mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-22 03:11:40 +00:00
Merge pull request #82966 from danwinship/iptables-nft
update images to Debian buster, detect iptables mode
This commit is contained in:
Kubernetes Prow Robot
GitHub
commit
be4683ef9c
@ -94,8 +94,8 @@ readonly KUBE_CONTAINER_RSYNC_PORT=8730
|
||||
# $1 - server architecture
|
||||
kube::build::get_docker_wrapped_binaries() {
|
||||
local arch=$1
|
||||
local debian_base_version=v1.0.0
|
||||
local debian_iptables_version=v11.0.2
|
||||
local debian_base_version=v2.0.0
|
||||
local debian_iptables_version=v12.0.1
|
||||
### If you change any of these lists, please also update DOCKERIZED_BINARIES
|
||||
### in build/BUILD. And kube::golang::server_image_targets
|
||||
local targets=(
|
||||
|
||||
@ -41,28 +41,14 @@ RUN apt-mark hold apt gnupg adduser passwd libsemanage1 libcap2
|
||||
# Several utilities (e.g. ping) were kept for usefulness, but may be removed in later versions.
|
||||
RUN echo "Yes, do as I say!" | apt-get purge \
|
||||
bash \
|
||||
debconf-i18n \
|
||||
e2fslibs \
|
||||
e2fsprogs \
|
||||
init \
|
||||
initscripts \
|
||||
libcap2-bin \
|
||||
libkmod2 \
|
||||
libmount1 \
|
||||
libsmartcols1 \
|
||||
libudev1 \
|
||||
libblkid1 \
|
||||
libncursesw5 \
|
||||
libprocps6 \
|
||||
libslang2 \
|
||||
libss2 \
|
||||
libsystemd0 \
|
||||
libtext-charwidth-perl libtext-iconv-perl libtext-wrapi18n-perl \
|
||||
ncurses-base \
|
||||
ncurses-bin \
|
||||
systemd \
|
||||
systemd-sysv \
|
||||
sysv-rc \
|
||||
tzdata
|
||||
|
||||
# No-op stubs replace some unnecessary binaries that may be depended on in the install process (in
|
||||
|
||||
@ -18,7 +18,7 @@ REGISTRY ?= staging-k8s.gcr.io
|
||||
IMAGE ?= $(REGISTRY)/debian-base
|
||||
BUILD_IMAGE ?= debian-build
|
||||
|
||||
TAG ?= v1.0.0
|
||||
TAG ?= v2.0.0
|
||||
|
||||
TAR_FILE ?= rootfs.tar
|
||||
ARCH?=amd64
|
||||
@ -33,22 +33,22 @@ SUDO=$(if $(filter 0,$(shell id -u)),,sudo)
|
||||
export DOCKER_CLI_EXPERIMENTAL := enabled
|
||||
|
||||
ifeq ($(ARCH),amd64)
|
||||
BASEIMAGE?=debian:stretch
|
||||
BASEIMAGE?=debian:buster-slim
|
||||
endif
|
||||
ifeq ($(ARCH),arm)
|
||||
BASEIMAGE?=arm32v7/debian:stretch
|
||||
BASEIMAGE?=arm32v7/debian:buster-slim
|
||||
QEMUARCH=arm
|
||||
endif
|
||||
ifeq ($(ARCH),arm64)
|
||||
BASEIMAGE?=arm64v8/debian:stretch
|
||||
BASEIMAGE?=arm64v8/debian:buster-slim
|
||||
QEMUARCH=aarch64
|
||||
endif
|
||||
ifeq ($(ARCH),ppc64le)
|
||||
BASEIMAGE?=ppc64le/debian:stretch
|
||||
BASEIMAGE?=ppc64le/debian:buster-slim
|
||||
QEMUARCH=ppc64le
|
||||
endif
|
||||
ifeq ($(ARCH),s390x)
|
||||
BASEIMAGE?=s390x/debian:stretch
|
||||
BASEIMAGE?=s390x/debian:buster-slim
|
||||
QEMUARCH=s390x
|
||||
endif
|
||||
|
||||
|
||||
@ -14,10 +14,28 @@
|
||||
|
||||
FROM BASEIMAGE
|
||||
|
||||
# Install latest iptables package from buster-backports
|
||||
RUN echo deb http://deb.debian.org/debian buster-backports main >> /etc/apt/sources.list; \
|
||||
apt-get update; \
|
||||
apt-get -t buster-backports -y --no-install-recommends install iptables
|
||||
|
||||
