Skip to content

Commit eb377ee

Browse files
e0nee0ne
authored
feat: Remove kubectl binary from container and apply CRDs with client-go (#1118)
Due too multiple CVEs in the kubectl binary we remove the dependency to it. To be able to update our CRDs we introduce a custom Go binary that uses client-go to apply our CRDs and also from our dependencies, like NFD and SRIOV. Additionally we remove the scale-down Helm hook as it is no longer needed. Fixes #1072
2 parents b090a05 + 29cdc84 commit eb377ee

File tree

10 files changed

+730
-118
lines changed

10 files changed

+730
-118
lines changed

‎Dockerfile‎

Lines changed: 36 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -16,16 +16,9 @@
1616
ARG ARCH
1717

1818
# Build the manager binary
19-
FROM golang:1.23@sha256:ad5c126b5cf501a8caef751a243bb717ec204ab1aa56dc41dc11be089fafcb4f AS builder
19+
FROM golang:1.23@sha256:ad5c126b5cf501a8caef751a243bb717ec204ab1aa56dc41dc11be089fafcb4f AS manager-builder
2020

2121
WORKDIR /workspace
22-
# Add kubectl tool
23-
# Using the $ARCH in the name of the binary here ensures we don't get any cross-arch caching after this binary is downloaded.
24-
ARG ARCH
25-
# kubectl latest version can be retrieved by curl -L -s https://dl.k8s.io/release/stable.txt
26-
ARG KUBECTL_VERSION=v1.31.1
27-
RUN curl -L "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${ARCH}/kubectl" -o kubectl-${ARCH} && \
28-
chmod +x ./kubectl-${ARCH}
2922

3023
# Copy the Go Modules manifests
3124
COPY go.mod go.mod
@@ -38,30 +31,55 @@ RUN --mount=type=cache,target=/go/pkg/mod \
3831
# Copy the go source
3932
COPY ./ ./
4033

34+
# Build
35+
ARG ARCH
36+
ARG LDFLAGS
37+
ARG GCFLAGS
38+
RUN --mount=type=cache,target=/go/pkg/mod \
39+
--mount=type=cache,target=/root/.cache/go-build \
40+
CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} go build -ldflags="${LDFLAGS}" -gcflags="${GCFLAGS}" -o manager main.go
41+
42+
# Build the apply-crds binary
43+
FROM golang:1.23@sha256:ad5c126b5cf501a8caef751a243bb717ec204ab1aa56dc41dc11be089fafcb4f AS apply-crds-builder
44+
45+
WORKDIR /workspace
46+
47+
# Copy the Go Modules manifests
48+
COPY cmd/apply-crds/go.mod go.mod
49+
COPY cmd/apply-crds/go.sum go.sum
50+
# cache deps before building and copying source so that we don't need to re-download as much
51+
# and so that source changes don't invalidate our downloaded layer
52+
RUN --mount=type=cache,target=/go/pkg/mod \
53+
go mod download -x
54+
55+
# Copy the go source
56+
COPY cmd/apply-crds/ ./
57+
COPY deployment/network-operator/ ./network-operator-chart/
58+
4159
# copy CRDs from helm charts
4260
RUN mkdir crds && \
43-
cp -r deployment/network-operator/crds /workspace/crds/network-operator/ && \
44-
cp -r deployment/network-operator/charts/sriov-network-operator/crds /workspace/crds/sriov-network-operator/ && \
45-
cp -r deployment/network-operator/charts/node-feature-discovery/crds /workspace/crds/node-feature-discovery/
61+
cp -r network-operator-chart/crds /workspace/crds/network-operator/ && \
62+
cp -r network-operator-chart/charts/sriov-network-operator/crds /workspace/crds/sriov-network-operator/ && \
63+
cp -r network-operator-chart/charts/node-feature-discovery/crds /workspace/crds/node-feature-discovery/ && \
64+
cp -r network-operator-chart/charts/nic-configuration-operator-chart/crds /workspace/crds/nic-configuration-operator/
4665

4766
# Build
67+
ARG ARCH
4868
ARG LDFLAGS
4969
ARG GCFLAGS
5070
RUN --mount=type=cache,target=/go/pkg/mod \
5171
--mount=type=cache,target=/root/.cache/go-build \
52-
CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} go build -ldflags="${LDFLAGS}" -gcflags="${GCFLAGS}" -o manager main.go
72+
CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} go build -ldflags="${LDFLAGS}" -gcflags="${GCFLAGS}" -o apply-crds main.go
5373

