Skip to content

Commit be4683e

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request kubernetes#82966 from danwinship/iptables-nft
update images to Debian buster, detect iptables mode
2 parents 16e0976 + ca32fd2 commit be4683e

File tree

7 files changed

+87
-39
lines changed

7 files changed

+87
-39
lines changed

‎build/common.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -94,8 +94,8 @@ readonly KUBE_CONTAINER_RSYNC_PORT=8730
9494
# $1 - server architecture
9595
kube::build::get_docker_wrapped_binaries() {
9696
local arch=$1
97-
local debian_base_version=v1.0.0
98-
local debian_iptables_version=v11.0.2
97+
local debian_base_version=v2.0.0
98+
local debian_iptables_version=v12.0.1
9999
### If you change any of these lists, please also update DOCKERIZED_BINARIES
100100
### in build/BUILD. And kube::golang::server_image_targets
101101
local targets=(

‎build/debian-base/Dockerfile.build‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -41,28 +41,14 @@ RUN apt-mark hold apt gnupg adduser passwd libsemanage1 libcap2
4141
# Several utilities (e.g. ping) were kept for usefulness, but may be removed in later versions.
4242
RUN echo "Yes, do as I say!" | apt-get purge \
4343
bash \
44-
debconf-i18n \
45-
e2fslibs \
4644
e2fsprogs \
47-
init \
48-
initscripts \
4945
libcap2-bin \
50-
libkmod2 \
5146
libmount1 \
5247
libsmartcols1 \
53-
libudev1 \
5448
libblkid1 \
55-
libncursesw5 \
56-
libprocps6 \
57-
libslang2 \
5849
libss2 \
59-
libsystemd0 \
60-
libtext-charwidth-perl libtext-iconv-perl libtext-wrapi18n-perl \
6150
ncurses-base \
6251
ncurses-bin \
63-
systemd \
64-
systemd-sysv \
65-
sysv-rc \
6652
tzdata
6753

6854
# No-op stubs replace some unnecessary binaries that may be depended on in the install process (in

‎build/debian-base/Makefile‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ REGISTRY ?= staging-k8s.gcr.io
1818
IMAGE ?= $(REGISTRY)/debian-base
1919
BUILD_IMAGE ?= debian-build
2020

21-
TAG ?= v1.0.0
21+
TAG ?= v2.0.0
2222

2323
TAR_FILE ?= rootfs.tar
2424
ARCH?=amd64
@@ -33,22 +33,22 @@ SUDO=$(if $(filter 0,$(shell id -u)),,sudo)
3333
export DOCKER_CLI_EXPERIMENTAL := enabled
3434

3535
ifeq ($(ARCH),amd64)
36-
BASEIMAGE?=debian:stretch
36+
BASEIMAGE?=debian:buster-slim
3737
endif
3838
ifeq ($(ARCH),arm)
39-
BASEIMAGE?=arm32v7/debian:stretch
39+
BASEIMAGE?=arm32v7/debian:buster-slim
4040
QEMUARCH=arm
4141
endif
4242
ifeq ($(ARCH),arm64)
43-
BASEIMAGE?=arm64v8/debian:stretch
43+
BASEIMAGE?=arm64v8/debian:buster-slim
4444
QEMUARCH=aarch64
4545
endif
4646
ifeq ($(ARCH),ppc64le)
47-
BASEIMAGE?=ppc64le/debian:stretch
47+
BASEIMAGE?=ppc64le/debian:buster-slim
4848
QEMUARCH=ppc64le
4949
endif
5050
ifeq ($(ARCH),s390x)
51-
BASEIMAGE?=s390x/debian:stretch
51+
BASEIMAGE?=s390x/debian:buster-slim
5252
QEMUARCH=s390x
5353
endif
5454

‎build/debian-iptables/Dockerfile‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,28 @@
1414

