fix: Update Dockerfiles to enhance security and package versions

.github/workflows/bump-test-workflows-version.yaml

@@ -22,7 +22,7 @@ jobs:
           with:
             ref: main
             persist-credentials: true
-            token: ${{ secrets.GH_ACCESS_TOKEN }}
+            token: ${{ github.token }}
         - name: Update version
           env:
             GH_TOKEN: ${{ github.token }}

.github/workflows/cleanup-old-docker-container.yaml

@@ -64,4 +64,4 @@ jobs:
           dry-run: ${{ env.DRY_RUN }}
           debug: ${{ env.DEBUG }}
         env:
-          PACKAGE_TOKEN: ${{ secrets.GH_RWD_PACKAGE_TOKEN }}
+          PACKAGE_TOKEN: ${{ github.token }}

curator/docker/backup-docker/Dockerfile

@@ -1,4 +1,4 @@
 FROM --platform=$BUILDPLATFORM golang:1.26.3-alpine3.23 as builder
 ARG BUILDPLATFORM
 ARG TARGETOS
 ARG TARGETARCH
@@ -16,7 +16,7 @@
 COPY curator/docker/backup-docker/indices_migration_tool/main.go main.go
 RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} GO111MODULE=on go build -a -o migration_tool main.go
 
-FROM ghcr.io/netcracker/qubership-backup-daemon-go:main
+FROM ghcr.io/netcracker/qubership-backup-daemon-go:0.1.14
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -29,7 +29,7 @@
 COPY curator/docker/backup-docker/config/curator.yml ${ELASTICSEARCH_CURATOR_HOME}/config/curator.yml
 COPY curator/docker/backup-docker/actions ${ELASTICSEARCH_CURATOR_HOME}/actions
 COPY curator/docker/backup-docker/docker-entrypoint.sh /docker-entrypoint.sh
 COPY --from=builder --chown=${USER_UID} /workspace/curator/docker/backup-docker/indices_migration_tool/migration_tool ${ELASTICSEARCH_CURATOR_HOME}
 
 RUN apk add --no-cache wget python3 python3-dev py3-pip \
     && apk update \
@@ -76,7 +76,7 @@
 RUN echo "https://dl-cdn.alpinelinux.org/alpine/edge/main" > /etc/apk/repositories  \
     && echo "https://dl-cdn.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories \
     && apk add --update --upgrade --no-cache \
-        pcre2 libcurl curl
+        pcre2 libcurl curl py3-setuptools py3-setuptools-pyc musl-utils
 
 USER 1000:0
 

curator/opensearch_indices_cleaner/docker/Dockerfile

@@ -10,14 +10,20 @@ COPY scripts/indices_cleaner_tests.py ${ELASTICSEARCH_INDICES_CLEANER_HOME}/indi
 # Return back 5.8.1 version for 'elasticsearch-curator' in requirements when 'botocore' version is compatible with 5.8.1 version of 'elasticsearch-curator'
 RUN set -x \
     && apk add --upgrade --no-cache build-base apk-tools \
-    && pip3 install --upgrade pip setuptools \
+    && pip3 install --upgrade pip setuptools==80.10.2 jaraco.context==6.1.0 \
     && pip3 install -r ${ELASTICSEARCH_INDICES_CLEANER_HOME}/requirements.txt \
     && pip3 install --upgrade urllib3 \
     && rm -rf /var/cache/apk/*
 
 # Upgrade all tools to avoid vulnerabilities
 RUN set -x && apk upgrade --no-cache --available
 
+# Upgrade tools from edge to avoid vulnerabilities
+RUN echo "https://dl-cdn.alpinelinux.org/alpine/edge/main" > /etc/apk/repositories  \
+    && echo "https://dl-cdn.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories \
+    && apk add --update --upgrade --no-cache \
+        libcrypto3 libssl3 binutils zlib
+
 RUN set -x \
     && python3 -m unittest discover -s ${ELASTICSEARCH_INDICES_CLEANER_HOME} -p "*_tests.py"
 

integration-tests/docker/Dockerfile

@@ -17,14 +17,15 @@ COPY robot ${ROBOT_HOME}
 RUN chmod -R 775 ${ROBOT_HOME}/tests/opensearch/ha/test-data-resources/*
 
