But I agree that controllers aren’t the most ideal place to solve this. In an ideal world, it’d be part of hydration process like kpt/kustomize, like github.com/google/k8s-digest…
Today, we're open sourcing a log4j JAR scanner. Throw it at a filesystem, detect vulnerable JARs, and even rewrite them in place.
Includes a Go API to import the JAR parsing for other applications.
github.com/google/log4jscann…
Aa far as I know, google/ko is undervalued or not well-known. This is pretty much useful tool for Go developers. Especially, in combination with Cloud Run, this is pretty neat!
github.com/google/ko
Do you want a blazing fast dev loop for your Go apps that you deploy to Kubernetes?
Want to ditch your Dockerfile and get best practices slim, secure Go images?
Check out Skaffold's new support for ko.
Amazing work by @halvard and the @skaffolddev team!