Skip to content

Commit f66e0a8

Browse files
medyaghmedyagh
authored
Merge pull request #9330 from afbjorklund/kicbase-ubuntu
Base kicbase directly on ubuntu, without kindbase
2 parents b015cfd + 5ab4bc6 commit f66e0a8

File tree

4 files changed

+141
-22
lines changed

4 files changed

+141
-22
lines changed

‎Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -579,7 +579,7 @@ storage-provisioner-image: out/storage-provisioner-$(GOARCH) ## Build storage-pr
579579
.PHONY: kic-base-image
580580
kic-base-image: ## builds the base image used for kic.
581581
docker rmi -f $(KIC_BASE_IMAGE_GCR)-snapshot || true
582-
docker build -f ./deploy/kicbase/Dockerfile -t local/kicbase:$(KIC_VERSION)-snapshot --build-arg COMMIT_SHA=${VERSION}-$(COMMIT) --cache-from $(KIC_BASE_IMAGE_GCR) --target base ./deploy/kicbase
582+
docker build -f ./deploy/kicbase/Dockerfile -t local/kicbase:$(KIC_VERSION)-snapshot --build-arg COMMIT_SHA=${VERSION}-$(COMMIT) --cache-from $(KIC_BASE_IMAGE_GCR) ./deploy/kicbase
583583
docker tag local/kicbase:$(KIC_VERSION)-snapshot $(KIC_BASE_IMAGE_GCR)-snapshot
584584
docker tag local/kicbase:$(KIC_VERSION)-snapshot $(KIC_BASE_IMAGE_GCR)
585585
docker tag local/kicbase:$(KIC_VERSION)-snapshot $(KIC_BASE_IMAGE_HUB)

‎deploy/kicbase/10-network-security.conf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Turn on Source Address Verification in all interfaces to
2+
# prevent some spoofing attacks.
3+
net.ipv4.conf.default.rp_filter=1
4+
net.ipv4.conf.all.rp_filter=1

‎deploy/kicbase/Dockerfile

Lines changed: 97 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,125 @@
1+
# Copyright 2018 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# kind node base image
16+
#
17+
# For systemd + docker configuration used below, see the following references:
18+
# https://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/
19+
20+
# start from ubuntu 20.04, this image is reasonably small as a starting point
21+
# for a kubernetes node image, it doesn't contain much we don't need
22+
FROM ubuntu:focal-20200423
23+
24+
# copy in static files (configs, scripts)
25+
COPY 10-network-security.conf /etc/sysctl.d/10-network-security.conf
26+
COPY clean-install /usr/local/bin/clean-install
27+
COPY entrypoint /usr/local/bin/entrypoint
28+
29+
# Install dependencies, first from apt, then from release tarballs.
30+
# NOTE: we use one RUN to minimize layers.
31+
#
32+
# First we must ensure that our util scripts are executable.
33+
#
34+
# The base image already has: ssh, apt, snapd, but we need to install more packages.
35+
# Packages installed are broken down into (each on a line):
36+
# - packages needed to run services (systemd)
37+
# - packages needed for kubernetes components
38+
# - packages needed by the container runtime
39+
# - misc packages kind uses itself
40+
# After installing packages we cleanup by:
41+
# - removing unwanted systemd services
42+
# - disabling kmsg in journald (these log entries would be confusing)
43+
#
44+
# Next we ensure the /etc/kubernetes/manifests directory exists. Normally
45+
# a kubeadm debain / rpm package would ensure that this exists but we install
46+
# freshly built binaries directly when we build the node image.
47+
#
48+
# Finally we adjust tempfiles cleanup to be 1 minute after "boot" instead of 15m
49+
# This is plenty after we've done initial setup for a node, but before we are
50+
# likely to try to export logs etc.
51+
RUN echo "Ensuring scripts are executable ..." \
52+
&& chmod +x /usr/local/bin/clean-install /usr/local/bin/entrypoint \
53+
&& echo "Installing Packages ..." \
54+
&& DEBIAN_FRONTEND=noninteractive clean-install \
55+
systemd \
56+
conntrack iptables iproute2 ethtool socat util-linux mount ebtables udev kmod \
57+
libseccomp2 \
58+
bash ca-certificates curl rsync \
59+
&& find /lib/systemd/system/sysinit.target.wants/ -name "systemd-tmpfiles-setup.service" -delete \
60+
&& rm -f /lib/systemd/system/multi-user.target.wants/* \
61+
&& rm -f /etc/systemd/system/*.wants/* \
62+
&& rm -f /lib/systemd/system/local-fs.target.wants/* \
63+
&& rm -f /lib/systemd/system/sockets.target.wants/*udev* \
64+
&& rm -f /lib/systemd/system/sockets.target.wants/*initctl* \
65+
&& rm -f /lib/systemd/system/basic.target.wants/* \
66+
&& echo "ReadKMsg=no" >> /etc/systemd/journald.conf \
67+
&& ln -s "$(which systemd)" /sbin/init \
68+
&& echo "Ensuring /etc/kubernetes/manifests" \
69+
&& mkdir -p /etc/kubernetes/manifests \
70+
&& echo "Adjusting systemd-tmpfiles timer" \
71+
&& sed -i /usr/lib/systemd/system/systemd-tmpfiles-clean.timer -e 's#OnBootSec=.*#OnBootSec=1min#' \
72+
&& echo "Modifying /etc/nsswitch.conf to prefer hosts" \
73+
&& sed -i /etc/nsswitch.conf -re 's#^(hosts:\s*).*#\1dns files#'
74+
75+
# tell systemd that it is in docker (it will check for the container env)
76+
# https://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/
77+
ENV container docker
78+
# systemd exits on SIGRTMIN+3, not SIGTERM (which re-executes it)
79+
# https://bugzilla.redhat.com/show_bug.cgi?id=1201657
80+
STOPSIGNAL SIGRTMIN+3
81+
# NOTE: this is *only* for documentation, the entrypoint is overridden later
82+
ENTRYPOINT [ "/usr/local/bin/entrypoint", "/sbin/init" ]
83+
184
ARG COMMIT_SHA
2-
# using base image created by kind https://github.com/kubernetes-sigs/kind/blob/v0.8.1/images/base/Dockerfile
85+
# using base image created by kind https://github.com/kubernetes-sigs/kind/blob/2c0eee40/images/base/Dockerfile
386
# which is an ubuntu 20.04 with an entry-point that helps running systemd
487
# could be changed to any debian that can run systemd
5-
FROM kindest/base:v20200430-2c0eee40 as base
688
USER root
7-
# specify version of everything explicitly using 'apt-cache policy'
8-
RUN apt-get update && apt-get install -y --no-install-recommends \
89+
90+
# install system requirements from the regular distro repositories
91+
RUN clean-install \
992
lz4 \
1093
gnupg \
1194
sudo \
1295
docker.io \
96+
containerd \
1397
openssh-server \
1498
dnsutils \
1599
runc \
16100
# libglib2.0-0 is required for conmon, which is required for podman
17-
libglib2.0-0 \
18-
# removing kind's crictl config
19-
&& rm /etc/crictl.yaml
101+
libglib2.0-0
20102