5474
FROM --platform=linux/${ARCH} registry.access.redhat.com/ubi8-micro:8.10
5575

56-
ARG ARCH
57-
5876
WORKDIR /
59-
COPY --from=builder /workspace/manager .
60-
COPY --from=builder /workspace/kubectl-${ARCH} /usr/local/bin/kubectl
61-
COPY --from=builder /workspace/crds /crds
77+
COPY --from=manager-builder /workspace/manager .
78+
COPY --from=apply-crds-builder /workspace/apply-crds .
79+
COPY --from=apply-crds-builder /workspace/crds /crds
6280

6381
# Default Certificates are missing in micro-ubi. These are need to fetch DOCA drivers image tags
64-
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
82+
COPY --from=manager-builder /etc/ssl/certs/ca-certificates.crt /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
6583
COPY /webhook-schemas /webhook-schemas
6684
COPY manifests/ manifests/
6785
USER 65532:65532

‎cmd/apply-crds/go.mod‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
module github.com/mellanox/network-operator/cmd/apply-crds
2+
3+
go 1.23.2
4+
5+
require (
6+
github.com/onsi/ginkgo/v2 v2.19.0
7+
github.com/onsi/gomega v1.33.1
8+
k8s.io/apiextensions-apiserver v0.31.2
9+
k8s.io/apimachinery v0.31.2
10+
k8s.io/client-go v0.31.2
11+
sigs.k8s.io/controller-runtime v0.19.1
12+
)
13+
14+
require (
15+
github.com/beorn7/perks v1.0.1 // indirect
16+
github.com/cespare/xxhash/v2 v2.3.0 // indirect
17+
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
18+
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
19+
github.com/evanphx/json-patch/v5 v5.9.0 // indirect
20+
github.com/fsnotify/fsnotify v1.7.0 // indirect
21+
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
22+
github.com/go-logr/logr v1.4.2 // indirect
23+
github.com/go-logr/zapr v1.3.0 // indirect
24+
github.com/go-openapi/jsonpointer v0.19.6 // indirect
25+
github.com/go-openapi/jsonreference v0.20.2 // indirect
26+
github.com/go-openapi/swag v0.22.4 // indirect
27+
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
28+
github.com/gogo/protobuf v1.3.2 // indirect
29+
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
30+
github.com/golang/protobuf v1.5.4 // indirect
31+
github.com/google/gnostic-models v0.6.8 // indirect
32+
github.com/google/go-cmp v0.6.0 // indirect
33+
github.com/google/gofuzz v1.2.0 // indirect
34+
github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af // indirect
35+
github.com/google/uuid v1.6.0 // indirect
36+
github.com/imdario/mergo v0.3.6 // indirect
37+
github.com/josharian/intern v1.0.0 // indirect
38+
github.com/json-iterator/go v1.1.12 // indirect
39+
github.com/mailru/easyjson v0.7.7 // indirect
40+
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
41+
github.com/modern-go/reflect2 v1.0.2 // indirect
42+
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
43+
github.com/pkg/errors v0.9.1 // indirect
44+
github.com/prometheus/client_golang v1.19.1 // indirect
45+
github.com/prometheus/client_model v0.6.1 // indirect
46+
github.com/prometheus/common v0.55.0 // indirect
47+
github.com/prometheus/procfs v0.15.1 // indirect
48+
github.com/spf13/pflag v1.0.5 // indirect
49+
github.com/x448/float16 v0.8.4 // indirect
50+
go.uber.org/multierr v1.11.0 // indirect
51+
go.uber.org/zap v1.26.0 // indirect
52+
golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc // indirect
53+
golang.org/x/net v0.26.0 // indirect
54+
golang.org/x/oauth2 v0.21.0 // indirect
55+
golang.org/x/sys v0.21.0 // indirect
56+
golang.org/x/term v0.21.0 // indirect
57+
golang.org/x/text v0.16.0 // indirect
58+
golang.org/x/time v0.3.0 // indirect
59+
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
60+
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
61+
google.golang.org/protobuf v1.34.2 // indirect
62+
gopkg.in/inf.v0 v0.9.1 // indirect
63+
gopkg.in/yaml.v2 v2.4.0 // indirect
64+
gopkg.in/yaml.v3 v3.0.1 // indirect
65+
k8s.io/api v0.31.2 // indirect
66+
k8s.io/klog/v2 v2.130.1 // indirect
67+
k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
68+
k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
69+
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
70+
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
71+
sigs.k8s.io/yaml v1.4.0 // indirect
72+
)

0 commit comments

Comments
 (0)