I filed the fifteen criticals in k3s's bundled components as accepted, reasoning
that only a k3s upgrade could move them and that this was its own undertaking.
Then I repeated that in conversation as 'the biggest lever, a big project'
without ever checking which k3s release ships which components. It is v1.34.6 to
v1.34.10 — a patch on the minor we already run.
That patch carries traefik 3.7.8, coredns v1.14.6, metrics-server v0.9.0,
local-path v0.0.36 and helm-controller v0.16.26. Measured against what runs now:
278 high findings become 60, and all fifteen criticals go away, without touching
a single version line in our own manifests.
The risk is not k3s. It is that the same patch moves traefik's chart across a
major, and that a single node with a sqlite datastore means restarting k3s takes
the platform down with it. Both are named as decisions for sorb rather than
assumptions of mine.
Thore Cimbal
bf2d87ad40