21103
# Install cri-o/podman dependencies:
22104
RUN sh -c "echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list" && \
23105
curl -LO https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/xUbuntu_20.04/Release.key && \
24-
apt-key add - < Release.key && apt-get update && \
25-
apt-get install -y --no-install-recommends containers-common catatonit conmon containernetworking-plugins podman-plugins varlink
106+
apt-key add - < Release.key && \
107+
clean-install containers-common catatonit conmon containernetworking-plugins cri-tools podman-plugins varlink
26108

27109
# install cri-o based on https://github.com/cri-o/cri-o/commit/96b0c34b31a9fc181e46d7d8e34fb8ee6c4dc4e1#diff-04c6e90faac2675aa89e2176d2eec7d8R128
28110
RUN sh -c "echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/1.18:/1.18.3/xUbuntu_20.04/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list" && \
29111
curl -LO https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/1.18:/1.18.3/xUbuntu_20.04/Release.key && \
30-
apt-key add - < Release.key && apt-get update && \
31-
apt-get install -y --no-install-recommends cri-o=1.18.3~3
112+
apt-key add - < Release.key && \
113+
clean-install cri-o=1.18.3~3
32114

33115
# install podman
34116
RUN sh -c "echo 'deb https://dl.bintray.com/afbjorklund/podman focal main' > /etc/apt/sources.list.d/podman.list" && \
35117
curl -L https://bintray.com/user/downloadSubjectPublicKey?username=afbjorklund -o afbjorklund-public.key.asc && \
36-
apt-key add - < afbjorklund-public.key.asc && apt-get update && \
37-
apt-get install -y --no-install-recommends podman=1.9.3~1
118+
apt-key add - < afbjorklund-public.key.asc && \
119+
clean-install podman=1.9.3~1
38120

39-
RUN mkdir -p /usr/lib/cri-o-runc/sbin && cp /usr/local/sbin/runc /usr/lib/cri-o-runc/sbin/runc
121+
RUN mkdir -p /usr/lib/cri-o-runc/sbin && cp /usr/sbin/runc /usr/lib/cri-o-runc/sbin/runc
40122

41-
COPY entrypoint /usr/local/bin/entrypoint
42123
# automount service
43124
COPY automount/minikube-automount /usr/sbin/minikube-automount
44125
COPY automount/minikube-automount.service /usr/lib/systemd/system/minikube-automount.service
@@ -71,12 +152,7 @@ USER root
71152
# https://github.com/kubernetes-sigs/kind/blob/master/images/base/files/usr/local/bin/entrypoint
72153
RUN mkdir -p /kind
73154
# Deleting leftovers
74-
RUN apt-get clean -y && rm -rf \
75-
/var/cache/debconf/* \
76-
/var/lib/apt/lists/* \
77-
/var/log/* \
78-
/tmp/* \
79-
/var/tmp/* \
155+
RUN rm -rf \
80156
/usr/share/doc/* \
81157
/usr/share/man/* \
82158
/usr/share/local/* \

‎deploy/kicbase/clean-install

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/bin/sh
2+
3+
# Copyright 2017 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# A script encapsulating a common Dockerimage pattern for installing packages
18+
# and then cleaning up the unnecessary install artifacts.
19+
# e.g. clean-install iptables ebtables conntrack
20+
21+
set -o errexit
22+
23+
if [ $# = 0 ]; then
24+
echo >&2 "No packages specified"
25+
exit 1
26+
fi
27+
28+
apt-get update
29+
apt-get install -y --no-install-recommends "$@"
30+
apt-get clean -y
31+
rm -rf \
32+
/var/cache/debconf/* \
33+
/var/lib/apt/lists/* \
34+
/var/log/* \
35+
/tmp/* \
36+
/var/tmp/* \
37+
/usr/share/doc/* \
38+
/usr/share/man/* \
39+
/usr/share/local/*

0 commit comments

Comments
 (0)