[January 2024] Container image updates

[jakemulley]

🟢 - low, OK to leave for now
🟠 - medium, within the next 2 sprints/4 weeks
🔴 - urgent, within this sprint

calico-apiserver

container image	urgency	latest version for k8s 1.26	link to issue
docker.io/calico/apiserver:v3.25.0	🟢	v3.27.0	n/a

calico-system

container image	urgency	latest version for k8s 1.26	link to issue
docker.io/calico/csi:v3.25.0	🟢	v3.27.0	n/a
docker.io/calico/kube-controllers:v3.25.0	🟢	v3.27.0	n/a
docker.io/calico/node-driver-registrar:v3.25.0	🟢	v3.27.0	n/a
docker.io/calico/node:v3.25.0	🟢	v3.27.0	n/a
docker.io/calico/typha:v3.25.0	🟢	v3.27.0	n/a

cert-manager

container image	urgency	latest version for k8s 1.26	link to issue
quay.io/jetstack/cert-manager-cainjector:v1.13.1	🟢	v1.14.0	n/a
quay.io/jetstack/cert-manager-controller:v1.13.1	🟢	v1.14.0	n/a
quay.io/jetstack/cert-manager-webhook:v1.13.1	🟢	v1.14.0	n/a

concourse

container image	urgency	latest version for k8s 1.26	link to issue
concourse/concourse:7.7.0	🟠	v7.11.0	tbd

external-secrets-operator

container image	urgency	latest version for k8s 1.26	link to issue
ghcr.io/external-secrets/external-secrets:v0.8.1	🟢	v0.9.11	tbd

gatekeeper-system

container image	urgency	latest version for k8s 1.26	link to issue
openpolicyagent/gatekeeper:v3.13.0	🟢	v3.15.0	#5277

ingress-controllers

container image	urgency	latest version for k8s 1.26	link to issue
debian:bookworm-slim	🟢	latest	n/a
fluent/fluent-bit:2.1.8-amd64	🟢	v2.2.2	n/a
ministryofjustice/cloud-platform-custom-error-pages:0.6	🟠	managed by us	#5278
registry.k8s.io/ingress-nginx/controller:v1.8.4	🟢	v1.9.6	tbd

kube-system

container image	urgency	latest version for k8s 1.26	link to issue
602401143452.dkr.ecr.eu-west-2.amazonaws.com/amazon-k8s-cni:v1.15.3-eksbuild.1	🟠	v1.16.2-eksbuild.1	#5244
602401143452.dkr.ecr.eu-west-2.amazonaws.com/amazon/aws-network-policy-agent:v1.0.5-eksbuild.1	🟠	v1.0.6-eksbuild.1	#5133
602401143452.dkr.ecr.eu-west-2.amazonaws.com/eks/coredns:v1.9.3-eksbuild.11	🟢	v1.9.3-eksbuild.11	n/a
602401143452.dkr.ecr.eu-west-2.amazonaws.com/eks/kube-proxy:v1.25.15-minimal-eksbuild.2	🟢	v1.25.16	#5242
amazon/aws-efs-csi-driver:v1.4.0	🟠	v1.7.3	tbd and #4877 (comment)
docker.io/bitnami/external-dns:0.14.0-debian-12-r14	🟢	v0.14.x	tbd
public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.24.0	🟠	v1.27.0	tbd
public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.4.0-eks-1-28-6	🟢	v4.5.0	tbd
public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v2.1.1-eks-1-18-13	🟠	v4.0.0	tbd and #4877 (comment)
public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.5.0-eks-1-28-6	🟢	v4.0.0	tbd
public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.9.0-eks-1-28-6	🟢	v1.10.0	tbd
public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.10.0-eks-1-28-6	🟢	v2.12.0	tbd
public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.2.0-eks-1-18-13	🟠	v2.12.0	tbd and #4877 (comment)
public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.1.0-eks-1-18-13	🟠	v2.10.0	node-driver-registrar:v2.1.0-eks-1-18-13
public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.9.0-eks-1-28-6	🟢	v2.10.0	tbd
registry.k8s.io/autoscaling/cluster-autoscaler:v1.25.3	🔴	v1.26.6	#5279
[registry.k8s.io/descheduler/descheduler:v0.26.1]	🟢	v0.26.1	n/a
registry.k8s.io/metrics-server/metrics-server:v0.6.2	🟠	v0.7.0	n/a

