Merge branch 'cherry_pick_199be59638835e1796f3d80d9d2700a0242a7292' into 'release-0.3'

Cherry-pick: Update cyrus-sasl-lib to address CVE-2022-24407

See merge request nvidia/cloud-native/mig-parted!72

Author: klueska

.common-ci.yml

@@ -38,10 +38,12 @@ stages:
 .dist-ubi8:
   variables:
     DIST: "ubi8"
+    CVE_UPDATES: "cyrus-sasl-lib"
 
 .dist-ubuntu20.04:
   variables:
     DIST: "ubuntu20.04"
+    CVE_UPDATES: "libsasl2-2 libsasl2-modules-db"
 
 # Define the platform targets
 .platform-amd64:

deployments/gpu-operator/Dockerfile renamed to deployments/gpu-operator/Dockerfile.ubi8

@@ -1,4 +1,4 @@
-# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+# Copyright (c) 2021-2022, NVIDIA CORPORATION.  All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-ARG BASE_DIST
+ARG BASE_DIST=ubi8
 ARG CUDA_VERSION
 ARG GOLANG_VERSION=x.x.x
 ARG VERSION="N/A"
@@ -55,4 +55,11 @@ LABEL name="NVIDIA MIG Manager for Kubernetes"
 LABEL summary="NVIDIA MIG Manager for Kubernetes"
 LABEL description="See summary"
 
+# Install / upgrade packages here that are required to resolve CVEs
+ARG CVE_UPDATES
+RUN if [ -n "${CVE_UPDATES}" ]; then \
+        yum update -y ${CVE_UPDATES} && \
+        rm -rf /var/cache/yum/*; \
+    fi
+
 ENTRYPOINT ["nvidia-mig-manager"]

deployments/gpu-operator/Dockerfile.ubuntu

@@ -0,0 +1,65 @@
+# Copyright (c) 2021-2022, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ARG BASE_DIST=ubuntu20.04
+ARG CUDA_VERSION
+ARG GOLANG_VERSION=x.x.x
+ARG VERSION="N/A"
+
+# NOTE: In cases where the libc version is a concern, we would have to use an
+# image based on the target OS to build the golang executables here -- especially
+# if cgo code is included.
+FROM golang:${GOLANG_VERSION} AS build
+
+SHELL ["/bin/bash", "-c"]
+
+ARG TARGETARCH
+WORKDIR /build
+COPY . .
+RUN go build -o /artifacts/nvidia-mig-parted ./cmd
+RUN go build -o /artifacts/nvidia-mig-manager ./deployments/gpu-operator/
+RUN cp ./deployments/gpu-operator/reconfigure-mig.sh /artifacts/reconfigure-mig.sh
+
+RUN OS_ARCH=${TARGETARCH/x86_64/amd64} && OS_ARCH=${OS_ARCH/aarch64/arm64} && curl -o /artifacts/kubectl -L "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${OS_ARCH}/kubectl";
+RUN chmod a+x /artifacts/kubectl
+
+FROM nvidia/cuda:${CUDA_VERSION}-base-${BASE_DIST}
+
+COPY ./LICENSE ./licenses/LICENSE
+COPY --from=build /artifacts/nvidia-mig-parted  /usr/bin/nvidia-mig-parted
+COPY --from=build /artifacts/nvidia-mig-manager /usr/bin/nvidia-mig-manager
+COPY --from=build /artifacts/reconfigure-mig.sh /usr/bin/reconfigure-mig.sh
+COPY --from=build /artifacts/kubectl            /usr/bin/kubectl
+
+ENV NVIDIA_DISABLE_REQUIRE="true"
+ENV NVIDIA_VISIBLE_DEVICES=all
+ENV NVIDIA_MIG_CONFIG_DEVICES=all
+ENV NVIDIA_DRIVER_CAPABILITIES=utility
+
+LABEL version="${VERSION}"
+LABEL release="N/A"
+LABEL vendor="NVIDIA"
+LABEL io.k8s.display-name="NVIDIA MIG Manager for Kubernetes"
+LABEL name="NVIDIA MIG Manager for Kubernetes"
+LABEL summary="NVIDIA MIG Manager for Kubernetes"
+LABEL description="See summary"
+
+# Install / upgrade packages here that are required to resolve CVEs
+ARG CVE_UPDATES
+RUN if [ -n "${CVE_UPDATES}" ]; then \
+        apt-get update && apt-get upgrade -y ${CVE_UPDATES} && \
+        rm -rf /var/lib/apt/lists/*; \
+    fi
+
+ENTRYPOINT ["nvidia-mig-manager"]

deployments/gpu-operator/Makefile

@@ -70,7 +70,7 @@ push-%: DIST = $(*)
 push-short: DIST = $(DEFAULT_PUSH_TARGET)
 
 build-%: DIST = $(*)
-build-%: DOCKERFILE = $(CURDIR)/deployments/gpu-operator/Dockerfile
+build-%: DOCKERFILE = $(CURDIR)/deployments/gpu-operator/Dockerfile.$(DOCKERFILE_SUFFIX)
 
 # Use a generic build target to build the relevant images
 $(BUILD_TARGETS): build-%: $(ARTIFACTS_ROOT)
@@ -83,5 +83,10 @@ $(BUILD_TARGETS): build-%: $(ARTIFACTS_ROOT)
 		--build-arg CUDA_VERSION="$(CUDA_VERSION)" \
 		--build-arg GOLANG_VERSION="$(GOLANG_VERSION)" \
 		--build-arg VERSION="$(vVERSION)" \
+		--build-arg CVE_UPDATES="$(CVE_UPDATES)" \
 		-f $(DOCKERFILE) \
 		$(CURDIR)
+
+build-ubuntu%: DOCKERFILE_SUFFIX := ubuntu
+
+build-ubi8: DOCKERFILE_SUFFIX := ubi8