Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Pipeline agent image update from 18.04 to 22.04 | AzSecPack #2327

Merged
merged 7 commits into from
Oct 26, 2023
Merged

fix: Pipeline agent image update from 18.04 to 22.04 | AzSecPack #2327

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
bd29ab6
Use ResolveCtl for Ubuntu22.04
Oct 24, 2023
1aed159
test: debug
jpayne3506 Oct 25, 2023
f76cd0a
test: XDG dir
jpayne3506 Oct 25, 2023
167c1f3
ci: Remove sudo for testvalidate
jpayne3506 Oct 26, 2023
02fe8d6
ci: remove sudo dualstack
jpayne3506 Oct 26, 2023
54fb0b3
ci: remove test scripts
jpayne3506 Oct 26, 2023
fe8ca4f
fix: lint
jpayne3506 Oct 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion .pipelines/containers/manifest-template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,16 @@ steps:
retryCountOnTaskFailure: 3

- script: |
set -e
set -ex
echo "checking XDG_RUNTIME_DIR"
echo $XDG_RUNTIME_DIR
make ${{ parameters.name }}-manifest-push
mkdir -p $(Build.ArtifactStagingDirectory)/images

echo "setting XDG_RUNTIME_DIR"
export XDG_RUNTIME_DIR=/run/user/$(id -u)
echo $XDG_RUNTIME_DIR
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to set this in the task or set this as an env var from the pipeline level?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we set this as an env var in the pipeline then it impacts podman and buildah negatively. This hack is exclusive to skopeo.


make ${{ parameters.name }}-skopeo-archive IMAGE_ARCHIVE_DIR=$(Build.ArtifactStagingDirectory)/images
name: manifest_push
displayName: Manifest Push
Expand Down
6 changes: 3 additions & 3 deletions .pipelines/singletenancy/azure-cni-overlay/azure-cni-overlay-e2e-step-template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ steps:
make -C ./hack/aks azcfg AZCLI=az REGION=$(REGION_AKS_CLUSTER_TEST)
kubectl get pods -owide -A
echo "Validating Node Restart"
sudo CNI_TYPE=cniv2 RESTART_CASE=true go test -timeout 30m -tags load -run ^TestValidateState$
CNI_TYPE=cniv2 RESTART_CASE=true go test -timeout 30m -tags load -run ^TestValidateState$
displayName: "Validate Node Restart"
retryCountOnTaskFailure: 3

Expand All @@ -108,12 +108,12 @@ steps:
kubectl get pod -owide -A
echo "validate pod state before CNS restarts"
cd test/integration/load
sudo CNI_TYPE=cniv2 go test -timeout 30m -tags load -run ^TestValidateState$
CNI_TYPE=cniv2 go test -timeout 30m -tags load -run ^TestValidateState$
kubectl rollout restart ds azure-cns -n kube-system
kubectl rollout status ds azure-cns -n kube-system
kubectl get pod -owide -A
echo "validate pods after CNS restart"
sudo CNI_TYPE=cniv2 go test -timeout 30m -tags load -run ^TestValidateState$
CNI_TYPE=cniv2 go test -timeout 30m -tags load -run ^TestValidateState$
name: "restartCNS_ValidatePodState"
displayName: "Restart CNS and validate pod state"
retryCountOnTaskFailure: 3
Expand Down
16 changes: 8 additions & 8 deletions .pipelines/singletenancy/dualstack-overlay/dualstackoverlay-e2e-step-template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,16 +56,16 @@ steps:
set -e
cd test/integration/load
echo "DualStack Overlay Linux control plane Node properties test"
sudo CNI_TYPE=dualstack go test -timeout 30m -tags load -run ^TestDualStackProperties$
CNI_TYPE=dualstack go test -timeout 30m -tags load -run ^TestDualStackProperties$
echo "DualStack Overlay Linux control plane Load test"
sudo go test -timeout 30m -tags load -run ^TestLoad$
go test -timeout 30m -tags load -run ^TestLoad$
echo "DualStack Overlay Linux control plane CNS validation test"
sudo CNI_TYPE=dualstack go test -timeout 30m -tags load -run ^TestValidateState$
CNI_TYPE=dualstack go test -timeout 30m -tags load -run ^TestValidateState$
cd ../datapath
echo "Dualstack Overlay Linux datapath IPv6 test"
sudo go test -count=1 datapath_linux_test.go -timeout 3m -tags connection -run ^TestDatapathLinux$ -tags=connection,integration -isDualStack=true
go test -count=1 datapath_linux_test.go -timeout 3m -tags connection -run ^TestDatapathLinux$ -tags=connection,integration -isDualStack=true
echo "Dualstack Overlay Linux datapath IPv4 test"
sudo go test -count=1 datapath_linux_test.go -timeout 3m -tags connection -run ^TestDatapathLinux$ -tags=connection,integration
go test -count=1 datapath_linux_test.go -timeout 3m -tags connection -run ^TestDatapathLinux$ -tags=connection,integration
echo "cleaning up load-test namespace"
kubectl delete ns load-test
retryCountOnTaskFailure: 3
Expand Down Expand Up @@ -100,7 +100,7 @@ steps:
make -C ./hack/aks azcfg AZCLI=az REGION=$(REGION_DUALSTACKOVERLAY_CLUSTER_TEST)
kubectl get pods -A
echo "Validating Node Restart"
sudo CNI_TYPE=dualstack RESTART_CASE=true go test -timeout 30m -tags load -run ^TestValidateState$
CNI_TYPE=dualstack RESTART_CASE=true go test -timeout 30m -tags load -run ^TestValidateState$
displayName: "Validate Node Restart"
retryCountOnTaskFailure: 3

