Skip to content

Commit

Permalink
feat: Remove kubectl binary from container and apply CRDs with client-go
Browse files Browse the repository at this point in the history 
Due too multiple CVEs in the kubectl binary we remove the dependency to it.
To be able to update our CRDs we introduce a custom Go binary that uses client-go
to apply our CRDs and also from our dependencies, like NFD and SRIOV.

Additionally we remove the scale-down Helm hook as it is no longer needed.

Signed-off-by: Tobias Giese <[email protected]>
  • Loading branch information
@tobiasgiese
tobiasgiese committed Oct 31, 2024
1 parent 4639663 commit bf31d0a
Show file tree
Hide file tree
Showing 10 changed files with 702 additions and 117 deletions.
57 changes: 37 additions & 20 deletions Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,17 +15,16 @@
# Ensure the final image uses the correct platform
ARG ARCH

# Build flags
ARG LDFLAGS
ARG GCFLAGS

ARG GOLANG_IMAGE_TAG=1.23@sha256:ad5c126b5cf501a8caef751a243bb717ec204ab1aa56dc41dc11be089fafcb4f

# Build the manager binary
FROM golang:1.23@sha256:ad5c126b5cf501a8caef751a243bb717ec204ab1aa56dc41dc11be089fafcb4f AS builder
FROM golang:${GOLANG_IMAGE_TAG} AS manager-builder

WORKDIR /workspace
# Add kubectl tool
# Using the $ARCH in the name of the binary here ensures we don't get any cross-arch caching after this binary is downloaded.
ARG ARCH
# kubectl latest version can be retrieved by curl -L -s https://dl.k8s.io/release/stable.txt
ARG KUBECTL_VERSION=v1.31.1
RUN curl -L "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${ARCH}/kubectl" -o kubectl-${ARCH} && \
chmod +x ./kubectl-${ARCH}

# Copy the Go Modules manifests
COPY go.mod go.mod
Expand All @@ -38,30 +37,48 @@ RUN --mount=type=cache,target=/go/pkg/mod \
# Copy the go source
COPY ./ ./

# Build
RUN --mount=type=cache,target=/go/pkg/mod \
--mount=type=cache,target=/root/.cache/go-build \
CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} go build -ldflags="${LDFLAGS}" -gcflags="${GCFLAGS}" -o manager main.go

# Build the apply-crds binary
FROM golang:${GOLANG_IMAGE_TAG} AS apply-crds-builder

WORKDIR /workspace

# Copy the Go Modules manifests
COPY cmd/apply-crds/go.mod go.mod
COPY cmd/apply-crds/go.sum go.sum
# cache deps before building and copying source so that we don't need to re-download as much
# and so that source changes don't invalidate our downloaded layer
RUN --mount=type=cache,target=/go/pkg/mod \
go mod download -x

# Copy the go source
COPY cmd/apply-crds/ ./
COPY deployment/network-operator/ ./network-operator-chart/

# copy CRDs from helm charts
RUN mkdir crds && \
cp -r deployment/network-operator/crds /workspace/crds/network-operator/ && \
cp -r deployment/network-operator/charts/sriov-network-operator/crds /workspace/crds/sriov-network-operator/ && \
cp -r deployment/network-operator/charts/node-feature-discovery/crds /workspace/crds/node-feature-discovery/
cp -r network-operator-chart/crds /workspace/crds/network-operator/ && \
cp -r network-operator-chart/charts/sriov-network-operator/crds /workspace/crds/sriov-network-operator/ && \
cp -r network-operator-chart/charts/node-feature-discovery/crds /workspace/crds/node-feature-discovery/

# Build
ARG LDFLAGS
ARG GCFLAGS
RUN --mount=type=cache,target=/go/pkg/mod \
--mount=type=cache,target=/root/.cache/go-build \
CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} go build -ldflags="${LDFLAGS}" -gcflags="${GCFLAGS}" -o manager main.go
CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} go build -ldflags="${LDFLAGS}" -gcflags="${GCFLAGS}" -o apply-crds main.go

FROM --platform=linux/${ARCH} registry.access.redhat.com/ubi8-micro:8.10

ARG ARCH

WORKDIR /
COPY --from=builder /workspace/manager .
COPY --from=builder /workspace/kubectl-${ARCH} /usr/local/bin/kubectl
COPY --from=builder /workspace/crds /crds
COPY --from=manager-builder /workspace/manager .
COPY --from=apply-crds-builder /workspace/apply-crds .
COPY --from=apply-crds-builder /workspace/crds /crds

# Default Certificates are missing in micro-ubi. These are need to fetch DOCA drivers image tags
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
COPY --from=manager-builder /etc/ssl/certs/ca-certificates.crt /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
COPY /webhook-schemas /webhook-schemas
COPY manifests/ manifests/
USER 65532:65532
Expand Down
72 changes: 72 additions & 0 deletions cmd/apply-crds/go.mod
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,72 @@
module github.com/mellanox/network-operator/cmd/apply-crds

go 1.23.2

require (
github.com/onsi/ginkgo/v2 v2.19.0
github.com/onsi/gomega v1.33.1
k8s.io/apiextensions-apiserver v0.31.2
k8s.io/apimachinery v0.31.2
k8s.io/client-go v0.31.2
sigs.k8s.io/controller-runtime v0.19.1
)

require (
github.com/beorn7/perks v1.0.1 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
github.com/evanphx/json-patch/v5 v5.9.0 // indirect
github.com/fsnotify/fsnotify v1.7.0 // indirect
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
github.com/go-logr/logr v1.4.2 // indirect
github.com/go-logr/zapr v1.3.0 // indirect
github.com/go-openapi/jsonpointer v0.19.6 // indirect
github.com/go-openapi/jsonreference v0.20.2 // indirect
github.com/go-openapi/swag v0.22.4 // indirect
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/gnostic-models v0.6.8 // indirect
github.com/google/go-cmp v0.6.0 // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/imdario/mergo v0.3.6 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/prometheus/client_golang v1.19.1 // indirect
github.com/prometheus/client_model v0.6.1 // indirect
github.com/prometheus/common v0.55.0 // indirect
github.com/prometheus/procfs v0.15.1 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/x448/float16 v0.8.4 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.26.0 // indirect
golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc // indirect
golang.org/x/net v0.26.0 // indirect
golang.org/x/oauth2 v0.21.0 // indirect
golang.org/x/sys v0.21.0 // indirect
golang.org/x/term v0.21.0 // indirect
golang.org/x/text v0.16.0 // indirect
golang.org/x/time v0.3.0 // indirect
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/protobuf v1.34.2 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/api v0.31.2 // indirect
k8s.io/klog/v2 v2.130.1 // indirect
k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
sigs.k8s.io/yaml v1.4.0 // indirect
)
Loading

0 comments on commit bf31d0a

Please sign in to comment.