fix: cve fix for git operator and webserver (#2646)

.env

@@ -1 +1 @@
-GIT_OPERATOR_VERSION="v0.13.1"
+GIT_OPERATOR_VERSION="v0.13.2"

licenses.d2iq.yaml

@@ -161,11 +161,11 @@ resources:
     sources:
       - ref: ${image_tag}
         url: https://github.com/mesosphere/dkp-insights
-  - container_image: docker.io/mesosphere/git-operator:v0.13.1
+  - container_image: docker.io/mesosphere/git-operator:v0.13.2
     sources:
       - ref: ${image_tag}
         url: https://github.com/mesosphere/git-operator
-  - container_image: docker.io/mesosphere/gitwebserver:v0.13.1
+  - container_image: docker.io/mesosphere/gitwebserver:v0.13.2
     sources:
       - ref: ${image_tag}
         url: https://github.com/mesosphere/git-operator
@@ -595,15 +595,15 @@ resources:
       - url: https://github.com/prometheus-community/postgres_exporter
         ref: v0.12.0
         license_path: LICENSE
-  - container_image: ghcr.io/mesosphere/dkp-container-images/docker.io/nginxinc/nginx-unprivileged:1.25.5-alpine-d2iq.0
+  - container_image: docker.io/nginxinc/nginx-unprivileged:1.27.1-alpine
     sources:
       - url: https://github.com/nginx/nginx
-        ref: release-${image_tag%-alpine-d2iq.0}
+        ref: release-${image_tag%-alpine}
         license_path: docs/text/LICENSE
-  - container_image: ghcr.io/mesosphere/dkp-container-images/docker.io/nginxinc/nginx-unprivileged:1.25.5-alpine-d2iq.0
+  - container_image: docker.io/nginxinc/nginx-unprivileged:1.27.1-alpine
     sources:
       - url: https://github.com/nginx/nginx
-        ref: release-${image_tag%-alpine-d2iq.0}
+        ref: release-${image_tag%-alpine}
         license_path: docs/text/LICENSE
   - container_image: bitnami/external-dns:0.14.2-debian-12-r7
     sources:

services/git-operator/0.1.0/git-operator-manifests/all.yaml → services/git-operator/0.1.1/git-operator-manifests/all.yaml

@@ -902,7 +902,7 @@ spec:
         - --metrics-bind-address=127.0.0.1:8080
         - --leader-elect
         - --namespace=${NAMESPACE:=git-operator-system}
-        image: docker.io/mesosphere/git-operator:v0.13.1
+        image: docker.io/mesosphere/git-operator:v0.13.2
         livenessProbe:
           httpGet:
             path: /healthz
@@ -955,7 +955,7 @@ spec:
         app.kubernetes.io/name: git-operator
     spec:
       containers:
-      - image: ghcr.io/mesosphere/dkp-container-images/docker.io/nginxinc/nginx-unprivileged:1.25.5-alpine-d2iq.0
+      - image: docker.io/nginxinc/nginx-unprivileged:1.27.1-alpine
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:
@@ -1006,7 +1006,7 @@ spec:
       - env:
         - name: GIT_VOLUME_PATH
           value: /volumes/git
-        image: docker.io/mesosphere/gitwebserver:v0.13.1
+        image: docker.io/mesosphere/gitwebserver:v0.13.2
         imagePullPolicy: IfNotPresent
         livenessProbe:
           initialDelaySeconds: 3
@@ -1046,7 +1046,7 @@ spec:
         - /volumes/admin-tmp/snapshots
         - --snapshot-symlink
         - /volumes/admin-tmp/active-snapshot
-        image: docker.io/mesosphere/gitwebserver:v0.13.1
+        image: docker.io/mesosphere/gitwebserver:v0.13.2
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:
@@ -1088,7 +1088,7 @@ spec:
         env:
         - name: ADMIN_REPO_PATH
           value: /volumes/admin/admin.git
-        image: docker.io/mesosphere/gitwebserver:v0.13.1
+        image: docker.io/mesosphere/gitwebserver:v0.13.2
         imagePullPolicy: IfNotPresent
         name: init-admin-repo
         securityContext:

