Update kube-dns to 1.14.5 for CVE-2017-14491

[mikesplain]

As described: https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html

Not sure if it'd be possible to cut a new 1.7 release with this or something to give people a quick fix.

Current work around would be to manually update the addons in s3. For those who may reference this, simply upgrading to 1.7.7 will not fix this in kops.

Edit

~ @chrislovecnm

Please see #3512 for more information on how to address these concerns with current kops releases. We are still in the process of testing this release of kube-dns, which is a very critical component of kubernetes.

[k8s-ci-robot]

Hi @mikesplain. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[mikesplain]

/assign @justinsb

[chrislovecnm]

/ok-to-test
/lgtm

[chrislovecnm]

We can also provide information on how to patch the file in s3 as a work around.

[mikesplain]

Great thanks @chrislovecnm

[chrislovecnm]

/lgtm cancel

[chrislovecnm]

I missed telling you that we need https://github.com/kubernetes/kops/blob/master/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go#L119 updated for channels to bump the version.

[mikesplain]

Oh yeah good call, these too @chrislovecnm ?https://github.com/kubernetes/kops/blob/master/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/kopeio-vxlan/manifest.yaml

kops/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml

Line 18 in 8055fe5

version: 1.14.4

[chrislovecnm]

@mikesplain how have you tested these changes on AWS?

[mikesplain]

@chrislovecnm Not yet was about to spin up a cluster with it.

[chrislovecnm]

/lgtm

[chrislovecnm]

/lgtm cancel

I really need caffiene

[mikesplain]

Squashed

[justinsb]

BTW the "hotfix" command for an existing cluster is:

kubectl set image deployment/kube-dns -n kube-system kubedns=gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.5 dnsmasq=gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.5

Edit from @chrislovecnm ... we are missing a command. See comment below

[chrislovecnm]

@mikesplain we also have

      - name: sidecar
        image: gcr.io/google_containers/k8s-dns-sidecar-amd64:1.14.4

Need to bump that as well

[mikesplain]

@chrislovecnm Ahh sorry about that, wasn't sure if that was different. Pushed and resquashed.

[chrislovecnm]

Here is the command to update all images including sidecar:

$ kubectl set image deployment/kube-dns -n kube-system kubedns=gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.5 dnsmasq=gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.5 sidecar=gcr.io/google_containers/k8s-dns-sidecar-amd64:1.14.5

[chrislovecnm]

/lgtm

[k8s-github-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: chrislovecnm

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

• OWNERS [chrislovecnm]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

[k8s-github-robot]

/test all [submit-queue is verifying that this PR is safe to merge]

[k8s-github-robot]

Automatic merge from submit-queue.