images.yaml

# List of all container images which are deployed by the Gardener.
# In case an image can only be used for a specific Kubernetes version, the
# entry must have a key "runtimeVersion" whose value describe for which kubernetes runtime
# the respective tag can be used. The syntax must be as described in the
# Masterminds/semver package: https://github.com/Masterminds/semver#hyphen-range-comparisons.
images:
# Gardener components
- name: gardener-apiserver
  sourceRepository: github.com/gardener/gardener
  repository: eu.gcr.io/gardener-project/gardener/apiserver
- name: gardenlet
  sourceRepository: github.com/gardener/gardener
  repository: eu.gcr.io/gardener-project/gardener/gardenlet
- name: gardener-resource-manager
  resourceId:
    name: resource-manager
  sourceRepository: github.com/gardener/gardener
  repository: eu.gcr.io/gardener-project/gardener/resource-manager

# Seed bootstrap
- name: pause-container
  sourceRepository: github.com/kubernetes/kubernetes/blob/master/build/pause/Dockerfile
  repository: registry.k8s.io/pause
  tag: "3.7"
  labels:
  - name: cloud.gardener.cnudie/dso/scanning-hints/binary_id/v1
    value:
      policy: skip
      comment: >
        pause-container is not accessible from outside k8s clusters and not
        interacted with from other containers or other systems
- name: etcd-druid
  sourceRepository: github.com/gardener/etcd-druid
  repository: eu.gcr.io/gardener-project/gardener/etcd-druid
  tag: "v0.18.4"
- name: dependency-watchdog
  sourceRepository: github.com/gardener/dependency-watchdog
  repository: eu.gcr.io/gardener-project/gardener/dependency-watchdog
  tag: "v1.1.1"
- name: nginx-ingress-controller
  sourceRepository: github.com/kubernetes/ingress-nginx
  repository: registry.k8s.io/ingress-nginx/controller-chroot
  tag: "v1.4.0"
  targetVersion: "1.22.x"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'public'
      authentication_enforced: true
      user_interaction: 'end-user'
      confidentiality_requirement: 'low'
      integrity_requirement: 'low'
      availability_requirement: 'low'
- name: nginx-ingress-controller
  sourceRepository: github.com/kubernetes/ingress-nginx
  repository: registry.k8s.io/ingress-nginx/controller-chroot
  tag: "v1.6.4"
  targetVersion: "1.23.x"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'public'
      authentication_enforced: true
      user_interaction: 'end-user'
      confidentiality_requirement: 'low'
      integrity_requirement: 'low'
      availability_requirement: 'low'
- name: nginx-ingress-controller
  sourceRepository: github.com/kubernetes/ingress-nginx
  repository: registry.k8s.io/ingress-nginx/controller-chroot
  tag: "v1.8.1"
  targetVersion: ">= 1.24"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'public'
      authentication_enforced: true
      user_interaction: 'end-user'
      confidentiality_requirement: 'low'
      integrity_requirement: 'low'
      availability_requirement: 'low'
- name: ingress-default-backend
  sourceRepository: github.com/gardener/ingress-default-backend
  repository: eu.gcr.io/gardener-project/gardener/ingress-default-backend
  tag: "0.16.0"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'end-user'
      confidentiality_requirement: 'none'
      integrity_requirement: 'none'
      availability_requirement: 'none'
      comment: Show static page when no path is found

