerability.
4343

44+
We will update this security advisory when Palette versions with the updated Nginx controller have been released.
45+
4446
### Affected Deployments
4547

4648
<!-- prettier-ignore-start -->
@@ -59,25 +61,303 @@ which will remediate this vulnerability.
5961

6062
<!-- prettier-ignore-start -->
6163

62-
We recommend taking the following actions to remediate CVE-2026-24514:
64+
We recommend taking the following actions to remediate CVE-2026-2451.
6365

64-
- **Multi-tenant and dedicated SaaS deployments** - No action necessary. Deployments will be patched as part of the standard update process.
65-
- **Self-hosted deployments** - Update the <VersionedLink text="Nginx" url="/integrations/packs/?pack=nginx" /> pack version to 1.13.7.
66-
- **Workload clusters**
66+
#### Multi-tenant and Dedicated SaaS Deployments
6767

68-
- Managed Kubernetes clusters (AKS, EKS, GKE) should be updated with patches from the cloud vendor as soon as they become available.
69-
- Patched OS images for other cluster types will be available in an upcoming release. All customers are advised to upgrade to the latest Kubernetes patch versions as soon as they become available.
70-
- A patch for Edge clusters will be available in an upcoming release. All customers are advised to upgrade the clusters to the patched version as soon as they become available.
68+
No action necessary. Deployments will be patched as part of the standard update process.
7169

72-
<!-- prettier-ignore-end -->
70+
#### Palette Enterprise or VerteX Installed with Helm Charts
7371

74-
If possible, we also recommend taking the following actions:
72+
If you have any instances of Palette enterprise or VerteX installed via Helm Charts with the affected version of the
73+
`ingress-nginx-controller` DaemonSet, you must update it to version `1.13.7`. Follow the steps below to download the
74+
updated version of the component and update your instance.
7575

