images.yaml

# List of all container images which are deployed by the Gardener.
# In case an image can only be used for a specific Kubernetes version, the
# entry must have a key "runtimeVersion" whose value describe for which kubernetes runtime
# the respective tag can be used. The syntax must be as described in the
# Masterminds/semver package: https://github.com/Masterminds/semver#hyphen-range-comparisons.
images:
# Gardener components
- name: gardenlet
  sourceRepository: github.com/gardener/gardener
  repository: eu.gcr.io/gardener-project/gardener/gardenlet
- name: gardener-resource-manager
  sourceRepository: github.com/gardener/gardener
  repository: eu.gcr.io/gardener-project/gardener/resource-manager

# Seed bootstrap
- name: pause-container
  sourceRepository: github.com/kubernetes/kubernetes/blob/master/build/pause/Dockerfile
  repository: registry.k8s.io/pause
  tag: "3.7"
  labels:
  - name: cloud.gardener.cnudie/dso/scanning-hints/binary_id/v1
    value:
      policy: skip
      comment: >
        pause-container is not accessible from outside k8s clusters and not
        interacted with from other containers or other systems
- name: etcd-druid
  sourceRepository: github.com/gardener/etcd-druid
  repository: eu.gcr.io/gardener-project/gardener/etcd-druid
  tag: "v0.16.1"
- name: dependency-watchdog
  sourceRepository: github.com/gardener/dependency-watchdog
  repository: eu.gcr.io/gardener-project/gardener/dependency-watchdog
  tag: "v1.0.0"
- name: nginx-ingress-controller-seed
  sourceRepository: github.com/kubernetes/ingress-nginx
  repository: registry.k8s.io/ingress-nginx/controller
  tag: "v0.49.3"
  targetVersion: "< 1.22"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'public'
      authentication_enforced: true
      user_interaction: 'end-user'
      confidentiality_requirement: 'low'
      integrity_requirement: 'low'
      availability_requirement: 'low'
- name: nginx-ingress-controller-seed
  sourceRepository: github.com/kubernetes/ingress-nginx
  repository: registry.k8s.io/ingress-nginx/controller-chroot
  tag: "v1.4.0"
  targetVersion: "1.22.x"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'public'
      authentication_enforced: true
      user_interaction: 'end-user'
      confidentiality_requirement: 'low'
      integrity_requirement: 'low'
      availability_requirement: 'low'
- name: nginx-ingress-controller-seed
  sourceRepository: github.com/kubernetes/ingress-nginx
  repository: registry.k8s.io/ingress-nginx/controller-chroot
  tag: "v1.6.4"
  targetVersion: ">= 1.23"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'public'
      authentication_enforced: true
      user_interaction: 'end-user'
      confidentiality_requirement: 'low'
      integrity_requirement: 'low'
      availability_requirement: 'low'
- name: ingress-default-backend
  sourceRepository: github.com/gardener/ingress-default-backend
  repository: eu.gcr.io/gardener-project/gardener/ingress-default-backend
  tag: "0.14.0"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'end-user'
      confidentiality_requirement: 'none'
      integrity_requirement: 'none'
      availability_requirement: 'none'
      comment: Show static page when no path is found

# Seed controlplane
#   hyperkube is used for kubectl + kubelet binaries on the worker nodes
- name: hyperkube
  sourceRepository: github.com/gardener/hyperkube
  repository: eu.gcr.io/gardener-project/hyperkube
- name: kube-apiserver
  sourceRepository: github.com/kubernetes/kubernetes
  repository: registry.k8s.io/kube-apiserver
- name: kube-controller-manager
  sourceRepository: github.com/kubernetes/kubernetes
  repository: registry.k8s.io/kube-controller-manager
- name: kube-scheduler
  sourceRepository: github.com/kubernetes/kubernetes
  repository: registry.k8s.io/kube-scheduler
- name: kube-proxy
  sourceRepository: github.com/kubernetes/kubernetes
  repository: registry.k8s.io/kube-proxy
- name: cluster-autoscaler
  sourceRepository: github.com/gardener/autoscaler
  repository: eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler
  tag: "v1.25.1"
  targetVersion: ">= 1.25"
- name: cluster-autoscaler
  sourceRepository: github.com/gardener/autoscaler
  repository: eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler
  tag: "v1.24.1"
  targetVersion: "1.24.x"
- name: cluster-autoscaler
  sourceRepository: github.com/gardener/autoscaler
  repository: eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler
  tag: "v1.23.2"
  targetVersion: "1.23.x"
- name: cluster-autoscaler
  sourceRepository: github.com/gardener/autoscaler
  repository: eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler
  tag: "v1.22.4"
  targetVersion: "1.22.x"
- name: cluster-autoscaler
  sourceRepository: github.com/gardener/autoscaler
  repository: eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler
  tag: "v1.21.4"
  targetVersion: "1.21.x"
- name: cluster-autoscaler
  sourceRepository: github.com/gardener/autoscaler
  repository: eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler
  tag: "v1.20.4"
  targetVersion: "< 1.21"
- name: vpn-seed-server
  sourceRepository: github.com/gardener/vpn2
  repository: eu.gcr.io/gardener-project/gardener/vpn-seed-server
  tag: "0.15.0"

# Monitoring
- name: alertmanager
  sourceRepository: github.com/prometheus/alertmanager
  repository: quay.io/prometheus/alertmanager
  tag: v0.24.0
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: public
      authentication_enforced: true
      user_interaction: end-user
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low
- name: prometheus
  sourceRepository: github.com/prometheus/prometheus
  repository: quay.io/prometheus/prometheus
  tag: v2.41.0
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: public
      authentication_enforced: true
      user_interaction: end-user
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low
- name: configmap-reloader
  sourceRepository: github.com/prometheus-operator/prometheus-operator
  repository: ghcr.io/prometheus-operator/prometheus-config-reloader
  tag: v0.61.1
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: private
      authentication_enforced: false
      user_interaction: gardener-operator
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low
- name: kube-state-metrics
  sourceRepository: github.com/kubernetes/kube-state-metrics
  repository: registry.k8s.io/kube-state-metrics/kube-state-metrics
  tag: v2.5.0
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: private
      authentication_enforced: false
      user_interaction: gardener-operator
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low
- name: node-exporter
  sourceRepository: github.com/prometheus/node_exporter
  repository: quay.io/prometheus/node-exporter
  tag: v1.5.0
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: protected
      authentication_enforced: false
      user_interaction: end-user
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low
      comment: the node-exporter is also deployed to the shoot cluster
- name: grafana
  sourceRepository: github.com/grafana/grafana
  repository: eu.gcr.io/gardener-project/3rd/grafana/grafana
  tag: "7.5.17"
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: public
      authentication_enforced: true
      user_interaction: end-user
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low
- name: blackbox-exporter
  sourceRepository: github.com/prometheus/blackbox_exporter
  repository: quay.io/prometheus/blackbox-exporter
  tag: v0.23.0
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: protected
      authentication_enforced: false
      user_interaction: end-user
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low
      comment: the blackbox-exporter is also deployed to the shoot cluster
- name: metrics-server
  sourceRepository: github.com/kubernetes-sigs/metrics-server
  repository: registry.k8s.io/metrics-server/metrics-server
  tag: v0.6.3
  labels:
  - name: gardener.cloud/cve-categorisation
    value:
      network_exposure: private
      authentication_enforced: false
      user_interaction: gardener-operator
      confidentiality_requirement: high
      integrity_requirement: high
      availability_requirement: low

