Reduce CVE for postgresql deployed by CNPG-operator

Akshay yadavrequested to merge
ak-cnpg-secured-image into main

The CNPG-operatr defaults to ghcr.io/cloudnative-pg/postgresql:18.3-system-trixie for PostgreSQL pods for keycloak (and harbor). This " system" image ships with extra system packages we don't use, which increases the attack surface and brings in many CVEs.

The list of CVEs ( listing only HIGH and CRITICAL CVEs to keep the list a bit small ) :

root@akki-b-vm:/home/ubuntu/ak-cnpg-secured-image/sylva-core# cat system-trixie-HIGH-CRITICAL-CVE-PACKAGE.txt
bsdutils CVE-2026-53615
dirmngr CVE-2026-24882
gnupg CVE-2026-24882
gnupg-l10n CVE-2026-24882
gpg CVE-2026-24882
gpg-agent CVE-2026-24882
gpgconf CVE-2026-24882
gpgsm CVE-2026-24882
gzip CVE-2026-41992
libacl1 CVE-2026-54369
libblkid1 CVE-2026-53615
libcap2 CVE-2026-4878
libexpat1 CVE-2025-59375
libexpat1 CVE-2026-25210
libexpat1 CVE-2026-45186
libexpat1 CVE-2026-56131
libexpat1 CVE-2026-56407
libexpat1 CVE-2026-56408
libgnutls30t64 CVE-2026-33845
libgnutls30t64 CVE-2026-42010
libgnutls30t64 CVE-2026-33846
libgnutls30t64 CVE-2026-3833
libgnutls30t64 CVE-2026-42009
libgssapi-krb5-2 CVE-2026-40355
libgssapi-krb5-2 CVE-2026-40356
libk5crypto3 CVE-2026-40355
libk5crypto3 CVE-2026-40356
libkrb5-3 CVE-2026-40355
libkrb5-3 CVE-2026-40356
libkrb5support0 CVE-2026-40355
libkrb5support0 CVE-2026-40356
liblastlog2-2 CVE-2026-53615
libmount1 CVE-2026-53615
libncursesw6 CVE-2025-69720
libperl5.40 CVE-2026-13221
libperl5.40 CVE-2026-42496
libperl5.40 CVE-2026-8376
libperl5.40 CVE-2026-42497
libperl5.40 CVE-2026-48962
libperl5.40 CVE-2026-57432
libperl5.40 CVE-2026-9538
libpython3.13-minimal CVE-2025-13836
libpython3.13-minimal CVE-2026-11940
libpython3.13-minimal CVE-2026-3644
libpython3.13-minimal CVE-2026-4224
libpython3.13-minimal CVE-2026-6100
libpython3.13-minimal CVE-2026-7210
libpython3.13-stdlib CVE-2025-13836
libpython3.13-stdlib CVE-2026-11940
libpython3.13-stdlib CVE-2026-3644
libpython3.13-stdlib CVE-2026-4224
libpython3.13-stdlib CVE-2026-6100
libpython3.13-stdlib CVE-2026-7210
libsmartcols1 CVE-2026-53615
libssl3t64 CVE-2026-45447
libtinfo6 CVE-2025-69720
libuuid1 CVE-2026-53615
libxml2 CVE-2026-6653
login CVE-2026-53615
mount CVE-2026-53615
ncurses-base CVE-2025-69720
ncurses-bin CVE-2025-69720
openssl CVE-2026-45447
openssl-provider-legacy CVE-2026-45447
perl CVE-2026-13221
perl CVE-2026-42496
perl CVE-2026-8376
perl CVE-2026-42497
perl CVE-2026-48962
perl CVE-2026-57432
perl CVE-2026-9538
perl-base CVE-2026-13221
perl-base CVE-2026-42496
perl-base CVE-2026-8376
perl-base CVE-2026-42497
perl-base CVE-2026-48962
perl-base CVE-2026-57432
perl-base CVE-2026-9538
perl-modules-5.40 CVE-2026-13221
perl-modules-5.40 CVE-2026-42496
perl-modules-5.40 CVE-2026-8376
perl-modules-5.40 CVE-2026-42497
perl-modules-5.40 CVE-2026-48962
perl-modules-5.40 CVE-2026-57432
perl-modules-5.40 CVE-2026-9538
python3-pkg-resources CVE-2026-23949
python3-setuptools CVE-2026-23949
python3.13 CVE-2025-13836
python3.13 CVE-2026-11940
python3.13 CVE-2026-3644
python3.13 CVE-2026-4224
python3.13 CVE-2026-6100
python3.13 CVE-2026-7210
python3.13-minimal CVE-2025-13836
python3.13-minimal CVE-2026-11940
python3.13-minimal CVE-2026-3644
python3.13-minimal CVE-2026-4224
python3.13-minimal CVE-2026-6100
python3.13-minimal CVE-2026-7210
util-linux CVE-2026-53615
PyJWT CVE-2026-48526
cryptography GHSA-537c-gmf6-5ccf
root@akki-b-vm:/home/ubuntu/ak-cnpg-secured-image/sylva-core#

This MR pins the CNPG clusters to use/deploy postgresql pods with "18.3-minimal-trixie ".

