Also update build/pause/cloudbuild.yaml and build/dependencies.yaml to
keep them in sync with test/images/cloudbuild.yaml, fixing the
verify-external-dependencies-version check.
This commit will use jq docker image to parse
`windows-pause-image-base` manifest for windows pause build.
Signed-off-by: ArkaSaha30 <arkasaha30@gmail.com>
this is a staging repository, which has lower security than registry.k8s.io, so we should REALLY be pinning it.
TODO: This is one of the few places we still depend on GCR to build things. We should consider promoting this image to registry.k8s.io or using a different image.
The issue this workaround set out to address has been resolved in
buildx for some time; there is no longer a need to preserve it.
Signed-off-by: Bjorn Neergaard <bneergaard@mirantis.com>
This change allows the `TAG` value in the pause Makefile to be
overridden from the environment. Defaults to existing hard-coded value
in `build/pause/Makefile`
For manifest lists containing Windows images, it is important to also have the "os.version"
annotation set, as it is needed by the Windows nodes, so they can pull the appropriate image
from the list.
Previously, the docker manifest CLI did not have the capability to set it, so, we had to set
it outselves in the manifest list's image JSON file. This is no longer necessary since
docker 20.10.0, which includes docker manifest annotate --os-version.
The docker installed in the image gcr.io/k8s-testimages/gcb-docker-gcloud:v20210622-762366a
satisfies this version requirement.
Update dependencies and the test images to use pause 3.5. We also
provide a changelog entry for the new container image version.
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
kube-cross:v1.16.3-1 contains x86_64-w64-mingw32, which will allow us to
build Windows binaries. With this, we won't have to rely on the dockerhub
image dockcross/windows-static-x64.
We now build the pause image to use a pseudo user and group 65535:65535.
This increases the security aspect of the container image, if a
vulnerability would directly affect the pause container.
Signed-off-by: Sascha Grunert <sgrunert@suse.com>
Not all instances of docker run has the --rm argument, which means that they'll
persist after they've finished. This can cause storage to remain occupied needlessly.
The ``.container-$OS-$ARCH`` make subaction is creating files with the same name, and ``clean`` is meant to delete them. However, the ``clean``'s rm regex is not quite correct.
A new Windows image has been released in the second half of 2020 with the tag 20H2.
We are going to need a pause image for it as well.
The image tag can be found here: https://hub.docker.com/_/microsoft-windows-nanoserver
It has been observed that the DiagTrack service in the pause
image is consuming a non-trivial amount of CPU. We don't need
this service in the pause image, so we should disable it.
We can disable the service by running chntpw in a docker buildx Linux stage
and then copy the SYSTEM file back to the final Windows image.
Co-Authored-By: Mark Rossetti <marosset@microsoft.com>
Co-Authored-By: Davanum Srinivas <davanum@gmail.com>
We can use docker buildx in order to build and push Windows images from the same Linux
node, as long as the Dockerfile does not have any RUN commands in the Windows step.
We also need to create a non-default builder instance in order to be able to
build and push Windows images.
The Windows images have to be built and pushed directly to the registry. Because of
this, the make target "push" has been removed (the target "all" will build and push
the images).
We need wincat for a few kubectl proxy scenarios.
For Windows containers without Hyper-V isolation, the host OS Version and the
Container OS Version need to match, which is why we added multiple Windows OS Versions
to the building process.
Adds support for Windows OS Versions: 1809, 1903, 1909, 2004.
Bumps pause image version to 3.4.
Co-Authored-By: Claudiu Belu <cbelu@cloudbasesolutions.com>
Co-Authored-By: Ben Moss <bmoss@pivotal.io>
Signed-off-by: Leah Hanson <lhanson@pivotal.io>
- Eliminates a failure in one image build from prevent the others
- Allows subdir approvers ownership over individual builds
- Makes cleanup a little easier if one or more of these images go away
Signed-off-by: Stephen Augustus <saugustus@vmware.com>
- Search/replace Google Infra kube-cross locations for K8s Infra
- Update kube-cross make targets
- Don't attempt to pre-pull image (docker build --pull)
This prevents CI failures when the image under test doesn't exist
yet in the registry.
- 'make all' now builds and pushes the kube-cross image
- Allow 'TAG' to be specified via env var
- Use 'KUBE_CROSS_VERSION' to represent the kube-cross version
- Tag kube-cross images with both a kubernetes version
('git describe') and a kube-cross version
- Add a GCB (Google Cloud Build) config file (cloudbuild.yaml)
Signed-off-by: Stephen Augustus <saugustus@vmware.com>
Davanum Srinivas