Can stale container images be safely updated?

[zestysoft]

I ran into an issue recently where the default size of the pvc wasn't large enough for Prometheus. After resizing the pvc and restarting the relevant pod, I found that it would still error our while starting. It turned out to be a bug that was fixed over a year ago:
prometheus/prometheus#8061

Looking at some of the other images this project uses, it seems there are a number of containers that are also stale:

• prom/node-exporter:v0.18.1 -> v1.3.1
• grafana/grafana:7.0.3 -> 8.3.2
• directxman12/k8s-prometheus-adapter:v0.7.0 -> v0.8.4
• prom/alertmanager:v0.21.0 -> v0.23.0

There are many security vulnerabilities with Grafana 7.0.3 for instance, some labeled critical.

In addition, there are two other containers that don't seem to have a current version tied to the "latest" tag:

• carlosedp/configmap-reloaded has version tags that are 3 years old, but 'latest' is 2?
• carlosedp/arm_exporter has no version tags

This results in downloading the images each time the pod restarts instead of using on-disk cache. It's also not a security "good practice" since we have no tag we can use immutably.

It's easy enough to fix the first list myself, and provide a PR here if that's welcome/wanted, but I'd need to maintain my own version of the containers in the second list if I wanted to set fixed tags.

Thoughts? Are there breaking changes in that first list preventing upgrading?

[carlosedp]

I'd accept a PR bumping the images but they must be tested first to make sure everything runs correctly.

[badnetmask]

I found this discussion because I also wanted to know if the k8s-prometheus-adapter could be updated. At the same time I see a good point in upgrading Grafana.
The issue I have been facing is that my logs were being spammed by the message below, which was fixed by forcing update the k8s-prometheus-adapter to 0.8.2, so I would like to see this updated as well.
Were there any movements in this regard?
This is the message I was having (for reference, in case someone searches for it as well):

k3s[46545]: E0820 11:20:27.906614   46545 controller.go:116] loading OpenAPI spec for "v1beta1.metrics.k8s.io" failed with: OpenAPI spec does not exist
k3s[46545]: I0820 11:20:27.906755   46545 controller.go:129] OpenAPI AggregationController: action for item v1beta1.metrics.k8s.io: Rate Limited Requeue.