Expand All @@ -109,12 +109,12 @@ steps:
kubectl get pod -owide -A
echo "validate pod state before CNS restarts"
cd test/integration/load
sudo CNI_TYPE=dualstack go test -timeout 30m -tags load -run ^TestValidateState$
CNI_TYPE=dualstack go test -timeout 30m -tags load -run ^TestValidateState$
kubectl rollout restart ds azure-cns -n kube-system
kubectl rollout status ds azure-cns -n kube-system
kubectl get pod -owide -A
echo "validate pods after CNS restarts"
sudo CNI_TYPE=dualstack go test -timeout 30m -tags load -run ^TestValidateState$
CNI_TYPE=dualstack go test -timeout 30m -tags load -run ^TestValidateState$
name: "restartCNS_ValidatePodState"
displayName: "Restart CNS and Validate Pod State"
retryCountOnTaskFailure: 3
Expand Down
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -499,7 +499,7 @@ manifest-push: # util target to push multiarch container manifest.
$(CONTAINER_BUILDER) manifest push --all $(IMAGE_REGISTRY)/$(IMAGE):$(TAG) docker://$(IMAGE_REGISTRY)/$(IMAGE):$(TAG)

manifest-skopeo-archive: # util target to export tar archive of multiarch container manifest.
skopeo copy --all docker://$(IMAGE_REGISTRY)/$(IMAGE):$(TAG) oci-archive:$(IMAGE_ARCHIVE_DIR)/$(IMAGE)-$(TAG).tar
skopeo copy --all docker://$(IMAGE_REGISTRY)/$(IMAGE):$(TAG) oci-archive:$(IMAGE_ARCHIVE_DIR)/$(IMAGE)-$(TAG).tar --debug
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to keep this as debug?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe we should as it provides good understanding of what is happening with the *auth.json files IRT skopeo. Future changes to skopeo could break the current hack and future CI changes of this command.