76-
- Avoid running untrusted container images.
77-
- Use rootless containers where possible to reduce impact scope.
78-
- Restrict container `sysctl` configurations and disable host access to `/proc/sysrq-trigger` and
79-
`/proc/sys/kernel/core_pattern` where feasible.
80-
- Reinforce LSM enforcement and confirm AppArmor and SELinux profiles are correctly applied post-patch.
76+
1. Use the `kubeconfig` file and `kubectl` tool to access your Palette enterprise or VerteX cluster. Refer to the
77+
[Access Cluster with CLI](../../clusters/cluster-management/palette-webctl.md) guide for more information.
78+
79+
2. Check the image used by the `ingress-nginx-controller` DaemonSet in the `ingress-nginx` namespace.
80+
81+
```shell
82+
kubectl get daemonset ingress-nginx-controller --namespace ingress-nginx --output yaml | grep 'image:'
83+
```
84+
85+
3. Once you identify the image, update its tag to `v1.13.7`. You can use the `kubectl set image` command to update the
86+
image.
87+
88+
- If the `ingress-nginx-controller` DaemonSet is using the image
89+
`gcr.io/spectro-images-public/release-fips/ingress-nginx/controller:v1.13.3`, update it to
90+
`gcr.io/spectro-images-public/release-fips/ingress-nginx/controller:v1.13.7`. Replace `<container-name>` with the name
91+
of the container.
92+
93+
```shell
94+
kubectl set image daemonset/ingress-nginx-controller <container-name>=gcr.io/spectro-images-public/release-fips/ingress-nginx/controller:v1.13.7 --namespace ingress-nginx
95+
```
96+
97+
- If the `ingress-nginx-controller` DaemonSet is using the image
98+
`us-docker.pkg.dev/palette-images/third-party/ingress-nginx/controller:v1.13.3`, update it to
99+
`us-docker.pkg.dev/palette-images/third-party/ingress-nginx/controller:v1.13.7`. Replace `<container-name>` with the
100+
name of the container.
101+
102+
```shell
103+
kubectl set image daemonset/ingress-nginx-controller <container-name>=us-docker.pkg.dev/palette-images/third-party/ingress-nginx/controller:v1.13.7 --namespace ingress-nginx
104+
```
105+
106+
#### Palette Enterprise or VerteX Installed with the Palette CLI
107+
108+
If you have any instances of Palette enterprise or VerteX installed via the Palette CLI with the affected version of the
109+
`ingress-nginx-controller` DaemonSet, you must update it to version `1.13.7`. Follow the steps below to download the
110+
updated version of the component and update your instance.
111+
112+
1. Use the `kubeconfig` file and `kubectl` tool to access your Palette enterprise or VerteX cluster. Refer to the
113+
[Access Cluster with CLI](../../clusters/cluster-management/palette-webctl.md) guide for more information.
114+
115+
2. Scale down the `palette-controller-manager` deployment to zero replicas in the `cluster-mgmt-*` namespace, replacing
116+
`*` with the suffix associated with your namespace.
117+
118+
```shell
119+
kubectl scale deployment palette-controller-manager --replicas=0 --namespace cluster-mgmt-*
120+
```
121+
122+
3. Scale down the `cluster-management-agent` deployment to zero replicas in the `cluster-mgmt-*` namespace, replacing
123+
`*` with the suffix associated with your namespace.
124+
125+
```shell
126+
kubectl scale deployment cluster-management-agent --replicas=0 --namespace cluster-mgmt-*
127+
```
128+
129+
4. Confirm that both deployments have been scaled down to zero replicas. Replace `*` with the suffix associated with
130+
your namespace.
131+
132+
```shell
133+
kubectl get deployments --namespace cluster-mgmt-*
134+
```
135+
136+
5. Check the image used by the `ingress-nginx-controller` DaemonSet in the `ingress-nginx` namespace.
137+
138+
```shell
139+
kubectl get daemonset ingress-nginx-controller --namespace ingress-nginx --output yaml | grep 'image:'
140+
```
141+
142+
6. Once you identify the image, update its tag to `v1.13.7`. You can use the `kubectl set image` command to update the
143+
image.
144+
145+
- If the `ingress-nginx-controller` DaemonSet is using the image
146+
`gcr.io/spectro-images-public/release-fips/ingress-nginx/controller:v1.13.3`, update it to
147+
`gcr.io/spectro-images-public/release-fips/ingress-nginx/controller:v1.13.7`. Replace `<container-name>` with the name
148+
of the container.
149+
150+
```shell
151+
kubectl set image daemonset/ingress-nginx-controller <container-name>=gcr.io/spectro-images-public/release-fips/ingress-nginx/controller:v1.13.7 --namespace ingress-nginx
152+
```
153+
154+
- If the `ingress-nginx-controller` DaemonSet is using the image
155+
`us-docker.pkg.dev/palette-images/third-party/ingress-nginx/controller:v1.13.3`, update it to
156+
`us-docker.pkg.dev/palette-images/third-party/ingress-nginx/controller:v1.13.7`. Replace `<container-name>` with the
157+
name of the container.
158+
159+
```shell
160+
kubectl set image daemonset/ingress-nginx-controller <container-name>=us-docker.pkg.dev/palette-images/third-party/ingress-nginx/controller:v1.13.7 --namespace ingress-nginx
161+
```
162+
163+
#### Airgap Palette Enterprise or VerteX
164+
165+