1515
FROM BASEIMAGE
1616

17+
# Install latest iptables package from buster-backports
18+
RUN echo deb http://deb.debian.org/debian buster-backports main >> /etc/apt/sources.list; \
19+
apt-get update; \
20+
apt-get -t buster-backports -y --no-install-recommends install iptables
21+
22+
# Install other dependencies and then clean up apt caches
1723
RUN clean-install \
1824
conntrack \
1925
ebtables \
2026
ipset \
21-
iptables \
2227
kmod \
2328
netbase
29+
30+
# Install iptables wrapper scripts to detect the correct iptables mode
31+
# the first time any of them is run
32+
COPY iptables-wrapper /usr/sbin/iptables-wrapper
33+
34+
RUN update-alternatives \
35+
--install /usr/sbin/iptables iptables /usr/sbin/iptables-wrapper 100 \
36+
--slave /usr/sbin/iptables-restore iptables-restore /usr/sbin/iptables-wrapper \
37+
--slave /usr/sbin/iptables-save iptables-save /usr/sbin/iptables-wrapper
38+
RUN update-alternatives \
39+
--install /usr/sbin/ip6tables ip6tables /usr/sbin/iptables-wrapper 100 \
40+
--slave /usr/sbin/ip6tables-restore ip6tables-restore /usr/sbin/iptables-wrapper \
41+
--slave /usr/sbin/ip6tables-save ip6tables-save /usr/sbin/iptables-wrapper

‎build/debian-iptables/Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,12 @@
1616

1717
REGISTRY?="staging-k8s.gcr.io"
1818
IMAGE=$(REGISTRY)/debian-iptables
19-
TAG?=v11.0.2
19+
TAG?=v12.0.1
2020
ARCH?=amd64
2121
ALL_ARCH = amd64 arm arm64 ppc64le s390x
2222
TEMP_DIR:=$(shell mktemp -d)
2323

24-
BASEIMAGE?=k8s.gcr.io/debian-base-$(ARCH):v1.0.0
24+
BASEIMAGE?=k8s.gcr.io/debian-base-$(ARCH):v2.0.0
2525

2626
# This option is for running docker manifest command
2727
export DOCKER_CLI_EXPERIMENTAL := enabled

‎build/debian-iptables/iptables-wrapper‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#!/bin/sh
2+
3+
# Copyright 2019 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -e
18+
19+
# Detect whether the base system is using iptables-legacy or
20+
# iptables-nft. This assumes that some non-containerized process (eg
21+
# kubelet) has already created some iptables rules.
22+
23+
# Bugs in iptables-nft 1.8.3 may cause it to get stuck in a loop in
24+
# some circumstances, so we have to run the nft check in a timeout. To
25+
# avoid hitting that timeout, we only bother to even check nft if
26+
# legacy iptables was empty / mostly empty.
27+
28+
num_legacy_lines=$( (iptables-legacy-save || true; ip6tables-legacy-save || true) 2>/dev/null | grep '^-' | wc -l)
29+
if [ "${num_legacy_lines}" -ge 10 ]; then
30+
mode=legacy
31+
else
32+
num_nft_lines=$( (timeout 5 sh -c "iptables-nft-save; ip6tables-nft-save" || true) 2>/dev/null | grep '^-' | wc -l)
33+
if [ "${num_legacy_lines}" -ge "${num_nft_lines}" ]; then
34+
mode=legacy
35+
else
36+
mode=nft
37+
fi
38+
fi
39+
40+
update-alternatives --set iptables "/usr/sbin/iptables-${mode}" > /dev/null
41+
update-alternatives --set ip6tables "/usr/sbin/ip6tables-${mode}" > /dev/null
42+
43+
# Now re-exec the original command with the newly-selected alternative
44+
exec "$0" "$@"

‎build/workspace.bzl‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -73,21 +73,21 @@ def cri_tarballs():
7373