## Build specific multiplat images.

Expand Down
88 changes: 80 additions & 8 deletions network/network_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@
package network

import (
"errors"
"fmt"
"net"
"strconv"
Expand All @@ -16,6 +15,7 @@
"github.com/Azure/azure-container-networking/network/networkutils"
"github.com/Azure/azure-container-networking/ovsctl"
"github.com/Azure/azure-container-networking/platform"
"github.com/pkg/errors"
"go.uber.org/zap"
"golang.org/x/sys/unix"
)
Expand All @@ -39,6 +39,8 @@
LocalIPKey = "localIP"
// InfraVnetIPKey key for infra vnet
InfraVnetIPKey = "infraVnetIP"
// Ubuntu Release Version for checking which command to use.
Ubuntu22 = "22.04"
)

const (
Expand Down Expand Up @@ -243,10 +245,69 @@
return false
}

func (nm *networkManager) systemVersion() (string, error) {
osVersion, err := nm.plClient.ExecuteCommand("lsb_release -rs")
if err != nil {
return osVersion, errors.Wrap(err, "error retrieving the system distribution version")
}
return osVersion, nil
}

func (nm *networkManager) addDomain(ifName, domain string) (string, error) {
osVersion, err := nm.systemVersion()
if err != nil {
return osVersion, err
}

var cmd string
switch {
case strings.HasPrefix(osVersion, Ubuntu22):
cmd = fmt.Sprintf("resolvectl domain %s %s", ifName, domain)
default:
cmd = fmt.Sprintf("systemd-resolve --interface %s --set-domain %s", ifName, domain)
}
return cmd, nil
}

func (nm *networkManager) addDNSServers(ifName string, dnsServers []string) (string, error) {
osVersion, err := nm.systemVersion()
if err != nil {
return osVersion, err
}

var cmd string
switch {
case strings.HasPrefix(osVersion, Ubuntu22):
cmd = fmt.Sprintf("resolvectl dns %s %s", ifName, strings.Join(dnsServers, " "))
default:
cmd = fmt.Sprintf("systemd-resolve --interface %s %s", ifName, strings.Join(dnsServers, "--set-dns "))
}
return cmd, nil
}

func (nm *networkManager) ifNameStatus(ifName string) (string, error) {
osVersion, err := nm.systemVersion()
if err != nil {
return osVersion, err
}
var cmd string
switch {
case strings.HasPrefix(osVersion, Ubuntu22):
cmd = fmt.Sprintf("resolvectl status %s", ifName)
default:
cmd = fmt.Sprintf("systemd-resolve --status %s", ifName)
}
return cmd, nil
}

func (nm *networkManager) readDNSInfo(ifName string) (DNSInfo, error) {
var dnsInfo DNSInfo

cmd := fmt.Sprintf("systemd-resolve --status %s", ifName)
cmd, err := nm.ifNameStatus(ifName)
if err != nil {
return dnsInfo, err
}

out, err := nm.plClient.ExecuteCommand(cmd)
if err != nil {
return dnsInfo, err
Expand Down Expand Up @@ -333,7 +394,8 @@

func (nm *networkManager) applyDNSConfig(extIf *externalInterface, ifName string) error {
var (
setDnsList string
setDNSList []string
cmd string
err error
)

Expand All @@ -344,21 +406,31 @@
continue
}

buf := fmt.Sprintf("--set-dns=%s", server)
setDnsList = setDnsList + " " + buf
setDNSList = append(setDNSList, server)
}

if setDnsList != "" {
cmd := fmt.Sprintf("systemd-resolve --interface=%s%s", ifName, setDnsList)
if len(setDNSList) > 0 {
cmd, err = nm.addDNSServers(ifName, setDNSList)
if err != nil {
return err
}

_, err = nm.plClient.ExecuteCommand(cmd)
if err != nil {
return err
}
}

if extIf.DNSInfo.Suffix != "" {
cmd := fmt.Sprintf("systemd-resolve --interface=%s --set-domain=%s", ifName, extIf.DNSInfo.Suffix)
cmd, err = nm.addDomain(ifName, extIf.DNSInfo.Suffix)
if err != nil {
return err
}

_, err = nm.plClient.ExecuteCommand(cmd)
if err != nil {
return err

Check failure on line 432 in network/network_linux.go

View workflow job for this annotation

GitHub Actions / Lint (1.20.x, ubuntu-latest) 

error returned from interface method should be wrapped: sig: func (github.com/Azure/azure-container-networking/platform.ExecClient).ExecuteCommand(command string) (string, error) (wrapcheck)
}
}

}
Expand Down
Loading