# Install other dependencies and then clean up apt caches
|
||||
RUN clean-install \
|
||||
conntrack \
|
||||
ebtables \
|
||||
ipset \
|
||||
iptables \
|
||||
kmod \
|
||||
netbase
|
||||
|
||||
# Install iptables wrapper scripts to detect the correct iptables mode
|
||||
# the first time any of them is run
|
||||
COPY iptables-wrapper /usr/sbin/iptables-wrapper
|
||||
|
||||
RUN update-alternatives \
|
||||
--install /usr/sbin/iptables iptables /usr/sbin/iptables-wrapper 100 \
|
||||
--slave /usr/sbin/iptables-restore iptables-restore /usr/sbin/iptables-wrapper \
|
||||
--slave /usr/sbin/iptables-save iptables-save /usr/sbin/iptables-wrapper
|
||||
RUN update-alternatives \
|
||||
--install /usr/sbin/ip6tables ip6tables /usr/sbin/iptables-wrapper 100 \
|
||||
--slave /usr/sbin/ip6tables-restore ip6tables-restore /usr/sbin/iptables-wrapper \
|
||||
--slave /usr/sbin/ip6tables-save ip6tables-save /usr/sbin/iptables-wrapper
|
||||
|
||||
@ -16,12 +16,12 @@
|
||||
|
||||
REGISTRY?="staging-k8s.gcr.io"
|
||||
IMAGE=$(REGISTRY)/debian-iptables
|
||||
TAG?=v11.0.2
|
||||
TAG?=v12.0.1
|
||||
ARCH?=amd64
|
||||
ALL_ARCH = amd64 arm arm64 ppc64le s390x
|
||||
TEMP_DIR:=$(shell mktemp -d)
|
||||
|
||||
BASEIMAGE?=k8s.gcr.io/debian-base-$(ARCH):v1.0.0
|
||||
BASEIMAGE?=k8s.gcr.io/debian-base-$(ARCH):v2.0.0
|
||||
|
||||
# This option is for running docker manifest command
|
||||
export DOCKER_CLI_EXPERIMENTAL := enabled
|
||||
|
||||
44
build/debian-iptables/iptables-wrapper
Executable file
44
build/debian-iptables/iptables-wrapper
Executable file
@ -0,0 +1,44 @@
|
||||
#!/bin/sh
|
||||
|
||||
# Copyright 2019 The Kubernetes Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -e
|
||||
|
||||
# Detect whether the base system is using iptables-legacy or
|
||||
# iptables-nft. This assumes that some non-containerized process (eg
|
||||
# kubelet) has already created some iptables rules.
|
||||
|
||||
# Bugs in iptables-nft 1.8.3 may cause it to get stuck in a loop in
|
||||
# some circumstances, so we have to run the nft check in a timeout. To
|
||||
# avoid hitting that timeout, we only bother to even check nft if
|
||||
# legacy iptables was empty / mostly empty.
|
||||
|
||||
num_legacy_lines=$( (iptables-legacy-save || true; ip6tables-legacy-save || true) 2>/dev/null | grep '^-' | wc -l)
|
||||
if [ "${num_legacy_lines}" -ge 10 ]; then
|
||||
mode=legacy
|
||||
else
|
||||
num_nft_lines=$( (timeout 5 sh -c "iptables-nft-save; ip6tables-nft-save" || true) 2>/dev/null | grep '^-' | wc -l)
|
||||
if [ "${num_legacy_lines}" -ge "${num_nft_lines}" ]; then
|
||||
mode=legacy
|
||||
else
|
||||
mode=nft
|
||||
fi
|
||||
fi
|
||||
|
||||
update-alternatives --set iptables "/usr/sbin/iptables-${mode}" > /dev/null
|
||||
update-alternatives --set ip6tables "/usr/sbin/ip6tables-${mode}" > /dev/null
|
||||
|
||||
# Now re-exec the original command with the newly-selected alternative
|
||||
exec "$0" "$@"
|
||||
@ -73,21 +73,21 @@ def cri_tarballs():
|
||||
|
||||
# Use go get -u github.com/estesp/manifest-tool to find these values
|
||||
_DEBIAN_BASE_DIGEST = {