If you have any airgapped instances of Palette enterprise or VerteX using the affected version of the
166+
`ingress-nginx-controller` DaemonSet, you must update it to version `1.13.7`. Follow the steps below to download the
167+
updated version of the component and update your instance.
168+
169+
<Tabs>
170+
171+
<TabItem value="Palette Enterprise" label="Palette Enterprise">
172+
173+
1. Contact your Palette support representative to obtain the `airgap-palette-nginx` binary version `1.13.7`. Ensure the
174+
SHA of the binary is `ea6d7f28a24e100998ea382ab2d206f81dc33776ac98091815e794fb35b215ce`. Once obtained, upload the
175+
`airgap-palette-nginx` binary to the registry. Follow the
176+
[Usage Instructions](../../downloads/self-hosted-palette/additional-packs.md) guide for detailed steps on downloading
177+
and installing the binary.
178+
179+
2. Log in to the Palette system console.
180+
181+
3. From the left **Main Menu**, select **Administration > Pack Registries**. Then, next to the registry, click the
182+
three-dot button > **Sync**. Wait for the registry synchronization to complete.
183+
184+
4. Use the `kubeconfig` file and `kubectl` tool to access your Palette enterprise cluster. Refer to the
185+
[Access Cluster with CLI](../../clusters/cluster-management/palette-webctl.md) guide for more information.
186+
187+
5. Scale down the `palette-controller-manager` deployment to zero replicas in the `cluster-mgmt-*` namespace, replacing
188+
`*` with the suffix associated with your namespace.
189+
190+
```shell
191+
kubectl scale deployment palette-controller-manager --replicas=0 --namespace cluster-mgmt-*
192+
```
193+
194+
6. Scale down the `cluster-management-agent` deployment to zero replicas in the `cluster-mgmt-*` namespace, replacing
195+
`*` with the suffix associated with your namespace.
196+
197+
```shell
198+
kubectl scale deployment cluster-management-agent --replicas=0 --namespace cluster-mgmt-*
199+
```
200+
201+
7. Confirm that both deployments have been scaled down to zero replicas. Replace `*` with the suffix associated with
202+
your namespace.
203+
204+
```shell
205+
kubectl get deployments --namespace cluster-mgmt-*
206+
```
207+
208+
8. Check the image used by the `ingress-nginx-controller` DaemonSet in the `ingress-nginx` namespace.
209+
210+
```shell
211+
kubectl get daemonset ingress-nginx-controller --namespace ingress-nginx --output yaml | grep 'image:'
212+
```
213+
214+
9. Once you identify the image, update its tag to `v1.13.7`. You can use the `kubectl set image` command to update the
215+
image.
216+
217+
- If the `ingress-nginx-controller` DaemonSet is using the image
218+
`gcr.io/spectro-images-public/release-fips/ingress-nginx/controller:v1.13.3`, update it to
219+
`gcr.io/spectro-images-public/release-fips/ingress-nginx/controller:v1.13.7`. Replace `<container-name>` with the name
220+
of the container.
221+
222+
```shell
223+
kubectl set image daemonset/ingress-nginx-controller <container-name>=gcr.io/spectro-images-public/release-fips/ingress-nginx/controller:v1.13.7 --namespace ingress-nginx
224+
```
225+
226+
- If the `ingress-nginx-controller` DaemonSet is using the image
227+
`us-docker.pkg.dev/palette-images/third-party/ingress-nginx/controller:v1.13.3`, update it to
228+
`us-docker.pkg.dev/palette-images/third-party/ingress-nginx/controller:v1.13.7`. Replace `<container-name>` with the
229+
name of the container.
230+
231+
```shell
232+
kubectl set image daemonset/ingress-nginx-controller <container-name>=us-docker.pkg.dev/palette-images/third-party/ingress-nginx/controller:v1.13.7 --namespace ingress-nginx
233+
```
234+
235+
</TabItem>
236+
237+
<TabItem value="Palette VerteX" label="Palette VerteX">
238+
239+
1. Contact your Palette support representative to obtain the `airgap-vertex-nginx` binary version `1.13.7`. Ensure the
240+
SHA of the binary is `ea6d7f28a24e100998ea382ab2d206f81dc33776ac98091815e794fb35b215ce`. Once obtained, upload the
241+
`airgap-vertex-nginx` binary to the registry. Follow the
242+
[Usage Instructions](../../downloads/palette-vertex/additional-packs.md) guide for detailed steps on downloading and
243+
installing the binary.
244+
245+
2. Log in to the Palette VerteX system console.
246+
247+
3. From the left **Main Menu**, select **Administration > Pack Registries**. Then, next to the registry, click the
248+
three-dot button > **Sync**. Wait for the registry synchronization to complete.
249+
250+
4. Use the `kubeconfig` file and `kubectl` tool to access your Palette enterprise cluster. Refer to the
251+
[Access Cluster with CLI](../../clusters/cluster-management/palette-webctl.md) guide for more information.
252+
253+
5. Scale down the `palette-controller-manager` deployment to zero replicas in the `cluster-mgmt-*` namespace, replacing
254+
`*` with the suffix associated with your namespace.
255+
256+
```shell
257+
kubectl scale deployment palette-controller-manager --replicas=0 --namespace cluster-mgmt-*
258+
```
259+
260+
6. Scale down the `cluster-management-agent` deployment to zero replicas in the `cluster-mgmt-*` namespace, replacing
261+
`*` with the suffix associated with your namespace.
262+
263+
```shell
264+
kubectl scale deployment cluster-management-agent --replicas=0 --namespace cluster-mgmt-*
265+
```
266+
267+
7. Confirm that both deployments have been scaled down to zero replicas. Replace `*` with the suffix associated with
268+
your namespace.
269+
270+
```shell
271+
kubectl get deployments --namespace cluster-mgmt-*
272+
```
273+
274+
8. Check the image used by the `ingress-nginx-controller` DaemonSet in the `ingress-nginx` namespace.
275+
276+
```shell
277+
kubectl get daemonset ingress-nginx-controller --namespace ingress-nginx --output yaml | grep 'image:'
278+
```
279+
280+
9. Once you identify the image, update its tag to `v1.13.7`. You can use the `kubectl set image` command to update the
281+
image.
282+
283+
- If the `ingress-nginx-controller` DaemonSet is using the image
284+
`gcr.io/spectro-images-public/release-fips/ingress-nginx/controller:v1.13.3`, update it to
285+
`gcr.io/spectro-images-public/release-fips/ingress-nginx/controller:v1.13.7`. Replace `<container-name>` with the name
286+
of the container.
287+
288+
```shell
289+
kubectl set image daemonset/ingress-nginx-controller <container-name>=gcr.io/spectro-images-public/release-fips/ingress-nginx/controller:v1.13.7 --namespace ingress-nginx
290+
```
291+
292+
- If the `ingress-nginx-controller` DaemonSet is using the image
293+
`us-docker.pkg.dev/palette-images/third-party/ingress-nginx/controller:v1.13.3`, update it to
294+
`us-docker.pkg.dev/palette-images/third-party/ingress-nginx/controller:v1.13.7`. Replace `<container-name>` with the
295+
name of the container.
296+
297+
```shell
298+
kubectl set image daemonset/ingress-nginx-controller <container-name>=us-docker.pkg.dev/palette-images/third-party/ingress-nginx/controller:v1.13.7 --namespace ingress-nginx
299+
```
300+
301+
</TabItem>
302+
303+
</Tabs>
304+
305+
#### Airgap Workload Clusters Using the Nginx Pack
306+
307+
If you have any airgap workload clusters using the affected version of the Nginx pack, you must update the cluster
308+
profile to version `1.13.7` of the Nginx pack. Follow the steps below to download the updated pack and modify your
309+
cluster profile.
310+
311+
<Tabs>
312+
313+
<TabItem value="Palette Enterprise" label="Palette Enterprise">
314+
315+
1. Contact your Palette support representative to obtain the `airgap-pack-nginx` binary version `1.13.7`. Once obtained,
316+
upload the `airgap-pack-nginx` binary to the registry. Follow the
317+
[Usage Instructions](../../downloads/self-hosted-palette/additional-packs.md) guide for detailed steps on downloading
318+
and installing the binary.
319+
320+
2. Log in to the Palette system console.
321+
322+
3. From the left main menu, select **Administration > Pack Registries**. Then, next to the registry, click the three-dot
323+
button > **Sync**. Wait for the registry synchronization to complete.
324+
325+
4. Log in to the Palette console.
326+
327+
5. Update all cluster profiles currently using the affected version of the Nginx pack. Refer to the
328+
[Update a Cluster Profile](../../profiles/cluster-profiles/modify-cluster-profiles/update-cluster-profile.md) guide
329+
for instructions on how to update a cluster profile.
330+
331+
6. Apply the profile updates to all affected clusters. Refer to the
332+
[Apply Profile Updates to Clusters](../../profiles/cluster-profiles/modify-cluster-profiles/update-cluster-profile.md#apply-profile-updates-to-clusters)
333+
guide to learn how to apply profile updates to clusters.
334+
335+
</TabItem>
336+
337+
<TabItem value="Palette VerteX" label="Palette VerteX">
338+
339+
1. Contact your Palette support representative to obtain the `airgap-pack-nginx` binary version `1.13.7`. Follow the
340+
[Usage Instructions](../../downloads/palette-vertex/additional-packs.md) guide for detailed steps on downloading and
341+
installing the binary.
342+
343+
2. Log in to the Palette VerteX system console.
344+
345+
3. From the left main menu, select **Administration > Pack Registries**. Then, next to the registry, click the three-dot
346+
button > **Sync**. Wait for the registry synchronization to complete.
347+
348+
4. Log in to the Palette VerteX console.
349+
350+
5. Update all cluster profiles currently using the affected version of the Nginx pack. Refer to the
351+
[Update a Cluster Profile](../../profiles/cluster-profiles/modify-cluster-profiles/update-cluster-profile.md) guide
352+
for instructions on how to update a cluster profile.
353+
354+
6. Apply the profile updates to all affected clusters. Refer to the
355+
[Apply Profile Updates to Clusters](../../profiles/cluster-profiles/modify-cluster-profiles/update-cluster-profile.md#apply-profile-updates-to-clusters)
356+
guide to learn how to apply profile updates to clusters.
357+
358+
</TabItem>
359+
360+
</Tabs>
81361

82362
### References
83363

0 commit comments

Comments
 (0)