When a vulnerability patch is released for a running container in Google Kubernetes Engine (GKE), the recommended approach is to update the application code or apply the patch directly to the codebase. Then, a new container image should be built incorporating these changes. After building the new image, it should be deployed to replace the running containers. This method ensures that the containers run the updated, secure code.
Steps:
* Update Application Code: Modify the application code or dependencies to incorporate the vulnerability patch.
* Build New Image: Use a tool like Docker to build a new container image with the updated code.
* Push New Image: Push the new container image to the Container Registry.
* Update Deployments: Update the Kubernetes deployment to use the new image. This can be done by modifying the image tag in the deployment YAML file.
* Redeploy Containers: Apply the updated deployment configuration using kubectl apply -f < deployment-file>.yaml, which will redeploy the containers with the new image.
References:
* Google Cloud: Container security
* Kubernetes: Updating an application