update canal to v3.28.0

[samuelfischer]

What this PR does / why we need it:
Continues #3214 to update canal-cni.

Additionally fixes Critical CVEs in the older flannel image ( CVE-2023-38545, CVE-2023-26463, CVE-2023-41913 ).

Which issue(s) this PR fixes:
Fixes #3206 (the first Task, the others should be fixed by the preceding PR)

What type of PR is this?
/kind feature

Special notes for your reviewer:

Does this PR introduce a user-facing change? Then add your Release Note here:

Update canal to v3.28.0

Documentation:

Do we need a hint to https://docs.tigera.io/calico/latest/release-notes/#important-upgrade-notes and that restarts of calico controllers might be necessary after the update?
Not sure how to handle that.

NONE

[kubermatic-bot]

Hi @samuelfischer. Thanks for your PR.

I'm waiting for a kubermatic member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[kron4eg]

@samuelfischer hey and thanks for the PR.

Additionally fixes Critical CVEs in the older flannel image

What CVE are you referring to?

[samuelfischer]

@samuelfischer hey and thanks for the PR.

Additionally fixes Critical CVEs in the older flannel image

What CVE are you referring to?

Ah sorry, I missed adding the CVEs on Friday - added them to the Description now.
Two are for "strongSwan" and one for "libcurl" in the image.

Re-checking the image again today I also saw two golang stdlib CVEs in the go version of flanneld - both will also be fixed by the update (CVE-2023-24538, CVE-2023-24540).

[samuelfischer]

rebased to fix conflicts after Merge of #3214

[kron4eg]

/test all

[kron4eg]

/approve
/lgtm

[kubermatic-bot]

LGTM label has been added.

Git tree hash: 1df257d94d80021a99c95064c8ab39d16ac33504

[kubermatic-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kron4eg

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [kron4eg]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment