Image metadata Creation field is always 0001-01-01T00:00:00Z

[decayofmind]

What happened:

The Created field in the image metadata is incorrectly set to 0001-01-01T00:00:00Z, not the actual creation timestamp.

Due to this, various container security solutions are flagging even the latest external-dns images as outdated. This situation makes it impossible to accurately track and prioritise dependency upgrades.

What you expected to happen:

The Created field in the image metadata to represent actual image creation timestamp.

How to reproduce it (as minimally and precisely as possible):

skopeo inspect --override-arch amd64 --override-os linux docker://registry.k8s.io/external-dns/external-dns:v0.20.0| jq -r '.Created'

Anything else we need to know?:

Environment:

• External-DNS version (use external-dns --version): all
• DNS provider: all
• Others:

[ivankatliarchuk]

It’s not a bug but a feature ;-). Explanation https://github.com/ko-build/ko/blob/6508cef7686342563c295b675ca01969541a5328/docs/advanced/faq.md?plain=1#L16

That said, if security is a priority, it’s best not to rely on the image as-is. Build your own image, maintain an SBOM, sign it, and apply zero-trust principles.

For the fix, you could sumbit a fix, but worth to ask in kubernetes slack channel first most likely.

1. https://github.com/ko-build/ko/blob/6508cef7686342563c295b675ca01969541a5328/docs/advanced/faq.md?plain=1#L16

2. external-dns/Makefile

   Line 111 in 098b9e4

   build.push/multiarch: ko