# Seed controlplane
#   hyperkube is used for kubectl + kubelet binaries on the worker nodes
- name: hyperkube
  sourceRepository: github.com/gardener/hyperkube
  repository: eu.gcr.io/gardener-project/hyperkube
- name: kube-apiserver
  sourceRepository: github.com/kubernetes/kubernetes
  repository: registry.k8s.io/kube-apiserver
- name: kube-controller-manager
  sourceRepository: github.com/kubernetes/kubernetes
  repository: registry.k8s.io/kube-controller-manager
- name: kube-scheduler
  sourceRepository: github.com/kubernetes/kubernetes
  repository: registry.k8s.io/kube-scheduler
- name: kube-proxy
  sourceRepository: github.com/kubernetes/kubernetes
  repository: registry.k8s.io/kube-proxy
- name: machine-controller-manager
  sourceRepository: github.com/gardener/machine-controller-manager
  repository: eu.gcr.io/gardener-project/gardener/machine-controller-manager
  tag: "v0.49.3"
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: protected
      authentication_enforced: false
      user_interaction: gardener-operator
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low
- name: cluster-autoscaler
  sourceRepository: github.com/gardener/autoscaler
  repository: eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler
  tag: "v1.27.0"
  targetVersion: ">= 1.27"
- name: cluster-autoscaler
  sourceRepository: github.com/gardener/autoscaler
  repository: eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler
  tag: "v1.26.2"
  targetVersion: "1.26.x"
- name: cluster-autoscaler
  sourceRepository: github.com/gardener/autoscaler
  repository: eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler
  tag: "v1.25.3"
  targetVersion: "1.25.x"
- name: cluster-autoscaler
  sourceRepository: github.com/gardener/autoscaler
  repository: eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler
  tag: "v1.24.3"
  targetVersion: "1.24.x"
- name: cluster-autoscaler
  sourceRepository: github.com/gardener/autoscaler
  repository: eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler
  tag: "v1.23.4"
  targetVersion: "1.23.x"
- name: cluster-autoscaler
  sourceRepository: github.com/gardener/autoscaler
  repository: eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler
  tag: "v1.22.6"
  targetVersion: "1.22.x"
- name: vpn-seed-server
  sourceRepository: github.com/gardener/vpn2
  repository: eu.gcr.io/gardener-project/gardener/vpn-seed-server
  tag: "0.17.0"

# Monitoring
- name: alertmanager
  sourceRepository: github.com/prometheus/alertmanager
  repository: quay.io/prometheus/alertmanager
  tag: v0.24.0
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: public
      authentication_enforced: true
      user_interaction: end-user
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/monitoring-maintainers'
- name: prometheus
  sourceRepository: github.com/prometheus/prometheus
  repository: quay.io/prometheus/prometheus
  tag: v2.43.1
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: public
      authentication_enforced: true
      user_interaction: end-user
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/monitoring-maintainers'
- name: configmap-reloader
  sourceRepository: github.com/prometheus-operator/prometheus-operator
  repository: ghcr.io/prometheus-operator/prometheus-config-reloader
  tag: v0.61.1
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: private
      authentication_enforced: false
      user_interaction: gardener-operator
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/monitoring-maintainers'
- name: kube-state-metrics
  sourceRepository: github.com/kubernetes/kube-state-metrics
  repository: registry.k8s.io/kube-state-metrics/kube-state-metrics
  tag: v2.5.0
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: private
      authentication_enforced: false
      user_interaction: gardener-operator
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/monitoring-maintainers'
- name: node-exporter
  sourceRepository: github.com/prometheus/node_exporter
  repository: quay.io/prometheus/node-exporter
  tag: v1.5.0
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: protected
      authentication_enforced: false
      user_interaction: end-user
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low
      comment: the node-exporter is also deployed to the shoot cluster
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/monitoring-maintainers'
- name: plutono
  sourceRepository: github.com/credativ/plutono
  repository: ghcr.io/credativ/plutono
  tag: "v7.5.22"
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: public
      authentication_enforced: true
      user_interaction: end-user
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/monitoring-maintainers'
- name: blackbox-exporter
  sourceRepository: github.com/prometheus/blackbox_exporter
  repository: quay.io/prometheus/blackbox-exporter
  tag: v0.23.0
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: protected
      authentication_enforced: false
      user_interaction: end-user
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low
      comment: the blackbox-exporter is also deployed to the shoot cluster
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/monitoring-maintainers'
- name: metrics-server
  sourceRepository: github.com/kubernetes-sigs/metrics-server
  repository: registry.k8s.io/metrics-server/metrics-server
  tag: v0.6.3
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: private
      authentication_enforced: false
      user_interaction: gardener-operator
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/monitoring-maintainers'

# Shoot core addons
- name: vpn-shoot-client
  sourceRepository: github.com/gardener/vpn2
  repository: eu.gcr.io/gardener-project/gardener/vpn-shoot-client
  tag: "0.17.0"
- name: coredns
  sourceRepository: github.com/coredns/coredns
  repository: registry.k8s.io/coredns/coredns
  tag: "v1.10.0"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'protected'
      authentication_enforced: false
      user_interaction: 'end-user'
      confidentiality_requirement: 'low'
      integrity_requirement: 'high'
      availability_requirement: 'high'
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/gardener-core-networking-maintainers'
- name: node-local-dns
  sourceRepository: github.com/kubernetes/kubernetes/blob/master/cluster/addons/dns/nodelocaldns
  repository: registry.k8s.io/dns/k8s-dns-node-cache
  tag: "1.22.20"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'end-user'
      confidentiality_requirement: 'low'
      integrity_requirement: 'high'
      availability_requirement: 'high'
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/gardener-core-networking-maintainers'
- name: node-problem-detector
  sourceRepository: github.com/kubernetes/node-problem-detector
  repository: registry.k8s.io/node-problem-detector/node-problem-detector
  tag: "v0.8.13"

