fix: [NPM] [CVEs] [v1.5] Update Ubuntu Image to 24.04 and Revert Manual NPM Linux Dockerfile Package Installations #3679

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

rayaisaiah wants to merge 10 commits into release/v1.5 from isaiahraya/npm-remove-hardcoded-package-installlations

Contributor

rayaisaiah commented May 22, 2025 •

edited

Loading

Reason for Change:
Bumps the NPM Ubuntu base image version from 20.04 to 24.04 as 20.04 is EOL and no longer supported (https://ubuntu.com/blog/ubuntu-20-04-lts-end-of-life-standard-support-is-coming-to-an-end-heres-how-to-prepare).

Reverts manual package installations made to the NPM Linux dockerfile in: #3439 and #3461. These changes were made as NPM base image (Ubuntu) did not have the updated packages installed which lead to CVEs on the base image. Ubuntu has since been patched to have the CVEs resolved so there is no need to manually install the packages at a specific version.

Trivy scan of NPM linux with changes to dockerfile:

acnpublic.azurecr.io/azure-npm:v1.5.49TestUbuntu (ubuntu 24.04)
===============================================================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

Issue Fixed:

Requirements:

uses conventional commit messages
includes documentation
adds unit tests
relevant PR labels added

Notes:

rayaisaiah added 7 commits

March 11, 2025 23:38


          fix: [NPM] Reduce/Refactor Noisy NPM Logs (#3468)

fb3ce45

* removed all logs from npm dataplane (except error/warning logs)

* removed all logs from npm controller (except error/warning logs)

* restored logs that are ununused by current npm (v2)

* removed test files

* resolved comments

* keep log related to reconciling chain placement when the chain is not in the right place

* added bootup logs back

* Removed two more noisy logs

* Add loglevel config option when printing application insight logs

* Updated all non-error/warning logs to commented out and with a vap TODO

* fixed typo

* small typo fix

* updated configmap with loglevel

* updated default value

* added a default value for loglevel

* fixed typo in json

* removed comma

* changed loglevel to info in configmap

* add a short sleep in TestNetPolInBackgroundSkipAddAfterRemove

* test remove dataplane changes to see if race condition fixes

* Revert "test remove dataplane changes to see if race condition fixes"

This reverts commit 08697eb.

* test

* Revert "test"

This reverts commit 449c2af.

* test

* update dataplane to test if changes are flagged in race

* added stop channels to unit tests to avoid race condtiions

* add non noisy logs back

* increased time

* revert time change after RunPeriodicTasks

* test with 1000 seconds

* 5000 milliseconds

* tweaked the delay

* update to 1500 for defer

* increased to 1500

* increase to 2000

* removed kubernetes


          Merge branch 'release/v1.5' of https://github.com/Azure/azure-contain…

284a4d7

…er-networking into release/v1.5


          Merge branch 'release/v1.5' of https://github.com/Azure/azure-contain…

169b542

…er-networking into release/v1.5


          Merge branch 'release/v1.5' of https://github.com/Azure/azure-contain…

b184664

…er-networking into release/v1.5


          Merge branch 'release/v1.5' of https://github.com/Azure/azure-contain…

a45273e

…er-networking into release/v1.5


          Merge branch 'release/v1.5' of https://github.com/Azure/azure-contain…

5e58eab

…er-networking into release/v1.5


          removed hardcoded package versions from npm dockerfile

ead064c

Copilot AI review requested due to automatic review settings

May 22, 2025 22:10

rayaisaiah added npm linux labels

rayaisaiah requested a review from a team as a code owner

May 22, 2025 22:10

rayaisaiah requested a review from vakalapa

May 22, 2025 22:10

Copilot AI reviewed

View reviewed changes

Contributor

Copilot AI left a comment

Pull Request Overview

This PR reverts previous manual version-specific package installations in the NPM Linux Dockerfile now that the Ubuntu base image has been updated to resolve the CVEs.

Removed explicit version constraints for libc-bin, libc6, libtasn1-6, and libgnutls30
Continues to install other required packages (iptables, ipset, ca-certificates) without version pinning

Contributor Author

rayaisaiah commented May 22, 2025

/azp run Azure Container Networking PR

Contributor Author

rayaisaiah commented May 22, 2025

/azp run NPM Conformance Tests

Contributor Author

rayaisaiah commented May 22, 2025

/azp run NPM Scale Test

azure-pipelines bot commented May 22, 2025

Azure Pipelines successfully started running 1 pipeline(s).

2 similar comments

azure-pipelines bot commented May 22, 2025

Azure Pipelines successfully started running 1 pipeline(s).

azure-pipelines bot commented May 22, 2025

Azure Pipelines successfully started running 1 pipeline(s).

rayaisaiah changed the title ~~revert: [NPM] [CVEs] Revert Manual NPM Linux Dockerfile Package Installations~~ revert: [NPM] [CVEs] [v1.5] Revert Manual NPM Linux Dockerfile Package Installations

Contributor Author

rayaisaiah commented May 22, 2025

/azp run NPM Conformance Tests

azure-pipelines bot commented May 22, 2025

Azure Pipelines successfully started running 1 pipeline(s).

