Start fixing govulncheck job by upgrading makefile modules

[SgtCoDFish]

This is fixed by upstream makefile modules.

I ran:

make upgrade-klone
make generate

IMPORTANT: Note that this skips two pod security static checks which came from upstream makefile-modules. I didn't want to fix those in this PR, since that would expand the scope of the PR beyond a makefile-modules bump. We'll need to discuss changing the chart to address those reports soon, but that doesn't block this PR

See make/verify-pod-security-standards-exceptions.yaml for the skipped checks; without them, the CI would fail:

│──────────│────────────────────────────────│────────────────────────────────────│─────────────────────────────────────────────────────────│────────│────────│
│ ID (19)  │ POLICY                         │ RULE                               │ RESOURCE                                                │ RESULT │ REASON │
│──────────│────────────────────────────────│────────────────────────────────────│─────────────────────────────────────────────────────────│────────│────────│
│ 1        │ disallow-capabilities          │ autogen-adding-capabilities        │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│ 2        │ disallow-capabilities-strict   │ autogen-require-drop-all           │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│ 3        │ disallow-capabilities-strict   │ autogen-adding-capabilities-strict │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│ 4        │ disallow-host-namespaces       │ autogen-host-namespaces            │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│ 5        │ disallow-host-path             │ autogen-host-path                  │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│ 6        │ disallow-host-ports            │ autogen-host-ports-none            │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│ 7        │ disallow-host-process          │ autogen-host-process-containers    │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│ 8        │ disallow-privilege-escalation  │ autogen-privilege-escalation       │ default/Deployment/venafi-kubernetes-agent-release-name │ Fail   │        │
│ 9        │ disallow-privileged-containers │ autogen-privileged-containers      │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│ 10       │ disallow-proc-mount            │ autogen-check-proc-mount           │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│ 11       │ disallow-selinux               │ autogen-selinux-type               │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│ 12       │ disallow-selinux               │ autogen-selinux-user-role          │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│ 13       │ require-run-as-non-root-user   │ autogen-run-as-non-root-user       │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│ 14       │ require-run-as-nonroot         │ autogen-run-as-non-root            │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│ 15       │ restrict-apparmor-profiles     │ autogen-app-armor                  │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│ 16       │ restrict-seccomp               │ autogen-check-seccomp              │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│ 17       │ restrict-seccomp-strict        │ autogen-check-seccomp-strict       │ default/Deployment/venafi-kubernetes-agent-release-name │ Fail   │        │
│ 18       │ restrict-sysctls               │ autogen-check-sysctls              │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│ 19       │ restrict-volume-types          │ autogen-restricted-volumes         │ default/Deployment/venafi-kubernetes-agent-release-name │ Pass   │        │
│──────────│────────────────────────────────│────────────────────────────────────│─────────────────────────────────────────────────────────│────────│────────│

[maelvls]

thanks for spending the time fixing this!

[maelvls]

Thanks for adding the table. I see that we are not complying with two of the policies: disallow-privilege-escalation and restrict-seccomp-strict. Do you need help fixing these?

[SgtCoDFish]

Thanks for adding the table. I see that we are not complying with two of the policies: disallow-privilege-escalation and restrict-seccomp-strict. Do you need help fixing these?

I think they're easy to fix, but I don't have the bandwidth today to ensure that they're safe to change for the agent.

If you know that the agent doesn't require privilege escalation / if we can adhere to the strict seccomp policy, then by all means we should fix that straight away!