[MOSIP-43615] updated kafka image tag and zookeeper #1676
Conversation
Signed-off-by: Ivanmeneges <ivan.anil016@gmail.com>
WalkthroughThis pull request updates Helm chart image tags in the Kafka deployment configuration. The Kafka image tag is bumped from 3.2.1-debian-11-r9 to 3.6.1-debian-12-r12, and the Zookeeper image tag is updated from 3.8.0-debian-11-r30 to 3.9.1-debian-12-r13. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes
Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
deployment/v3/external/kafka/install.sh(1 hunks)
🔇 Additional comments (1)
deployment/v3/external/kafka/install.sh (1)
27-32: Good: Image tags are properly parameterized in Helm values.The use of
--setflags for image repository and tag is a clean approach that maintains flexibility for future updates. This is appropriate for a deployment script.
| helm -n $NS install kafka bitnami/kafka \ | ||
| --set image.repository="mosipid/kafka" \ | ||
| --set image.tag="3.2.1-debian-11-r9" \ | ||
| --set image.tag="3.6.1-debian-12-r12" \ |
There was a problem hiding this comment.
🧩 Analysis chain
Verify compatibility and security for Kafka and Zookeeper version bumps.
The Kafka (3.2.1→3.6.1) and Zookeeper (3.8.0→3.9.1) versions are being bumped with a concurrent Debian OS upgrade (11→12). Ensure these changes are compatible and secure before deployment.
Please verify the following:
- Version existence: Confirm that the image tags exist in the registry
- Compatibility: Verify that Kafka 3.6.1 and Zookeeper 3.9.1 are compatible with each other and with Helm chart version 18.3.1
- Security: Check for any CVEs or security advisories in these versions
- Breaking changes: Review release notes for breaking changes between the old and new versions
You can verify this by searching the official Kafka and Zookeeper release notes or checking the image availability:
Alternatively, search the web for:
and
Also applies to: 31-31
🏁 Script executed:
#!/bin/bash
# Description: Verify image availability and check release notes for breaking changes
# Check image availability (if registry is accessible)
# docker pull mosipid/kafka:3.6.1-debian-12-r12
# docker pull mosipid/zookeeper:3.9.1-debian-12-r13
# Search for Kafka release notes mentioning breaking changes
echo "Checking Kafka 3.6.1 release information..."
echo "Checking Zookeeper 3.9.1 release information..."
# Search for CVE/security advisories (if applicable)
echo "Verify no critical CVEs in these versions"Length of output: 133
🌐 Web query:
Kafka 3.6.1 breaking changes and compatibility with Zookeeper 3.9.1
💡 Result:
Short answer
- Kafka 3.6.1 is a bugfix release (no major breaking changes in the Kafka project itself); the release primarily contains fixes and dependency upgrades — notably ZooKeeper was upgraded in the Kafka 3.6.1 distribution to ZooKeeper 3.8.3. [1][2]
- Running Kafka 3.6.1 with an external ZooKeeper 3.9.1 is generally possible: the ZooKeeper project documents that ZooKeeper 3.9.x servers are compatible with ZooKeeper clients from 3.5.x onward, and 3.9.x clients are compatible with 3.5–3.8 servers (so client-server compatibility is maintained). Kafka 3.6.1 ships with ZK 3.8.3 but should interoperate with a 3.9.1 server; however, test in your environment and watch for transitive-dependency or logging-library differences introduced by ZK 3.9.1. [3][1][4]
Notes / pointers
- See Kafka 3.6.1 release notes (bugfix list and note about ZK 3.8.3). [1]
- Kafka 3.6.1 release announcement / blog. [2]
- ZooKeeper releases page: compatibility statements for 3.9.x. [3]
- Practical issues: users have reported that upgrading ZK can bring in different transient dependencies (logging, netty, etc.) that may change runtime behavior (example: logging config changes). Verify dependency tree and run integration tests. [4]
If you want, I can:
- check a specific Kafka distribution/package (Confluent, MSK, your build) for its bundled ZK and known compatibility notes, or
- run a quick dependency diff (pom/gradle) between Kafka's bundled ZK and 3.9.1 to show possible transitive changes.
🌐 Web query:
Zookeeper 3.9.1 Debian 12 security vulnerabilities
💡 Result:
Short answer: Yes — Zookeeper 3.9.1 is mixed: it fixes the SASL quorum auth bypass (CVE-2023-44981) but is known to be vulnerable to at least one later issue (information-disclosure in persistent watchers, CVE-2024-23944) that affects 3.9.0–3.9.1 and was fixed in later releases. Debian 12 (bookworm) ships zookeeper as 3.8.x with Debian security fixes applied; Debian’s trackers list which CVEs are fixed or still relevant for each release. [1][2][3]
Details and recommended actions
- CVE-2023-44981 (authorization bypass in SASL quorum peer auth): fixed by upstream in 3.9.1 and backported in Debian packages — upgrade zookeeper if you are on an affected older release or ensure quorum traffic is firewall‑protected if you cannot upgrade. [1][3]
- CVE-2024-23944 (missing ACL check → persistent-watcher info disclosure): affects 3.9.0–3.9.1 (and some 3.8.x); fixed upstream in 3.9.2/3.8.4 and in Debian package updates — do not run unpatched 3.9.1 in production if you rely on persistent watchers. [2][3]
- Debian bookworm package status: Debian’s zookeeper package for bookworm is 3.8.0-11+deb12u2 (with security fixes). If you installed upstream 3.9.1 manually on Debian 12, you should treat it as vulnerable to the watcher ACL issue and upgrade to an upstream version that contains the fixes (or use the patched Debian package). [3]
References
- Debian security tracker — CVE-2023-44981. [1]
- Debian security tracker — CVE-2024-23944. [2]
- Debian zookeeper package tracker / available versions and security notes. [3]
If you want, I can: (a) check whether your installed zookeeper package on Debian 12 is the Debian-provided 3.8.x or a manually installed 3.9.1, and give exact upgrade/mitigation steps.
Upgrade ZooKeeper to 3.9.2+ to fix CVE-2024-23944 vulnerability in 3.9.1.
ZooKeeper 3.9.1 is vulnerable to CVE-2024-23944 (a persistent-watcher information-disclosure issue), which was fixed in 3.9.2. Update line 31 to use 3.9.2-debian-12-r* or later.
Additionally, Kafka 3.6.1 with external ZooKeeper 3.9.1 is generally compatible, but users have reported transitive dependency and logging-library differences. Test the upgrade in a staging environment to verify no behavioral changes.
🤖 Prompt for AI Agents
In deployment/v3/external/kafka/install.sh around lines 29-31, the manifest pins
ZooKeeper to 3.9.1 which is vulnerable to CVE-2024-23944; change the ZooKeeper
image tag to 3.9.2-debian-12-r* (or later) by updating the version string to
3.9.2-debian-12-rX, rebuild/redeploy the chart, and run validation in a staging
environment to confirm compatibility with Kafka 3.6.1 (check transitive
dependencies and logging behavior).
1 participant
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.