Update outdated NATS images used by Argo Events EventBus

[giomke]

Summary

Argo Events currently ships older NATS-related images in the default EventBus configuration.

In the current installation manifest, the EventBus configuration includes NATS ecosystem images such as:

natsImage: nats:2.10.29
metricsExporterImage: natsio/prometheus-nats-exporter:0.14.0
configReloaderImage: natsio/nats-server-config-reloader:0.14.0

These images appear to be based on older builds and older base image layers. Some of the base image versions used by these older images may already be end-of-life or no longer actively maintained, which increases the risk of carrying known vulnerabilities and outdated dependencies.

Request

Could you please review and update the NATS-related images used by the Argo Events EventBus to currently supported upstream versions?

Specifically, please consider updating:

natsImage
metricsExporterImage
configReloaderImage

to newer supported versions that:

• are actively maintained upstream;
• use supported base images;
• are not based on end-of-life Alpine or other end-of-life base image versions;
• include newer dependency and security fixes;
• reduce the number of known vulnerabilities inherited from old image layers.

Why this matters

Users installing the latest Argo Events release inherit these NATS-related image versions by default through the EventBus configuration.

Because the EventBus is a core component for Argo Events, keeping the bundled NATS images reasonably current is important for production environments. Older images and end-of-life base layers can introduce avoidable security, compliance, and maintenance risks.

Updating these defaults would help users run Argo Events with a better security posture and reduce the need for manual post-installation patching of generated EventBus resources.

Affected component

Argo Events EventBus
NATS JetStream EventBus configuration
argo-events-controller-config ConfigMap

Example location

eventBus:
  jetstream:
    versions:
    - version: latest
      natsImage: nats:2.10.29
      metricsExporterImage: natsio/prometheus-nats-exporter:0.14.0
      configReloaderImage: natsio/nats-server-config-reloader:0.14.0
      startCommand: /nats-server
    - version: 2.10.29
      natsImage: nats:2.10.29
      metricsExporterImage: natsio/prometheus-nats-exporter:0.14.0
      configReloaderImage: natsio/nats-server-config-reloader:0.14.0
      startCommand: /nats-server

Expected outcome

Please update the default EventBus image matrix to use newer supported NATS ecosystem images.

It would also be helpful to document the supported version matrix for:

• NATS Server
• prometheus-nats-exporter
• nats-server-config-reloader

If the current versions are intentionally pinned for compatibility reasons, please document the rationale and provide guidance on the latest safe and supported versions that users can configure manually.

Additional context

The currently bundled NATS-related images are old compared to newer upstream releases.

For example, the EventBus configuration still references:

metricsExporterImage: natsio/prometheus-nats-exporter:0.14.0
configReloaderImage: natsio/nats-server-config-reloader:0.14.0

Please consider moving the defaults to supported versions with maintained base images and fewer known