The 'minimal' only includes what PostgreSQL needs to run.

Closes #4252 (closed)

Earlier we had:

image

now we are using:

image

which is deployed successfully.

image

cc @alain.thioliere @satyawanj @marc.bailly1

CI configuration

Below you can choose test deployment variants to run in this MR's CI.

Click to open to CI configuration

Legend:

Icon Meaning Available values
☁️ Infra Provider capd, capo, capm3
🚀 Bootstrap Provider kubeadm (alias kadm), rke2, okd, ck8s
🐧 Node OS ubuntu, suse, na, leapmicro
🛠️ Deployment Options Deployment option list and description
🎬 Pipeline Scenarios Available scenario list and description
🟢 Enabled units Any available units name, by default apply to management and workload cluster. Can be prefixed by mgmt: or wkld: to be applied only to a specific cluster type
🔴 Disabled units Any available units name, by default apply to management and workload cluster. Can be prefixed by mgmt: or wkld: to be applied only to a specific cluster type
🏗️ Target platform Can be used to select specific deployment environment Available platform list and description
⚡ Pipeline control autorun, manual or blocking. Can be used to override global config and start a deployment pipeline the required way

  • 🎬 preview ☁️ capd 🚀 kadm 🐧 ubuntu

  • 🎬 preview ☁️ capo 🚀 rke2 🐧 suse

  • 🎬 preview ☁️ capm3 🚀 rke2 🐧 ubuntu

  • ☁️ capd 🚀 kadm 🛠️ light-deploy 🐧 ubuntu

  • ☁️ capd 🚀 rke2 🛠️ light-deploy 🐧 suse

  • ☁️ capo 🚀 rke2 🐧 suse

  • ☁️ capo 🚀 rke2 🐧 leapmicro

  • ☁️ capo 🚀 kadm 🐧 ubuntu

  • ☁️ capo 🚀 kadm 🐧 ubuntu 🟢 neuvector,mgmt:harbor

  • ☁️ capo 🚀 rke2 🎬 rolling-update 🛠️ ha 🐧 ubuntu

  • ☁️ capo 🚀 kadm 🎬 wkld-k8s-upgrade 🐧 ubuntu

  • ☁️ capo 🚀 rke2 🎬 rolling-update-no-wkld 🛠️ ha 🐧 suse

  • ☁️ capo 🚀 rke2 🎬 sylva-upgrade 🛠️ ha 🐧 ubuntu

  • ☁️ capo 🚀 rke2 🎬 sylva-upgrade-from-1.6.x 🛠️ ha,misc 🐧 ubuntu

  • ☁️ capo 🚀 rke2 🛠️ ha,misc 🐧 ubuntu

  • ☁️ capo 🚀 rke2 🛠️ misc 🐧 ubuntu 🟢 mgmt:harbor 🔴 neuvector

  • ☁️ capo 🚀 rke2 🛠️ ha,misc,openbao 🐧 suse

  • ☁️ capo 🚀 rke2 🐧 suse 🎬 upgrade-from-prev-tag

  • ☁️ capm3 🚀 rke2 🐧 suse

  • ☁️ capm3 🚀 kadm 🐧 ubuntu

  • ☁️ capm3 🚀 ck8s 🐧 ubuntu

  • ☁️ capm3 🚀 kadm 🎬 rolling-update-no-wkld 🛠️ ha,misc 🐧 ubuntu

  • ☁️ capm3 🚀 rke2 🎬 wkld-k8s-upgrade 🛠️ ha 🐧 suse

  • ☁️ capm3 🚀 kadm 🎬 rolling-update 🛠️ ha 🐧 ubuntu

  • ☁️ capm3 🚀 rke2 🎬 upgrade-from-prev-release-branch 🛠️ ha 🐧 suse

  • ☁️ capm3 🚀 rke2 🛠️ misc,ha 🐧 suse

  • ☁️ capm3 🚀 rke2 🎬 sylva-upgrade 🛠️ ha,misc 🐧 suse

  • ☁️ capm3 🚀 kadm 🎬 rolling-update 🛠️ ha 🐧 suse

  • ☁️ capm3 🚀 ck8s 🎬 rolling-update 🛠️ ha 🐧 ubuntu

  • ☁️ capm3 🚀 rke2|okd 🎬 no-update 🐧 ubuntu|na

  • ☁️ capm3 🚀 rke2 🐧 suse 🎬 upgrade-from-release-1.5

  • ☁️ capm3 🚀 rke2 🐧 suse 🎬 upgrade-to-main

Global config for deployment pipelines

  • autorun pipelines
  • allow failure on pipelines
  • record sylvactl events

Notes:

  • Enabling autorun will make deployment pipelines to be run automatically without human interaction
  • Disabling allow failure will make deployment pipelines mandatory for pipeline success.
  • if both autorun and allow failure are disabled, deployment pipelines will need manual triggering but will be blocking the pipeline

Be aware: after configuration change, pipeline is not triggered automatically. Please run it manually (by clicking the run pipeline button in Pipelines tab) or push new code.

Edited by Akshay yadav

Merge request reports