Skip to content

Commit 2d5e569

Browse files
cloudnullcloudnull
committed
feat: add kube-ovn
Signed-off-by: Kevin Carter <[email protected]>
1 parent a88bf9f commit 2d5e569

File tree

4 files changed

+249
-0
lines changed

4 files changed

+249
-0
lines changed

‎.github/workflows/container-build-kube-ovn.yaml‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
---
2+
name: Create and publish a kube-ovn image
3+
4+
permissions:
5+
actions: read
6+
contents: read
7+
id-token: write
8+
packages: write
9+
pull-requests: write
10+
security-events: write
11+
12+
on:
13+
pull_request:
14+
paths:
15+
- .github/workflows/container-build-kube-ovn.yaml
16+
- ContainerFiles/kube-ovn
17+
schedule:
18+
- cron: '0 0 * * 0' # Run Weekly at midnight UTC
19+
workflow_dispatch:
20+
inputs:
21+
kube-ovn-version:
22+
description: 'Version of Kube-OVN to use'
23+
required: true
24+
default: "v1.14.4"
25+
type: choice
26+
options:
27+
- "v1.13.14"
28+
- "v1.14.4"
29+
30+
env:
31+
REGISTRY: ghcr.io
32+
IMAGE_NAME: ${{ github.repository }}/kube-ovn
33+
# NOTE(cloudnull): This is used to parse the workflow_dispatch inputs, sadly the inputs are not available in the
34+
# workflow_dispatch event, so they're being stored in the environment variables. This is a
35+
# workaround until there's a better way to handle this.
36+
kube_ovn: >
37+
["v1.14.4", "v1.13.14"]
38+
jobs:
39+
init:
40+
runs-on: ubuntu-latest
41+
outputs:
42+
kube-ovn-version: ${{ steps.generate-matrix.outputs.kube_ovn }}
43+
steps:
44+
- name: generate-matrix
45+
id: generate-matrix
46+
run: |
47+
if [ "${{ github.event_name == 'workflow_dispatch' }}" = "true" ]; then
48+
kube_ovn="$(echo '${{ github.event.inputs.kube-ovn-version }}' | jq -R '[select(length>0)]' | jq -c '.')"
49+
fi
50+
echo "kube_ovn=${kube_ovn:-${{ env.kube_ovn }}}" >> $GITHUB_OUTPUT
51+
build-and-push-image:
52+
needs:
53+
- init
54+
strategy:
55+
matrix:
56+
kube-ovn-version: ${{ fromJSON(needs.init.outputs.kube-ovn-version) }}
57+
runs-on: ubuntu-latest
58+
steps:
59+
- name: Checkout
60+
uses: actions/checkout@v4
61+
- name: Set up QEMU
62+
uses: docker/setup-qemu-action@v3
63+
- name: Set up Docker Buildx
64+
uses: docker/setup-buildx-action@v3
65+
- name: Dynamically set MY_DATE environment variable
66+
run: echo "MY_DATE=$(date +%s)" >> $GITHUB_ENV
67+
- name: Dynamically set environment variables
68+
run: |
69+
VERSION=$(echo -n "${{ matrix.kube-ovn-version }}" | awk -F'/' '{($2=="" ? x=$1 : x=$2); print x}')
70+
echo "OS_VERSION_PARSE=${VERSION}" >> $GITHUB_ENV
71+
NAME=$(echo -n "${{ env.IMAGE_NAME }}" | awk -F'/' '{print $NF}')
72+
echo "CATEGORY_NAME=${VERSION}-${NAME}" >> $GITHUB_ENV
73+
- name: Log in to the Container registry
74+
uses: docker/login-action@v3
75+
with:
76+
registry: ${{ env.REGISTRY }}
77+
username: ${{ github.actor }}
78+
password: ${{ secrets.GITHUB_TOKEN }}
79+
- name: Extract metadata (tags, labels) for Docker
80+
id: meta
81+
uses: docker/metadata-action@v5
82+
with:
83+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
84+
- name: Build and push Docker image
85+
uses: docker/build-push-action@v6
86+
with:
87+
context: .
88+
file: ContainerFiles/kube-ovn
89+
push: false
90+
load: true
91+
cache-from: type=gha
92+
cache-to: type=gha,mode=max
93+
tags: |
94+
${{ env.IMAGE_NAME }}:local
95+
labels: ${{ steps.meta.outputs.labels }}
96+
build-args: |
97+
KUBE_OVN_VERSION=${{ matrix.kube-ovn-version }}
98+
CACHEBUST=${{ github.sha }}
99+
- name: Run Trivy vulnerability scanner
100+
uses: aquasecurity/[email protected]
101+
if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
102+
with:
103+
image-ref: '${{ env.IMAGE_NAME }}:local'
104+
format: 'sarif'
105+
output: 'trivy-results.sarif'
106+
ignore-unfixed: true
107+
severity: 'CRITICAL,HIGH,MEDIUM'
108+
- name: Upload Trivy scan results to GitHub Security tab
109+
continue-on-error: true
110+
if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
111+
uses: github/codeql-action/upload-sarif@v3
112+
with:
113+
sarif_file: 'trivy-results.sarif'
114+
category: "${{ env.CATEGORY_NAME }}"
115+
- name: Run Trivy scanner
116+
uses: aquasecurity/[email protected]
117+
if: ${{ github.event_name == 'pull_request' }}
118+
with:
119+
image-ref: '${{ env.IMAGE_NAME }}:local'
120+
output: trivy.txt
121+
ignore-unfixed: true
122+
severity: 'CRITICAL,HIGH,MEDIUM'
123+
- name: Create trivy output file in markdown format
124+
if: ${{ github.event_name == 'pull_request' }}
125+
run: |
126+
if [[ -s trivy.txt ]]; then
127+
echo "### Security Output" > trivy-output.txt
128+
echo '```terraform' >> trivy-output.txt
129+
cat trivy.txt >> trivy-output.txt
130+
echo '```' >> trivy-output.txt
131+
fi
132+
- name: Publish Trivy Output to Summary
133+
if: ${{ github.event_name == 'pull_request' }}
134+
run: |
135+
if [[ -s trivy-output.txt ]]; then
136+
{
137+
cat trivy-output.txt
138+
} >> $GITHUB_STEP_SUMMARY
139+
fi
140+
- name: Build and push Docker image
141+
uses: docker/build-push-action@v6
142+
with:
143+
context: .
144+
file: ContainerFiles/kube-ovn
145+
push: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
146+
cache-from: type=gha
147+
cache-to: type=gha,mode=max
148+
tags: |
149+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.kube-ovn-version }}
150+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.kube-ovn-version }}-latest
151+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.kube-ovn-version }}-${{ env.MY_DATE }}
152+
labels: ${{ steps.meta.outputs.labels }}
153+
build-args: |
154+
KUBE_OVN_VERSION=${{ matrix.kube-ovn-version }}
155+
CACHEBUST=${{ github.sha }}