services/grafana-loki/0.79.3/defaults/cm.yaml → services/grafana-loki/0.79.4/defaults/cm.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: grafana-loki-0.79.3-d2iq-defaults
+  name: grafana-loki-0.79.4-d2iq-defaults
   namespace: ${releaseNamespace}
 data:
   values.yaml: |
@@ -186,9 +186,9 @@ data:
       image:
         # Override nginx image to address known CVEs.
         # As of 0.48.4, chart maintainers are still using 1.19-alpine.
-        registry: ghcr.io
-        repository: mesosphere/dkp-container-images/docker.io/nginxinc/nginx-unprivileged
-        tag: 1.25.5-alpine-d2iq.0
+        #registry: docker.io
+        #repository: nginxinc/nginx-unprivileged
+        tag: 1.27.1-alpine
       nginxConfig:
         httpSnippet: |-
           client_max_body_size 10M;

services/grafana-loki/0.79.3/grafana-loki-helmrelease.yaml → services/grafana-loki/0.79.4/grafana-loki-helmrelease.yaml

@@ -12,7 +12,7 @@ spec:
   wait: true
   interval: 6h
   retryInterval: 1m
-  path: ./services/grafana-loki/0.79.3/grafana-loki-helmrelease
+  path: ./services/grafana-loki/0.79.4/grafana-loki-helmrelease
   sourceRef:
     kind: GitRepository
     name: management

services/grafana-loki/0.79.3/grafana-loki-helmrelease/grafana-loki.yaml → services/grafana-loki/0.79.4/grafana-loki-helmrelease/grafana-loki.yaml

@@ -25,4 +25,4 @@ spec:
   releaseName: grafana-loki
   valuesFrom:
     - kind: ConfigMap
-      name: grafana-loki-0.79.3-d2iq-defaults
+      name: grafana-loki-0.79.4-d2iq-defaults

services/grafana-loki/0.79.3/grafana-loki-pre-install.yaml → services/grafana-loki/0.79.4/grafana-loki-pre-install.yaml

@@ -9,7 +9,7 @@ spec:
   wait: true
   interval: 6h
   retryInterval: 1m
-  path: ./services/grafana-loki/0.79.3/grafana-loki-pre-install-jobs
+  path: ./services/grafana-loki/0.79.4/grafana-loki-pre-install-jobs
   sourceRef:
     kind: GitRepository
     name: management

services/project-grafana-loki/0.79.3/defaults/cm.yaml → services/project-grafana-loki/0.79.4/defaults/cm.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: project-grafana-loki-0.79.3-d2iq-defaults
+  name: project-grafana-loki-0.79.4-d2iq-defaults
   namespace: ${releaseNamespace}
 data:
   values.yaml: |
@@ -194,9 +194,9 @@ data:
       image:
         # Override nginx image to address known CVEs.
         # As of 0.48.4, chart maintainers are still using 1.19-alpine.
-        registry: ghcr.io
-        repository: mesosphere/dkp-container-images/docker.io/nginxinc/nginx-unprivileged
-        tag: 1.25.5-alpine-d2iq.0
+        #registry: docker.io
+        #repository: nginxinc/nginx-unprivileged
+        tag: 1.27.1-alpine
       verboseLogging: false
       nginxConfig:
         httpSnippet: |-

services/project-grafana-loki/0.79.3/object-bucket-claims.yaml → services/project-grafana-loki/0.79.4/object-bucket-claims.yaml

@@ -24,7 +24,7 @@ spec:
   releaseName: project-loki-object-bucket-claims
   valuesFrom:
     - kind: ConfigMap
-      name: project-grafana-loki-0.79.3-d2iq-defaults
+      name: project-grafana-loki-0.79.4-d2iq-defaults
     - kind: ConfigMap
       name: project-grafana-loki-overrides
       optional: true

services/project-grafana-loki/0.79.3/project-grafana-loki.yaml → services/project-grafana-loki/0.79.4/project-grafana-loki.yaml

@@ -25,4 +25,4 @@ spec:
   releaseName: project-grafana-loki
   valuesFrom:
     - kind: ConfigMap
-      name: project-grafana-loki-0.79.3-d2iq-defaults
+      name: project-grafana-loki-0.79.4-d2iq-defaults