Repository navigation
fix(security): bump Percona MongoDB server and exporter images - #3377
Conversation
percona-server-mongodb 8.0.26-11 -> 8.0.32-14 (operator 1.23.1's certified 8.0 version) and mongodb_exporter 0.53.0 -> 0.54.0, pinned by multi-arch index digest. grype 0.121.0 with the weekly scan's flags, linux/amd64: server 26 critical / 261 high -> 17 / 116, exporter 2 / 23 -> 0 / 0. Backup 2.17.0, fluentbit 5.1.4-1, pmm-client 3.10.0 and server 8.0.34-15 scan clean or nearly so but are not certified for operator 1.23.1; they follow the next operator release. Signed-off-by: Mark Chmarny <mark@chmarny.com>
mchmarny
added
the
theme/supply-chain
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes. ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly and concisely describes the primary change: updating the Percona MongoDB server and exporter images. |
| Description check | |
The description directly explains the image updates, security motivation, affected files, testing, compatibility, and rollout impact. |
| Linked Issues check | |
Issue #3376 is open and directly linked. The diff updates percona-server-mongodb from 8.0.26-11 to 8.0.32-14 and mongodb_exporter from 0.53.0 to 0.54.0. It updates the pins in `recipes/com… |
| Out of Scope Changes check | |
The changed workflow, documentation, render-test constants, mirror e2e list, and upgrade-record text support the two image updates in issue #3376. No unrelated product behavior or deferred Percona ima… |
Full details: Linked Issues check
-
Explanation
Issue
#3376is open and directly linked. The diff updatespercona-server-mongodbfrom8.0.26-11to8.0.32-14andmongodb_exporterfrom0.53.0to0.54.0. It updates the pins inrecipes/components/nvsentinel-mongodb/values.yaml, all three NVSentinel mixins, the image scan workflow, the mirror e2e list, the render-test constants, and the user documentation. The operator remains at 1.23.1,crVersionremains 1.23.0, and the upgrade record documents the same-major MongoDB image roll. The specified deferred Percona image versions are unchanged.
Full details: Out of Scope Changes check
-
Explanation
The changed workflow, documentation, render-test constants, mirror e2e list, and upgrade-record text support the two image updates in issue
#3376. No unrelated product behavior or deferred Percona image update appears in the whole-PR diff. The changes stay within the linked issue scope.
✨ Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
|
🌿 Preview your docs: https://nvidia-preview-fix-percona-mongodb-cves.docs.buildwithfern.com/aicr |
Recipe evidence checkNo leaf overlays affected by this PR. This gate is warning-only and never blocks merge. |
Coverage Report ✅
Coverage BadgeNo Go source files changed in this PR. |
2 participants
Summary
Move the NVSentinel MongoDB datastore's
percona-server-mongodbfrom 8.0.26-11 to 8.0.32-14 and itsmongodb_exportersidecar from 0.53.0 to 0.54.0, pinned by multi-arch index digest. Together they remove most of the critical and high findings the weekly image scan reports on these images.Motivation / Context
The 2026-10-22 weekly scan (
a2f7cb2) is clean on every AICR-built and NVSentinel image; its remaining critical and high findings are on the Percona images. AICR pins those by digest without building them, so the remediation is a newer upstream build rather than a VEX statement.Fixes: #3376
Related: N/A
Type of Change
Component(s) Affected
cmd/aicr,pkg/cli)cmd/aicrd,pkg/server)pkg/recipe)pkg/bundler,pkg/component)pkg/collector,pkg/snapshotter)pkg/validator)pkg/errors,pkg/k8s)docs/,examples/)recipes/(nvsentinel-mongodb values, three nvsentinel mixins, psmdb-operator upgrade record), scan matrix, mirror e2e listImplementation Notes
Measured with grype 0.121.0, using the workflow's flags (
--only-fixed -c .grype.yaml, linux/amd64):percona-server-mongodbmongodb_exporterpercona-backup-mongodb2.17.0,fluentbit5.1.4-1 andpmm-client3.10.0 scan 0 or near 0 critical and high. Operator 1.23.1 (still the newest release) certifies only the pinned 2.15.0, 5.1.2-1 and 3.9.1 for those images, so they follow the next operator release, which also moves the chart.TestRemediationImagesPinnedEverywhererequires. That covers the nvsentinel-mongodb values, the observe, quarantine and remediation mixins, the scan matrix, the mirror e2e list and the render test constants. The BOM is regenerated, and the catalog's MongoDB version is updated.mongodb_exporter0.54.0 accepts every flag our values pass, and its flag set is identical to 0.53.0's.mongosh2.10.0, which NVSentinel's setup Job runs.global.datastore, which holdssetupJob.image, so the image change renders a new Job instead of patching an immutable one.psmdb-operatorupgrade record summary is reworded. It said "crVersion stays at 1.23.0, so the MongoDB version does not change". The MongoDB image is pinned separately, and bundles from this commit do roll mongod.Testing
make qualify make update-goldens # no golden changes: no stock leaf includes the nvsentinel mixins make bom-docsmake qualifypasses.make bom-docschanges only the two image lines.ubuntu-22.04, which mongod below 8.0.35 still needs).Risk Assessment
Rollout notes: An existing nvsentinel-mongodb replica set rolls to MongoDB 8.0.32 on its next sync, which is a same-major patch upgrade. Revert by restoring the previous digests.
Checklist
make testwith-race)make lint)git commit -s -S) — GPG signing info