# Shoot optional addons
- name: kubernetes-dashboard
  sourceRepository: github.com/kubernetes/dashboard
  repository: eu.gcr.io/gardener-project/3rd/kubernetesui/dashboard
  tag: v2.5.1
  labels: &optionalAddonLabels
  - name: cloud.gardener.cnudie/dso/scanning-hints/binary_id/v1
    value:
      policy: skip
      comment: >
        not deployed as part of gardener infrastructure. Offered to users for development
        purposes only, accompanied w/ warning that no support be provided.
- name: kubernetes-dashboard-metrics-scraper
  sourceRepository: github.com/kubernetes/dashboard
  repository: eu.gcr.io/gardener-project/3rd/kubernetesui/metrics-scraper
  tag: v1.0.7
  labels: *optionalAddonLabels

# Miscellaenous
- name: alpine
  repository: eu.gcr.io/gardener-project/3rd/alpine
  tag: "3.15.8"

# Logging
- name: fluent-operator
  sourceRepository: github.com/fluent/fluent-operator
  repository: eu.gcr.io/gardener-project/3rd/kubesphere/fluent-operator
  tag: "v2.3.0"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'low'
      integrity_requirement: 'low'
      availability_requirement: 'low'
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/logging-maintainers'
- name: fluent-bit
  sourceRepository: github.com/fluent/fluent-operator
  repository: eu.gcr.io/gardener-project/3rd/kubesphere/fluent-bit
  tag: "v2.1.4"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'high'
      integrity_requirement: 'low'
      availability_requirement: 'low'
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/logging-maintainers'
- name: fluent-bit-plugin-installer
  resourceId:
    name: fluent-bit-to-vali
  sourceRepository: github.com/gardener/logging
  repository: eu.gcr.io/gardener-project/gardener/fluent-bit-to-vali
  tag: "v0.55.4"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'none'
      integrity_requirement: 'none'
      availability_requirement: 'none'
      comment: no data is stored or processed by the installer
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/logging-maintainers'
- name: vali
  sourceRepository: github.com/credativ/vali
  repository: ghcr.io/credativ/vali
  tag: "v2.2.6"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'high'
      integrity_requirement: 'high'
      availability_requirement: 'low'
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/logging-maintainers'
- name: vali-curator
  sourceRepository: github.com/gardener/logging
  repository: eu.gcr.io/gardener-project/gardener/vali-curator
  tag: "v0.55.4"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'none'
      integrity_requirement: 'high'
      availability_requirement: 'low'
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/logging-maintainers'
- name: kube-rbac-proxy
  sourceRepository: github.com/brancz/kube-rbac-proxy
  repository: quay.io/brancz/kube-rbac-proxy
  tag: v0.14.2
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'public'
      authentication_enforced: true
      user_interaction: 'end-user'
      confidentiality_requirement: 'high'
      integrity_requirement: 'high'
      availability_requirement: 'low'
      comment: kube-rbac-proxy is an authentication proxy working with credentials
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/logging-maintainers'
- name: valitail
  sourceRepository: github.com/credativ/vali
  repository: ghcr.io/credativ/valitail
  tag: "v2.2.6"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'end-user'
      confidentiality_requirement: 'high'
      integrity_requirement: 'high'
      availability_requirement: 'low'
      comment: valitail is running as a client (not as a server) and as such is not publicly exposed to the internet. Vulnerabilities with Attack Vector:Network are not exploitable.
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/logging-maintainers'
- name: telegraf
  resourceId:
    name: telegraf-iptables
  sourceRepository: github.com/gardener/logging
  repository: eu.gcr.io/gardener-project/gardener/telegraf-iptables
  tag: "v0.55.4"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'none'
      integrity_requirement: 'none'
      availability_requirement: 'none'
      comment: >
        telegraf is not accessible from outside the seed cluster and does not
        interact with confidential data
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/logging-maintainers'
- name: event-logger
  sourceRepository: github.com/gardener/logging
  repository: eu.gcr.io/gardener-project/gardener/event-logger
  tag: "v0.55.4"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'high'
      integrity_requirement: 'high'
      availability_requirement: 'low'
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/logging-maintainers'
- name: tune2fs
  sourceRepository: github.com/gardener/logging
  repository: eu.gcr.io/gardener-project/gardener/tune2fs
  tag: "v0.55.4"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'none'
      integrity_requirement: 'none'
      availability_requirement: 'low'
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/logging-maintainers'

