chore(api): bump the default runner image to v19.2.2 - #73
Merged
Conversation
Upstream released v19.2.2 on 2026-08-13. It carries fixes for CVE-2026-34986 (go-jose), CVE-2026-33186 (grpc in runner_wrapper) and several golang.org/x/net CVEs, which is the main reason to take it. Two consequences land on every user who does not set spec.image. The helper image moves too. The runner derives the helper tag from its own version, so build pods now pull gitlab-runner-helper:<arch>-v19.2.2. Anyone mirroring registries, running air-gapped, or allowlisting helper tags in admission must mirror the new tag or pin helper_image; the symptom otherwise is ImagePullBackOff on the helper container while the runner pod itself reports Ready. Kubernetes config and secret-resolution failures are reclassified. Paths in the executor's Prepare() that previously returned bare errors now return ConfigurationError, and secret failures map to ConfigurationError or RunnerExternalDependencyFailure where upstream reported RunnerSystemFailure before. A job with `retry: when: [runner_system_failure]` stops retrying those. Reviewed for CRD impact and found none needed. No key was added to or removed from the Kubernetes executor subtree between v19.1.0 and v19.2.2, and the exposure gap is unchanged: 13 autoscaler pairs deliberately unexposed, one stale key, all fourteen already suppressed. Upstream did add 23 (struct, key) pairs outside that subtree, under experimental.boot_verify and experimental.usage_logger. The release watcher cannot see those because it walks only structs reachable from a Kubernetes* root, so they were checked by hand: every one is opt-in and none changes a default. v19.2.0 also added a /health/ready endpoint. Not adopting it as the readiness probe: it is gated on boot-verify, which is opt-in and never enabled by this operator, so it returns 200 as soon as the listener binds and carries no more information than the current TCP check on 9090. The stale comment in gitlab_types.go described a two-step sync against the old pin. Reworded to name the version the field set corresponds to, and trimmed to the comment budget by pointing at runner-release-watch.suppress, which already carries the autoscaler rationale verbatim. Refs: #61 Signed-off-by: Alexander Chernov <alexander@chernov.it>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe default GitLab Runner image now uses version v19.2.2. The ChangesRunner version synchronization
Estimated code review effort: 1 (Trivial) | ~3 minutes Merge Risk: ⚪ Minimal · up to The default runner image moves to v19.2.2, which also updates the derived helper-image tag and related failure reporting; the supplied checks pass and no actionable merge-blocking risk remains. Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps
DefaultRunnerImageto gitlab-runner v19.2.2, released 2026-08-13. The direct reason to take it is security content: CVE-2026-34986 (go-jose), CVE-2026-33186 (grpc in runner_wrapper) and several golang.org/x/net CVEs.Two consequences reach every user who does not set
spec.image. The helper image moves with the runner, since the runner derives the helper tag from its own version, so build pods now pullgitlab-runner-helper:<arch>-v19.2.2; mirrored or air-gapped registries need the new tag or a pinnedhelper_image, and the symptom otherwise is ImagePullBackOff on the helper container while the runner pod reports Ready. And Kubernetes config plus secret-resolution failures now reportconfiguration_errorwhere upstream reportedrunner_system_failure, soretry: when: [runner_system_failure]stops retrying those. Both are in the commit body, which is the release note.No CRD change needed: nothing was added to or removed from the Kubernetes executor subtree between v19.1.0 and v19.2.2. Upstream did add 23 (struct, key) pairs outside it under
experimental.boot_verifyandexperimental.usage_logger, which the release watcher cannot see because it walks onlyKubernetes*roots; checked by hand, all opt-in, none changes a default. The new/health/readyendpoint is not adopted as the probe, because boot-verify is opt-in and never enabled here, so it returns 200 as soon as the listener binds.Verified:
make test,make lintandhack/runner-release-watch_test.shall matchmain,make manifestsis a no-op, and the watcher flips from "already tracked in #61" to "up to date", proving its parse regex still matches. e2e exercises the new image directly, since no spec in it sets an image.Refs: #61
Summary by CodeRabbit
New Features
Documentation