kuberhealthy

container image	urgency	latest version for k8s 1.26	link to issue
754256621582.dkr.ecr.eu-west-2.amazonaws.com/webops/cloud-platform-kuberhealthy-checks:1.4	🟢	managed by us	n/a
docker.io/kuberhealthy/daemonset-check:v3.3.0	🟢	v3.3.0	n/a
docker.io/kuberhealthy/deployment-check:v1.9.0	🟢	v1.9.0	n/a
docker.io/kuberhealthy/dns-resolution-check:v1.5.0	🟢	v1.5.0	n/a
docker.io/kuberhealthy/kuberhealthy:v2.7.1	🟢	v2.7.1	n/a

kuberos

container image	urgency	latest version for k8s 1.26	link to issue
docker.io/ministryofjustice/cloud-platform-kuberos:2.6.0	🟢	managed by us	n/a

logging

container image	urgency	latest version for k8s 1.26	link to issue
docker.io/fluent/fluent-bit:2.2.1	🟢	v2.2.1	n/a
gcr.io/heptio-images/eventrouter:v0.3	🟠	deprecated	#5171

monitoring

container image	urgency	latest version for k8s 1.26	link to issue
docker.io/bitnami/redis:6.2.6-debian-10-r120	🟠	v7.2.4-debian-11-r5	n/a
docker.io/bitnami/thanos:0.28.1-scratch-r0	🟠	v0.34.0	#5281
grafana/grafana:9.2.4	🟠	v10.2.3	#5173
ministryofjustice/prometheus-ecr-exporter:0.2.0	🟢	managed by us	n/a
prom/cloudwatch-exporter:v0.15.0	🟢	v0.15.5	n/a
quay.io/kiwigrid/k8s-sidecar:1.19.2	🟠	v1.25.3	#5173
quay.io/oauth2-proxy/oauth2-proxy:v7.2.1	🟠	v7.5.1	tbd
quay.io/prometheus-operator/prometheus-config-reloader:v0.60.1	🟠	v0.70.0	#5173
quay.io/prometheus-operator/prometheus-operator:v0.60.1	🟠	v0.70.0	#5173
quay.io/prometheus/alertmanager:v0.24.0	🟠	v0.26.0	#5173
quay.io/prometheus/node-exporter:v1.3.1	🟠	v1.7.0	#5173
quay.io/prometheus/prometheus:v2.39.1	🟠	v2.48.1	#5173
quay.io/thanos/thanos:v0.28.0	🟠	v0.33.0	#5173
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.7.0	🔴	v2.9.2	#5255

overprovision

container image	urgency	latest version for k8s 1.26	link to issue
registry.k8s.io/cpa/cluster-proportional-autoscaler:1.8.6	🟢	v1.8.9	n/a
registry.k8s.io/pause:3.9	🟢	v3.9	n/a

tigera-operator

container image	urgency	latest version for k8s 1.26	link to issue
quay.io/tigera/operator:v1.29.1	🟢	v1.33.0	n/a

trivy-operator

container image	urgency	latest version for k8s 1.26	link to issue
ghcr.io/aquasecurity/trivy-operator:0.16.4	🟢	v0.18.5	tbd
ghcr.io/aquasecurity/trivy:0.47.0	🟢	v0.49.1	tbd

velero

container image	urgency	latest version for k8s 1.26	link to issue
velero/velero:v1.11.1	🔴	v1.13.0	#5280