Chaos Mesh
v2.8.2ObservabilityChaos Mesh v2.8.2 is a security-focused patch that resolves CVEs across Go and UI dependencies, drops install.sh, and fixes cert-manager webhook conflicts.
securityUpgrade now — this release exists specifically to fix CVEs
Both Go and UI packages were upgraded in bulk to address vulnerabilities tracked in issue #4830. No specific CVE IDs are listed in the release notes, but the scope (all direct dependencies) suggests broad exposure. If you're running v2.8.1 or earlier, treat this as an urgent upgrade, especially for clusters where Chaos Mesh's dashboard is internet-accessible or exposed internally to untrusted users.
breakingStop using install.sh — it's been deleted, not just deprecated
install.sh is physically removed in this release. Any CI/CD pipelines, runbooks, or onboarding docs that reference it will break immediately. Migrate to the Helm chart or the official quick-start guide before upgrading. Check your automation scripts and internal documentation now.
enhancementFix cert-manager server-side apply conflicts before they hit you in prod
If you use cert-manager to manage Chaos Mesh's webhook certificates, the caBundle placeholder in webhook templates was causing server-side apply (SSA) field ownership conflicts — a subtle issue that silently breaks reconciliation. After upgrading to v2.8.2, re-apply your Helm release or manifests to let SSA recalculate field ownership cleanly. If you've been seeing unexpected webhook certificate errors or Helm diff noise, this is likely the cause.
主な変更 (5)
- All direct Go and UI dependencies upgraded to remediate known CVEs
- install.sh removed — deprecated installer is gone, Helm/kubectl is now the only supported path
- Go runtime bumped to 1.25.8
- go-ethereum JSON-RPC replaced with creachadair/jrpc2 to eliminate a vulnerable transitive dependency
- Fixed cert-manager + server-side apply conflict caused by caBundle placeholder in webhook templates