Repository navigation
Base images drop the distrusted eMudhra roots and the kind Jaeger moves to v2.22.0 - #3196
Merged
Dmitry Berkovich (dberkov) merged 3 commits intoOct 24, 2026
Merged
Conversation
The pinned distroless static and base digests and alpine 3.24.2 still trust AAA Certificate Services and emSign ECC Root CA - G3. The current distroless digests and alpine 3.24.3 do not.
Jaeger v1 had its last release in December 2025. With no --config the v2 image runs the same all-in-one: OTLP on 4317 and 4318, the UI on 16686, memory storage.
Collaborator
Author
The plugin builds from its own .ko.yaml, which still pinned the distroless digest with the distrusted roots.
Dmitry Berkovich (dberkov)
approved these changes
Oct 24, 2026
Collaborator
|
Thanks dims. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The distroless and alpine digests in
.ko.yamlstill trust the two roots the eMudhra compromise distrusted, so every ko image does. The kind overlay ran Jaeger all-in-one 1.55, and Jaeger v1 had its last release in December 2025.Change. Three commits.
.ko.yamland the GCP Secret Manager plugin's.ko.yamlmove to the current distroless static and base digests and to alpine 3.24.3, whose bundles drop AAA Certificate Services and emSign ECC Root CA - G3. The kind overlay runsjaegertracing/jaeger:2.22.0, which with no config is the all-in-one: OTLP on 4317 and 4318, the UI on 16686, memory storage. Two doc phrases drop "all-in-one".Tests.
go test ./cmd/ate-setup/...passes. On a kind cluster the v2 image rolls out, logs the all-in-one default, answers on the UI and the v3 API, and lists the components' traces from the collector.AI use: AI-assisted, I reviewed and tested it.