7474
# Use go get -u github.com/estesp/manifest-tool to find these values
7575
_DEBIAN_BASE_DIGEST = {
76-
"manifest": "sha256:6966a0aedd7592c18ff2dd803c08bd85780ee19f5e3a2e7cf908a4cd837afcde",
77-
"amd64": "sha256:8ccb65cd2dd7e0c24193d0742a20e4a673dbd11af5a33f16fcd471a31486866c",
78-
"arm": "sha256:3432b41de3f6dfffdc1386fce961cfd1f9f8e208b3a35070e10ef3e2a733cb17",
79-
"arm64": "sha256:9189251e1d1eb4126d6e6add2e272338f9c8a6a3db38863044625bca4b667f31",
80-
"ppc64le": "sha256:50aa659e1e75e4231ee8293c3b4115e5755bb0517142b9b4bddbc134bf4354db",
81-
"s390x": "sha256:bbb8ee3a2aaca738c00809f450233d98029fea4e319d8faaa30aa94c8b17a806",
76+
"manifest": "sha256:ebda8587ec0f49eb88ee3a608ef018484908cbc5aa32556a0d78356088c185d4",
77+
"amd64": "sha256:d7be39e143d4e6677a28c81c0a84868b40800fc979dea1848bb19d526668a00c",
78+
"arm": "sha256:fc731da13b0bc9013b85a86b583fc92e50869b5bc8e7aa6ca730ec0240954c7d",
79+
"arm64": "sha256:12502c3eed050fa9b6d5fe353a44bfc5f437dc325c8912b1a48dcc180df36f1e",
80+
"ppc64le": "sha256:4277aa59b63c5a1369e6d84a295ecc4ffa08985dcf114de9f7b6de1af4fcbc86",
81+
"s390x": "sha256:78ef2a6b017539379c1654b4e52ba8519bfec821c62d0b3a1dbd15104b711e21",
8282
}
8383

8484
_DEBIAN_IPTABLES_DIGEST = {
85-
"manifest": "sha256:b522b0035dba3ac2d5c0dbaaf8217bd66248e790332ccfdf653e0f943a280dcf",
86-
"amd64": "sha256:adc40e9ec817c15d35b26d1d6aa4d0f8096fba4c99e26a026159bb0bc98c6a89",
87-
"arm": "sha256:58e8a1d3b187eed2d8d3664cd1c9723e5029698714a24dfca4b6ef42ea27a9d4",
88-
"arm64": "sha256:1a63fdd216fe7b84561d40ab1ebaa0daae1fc73e4232a6caffbd8353d9a14cea",
89-
"ppc64le": "sha256:9f90adbc7513cc96d92fcec7633c4b29e766dd31cf876af03c0b54374e22fa9c",
90-
"s390x": "sha256:4f147708deff2a0163ee49b6980cc95423514bec5f4091612d65773b898fbdae",
85+
"manifest": "sha256:d1cd487e89fb4cba853cd3a948a6e9016faf66f2a7bb53cb1ac6b6c9cb58f5ed",
86+
"amd64": "sha256:852d3c569932059bcab3a52cb6105c432d85b4b7bbd5fc93153b78010e34a783",
87+
"arm": "sha256:c10f01b414a7cd4b2f3e26e152c90c64a1e781d99f83a6809764cf74ecbc46c3",
88+
"arm64": "sha256:5725e6fde13a6405cf800e22846ebd2bde24b0860f1dc3f6f5f256f03cfa85bd",
89+
"ppc64le": "sha256:b6d6e56a0c34c0393dcba0d5faaa531b92e5876114c5ab5a90e82e4889724c5a",
90+
"s390x": "sha256:39e67e9bf25d67fe35bd9dcb25367277e5967368e02f2741e0efd4ce8874db14",
9191
}
9292

9393
_DEBIAN_HYPERKUBE_BASE_DIGEST = {
@@ -113,7 +113,7 @@ def debian_image_dependencies():
113113
digest = _digest(_DEBIAN_BASE_DIGEST, arch),
114114
registry = "k8s.gcr.io",
115115
repository = "debian-base",
116-
tag = "0.4.1", # ignored, but kept here for documentation
116+
tag = "v2.0.0", # ignored, but kept here for documentation
117117
)
118118

119119
container_pull(
@@ -122,7 +122,7 @@ def debian_image_dependencies():
122122
digest = _digest(_DEBIAN_IPTABLES_DIGEST, arch),
123123
registry = "k8s.gcr.io",
124124
repository = "debian-iptables",
125-
tag = "v11.0.2", # ignored, but kept here for documentation
125+
tag = "v12.0.1", # ignored, but kept here for documentation
126126
)
127127

128128
container_pull(

0 commit comments

Comments
 (0)