# Shoot core addons
- name: vpn-shoot-client
  sourceRepository: github.com/gardener/vpn2
  repository: eu.gcr.io/gardener-project/gardener/vpn-shoot-client
  tag: "0.15.0"
- name: coredns
  sourceRepository: github.com/coredns/coredns
  repository: eu.gcr.io/gardener-project/3rd/coredns/coredns
  tag: "1.10.0"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'protected'
      authentication_enforced: false
      user_interaction: 'end-user'
      confidentiality_requirement: 'low'
      integrity_requirement: 'high'
      availability_requirement: 'high'
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/gardener-core-networking-maintainers'
- name: node-local-dns
  sourceRepository: github.com/kubernetes/kubernetes/blob/master/cluster/addons/dns/nodelocaldns
  repository: registry.k8s.io/dns/k8s-dns-node-cache
  tag: "1.22.20"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'end-user'
      confidentiality_requirement: 'low'
      integrity_requirement: 'high'
      availability_requirement: 'high'
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/gardener-core-networking-maintainers'
- name: node-problem-detector
  sourceRepository: github.com/kubernetes/node-problem-detector
  repository: registry.k8s.io/node-problem-detector/node-problem-detector
  tag: "v0.8.13"

# Shoot optional addons
- name: kubernetes-dashboard
  sourceRepository: github.com/kubernetes/dashboard
  repository: eu.gcr.io/gardener-project/3rd/kubernetesui/dashboard
  tag: v2.2.0
  targetVersion: "< 1.21"
  labels: &optionalAddonLabels
  - name: cloud.gardener.cnudie/dso/scanning-hints/binary_id/v1
    value:
      policy: skip
      comment: >
        not deployed as part of gardener infrastructure. Offered to users for development
        purposes only, accompanied w/ warning that no support be provided.
- name: kubernetes-dashboard
  sourceRepository: github.com/kubernetes/dashboard
  repository: eu.gcr.io/gardener-project/3rd/kubernetesui/dashboard
  tag: v2.4.0
  targetVersion: ">= 1.21, < 1.22"
  labels: *optionalAddonLabels
- name: kubernetes-dashboard
  sourceRepository: github.com/kubernetes/dashboard
  repository: eu.gcr.io/gardener-project/3rd/kubernetesui/dashboard
  tag: v2.5.1
  targetVersion: ">= 1.22"
  labels: *optionalAddonLabels
- name: kubernetes-dashboard-metrics-scraper
  sourceRepository: github.com/kubernetes/dashboard
  repository: eu.gcr.io/gardener-project/3rd/kubernetesui/metrics-scraper
  tag: v1.0.7
  labels: *optionalAddonLabels
- name: nginx-ingress-controller
  sourceRepository: github.com/kubernetes/ingress-nginx
  repository: registry.k8s.io/ingress-nginx/controller
  tag: "v0.49.3"
  targetVersion: "< 1.22"
  labels: *optionalAddonLabels
- name: nginx-ingress-controller
  sourceRepository: github.com/kubernetes/ingress-nginx
  repository: registry.k8s.io/ingress-nginx/controller-chroot
  tag: "v1.2.1"
  targetVersion: ">= 1.22"
  labels: *optionalAddonLabels

