Skip to content

Commit 48b7c0f

Browse files
sheylatrudosheylatrudo
committed
Use Signed Binaries for Docker Build
1 parent 69251e4 commit 48b7c0f

File tree

11 files changed

+503
-276
lines changed

11 files changed

+503
-276
lines changed

‎.pipelines/build/dockerfiles/azure-ipam.Dockerfile‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
ARG ARTIFACT_DIR
2+
3+
FROM scratch AS linux
4+
COPY ${ARTIFACT_DIR}/bins/dropgz dropgz
5+
ENTRYPOINT [ "/dropgz" ]
6+
7+
8+
# skopeo inspect docker://mcr.microsoft.com/oss/kubernetes/windows-host-process-containers-base-image:v1.0.0 --format "{{.Name}}@{{.Digest}}"
9+
FROM mcr.microsoft.com/oss/kubernetes/windows-host-process-containers-base-image@sha256:b4c9637e032f667c52d1eccfa31ad8c63f1b035e8639f3f48a510536bf34032b as windows
10+
COPY ${ARTIFACT_DIR}/bins/dropgz dropgz.exe
11+
ENTRYPOINT [ "/dropgz.exe" ]

‎.pipelines/build/dockerfiles/cni.Dockerfile‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
ARG ARCH
2+
ARG ARTIFACT_DIR
3+
4+
FROM scratch AS linux
5+
ADD ${ARTIFACT_DIR}/bins/dropgz dropgz
6+
ENTRYPOINT [ "/dropgz" ]
7+
8+
9+
# mcr.microsoft.com/oss/kubernetes/windows-host-process-containers-base-image:v1.0.0
10+
FROM --platform=windows/${ARCH} mcr.microsoft.com/oss/kubernetes/windows-host-process-containers-base-image@sha256:b4c9637e032f667c52d1eccfa31ad8c63f1b035e8639f3f48a510536bf34032b as hpc
11+
12+
FROM hpc as windows
13+
ADD ${ARTIFACT_DIR}/bins/dropgz dropgz.exe
14+
ENTRYPOINT [ "/dropgz.exe" ]
15+
16+

‎.pipelines/build/dockerfiles/cns.Dockerfile‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
ARG ARCH
2+
ARG ARCHIVE_DIR
3+
4+
# mcr.microsoft.com/cbl-mariner/base/core:2.0
5+
FROM mcr.microsoft.com/cbl-mariner/base/core@sha256:961bfedbbbdc0da51bc664f51d959da292eced1ad46c3bf674aba43b9be8c703 AS iptables
6+
RUN tdnf install -y iptables
7+
8+
# mcr.microsoft.com/cbl-mariner/distroless/minimal:2.0
9+
FROM mcr.microsoft.com/cbl-mariner/distroless/minimal@sha256:7778a86d86947d5f64c1280a7ee0cf36c6c6d76b5749dd782fbcc14f113961bf AS linux
10+
COPY --from=iptables /usr/sbin/*tables* /usr/sbin/
11+
COPY --from=iptables /usr/lib /usr/lib
12+
COPY ${ARCHIVE_DIR}/bins/azure-cns /usr/local/bin/azure-cns
13+
ENTRYPOINT [ "/usr/local/bin/azure-cns" ]
14+
EXPOSE 10090
15+
16+
17+
# mcr.microsoft.com/oss/kubernetes/windows-host-process-containers-base-image:v1.0.0
18+
FROM --platform=windows/${ARCH} mcr.microsoft.com/oss/kubernetes/windows-host-process-containers-base-image@sha256:b4c9637e032f667c52d1eccfa31ad8c63f1b035e8639f3f48a510536bf34032b AS windows
19+
COPY ${ARCHIVE_DIR}/files/kubeconfigtemplate.yaml kubeconfigtemplate.yaml
20+
COPY ${ARCHIVE_DIR}/files/setkubeconfigpath.ps1 setkubeconfigpath.ps1
21+
COPY ${ARCHIVE_DIR}/bins/azure-cns /azure-cns.exe
22+
ENTRYPOINT ["azure-cns.exe"]
23+
EXPOSE 10090

‎.pipelines/build/dockerfiles/ipv6-hp-bpf.Dockerfile‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
ARG ARCHIVE_DIR
2+
3+
FROM mcr.microsoft.com/cbl-mariner/distroless/minimal:2.0 AS linux
4+
COPY ${ARCHIVE_DIR}/lib/* /lib
5+
COPY ${ARCHIVE_DIR}/bins/ipv6-hp-bpf /ipv6-hp-bpf
6+
COPY ${ARCHIVE_DIR}/bins/nft /usr/sbin/nft
7+
COPY ${ARCHIVE_DIR}/bins/ip /sbin/ip
8+
CMD ["/ipv6-hp-bpf"]

