[1.19] CVE fix bump kubectl to 1.34.3

[alexliu541]

Description

• Update kubectl image to 1.34.3 to resolve CVE-2025-58183 and CVE-2025-61729

Context

Testing steps

 for image in access-logger certgen discovery gloo gloo-envoy-wrapper ingress kubectl sds; do trivy image --severity HIGH,CRITICAL quay.io/solo-io/${image}:1.0.1-dev; done

2026-01-09T01:41:02-08:00       INFO    [vuln] Vulnerability scanning is enabled
2026-01-09T01:41:02-08:00       INFO    [secret] Secret scanning is enabled
2026-01-09T01:41:02-08:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-01-09T01:41:02-08:00       INFO    [secret] Please see https://trivy.dev/docs/v0.68/guide/scanner/secret#recommendation for faster secret detection
2026-01-09T01:41:02-08:00       INFO    Detected OS     family="alpine" version="3.21.5"
2026-01-09T01:41:02-08:00       INFO    [alpine] Detecting vulnerabilities...   os_version="3.21" repository="3.21" pkg_num=16
2026-01-09T01:41:02-08:00       INFO    Number of language-specific files       num=1
2026-01-09T01:41:02-08:00       INFO    [gobinary] Detecting vulnerabilities...
2026-01-09T01:41:02-08:00       INFO    Some vulnerabilities have been ignored/suppressed. Use the "--show-suppressed" flag to display them.

Report Summary

┌─────────────────────────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│                         Target                          │   Type   │ Vulnerabilities │ Secrets │
├─────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ quay.io/solo-io/access-logger:1.0.1-dev (alpine 3.21.5) │  alpine  │        0        │    -    │
├─────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/local/bin/access-logger                             │ gobinary │        0        │    -    │
└─────────────────────────────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

2026-01-09T01:41:02-08:00       INFO    [vuln] Vulnerability scanning is enabled
2026-01-09T01:41:02-08:00       INFO    [secret] Secret scanning is enabled
2026-01-09T01:41:02-08:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-01-09T01:41:02-08:00       INFO    [secret] Please see https://trivy.dev/docs/v0.68/guide/scanner/secret#recommendation for faster secret detection
2026-01-09T01:41:02-08:00       INFO    Detected OS     family="alpine" version="3.21.5"
2026-01-09T01:41:02-08:00       INFO    [alpine] Detecting vulnerabilities...   os_version="3.21" repository="3.21" pkg_num=16
2026-01-09T01:41:02-08:00       INFO    Number of language-specific files       num=1
2026-01-09T01:41:02-08:00       INFO    [gobinary] Detecting vulnerabilities...

Report Summary

┌───────────────────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│                      Target                       │   Type   │ Vulnerabilities │ Secrets │
├───────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ quay.io/solo-io/certgen:1.0.1-dev (alpine 3.21.5) │  alpine  │        0        │    -    │
├───────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/local/bin/certgen                             │ gobinary │        0        │    -    │
└───────────────────────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

2026-01-09T01:41:02-08:00       INFO    [vuln] Vulnerability scanning is enabled
2026-01-09T01:41:02-08:00       INFO    [secret] Secret scanning is enabled
2026-01-09T01:41:02-08:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-01-09T01:41:02-08:00       INFO    [secret] Please see https://trivy.dev/docs/v0.68/guide/scanner/secret#recommendation for faster secret detection
2026-01-09T01:41:03-08:00       INFO    Detected OS     family="alpine" version="3.21.5"
2026-01-09T01:41:03-08:00       INFO    [alpine] Detecting vulnerabilities...   os_version="3.21" repository="3.21" pkg_num=16
2026-01-09T01:41:03-08:00       INFO    Number of language-specific files       num=1
2026-01-09T01:41:03-08:00       INFO    [gobinary] Detecting vulnerabilities...
2026-01-09T01:41:03-08:00       INFO    Some vulnerabilities have been ignored/suppressed. Use the "--show-suppressed" flag to display them.

Report Summary

┌─────────────────────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│                       Target                        │   Type   │ Vulnerabilities │ Secrets │
├─────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ quay.io/solo-io/discovery:1.0.1-dev (alpine 3.21.5) │  alpine  │        0        │    -    │
├─────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/local/bin/discovery                             │ gobinary │        0        │    -    │
└─────────────────────────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

2026-01-09T01:41:03-08:00       INFO    [vuln] Vulnerability scanning is enabled
2026-01-09T01:41:03-08:00       INFO    [secret] Secret scanning is enabled
2026-01-09T01:41:03-08:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-01-09T01:41:03-08:00       INFO    [secret] Please see https://trivy.dev/docs/v0.68/guide/scanner/secret#recommendation for faster secret detection
2026-01-09T01:41:05-08:00       INFO    Detected OS     family="ubuntu" version="20.04"
2026-01-09T01:41:05-08:00       INFO    [ubuntu] Detecting vulnerabilities...   os_version="20.04" pkg_num=98
2026-01-09T01:41:05-08:00       INFO    Number of language-specific files       num=1
2026-01-09T01:41:05-08:00       INFO    [gobinary] Detecting vulnerabilities...
2026-01-09T01:41:05-08:00       WARN    This OS version is no longer supported by the distribution      family="ubuntu" version="20.04"
2026-01-09T01:41:05-08:00       WARN    The vulnerability detection may be insufficient because security updates are not provided
2026-01-09T01:41:05-08:00       INFO    Some vulnerabilities have been ignored/suppressed. Use the "--show-suppressed" flag to display them.