# Miscellaenous
- name: alpine
  repository: eu.gcr.io/gardener-project/3rd/alpine
  tag: "3.15.4"

# Logging
- name: fluent-bit
  sourceRepository: github.com/fluent/fluent-bit
  repository: eu.gcr.io/gardener-project/3rd/fluent/fluent-bit
  tag: "1.9.7"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'high'
      integrity_requirement: 'low'
      availability_requirement: 'low'
- name: fluent-bit-plugin-installer
  sourceRepository: github.com/gardener/logging
  repository: eu.gcr.io/gardener-project/gardener/fluent-bit-to-loki
  tag: "v0.52.0"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'none'
      integrity_requirement: 'none'
      availability_requirement: 'none'
      comment: no data is stored or processed by the installer
- name: loki
  sourceRepository: github.com/grafana/loki
  repository: eu.gcr.io/gardener-project/3rd/grafana/loki
  tag: "2.2.1"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'high'
      integrity_requirement: 'high'
      availability_requirement: 'low'
- name: loki-curator
  sourceRepository: github.com/gardener/logging
  repository: eu.gcr.io/gardener-project/gardener/loki-curator
  tag: "v0.52.0"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'none'
      integrity_requirement: 'high'
      availability_requirement: 'low'
- name: kube-rbac-proxy
  sourceRepository: github.com/brancz/kube-rbac-proxy
  repository: quay.io/brancz/kube-rbac-proxy
  tag: v0.14.0
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'public'
      authentication_enforced: true
      user_interaction: 'end-user'
      confidentiality_requirement: 'high'
      integrity_requirement: 'high'
      availability_requirement: 'low'
      comment: kube-rbac-proxy is an authentication proxy working with credentials
- name: promtail
  sourceRepository: github.com/grafana/loki
  repository: eu.gcr.io/gardener-project/3rd/grafana/promtail
  tag: "2.2.1"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'public'
      authentication_enforced: false
      user_interaction: 'end-user'
      confidentiality_requirement: 'high'
      integrity_requirement: 'high'
      availability_requirement: 'low'
      comment: network exposure is public due to the outbound connectivity, there is no exposed endpoint requiring auth.
- name: telegraf
  sourceRepository: github.com/gardener/logging
  repository: eu.gcr.io/gardener-project/gardener/telegraf-iptables
  tag: "v0.52.0"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'none'
      integrity_requirement: 'none'
      availability_requirement: 'none'
      comment: >
        telegraf is not accessible from outside the seed cluster and does not
        interact with confidential data
- name: event-logger
  sourceRepository: github.com/gardener/logging
  repository: eu.gcr.io/gardener-project/gardener/event-logger
  tag: "v0.52.0"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'high'
      integrity_requirement: 'high'
      availability_requirement: 'low'
- name: tune2fs
  sourceRepository: github.com/gardener/logging
  repository: eu.gcr.io/gardener-project/gardener/tune2fs
  tag: "v0.52.0"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'private'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'none'
      integrity_requirement: 'none'
      availability_requirement: 'low'

# VPA
- name: vpa-admission-controller
  sourceRepository: github.com/kubernetes/autoscaler
  repository: registry.k8s.io/autoscaling/vpa-admission-controller
  tag: "0.11.0"
  targetVersion: "< 1.21"
  labels:
    - name: 'gardener.cloud/cve-categorisation'
      value:
        network_exposure: 'private'
        authentication_enforced: false
        user_interaction: 'gardener-operator'
        confidentiality_requirement: 'low'
        integrity_requirement: 'high'
        availability_requirement: 'high'
- name: vpa-admission-controller
  sourceRepository: github.com/kubernetes/autoscaler
  repository: registry.k8s.io/autoscaling/vpa-admission-controller
  tag: "0.13.0"
  targetVersion: ">= 1.21"
  labels:
    - name: 'gardener.cloud/cve-categorisation'
      value:
        network_exposure: 'private'
        authentication_enforced: false
        user_interaction: 'gardener-operator'
        confidentiality_requirement: 'low'
        integrity_requirement: 'high'
        availability_requirement: 'high'
- name: vpa-recommender
  sourceRepository: github.com/kubernetes/autoscaler
  repository: registry.k8s.io/autoscaling/vpa-recommender
  tag: "0.11.0"
  targetVersion: "< 1.21"
  labels:
    - name: 'gardener.cloud/cve-categorisation'
      value:
        network_exposure: 'private'
        authentication_enforced: false
        user_interaction: 'gardener-operator'
        confidentiality_requirement: 'low'
        integrity_requirement: 'high'
        availability_requirement: 'high'
- name: vpa-recommender
  sourceRepository: github.com/kubernetes/autoscaler
  repository: registry.k8s.io/autoscaling/vpa-recommender
  tag: "0.13.0"
  targetVersion: ">= 1.21"
  labels:
    - name: 'gardener.cloud/cve-categorisation'
      value:
        network_exposure: 'private'
        authentication_enforced: false
        user_interaction: 'gardener-operator'
        confidentiality_requirement: 'low'
        integrity_requirement: 'high'
        availability_requirement: 'high'
- name: vpa-updater
  sourceRepository: github.com/kubernetes/autoscaler
  repository: registry.k8s.io/autoscaling/vpa-updater
  tag: "0.11.0"
  targetVersion: "< 1.21"
  labels:
    - name: 'gardener.cloud/cve-categorisation'
      value:
        network_exposure: 'private'
        authentication_enforced: false
        user_interaction: 'gardener-operator'
        confidentiality_requirement: 'low'
        integrity_requirement: 'high'
        availability_requirement: 'high'
- name: vpa-updater
  sourceRepository: github.com/kubernetes/autoscaler
  repository: registry.k8s.io/autoscaling/vpa-updater
  tag: "0.13.0"
  targetVersion: ">= 1.21"
  labels:
    - name: 'gardener.cloud/cve-categorisation'
      value:
        network_exposure: 'private'
        authentication_enforced: false
        user_interaction: 'gardener-operator'
        confidentiality_requirement: 'low'
        integrity_requirement: 'high'
        availability_requirement: 'high'