‎.pipelines/build/dockerfiles/npm.Dockerfile‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
FROM mcr.microsoft.com/mirror/docker/library/ubuntu:20.04 as linux
2+
3+
RUN apt-get update && \
4+
apt-get install -y libc-bin=2.31-0ubuntu9.17 libc6=2.31-0ubuntu9.17 libtasn1-6=4.16.0-2ubuntu0.1 libgnutls30=3.6.13-2ubuntu1.12 iptables ipset ca-certificates && \
5+
apt-get autoremove -y && \
6+
apt-get clean
7+
8+
RUN chmod +x /usr/bin/azure-npm
9+
ENTRYPOINT ["/usr/bin/azure-npm", "start"]
10+
11+
12+
# intermediate for win-ltsc2022
13+
FROM mcr.microsoft.com/windows/servercore@sha256:45952938708fbde6ec0b5b94de68bcdec3f8c838be018536b1e9e5bd95e6b943 as windows
14+
15+
COPY ${ARTIFACT_DIR}/files/kubeconfigtemplate.yaml kubeconfigtemplate.yaml
16+
COPY ${ARTIFACT_DIR}/files/setkubeconfigpath.ps1 setkubeconfigpath.ps1
17+
COPY ${ARTIFACT_DIR}/files/setkubeconfigpath-capz.ps1 setkubeconfigpath-capz.ps1
18+
COPY ${ARTIFACT_DIR}/bins/azure-npm.exe npm.exe
19+
20+
CMD ["npm.exe", "start" "--kubeconfig=.\\kubeconfig"]

‎.pipelines/build/images.jobs.yaml‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
parameters:
2+
- name: images
3+
type: jobList
4+
5+
6+
jobs:
7+
- ${{ each job_data in parameters.images }}:
8+
- job: pkg_${{ job_data.job }}
9+
displayName: "Build Image Package - ${{ job_data.displayName }} -"
10+
strategy: ${{ job_data.strategy }}
11+
pool:
12+
type: linux
13+
${{ if eq(job_data.job, 'linux_arm64') }}:
14+
hostArchitecture: arm64
15+
16+
variables:
17+
ob_outputDirectory: $(Build.ArtifactStagingDirectory)
18+
ob_artifactSuffix: _$(artifact)
19+
ob_git_checkout: false
20+
${{ if eq(job_data.job, 'linux_amd64') }}:
21+
LinuxContainerImage: 'onebranch.azurecr.io/linux/ubuntu-2204:latest'
22+
ARCH: amd64
23+
GOARCH: amd64
24+
OS: linux
25+
GOOS: linux
26+
${{ elseif eq(job_data.job, 'windows_amd64') }}:
27+
LinuxContainerImage: 'onebranch.azurecr.io/linux/ubuntu-2204:latest'
28+
ARCH: amd64
29+
GOARCH: amd64
30+
OS: windows
31+
GOOS: windows
32+
${{ elseif eq(job_data.job, 'linux_arm64') }}:
33+
ob_enable_qemu: true
34+
ARCH: arm64
35+
GOARCH: arm64
36+
OS: linux
37+
GOOS: linux
38+
# keep these variables concerned with instrumentation.
39+
ob_outputDirectory: $(Build.ArtifactStagingDirectory)
40+
GEN_DIR: $(Build.SourcesDirectory)/temp
41+
REPO_ROOT: $(Build.SourcesDirectory)/${{ job_data.templateContext.repositoryArtifact }}
42+
OUT_DIR: $(Build.ArtifactStagingDirectory)
43+
steps:
44+
- task: DownloadPipelineArtifact@2
45+
inputs:
46+
targetPath: $(REPO_ROOT)
47+
artifact: '${{ job_data.templateContext.repositoryArtifact }}'
48+
49+
- task: ShellScript@2
50+
inputs:
51+
scriptPath: ${{ job_data.templateContext.buildScript }}
52+
53+
- task: ExtractFiles@1
54+
inputs:
55+
archiveFilePatterns: '**/*.?(tgz|tgz.gz|zip)'
56+
destinationFolder: $(OUT_DIR)
57+
cleanDestinationFolder: false
58+
overwriteExistingFiles: true
59+
60+
- shell: |
61+
cp "$SOURCE" "$DEST"
62+
env:
63+
SOURCE: $(REPO_ROOT)/${{ job_data.templateContext.obDockerfile }}
64+
DEST: $(OUT_DIR)/Dockerfile
65+
66+
- task: onebranch.pipeline.signing@1
67+
inputs:
68+
command: 'sign'
69+
signing_profile: 'external_distribution'
70+
files_to_sign: '**/*'
71+
search_root: $(OUT_DIR)
72+
73+
74+
- job: images_${{ job_data.job }}
75+
displayName: "Build Images - ${{ job_data.displayName }} -"
76+
dependsOn:
77+
- pkg_${{ job_data.job }}
78+
strategy: ${{ job_data.strategy }}
79+
pool:
80+
os: linux
81+
type: docker
82+
${{ if eq(job_data.job, 'linux_arm64') }}:
83+
hostArchitecture: arm64
84+
LinuxHostVersion:
85+
distribution: mariner
86+
architecture: arm64
87+
variables:
88+
ob_outputDirectory: $(Build.SourcesDirectory)/out/images/$(os)_$(arch)
89+
ob_artifactSuffix: _$(name)
90+
ob_git_checkout: false
91+
${{ if eq(job_data.job, 'linux_amd64') }}:
92+
LinuxContainerImage: 'onebranch.azurecr.io/linux/ubuntu-2204:latest'
93+
ARCH: amd64
94+
OS: linux
95+
${{ elseif eq(job_data.job, 'windows_amd64') }}:
96+
ob_enable_qemu: true
97+
ARCH: amd64
98+
OS: windows
99+
${{ elseif eq(job_data.job, 'linux_arm64') }}:
100+
ob_build_container: true
101+
ARCH: arm64
102+
OS: linux
103+
104+
steps:
105+
- template: build/image.steps.yaml
106+
parameters:
107+
arch: $(ARCH)
108+
os: $(OS)
109+
name: $(name)
110+
dockerfile_path: ${{ job_data.templateContext.pkgArtifact }}
111+
build_tag: $(imageTag)
112+
extra_args: $(extraArgs)
113+
archive_file: $(archiveName)-$(OS)-$(ARCH)-$(archiveVersion)
114+
source: ${{ job_data.templateContext.pkgArtifact }}