‎ContainerFiles/kube-ovn‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# syntax = docker/dockerfile:1
2+
# This Dockerfile uses multi-stage build to customize DEV and PROD images:
3+
# https://docs.docker.com/develop/develop-images/multistage-build/
4+
5+
ARG KUBE_OVN_VERSION=v1.14.4
6+
FROM golang:1.24-bookworm AS dependency_build
7+
ARG KUBE_OVN_VERSION=v1.14.4
8+
ARG CACHEBUST=0
9+
RUN export DEBIAN_FRONTEND=noninteractive \
10+
&& apt-get update && apt-get upgrade -y \
11+
&& apt-get install --no-install-recommends -y \
12+
git \
13+
build-essential
14+
RUN git clone --recursive https://github.com/kubeovn/kube-ovn /opt/kube-ovn
15+
WORKDIR /opt/kube-ovn
16+
RUN git checkout ${KUBE_OVN_VERSION} && \
17+
git submodule update --init --recursive && \
18+
git submodule foreach --recursive git reset --hard && \
19+
git submodule foreach --recursive git clean -fdx
20+
COPY scripts/kube-ovn.sh /opt/
21+
RUN bash /opt/kube-ovn.sh
22+
RUN make build-go
23+
RUN mv /opt/kube-ovn/dist/images/logrotate/* /etc/logrotate.d/ \
24+
&& rm -rf /opt/kube-ovn/dist/images/logrotate
25+
26+
27+
FROM kubeovn/kube-ovn-base:${KUBE_OVN_VERSION}
28+
# NOTE(cloudnull): Resolves CVE CVE-2025-47268,CVE-2025-48964,CVE-2025-1795,CVE-2025-40909,CVE-2024-12718,CVE-2025-22870,CVE-2025-22872,
29+
# CVE-2025-32988,CVE-2025-32990,CVE-2025-4138,CVE-2025-4330,CVE-2025-4435,CVE-2025-4516,CVE-2025-4517,
30+
# CVE-2025-4877,CVE-2025-4878,CVE-2025-5318,CVE-2025-5351,CVE-2025-5372,CVE-2025-5702,CVE-2025-5987,
31+
# CVE-2025-5994,CVE-2025-6020,CVE-2025-6395,CVE-2025-6965
32+
RUN curl -L http://archive.ubuntu.com/ubuntu/pool/main/a/apt/apt_2.7.14build2_amd64.deb -o /tmp/apt.deb \
33+
&& curl -L http://launchpadlibrarian.net/611243934/gpgv_2.2.27-3ubuntu2.1_amd64.deb -o /tmp/gpgv.deb \
34+
&& dpkg -i /tmp/apt.deb /tmp/gpgv.deb \
35+
&& rm -f /tmp/apt.deb /tmp/gpgv.deb \
36+
&& apt-get update && apt-get upgrade -y \
37+
&& apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \
38+
&& apt-get clean -y
39+
COPY --from=dependency_build /opt/kube-ovn/dist/images/* /kube-ovn/
40+
COPY --from=dependency_build /etc/logrotate.d/* /etc/logrotate.d/
41+
# NOTE(cloudnull): Lifted the following steps from https://github.com/kubeovn/kube-ovn/blob/master/dist/images/Dockerfile
42+
# The kube-ovn-cmd binary is used by all the kube-ovn components.
43+
RUN ln -sf /kube-ovn/kube-ovn-cmd /kube-ovn/kube-ovn-monitor && \
44+
ln -sf /kube-ovn/kube-ovn-cmd /kube-ovn/kube-ovn-speaker && \
45+
ln -sf /kube-ovn/kube-ovn-cmd /kube-ovn/kube-ovn-webhook && \
46+
ln -sf /kube-ovn/kube-ovn-cmd /kube-ovn/kube-ovn-leader-checker && \
47+
ln -sf /kube-ovn/kube-ovn-cmd /kube-ovn/kube-ovn-ic-controller && \
48+
ln -sf /kube-ovn/kube-ovn-controller /kube-ovn/kube-ovn-pinger && \
49+
setcap CAP_NET_BIND_SERVICE+eip /kube-ovn/kube-ovn-cmd && \
50+
setcap CAP_NET_RAW,CAP_NET_BIND_SERVICE+eip /kube-ovn/kube-ovn-controller && \
51+
setcap CAP_NET_ADMIN,CAP_NET_RAW,CAP_NET_BIND_SERVICE,CAP_SYS_ADMIN+eip /kube-ovn/kube-ovn-daemon
52+
RUN ln -sf /kube-ovn/grace_stop_ovn_controller /usr/share/ovn/scripts/grace_stop_ovn_controller
53+
RUN /kube-ovn/iptables-wrapper-installer.sh --no-sanity-check
54+
WORKDIR /kube-ovn

