hardened-k8s-metrics-server references EOL Prometheus version, no clue where to contribute to get LTS versions back into our RKE2 clusters

[Najzer0]

Hey all, we got quite some EOL notifications in our clusters from various sec-scanners that we get Prometheus 2.5.0 into our project because of the hardened metrics server from rancher... could someone give me some pointers on where to either contribute or raise issues to get the included prometheus versions bumped?

With KR
Adrian

[brandond]

Our build of metrics-server pulls directly from upstream. Any version bumps would need to be done in the upstream project. Can you share more info on what specifically your scanner is showing?

The most recent build of hardened-k8s-metrics-server is https://github.com/rancher/image-build-k8s-metrics-server/releases/tag/v0.6.3-build20231009 which uses the following prometheus versions:
https://github.com/kubernetes-sigs/metrics-server/blob/v0.6.3/go.mod#L10-L11

v0.7.0 appears to have updated that already; that will be picked up next time we bump metrics-server.
https://github.com/kubernetes-sigs/metrics-server/blob/v0.7.0/go.mod#L9-L10

Note that these are just the standard client libs for exposing metrics, if your scanner is suggesting that there is a whole Prometheus server instance in this image, then it is giving you bad results.