‎.pipelines/build/scripts/azure-ipam.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/bin/bash
2+
set -nex
3+
4+
DROPGZ_VERSION="${DROPGZ_VERSION:-v0.0.12}"
5+
IPAM_BUILD_DIR=$(mktemp -d -p "$GEN_DIR")
6+
7+
pushd "$ROOT_DIR"/azure-ipam
8+
GOOS=$OS CGO_ENABLED=0 go build -v -a -o "$IPAM_BUILD_DIR"/azure-ipam -trimpath -ldflags "-X github.com/Azure/azure-container-networking/azure-ipam/internal/buildinfo.Version="$AZURE_IPAM_VERSION" main.version="$VERSION"" -gcflags="-dwarflocationlists=true"
9+
cp *.conflist "$IPAM_BUILD_DIR"
10+
sha256sum * > sum.txt
11+
gzip --verbose --best --recursive . && for f in *.gz; do mv -- "$f" "${f%%.gz}"; done
12+
popd
13+
14+
go mod download github.com/azure/azure-container-networking/dropgz@$DROPGZ_VERSION
15+
pushd "$GOPATH"/pkg/mod/github.com/azure/azure-container-networking/dropgz\@$DROPGZ_VERSION
16+
cp "$IPAM_BUILD_DIR"/* pkg/embed/fs/
17+
GOOS=$OS CGO_ENABLED=0 go build -a -o "$OUT_DIR"/bins/dropgz -trimpath -ldflags "-X github.com/Azure/azure-container-networking/dropgz/internal/buildinfo.Version="$VERSION"" -gcflags="-dwarflocationlists=true" main.go
18+
popd

‎.pipelines/build/scripts/cns.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/bin/bash
2+
#ARG CNS_AI_ID
3+
#ARG CNS_AI_PATH
4+
5+
mkdir -p "$OUT_DIR"/files
6+
mkdir -p "$OUT_DIR"/bins
7+
8+
pushd "$REPO_ROOT"
9+
GOOS=$OS CGO_ENABLED=0 go build -a -o "$OUT_DIR"/bins/azure-cns -ldflags "-X main.version="$VERSION" -X "$CNS_AI_PATH"="$CNS_AI_ID"" -gcflags="-dwarflocationlists=true" cns/service/*.go
10+
cp cns/kubeconfigtemplate.yaml "$OUT_DIR"/files/kubeconfigtemplate.yaml
11+
cp npm/examples/windows/setkubeconfigpath.ps1 "$OUT_DIR"/files/setkubeconfigpath.ps1
12+
popd