Report Summary

┌───────────────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│                    Target                     │   Type   │ Vulnerabilities │ Secrets │
├───────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ quay.io/solo-io/gloo:1.0.1-dev (ubuntu 20.04) │  ubuntu  │        0        │    -    │
├───────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/local/bin/gloo                            │ gobinary │        0        │    -    │
└───────────────────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

2026-01-09T01:41:05-08:00       INFO    [vuln] Vulnerability scanning is enabled
2026-01-09T01:41:05-08:00       INFO    [secret] Secret scanning is enabled
2026-01-09T01:41:05-08:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-01-09T01:41:05-08:00       INFO    [secret] Please see https://trivy.dev/docs/v0.68/guide/scanner/secret#recommendation for faster secret detection
2026-01-09T01:41:05-08:00       INFO    Detected OS     family="ubuntu" version="20.04"
2026-01-09T01:41:05-08:00       INFO    [ubuntu] Detecting vulnerabilities...   os_version="20.04" pkg_num=98
2026-01-09T01:41:05-08:00       INFO    Number of language-specific files       num=1
2026-01-09T01:41:05-08:00       INFO    [gobinary] Detecting vulnerabilities...
2026-01-09T01:41:05-08:00       WARN    This OS version is no longer supported by the distribution      family="ubuntu" version="20.04"
2026-01-09T01:41:05-08:00       WARN    The vulnerability detection may be insufficient because security updates are not provided

Report Summary

┌─────────────────────────────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│                           Target                            │   Type   │ Vulnerabilities │ Secrets │
├─────────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ quay.io/solo-io/gloo-envoy-wrapper:1.0.1-dev (ubuntu 20.04) │  ubuntu  │        0        │    -    │
├─────────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/local/bin/envoyinit                                     │ gobinary │        0        │    -    │
└─────────────────────────────────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

2026-01-09T01:41:05-08:00       INFO    [vuln] Vulnerability scanning is enabled
2026-01-09T01:41:05-08:00       INFO    [secret] Secret scanning is enabled
2026-01-09T01:41:05-08:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-01-09T01:41:05-08:00       INFO    [secret] Please see https://trivy.dev/docs/v0.68/guide/scanner/secret#recommendation for faster secret detection
2026-01-09T01:41:06-08:00       INFO    Detected OS     family="alpine" version="3.21.5"
2026-01-09T01:41:06-08:00       INFO    [alpine] Detecting vulnerabilities...   os_version="3.21" repository="3.21" pkg_num=15
2026-01-09T01:41:06-08:00       INFO    Number of language-specific files       num=1
2026-01-09T01:41:06-08:00       INFO    [gobinary] Detecting vulnerabilities...
2026-01-09T01:41:06-08:00       INFO    Some vulnerabilities have been ignored/suppressed. Use the "--show-suppressed" flag to display them.

Report Summary

┌───────────────────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│                      Target                       │   Type   │ Vulnerabilities │ Secrets │
├───────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ quay.io/solo-io/ingress:1.0.1-dev (alpine 3.21.5) │  alpine  │        0        │    -    │
├───────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/local/bin/ingress                             │ gobinary │        0        │    -    │
└───────────────────────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

2026-01-09T01:41:06-08:00       INFO    [vuln] Vulnerability scanning is enabled
2026-01-09T01:41:06-08:00       INFO    [secret] Secret scanning is enabled
2026-01-09T01:41:06-08:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-01-09T01:41:06-08:00       INFO    [secret] Please see https://trivy.dev/docs/v0.68/guide/scanner/secret#recommendation for faster secret detection
2026-01-09T01:41:06-08:00       INFO    Detected OS     family="alpine" version="3.21.5"
2026-01-09T01:41:06-08:00       INFO    [alpine] Detecting vulnerabilities...   os_version="3.21" repository="3.21" pkg_num=15
2026-01-09T01:41:06-08:00       INFO    Number of language-specific files       num=1
2026-01-09T01:41:06-08:00       INFO    [gobinary] Detecting vulnerabilities...

Report Summary

┌───────────────────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│                      Target                       │   Type   │ Vulnerabilities │ Secrets │
├───────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ quay.io/solo-io/kubectl:1.0.1-dev (alpine 3.21.5) │  alpine  │        0        │    -    │
├───────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/local/bin/kubectl                             │ gobinary │        0        │    -    │
└───────────────────────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

2026-01-09T01:41:06-08:00       INFO    [vuln] Vulnerability scanning is enabled
2026-01-09T01:41:06-08:00       INFO    [secret] Secret scanning is enabled
2026-01-09T01:41:06-08:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-01-09T01:41:06-08:00       INFO    [secret] Please see https://trivy.dev/docs/v0.68/guide/scanner/secret#recommendation for faster secret detection
2026-01-09T01:41:06-08:00       INFO    Detected OS     family="alpine" version="3.21.5"
2026-01-09T01:41:06-08:00       INFO    [alpine] Detecting vulnerabilities...   os_version="3.21" repository="3.21" pkg_num=15
2026-01-09T01:41:06-08:00       INFO    Number of language-specific files       num=1
2026-01-09T01:41:06-08:00       INFO    [gobinary] Detecting vulnerabilities...
2026-01-09T01:41:06-08:00       INFO    Some vulnerabilities have been ignored/suppressed. Use the "--show-suppressed" flag to display them.

Report Summary

┌───────────────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│                    Target                     │   Type   │ Vulnerabilities │ Secrets │
├───────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ quay.io/solo-io/sds:1.0.1-dev (alpine 3.21.5) │  alpine  │        0        │    -    │
├───────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/local/bin/sds                             │ gobinary │        0        │    -    │
└───────────────────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

Notes for reviewers

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works

[solo-changelog-bot]

Issues linked to changelog:
#11089

[sheidkamp]

We should bump the kubectl dependency versions in the max_versions/pr_versions files in CI (and check if we should bump the node version to match), otherwise, this should be all we need.