‎docs/containers/kube-ovn.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# kube-ovn
2+
3+
The `kube-ovn` image is built from [ContainerFiles/kube-ovn](https://github.com/rackerlabs/genestack-images/blob/main/ContainerFiles/kube-ovn). This image has no dedicated CVE script; security updates are included during the build.
4+
5+
This container packages the kube-ovn service for use in the stack. The build installs the required packages, applies security updates and configuration, and prepares the service for integration.
6+
7+
``` mermaid
8+
graph LR
9+
A[Base image] --> B[Install packages]
10+
B --> C[Apply CVE patches]
11+
C --> D[Configure kube-ovn]
12+
D --> E[Container ready]
13+
E --> Keystone
14+
```
15+
16+
??? example "ContainerFile used for the build"
17+
18+
``` docker
19+
--8<-- "ContainerFiles/kube-ovn"
20+
```
21+
22+
## Dependencies
23+
24+
- Builds From [Upstream Debian](https://hub.docker.com/_/debian)
25+
26+
## Container Image
27+
28+
The container image is available on [Github Container Registry](https://github.com/rackerlabs/genestack-images/pkgs/container/genestack-images%2Fkube-ovn).

‎scripts/kube-ovn.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/usr/bin/env bash
2+
3+
if [ ${KUBE_OVN_VERSION:-master} = "v1.14.4" ]; then
4+
# CVE fixes CVE-2025-54388,CVE-2025-22870,CVE-2025-22872,CVE-2025-22868
5+
go get -u github.com/docker/docker
6+
go get -u golang.org/x/net
7+
go get -u golang.org/x/oauth2
8+
elif [ ${KUBE_OVN_VERSION:-master} = "v1.13.14" ]; then
9+
# CVE fixes CVE-2025-22870,CVE-2025-22872,CVE-2025-22868
10+
go get -u golang.org/x/net
11+
go get -u golang.org/x/oauth2
12+
fi

0 commit comments

Comments
 (0)