 RUN set -x \
+    && pip install --no-cache-dir --upgrade pip==26.0 \
     && pip3 install -r ${ROBOT_HOME}/requirements.txt \
     && apk add --no-cache curl \
     && rm -rf /var/cache/apk/*
 
 RUN echo "https://dl-cdn.alpinelinux.org/alpine/edge/main" > /etc/apk/repositories \
     && echo "https://dl-cdn.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories \
     && apk add --update --upgrade --no-cache \
-        libcurl curl
+        libcurl curl libcrypto3 musl-dev musl-utils musl libssl3 libuuid binutils vim xxd vim-common
 
 RUN set -x && apk add --update --no-cache apk-tools && apk upgrade --no-cache --available
 

integration-tests/docker/requirements.txt

@@ -1,3 +1,6 @@
 robotframework-requests==0.9.7
 python-dateutil==2.9.0
 jsonpath==0.82.2
+urllib3==2.6.3
+cryptography==46.0.7
+requests==2.32.0

monitoring/docker/Dockerfile

@@ -19,6 +19,14 @@ RUN set -x \
 # Upgrade all tools to avoid vulnerabilities
 RUN set -x && apk upgrade --no-cache --available
 
+# Upgrade tools from edge to avoid vulnerabilities
+RUN echo "https://dl-cdn.alpinelinux.org/alpine/edge/main" > /etc/apk/repositories  \
+    && echo "https://dl-cdn.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories \
+    && apk add --update --upgrade --no-cache \
+        net-snmp-tools net-snmp-libs net-snmp-agent-libs musl musl-utils libcrypto3 libssl3 \
+        setpriv libcap-utils libcap2 libcap-getcap libcap libexpat zlib iputils-arping iputils-clockdiff \
+        iputils iputils-ping iputils-tracepath openssl
+
 RUN rm /usr/lib/python3.12/EXTERNALLY-MANAGED
 
 # Install misc tools

monitoring/docker/config/requirements.txt

@@ -1,2 +1,2 @@
 requests==2.33.1
-kubernetes==21.7.0
+kubernetes==21.7.0

operator/Dockerfile

@@ -1,6 +1,6 @@
 # Build the manager binary
 # Note: this uses host platform for the build, and we ask go build to target the needed platform, so we do not spend time on qemu emulation when running "go build"
 FROM --platform=$BUILDPLATFORM golang:1.26.3-alpine3.23 as builder
 ARG BUILDPLATFORM
 ARG TARGETOS
 ARG TARGETARCH
@@ -47,7 +47,7 @@
 RUN echo "https://dl-cdn.alpinelinux.org/alpine/edge/main" > /etc/apk/repositories  \
     && echo "https://dl-cdn.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories \
     && apk add --update --upgrade --no-cache \
-        pcre2 libcurl curl
+        pcre2 libcurl curl musl musl-utils libcrypto3 libssl3 zlib openssl
 
 RUN addgroup ${GROUP_NAME} && adduser -D -G ${GROUP_NAME} -u ${USER_UID} ${USER_NAME}
 USER ${USER_UID}

tls-init/docker/Dockerfile

@@ -23,7 +23,7 @@ RUN set -x \
 RUN echo "https://dl-cdn.alpinelinux.org/alpine/edge/main" > /etc/apk/repositories  \
     && echo "https://dl-cdn.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories \
     && apk add --update --upgrade --no-cache \
-        libcurl curl
+        libcurl curl musl musl-utils libcrypto3 libssl3 zlib openssl musl-dev
 
 WORKDIR ${OPENSEARCH_TLS_INIT_HOME}