|
||||
"manifest": "sha256:6966a0aedd7592c18ff2dd803c08bd85780ee19f5e3a2e7cf908a4cd837afcde",
|
||||
"amd64": "sha256:8ccb65cd2dd7e0c24193d0742a20e4a673dbd11af5a33f16fcd471a31486866c",
|
||||
"arm": "sha256:3432b41de3f6dfffdc1386fce961cfd1f9f8e208b3a35070e10ef3e2a733cb17",
|
||||
"arm64": "sha256:9189251e1d1eb4126d6e6add2e272338f9c8a6a3db38863044625bca4b667f31",
|
||||
"ppc64le": "sha256:50aa659e1e75e4231ee8293c3b4115e5755bb0517142b9b4bddbc134bf4354db",
|
||||
"s390x": "sha256:bbb8ee3a2aaca738c00809f450233d98029fea4e319d8faaa30aa94c8b17a806",
|
||||
"manifest": "sha256:ebda8587ec0f49eb88ee3a608ef018484908cbc5aa32556a0d78356088c185d4",
|
||||
"amd64": "sha256:d7be39e143d4e6677a28c81c0a84868b40800fc979dea1848bb19d526668a00c",
|
||||
"arm": "sha256:fc731da13b0bc9013b85a86b583fc92e50869b5bc8e7aa6ca730ec0240954c7d",
|
||||
"arm64": "sha256:12502c3eed050fa9b6d5fe353a44bfc5f437dc325c8912b1a48dcc180df36f1e",
|
||||
"ppc64le": "sha256:4277aa59b63c5a1369e6d84a295ecc4ffa08985dcf114de9f7b6de1af4fcbc86",
|
||||
"s390x": "sha256:78ef2a6b017539379c1654b4e52ba8519bfec821c62d0b3a1dbd15104b711e21",
|
||||
}
|
||||
|
||||
_DEBIAN_IPTABLES_DIGEST = {
|
||||
"manifest": "sha256:b522b0035dba3ac2d5c0dbaaf8217bd66248e790332ccfdf653e0f943a280dcf",
|
||||
"amd64": "sha256:adc40e9ec817c15d35b26d1d6aa4d0f8096fba4c99e26a026159bb0bc98c6a89",
|
||||
"arm": "sha256:58e8a1d3b187eed2d8d3664cd1c9723e5029698714a24dfca4b6ef42ea27a9d4",
|
||||
"arm64": "sha256:1a63fdd216fe7b84561d40ab1ebaa0daae1fc73e4232a6caffbd8353d9a14cea",
|
||||
"ppc64le": "sha256:9f90adbc7513cc96d92fcec7633c4b29e766dd31cf876af03c0b54374e22fa9c",
|
||||
"s390x": "sha256:4f147708deff2a0163ee49b6980cc95423514bec5f4091612d65773b898fbdae",
|
||||
"manifest": "sha256:d1cd487e89fb4cba853cd3a948a6e9016faf66f2a7bb53cb1ac6b6c9cb58f5ed",
|
||||
"amd64": "sha256:852d3c569932059bcab3a52cb6105c432d85b4b7bbd5fc93153b78010e34a783",
|
||||
"arm": "sha256:c10f01b414a7cd4b2f3e26e152c90c64a1e781d99f83a6809764cf74ecbc46c3",
|
||||
"arm64": "sha256:5725e6fde13a6405cf800e22846ebd2bde24b0860f1dc3f6f5f256f03cfa85bd",
|
||||
"ppc64le": "sha256:b6d6e56a0c34c0393dcba0d5faaa531b92e5876114c5ab5a90e82e4889724c5a",
|
||||
"s390x": "sha256:39e67e9bf25d67fe35bd9dcb25367277e5967368e02f2741e0efd4ce8874db14",
|
||||
}
|
||||
|
||||
_DEBIAN_HYPERKUBE_BASE_DIGEST = {
|
||||
@ -113,7 +113,7 @@ def debian_image_dependencies():
|
||||
digest = _digest(_DEBIAN_BASE_DIGEST, arch),
|
||||
registry = "k8s.gcr.io",
|
||||
repository = "debian-base",
|
||||
tag = "0.4.1", # ignored, but kept here for documentation
|
||||
tag = "v2.0.0", # ignored, but kept here for documentation
|
||||
)
|
||||
|
||||
container_pull(
|
||||
@ -122,7 +122,7 @@ def debian_image_dependencies():
|
||||
digest = _digest(_DEBIAN_IPTABLES_DIGEST, arch),
|
||||
registry = "k8s.gcr.io",
|
||||
repository = "debian-iptables",
|
||||
tag = "v11.0.2", # ignored, but kept here for documentation
|
||||
tag = "v12.0.1", # ignored, but kept here for documentation
|
||||
)
|
||||
|
||||
container_pull(
|
||||
|
||||
Loading…
Reference in New Issue
Block a user