# VPA
- name: vpa-admission-controller
  sourceRepository: github.com/kubernetes/autoscaler
  repository: registry.k8s.io/autoscaling/vpa-admission-controller
  tag: "0.14.0"
  labels:
    - name: 'gardener.cloud/cve-categorisation'
      value:
        network_exposure: 'private'
        authentication_enforced: false
        user_interaction: 'gardener-operator'
        confidentiality_requirement: 'low'
        integrity_requirement: 'high'
        availability_requirement: 'high'
- name: vpa-recommender
  sourceRepository: github.com/kubernetes/autoscaler
  repository: registry.k8s.io/autoscaling/vpa-recommender
  tag: "0.14.0"
  labels:
    - name: 'gardener.cloud/cve-categorisation'
      value:
        network_exposure: 'private'
        authentication_enforced: false
        user_interaction: 'gardener-operator'
        confidentiality_requirement: 'low'
        integrity_requirement: 'high'
        availability_requirement: 'high'
- name: vpa-updater
  sourceRepository: github.com/kubernetes/autoscaler
  repository: registry.k8s.io/autoscaling/vpa-updater
  tag: "0.14.0"
  labels:
    - name: 'gardener.cloud/cve-categorisation'
      value:
        network_exposure: 'private'
        authentication_enforced: false
        user_interaction: 'gardener-operator'
        confidentiality_requirement: 'low'
        integrity_requirement: 'high'
        availability_requirement: 'high'

# HVPA
- name: hvpa-controller
  sourceRepository: github.com/gardener/hvpa-controller
  repository: eu.gcr.io/gardener-project/gardener/hvpa-controller
  tag: "v0.13.0"
  labels:
    - name: 'gardener.cloud/cve-categorisation'
      value:
        network_exposure: 'private'
        authentication_enforced: false
        user_interaction: 'gardener-operator'
        confidentiality_requirement: 'low'
        integrity_requirement: 'high'
        availability_requirement: 'high'

# Horizontal cluster-proportional-autoscaler
- name: cluster-proportional-autoscaler
  sourceRepository: https://github.com/kubernetes-sigs/cluster-proportional-autoscaler
  repository: registry.k8s.io/cpa/cluster-proportional-autoscaler
  tag: "v1.8.8"

# Istio
- name: istio-proxy
  sourceRepository: github.com/istio/istio
  repository: gcr.io/istio-release/proxyv2
  tag: "1.17.1-distroless"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'public'
      authentication_enforced: false
      user_interaction: 'end-user'
      confidentiality_requirement: 'low'
      integrity_requirement: 'high'
      availability_requirement: 'high'
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/gardener-core-networking-maintainers'
- name: istio-istiod
  sourceRepository: github.com/istio/istio
  repository: gcr.io/istio-release/pilot
  tag: "1.17.1-distroless"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'protected'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'low'
      integrity_requirement: 'high'
      availability_requirement: 'low'
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/gardener-core-networking-maintainers'

# External Authorization Server for the Istio Endpoint of Reversed VPN
- name: ext-authz-server
  sourceRepository: github.com/gardener/ext-authz-server
  repository: eu.gcr.io/gardener-project/gardener/ext-authz-server
  tag: "0.8.0"

# API Server SNI
- name: apiserver-proxy
  sourceRepository: github.com/envoyproxy/envoy
  repository: eu.gcr.io/gardener-project/3rd/envoyproxy/envoy-distroless
  tag: "v1.26.4"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'protected'
      authentication_enforced: false
      user_interaction: 'end-user'
      confidentiality_requirement: 'low'
      integrity_requirement: 'high'
      availability_requirement: 'high'
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/gardener-core-networking-maintainers'
- name: apiserver-proxy-sidecar
  resourceId:
    name: apiserver-proxy
  sourceRepository: github.com/gardener/apiserver-proxy
  repository: eu.gcr.io/gardener-project/gardener/apiserver-proxy
  tag: "v0.12.0"