Ability to exclude Cruise Control

[tjreardon21]

Hello -

I am attempting to exclude cruise control from being introduced to the file system during the helm install/upgrade of strimzi kafka operator as it has not been maintained in a long time and has a large number of CVEs against it (It still uses Log4J 2.17.2 compared to Kafkas 2.25.5).

I tried blocking it using a values file during the helm install to remove the reference to cruise-control and the sidecar, but I can see in the '/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/#####/fs/opt/cruise-control/' that cruise-control is still present. Is there a environment variable that could used during the helm install/upgrade to exclude the cruise-control layer/image or is the only way to build a custom image for each Strimzi version to remove cruise-control and any other parts we do not want?

Thanks!

[scholzj]

Cruise Control is moving under a new management (https://github.com/cruise-control-for-kafka/cruise-control) and hopefully will soon have some new release with CVE fixes. I think if you want to remove Cruise Control from the container images you have probably two options:

• Build Strimzi from source without it
• Use the released Strimzi container image, delete Cruise Control from there, and squash the image if you want to remove the old layers.

[tjreardon21]

Thanks, I have been waiting on cruise-control-for-kafka/cruise-control#2344 since Dec/Jan even though that would only get Log4J to 2.25.0.

[scholzj]

Yeah, hopefully it starts moving forward again soon.