releng/k8s-ci-builder base image: update to bookworm

[pacoxu]

kubernetes/kubernetes#122939 (comment)

Fixes kubernetes/kubernetes#122939

/priority critical-urgent

/sig release
/area release-eng
/assign @saschagrunert @xmudrii

to fix https://testgrid.k8s.io/sig-release-master-blocking#build-master-fast

None

[pacoxu]

/kind failing-test

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: pacoxu
Once this PR has been reviewed and has the lgtm label, please ask for approval from saschagrunert. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[pacoxu]

release/images/releng/k8s-ci-builder/Makefile

Line 20 in d5a2bc9

CONFIG ?= default

The ci is using default.

[pacoxu]

We have this, so just remove line 439-440.

[pacoxu]

Change this as https://testgrid.k8s.io/sig-release-1.28-blocking#build-1.28 started to fail as well.

[pacoxu]

root@65317feff64c:/# systemd --version
systemd 252 (252.19-1~deb12u1)
+PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified
root@65317feff64c:/# cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"

I add the last commit to comment it.

docker/cli#4807 (comment)

In debian booworm, it sounds like enough.

root@65317feff64c:/# sed -i 's/ulimit -Hn/# ulimit -Hn/g' /etc/init.d/docker
root@65317feff64c:/#   service docker start
Starting Docker: docker.

root@65317feff64c:/# cat /etc/init.d/docker | grep ulimit
		# ulimit -Hn 524288
root@65317feff64c:/# ulimit -Sn
1048576
root@65317feff64c:/# ulimit -Hn
1048576

1048576 > 524288

[xmudrii]

/hold for discussion

[xmudrii]

Thank you for opening this PR! Generally this looks good, however, this change is not as simple as it might seem and I'd like that we discuss it more in-depth.

If we update k8s-ci-builder, we should/must also update k8s-cloud-builder. Otherwise, we'll be releasing binaries using bullseye, but test binaries using bookworm. While it might be fine, it poses some risk that we should take into the consideration.

However, if we update k8s-cloud-builder, we'll be running into #3246. This might be acceptable for v1.30, but IMO it's not acceptable for earlier releases as it'll change what operating system versions we support.

As mentioned in the issue (kubernetes/kubernetes#122939 (comment)), let's see how feasible it is to pin Docker to a lower version. That way we don't affect users while we'll hopefully unblock CI.

[pacoxu]

However, if we update k8s-cloud-builder, we'll be running into #3246. This might be acceptable for v1.30, but IMO it's not acceptable for earlier releases as it'll change what operating system versions we support.

If so, I'd like to fix the issue with lower docker version now.

Besides, we should think about change the minimal kernel version plan. I have an open issue in kubernetes/kubernetes#116799.

[pacoxu]

@xmudrii thanks for your detailed explanation.

I opened #3430 to lock the docker version.

This may need more investigation for #3246.

[k8s-ci-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[xmudrii]

@pacoxu Can we close this PR for now?

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Mark this PR as fresh with /remove-lifecycle stale
• Close this PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Mark this PR as fresh with /remove-lifecycle rotten
• Close this PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[xmudrii]

/close

[k8s-ci-robot]

@xmudrii: Closed this PR.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[xmudrii]

@pacoxu Please feel free to reopen and rebase the PR if you think it's still needed!