# HVPA
- name: hvpa-controller
  sourceRepository: github.com/gardener/hvpa-controller
  repository: eu.gcr.io/gardener-project/gardener/hvpa-controller
  tag: "v0.11.0"
  labels:
    - name: 'gardener.cloud/cve-categorisation'
      value:
        network_exposure: 'private'
        authentication_enforced: false
        user_interaction: 'gardener-operator'
        confidentiality_requirement: 'low'
        integrity_requirement: 'high'
        availability_requirement: 'high'

# Horizontal cluster-proportional-autoscaler
- name: cluster-proportional-autoscaler
  sourceRepository: https://github.com/kubernetes-sigs/cluster-proportional-autoscaler
  repository: registry.k8s.io/cpa/cluster-proportional-autoscaler
  tag: "1.8.6"

# Istio
- name: istio-proxy
  sourceRepository: github.com/istio/istio
  repository: gcr.io/istio-release/proxyv2
  tag: "1.17.1-distroless"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'public'
      authentication_enforced: false
      user_interaction: 'end-user'
      confidentiality_requirement: 'low'
      integrity_requirement: 'high'
      availability_requirement: 'high'
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/gardener-core-networking-maintainers'
- name: istio-istiod
  sourceRepository: github.com/istio/istio
  repository: gcr.io/istio-release/pilot
  tag: "1.17.1-distroless"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'protected'
      authentication_enforced: false
      user_interaction: 'gardener-operator'
      confidentiality_requirement: 'low'
      integrity_requirement: 'high'
      availability_requirement: 'low'
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/gardener-core-networking-maintainers'

# External Authorization Server for the Istio Endpoint of Reversed VPN
- name: ext-authz-server
  sourceRepository: github.com/gardener/ext-authz-server
  repository: eu.gcr.io/gardener-project/gardener/ext-authz-server
  tag: "0.7.0"

# API Server SNI
- name: apiserver-proxy
  sourceRepository: github.com/envoyproxy/envoy
  repository: eu.gcr.io/gardener-project/3rd/envoyproxy/envoy-distroless
  tag: "v1.24.1"
  labels:
  - name: 'gardener.cloud/cve-categorisation'
    value:
      network_exposure: 'protected'
      authentication_enforced: false
      user_interaction: 'end-user'
      confidentiality_requirement: 'low'
      integrity_requirement: 'high'
      availability_requirement: 'high'
  - name: 'cloud.gardener.cnudie/responsibles'
    value:
    - type: 'githubTeam'
      teamname: 'gardener/gardener-core-networking-maintainers'
- name: apiserver-proxy-sidecar
  sourceRepository: github.com/gardener/apiserver-proxy
  repository: eu.gcr.io/gardener-project/gardener/apiserver-proxy
  tag: "v0.11.0"
- name: apiserver-proxy-pod-webhook
  sourceRepository: github.com/gardener/apiserver-proxy
  repository: eu.gcr.io/gardener-project/gardener/apiserver-proxy-pod-webhook
  tag: "v0.11.0"