Contributor Author

rayaisaiah commented May 23, 2025

/azp run NPM Conformance Tests

azure-pipelines bot commented May 23, 2025

Azure Pipelines successfully started running 1 pipeline(s).

Contributor Author

rayaisaiah commented May 23, 2025

conformance passed on rerun: https://msazure.visualstudio.com/One/_build/results?buildId=125179648&view=results

Contributor Author

rayaisaiah commented May 23, 2025

/azp run NPM Conformance Tests

azure-pipelines bot commented May 23, 2025

Azure Pipelines successfully started running 1 pipeline(s).

matmerr previously approved these changes

View reviewed changes

rayaisaiah added this pull request to the merge queue

github-merge-queue bot removed this pull request from the merge queue due to failed status checks

rayaisaiah added this pull request to the merge queue

github-merge-queue bot removed this pull request from the merge queue due to failed status checks

rayaisaiah added this pull request to the merge queue

github-merge-queue bot removed this pull request from the merge queue due to failed status checks

rayaisaiah added this pull request to the merge queue

rayaisaiah added 2 commits

May 27, 2025 17:19


          Merge branch 'release/v1.5' of https://github.com/Azure/azure-contain…

391f16b

…er-networking into release/v1.5


          Merge branch 'release/v1.5' into isaiahraya/npm-remove-hardcoded-pack…

dea9101

…age-installlations

rayaisaiah removed this pull request from the merge queue due to a manual request

Contributor Author

rayaisaiah commented May 27, 2025

/azp run Azure Container Networking PR

rayaisaiah enabled auto-merge

May 27, 2025 17:21

azure-pipelines bot commented May 27, 2025

Azure Pipelines successfully started running 1 pipeline(s).

rayaisaiah added this pull request to the merge queue

rayaisaiah removed this pull request from the merge queue due to a manual request

rayaisaiah added this pull request to the merge queue

github-merge-queue bot removed this pull request from the merge queue due to failed status checks

rayaisaiah changed the title ~~revert: [NPM] [CVEs] [v1.5] Revert Manual NPM Linux Dockerfile Package Installations~~ fix: [NPM] [CVEs] [v1.5] Revert Manual NPM Linux Dockerfile Package Installations

rayaisaiah changed the title ~~fix: [NPM] [CVEs] [v1.5] Revert Manual NPM Linux Dockerfile Package Installations~~ fix: [NPM] [CVEs] [v1.5] Update Ubuntu Image to 24.04 and Revert Manual NPM Linux Dockerfile Package Installations


          update linux to 24.04

rayaisaiah dismissed matmerr’s stale review via

June 2, 2025 21:18

Contributor Author

rayaisaiah commented Jun 2, 2025

/azp run Azure Container Networking PR

Contributor Author

rayaisaiah commented Jun 2, 2025

/azp run NPM Conformance Tests

azure-pipelines bot commented Jun 2, 2025

Azure Pipelines successfully started running 1 pipeline(s).

1 similar comment

azure-pipelines bot commented Jun 2, 2025

Azure Pipelines successfully started running 1 pipeline(s).

Contributor Author

rayaisaiah commented Jun 2, 2025

/azp run NPM Scale Test

azure-pipelines bot commented Jun 2, 2025

Azure Pipelines successfully started running 1 pipeline(s).

Contributor Author

rayaisaiah commented Jun 2, 2025

Note: NPM on arm64 nodes hit the following error:

rayaisaiah commented

View reviewed changes

npm/linux.Dockerfile

@@ @@ -6,8 +6,8 @@ WORKDIR /usr/local/src @@
               COPY . .
               RUN CGO_ENABLED=0 go build -v -o /usr/local/bin/azure-npm -ldflags "-X main.version="$VERSION" -X "$NPM_AI_PATH"="$NPM_AI_ID"" -gcflags="-dwarflocationlists=true" npm/cmd/*.go
-              FROM mcr.microsoft.com/mirror/docker/library/ubuntu:20.04
+              FROM mcr.microsoft.com/mirror/docker/library/ubuntu:24.04

Contributor Author

rayaisaiah Jun 4, 2025

cyclonus run on the 24.04 image also failed quite a few tests (75% for first run 66% for second). because of this i think at a later time we should probably dedicate some cycles to seeing the iprule/ipset differences between the Ubuntu versions to see what is causing this drop. Maybe use Ubuntu 22.04?

Contributor Author

rayaisaiah Jun 4, 2025

Queued a run directly from the cyclonus pipeline here: https://github.com/Azure/azure-container-networking/actions/runs/15448171797

Contributor Author

rayaisaiah Jun 4, 2025

green on second run: https://github.com/Azure/azure-container-networking/actions/runs/15449432372

Contributor Author

rayaisaiah commented Jun 9, 2025 •

edited

Loading

Passing the cyclonus-extended test on master: https://github.com/Azure/azure-container-networking/actions/runs/15539895740

Scale: https://msazure.visualstudio.com/One/_build/results?buildId=126046671&view=results
Conformance: https://msazure.visualstudio.com/One/_build/results?buildId=126046649&view=results

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels