Repository navigation
Controller image still trusts the compromised eMudhra root #36
Description
The vpc-controller and fabric-identity-controller image still trusts emSign ECC Root CA - G3, the eMudhra root whose intermediate CA keys anyone can recover. A forged certificate for any host would pass on the controllers' outbound TLS calls. The image runs on gcr.io/distroless/static-debian12, whose CA list still carries the root (150 certs on 21 October). Moving to gcr.io/distroless/static-debian13, whose list dropped it (148 certs), closes this here, as it did for network-services-operator v0.32.33.
The scratch revert in #35 put the image back on Debian 12, so this regressed on 21 October.
Success looks like
- A release whose image CA list does not include emSign ECC Root CA - G3
- Staging and production run that release
Related to datum-cloud/infra#7423
Activity
ecv commentedon Oct 21, 2026
Closed. #37 moves the image to distroless static Debian 13, whose CA list has no emSign ECC Root CA - G3. No cluster runs this image: infra v0.84.84 retired the cloud controllers (datum-cloud/infra#7275), and kube_pod_container_info in production and staging VictoriaMetrics shows no ghcr.io/datum-cloud/cloud pod (2026-10-21 23:59Z). The next release carries the fix if the controllers come back. Related to datum-cloud/infra#7423.