Description
migrations/cassandra includes kubectl v1.36.4 because the Cassandra cluster-initialization hook uses this image to inspect the StatefulSet and execute cqlsh in Cassandra pods. The official v1.36.4 binaries report Go 1.26.5 and carry reachable vulnerable Go symbols for GO-2026-5026, GO-2026-5942, GO-2026-5972, GO-2026-6088, GO-2026-6089, and GO-2026-6090.
NVCF supports Kubernetes v1.35 through v1.37. Under the kubectl +/-1 minor skew policy, the v1.36 client line is required to cover that full range, so moving to v1.37 is not a compatible remediation.
Definition of Done
- Keep a kubectl v1.36 client for the supported Kubernetes v1.35-v1.37 range.
- Rebuild the checksum-pinned official release source with Go 1.26.6 or newer.
- Verify source provenance, embedded build metadata, and both target architectures.
- Keep
cqlsh, migrate, and the existing migration and initialization entrypoints working.
- Update image documentation and tests.
Description
migrations/cassandraincludes kubectl v1.36.4 because the Cassandra cluster-initialization hook uses this image to inspect the StatefulSet and execute cqlsh in Cassandra pods. The official v1.36.4 binaries report Go 1.26.5 and carry reachable vulnerable Go symbols for GO-2026-5026, GO-2026-5942, GO-2026-5972, GO-2026-6088, GO-2026-6089, and GO-2026-6090.NVCF supports Kubernetes v1.35 through v1.37. Under the kubectl +/-1 minor skew policy, the v1.36 client line is required to cover that full range, so moving to v1.37 is not a compatible remediation.
Definition of Done
cqlsh, migrate, and the existing migration and initialization entrypoints working.