‎.pipelines/build/scripts/ipv6-hp-bpf.sh‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
#!/bin/bash
2+
3+
mkdir -p "$OUT_DIR"/bins
4+
mkdir -p "$OUT_DIR"/lib
5+
6+
apt-get update -y
7+
apt-get install -y llvm clang linux-libc-dev linux-headers-generic libbpf-dev libc6-dev nftables iproute2
8+
9+
# Copy Needed Library Binaries
10+
cp /usr/sbin/nft "$OUT_DIR"/bins/nft
11+
cp /sbin/ip "$OUT_DIR"/bins/ip
12+
13+
# Package up Needed C Files
14+
if [ "$ARCH" = "arm64" ]; then
15+
apt-get install -y gcc-aarch64-linux-gnu
16+
ARCH=aarch64-linux-gnu
17+
cp /lib/"$ARCH"/ld-linux-aarch64.so.1 "$OUT_DIR"/lib/
18+
19+
for dir in /usr/include/"$ARCH"/*; do
20+
ln -s "$dir" /usr/include/$(basename "$dir")
21+
done
22+
23+
elif [ "$ARCH" = "amd64" ]; then
24+
apt-get install -y gcc-multilib
25+
ARCH=x86_64-linux-gnu
26+
cp /lib/"$ARCH"/ld-linux-x86-64.so.2 "$OUT_DIR"/lib/
27+
28+
for dir in /usr/include/"$ARCH"/*; do
29+
ln -s "$dir" /usr/include/$(basename "$dir")
30+
done
31+
fi
32+
33+
ln -sfn /usr/include/"$ARCH"/asm /usr/include/asm
34+
cp /lib/"$ARCH"/libnftables.so.1 "$OUT_DIR"/lib/
35+
cp /lib/"$ARCH"/libedit.so.2 "$OUT_DIR"/lib/
36+
cp /lib/"$ARCH"/libc.so.6 "$OUT_DIR"/lib/
37+
cp /lib/"$ARCH"/libmnl.so.0 "$OUT_DIR"/lib/
38+
cp /lib/"$ARCH"/libnftnl.so.11 "$OUT_DIR"/lib/
39+
cp /lib/"$ARCH"/libxtables.so.12 "$OUT_DIR"/lib/
40+
cp /lib/"$ARCH"/libjansson.so.4 "$OUT_DIR"/lib/
41+
cp /lib/"$ARCH"/libgmp.so.10 "$OUT_DIR"/lib/
42+
cp /lib/"$ARCH"/libtinfo.so.6 "$OUT_DIR"/lib/
43+
cp /lib/"$ARCH"/libbsd.so.0 "$OUT_DIR"/lib/
44+
cp /lib/"$ARCH"/libmd.so.0 "$OUT_DIR"/lib/
45+
46+
47+
# Build IPv6 HP BPF
48+
export C_INCLUDE_PATH=/usr/include/bpf
49+
pushd "$REPO_ROOT"/bpf-prog/ipv6-hp-bpf
50+
cp ./cmd/ipv6-hp-bpf/*.go ./
51+
52+
if [ "$DEBUG" = "true" ]; then
53+
echo "\n#define DEBUG" >> ./include/helper.h
54+
fi
55+
56+
GOOS=$OS CGO_ENABLED=0 go generate ./...
57+
GOOS=$OS CGO_ENABLED=0 go build -a -o "$OUT_DIR"/bins/ipv6-hp-bpf -trimpath -ldflags "-X main.version="$VERSION"" -gcflags="-dwarflocationlists=true" .
58+
popd

‎.pipelines/build/scripts/npm.sh‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/bash
2+
set -nex
3+
4+
mkdir -p "$OUT_DIR"/files
5+
mkdir -p "$OUT_DIR"/bins
6+
7+
pushd "$ROOT_DIR"/npm
8+
GOOS=$OS CGO_ENABLED=0 go build -v -o "$OUT_DIR"/bins/azure-npm -ldflags "-X main.version="$VERSION" -X "$NPM_AI_PATH"="$NPM_AI_ID"" -gcflags="-dwarflocationlists=true" ./cmd/*.go
9+
10+
cp ./examples/windows/kubeconfigtemplate.yaml "$OUT_DIR"/files/kubeconfigtemplate.yaml
11+
cp ./examples/windows/setkubeconfigpath.ps1 "$OUT_DIR"/files/setkubeconfigpath.ps1
12+
cp ./examples/windows/setkubeconfigpath-capz.ps1 "$OUT_DIR"/files/setkubeconfigpath-capz.ps1
13+
popd

0 commit comments

Comments
 (0)