Fourteen critical findings and 231 high ones sit in the controllers that deploy
everything else. Measured on the target images before touching anything: all four
go to zero critical, and high drops from 231 to 48.
The manifest was generated with the flux CLI for exactly the components we run —
source, kustomize, helm and notification. The release install.yaml carries seven
deployments; dropping it in unchanged would have added image-automation,
image-reflector and source-watcher, which we do not operate. Structurally the
generated file matches what it replaces: four deployments, four service accounts,
eleven CRDs.
Flux applies this itself through the flux-system Kustomization, so it upgrades
its own controllers. The way back is a kubectl apply of the previous file
straight from git, which is why the commit before this one is named in the
message: 8114b9ec.
Thore Cimbal
fcf3169aa3