build: Replace CentOS 7 base images with Rocky Linux #3773

gdemonet · 2022-05-18T07:41:50Z

Component: build

Context: There are some CVEs (notably CVE-2018-25032) for which a fix is only available in Red Hat 8 repositories, so we want to take a safer bet by running on a more recent base OS

Summary: The base image for metalk8s-utils and salt-master is changed from centos:7 to rockylinux:8.5.

Acceptance criteria: Everything keeps working as before.

bert-e · 2022-05-18T07:41:51Z

Hello gdemonet,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Status report is not available.

bert-e · 2022-05-18T07:41:56Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
one peer

Peer approvals must include at least 1 approval from the following list:

TeddyAndrieux

Overall LGTM, we will see if it pass the CI

Wondering if there is a reason to pick RockyLinux instead of Ubi for example ? (just asking I have no strong opinion on this choice)

images/metalk8s-utils/Dockerfile

TeddyAndrieux · 2022-05-18T08:57:30Z

images/metalk8s-utils/configure-repos.sh

-baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el$CENTOS_VERSION-x86_64
+baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64


Oh, sad, el8 packages are also available on kubernetes-el7... make sense 🙃

Yeah... 🤷

images/salt-master/Dockerfile

TeddyAndrieux · 2022-05-18T08:59:25Z

images/salt-master/Dockerfile

 && pip3 install pip==20.1 \
 && pip3 install "etcd3 != 0.11.0" \
- && yum install -y git \
+ && dnf install -y git \
 && pip3 install "git+https://github.com/kubernetes-client/python.git@cef5e9bd10a6d5ca4d9c83da46ccfe2114cdaaf8#egg=kubernetes" \


(not necessarily part of this PR, but I think we can now move to a "real" version of python-kubernetes since we do not really rely on it)

Will open a ticket then!

gdemonet · 2022-05-18T17:31:05Z

Wondering if there is a reason to pick RockyLinux instead of Ubi for example ? (just asking I have no strong opinion on this choice)

For metalk8s-utils, UBI was really missing too many packages (it doesn't have most core repos), so it was going to be a pain to download all the missing ones from various places, Rocky made more sense to me.
For salt-master, well, since we already have one base image in the ISO, I decided to use the same one to avoid increasing the storage consumption.

bert-e · 2022-05-19T12:50:27Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
one peer

Peer approvals must include at least 1 approval from the following list:

bert-e · 2022-05-23T10:00:45Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
one peer

Peer approvals must include at least 1 approval from the following list:

bert-e · 2022-05-25T06:10:57Z

Conflict

There is a conflict between your branch improvement/bump-centos-base-images and the
destination branch development/123.0.

Please resolve the conflict on the feature branch (improvement/bump-centos-base-images).

git fetch && \
git checkout origin/improvement/bump-centos-base-images && \
git merge origin/development/123.0

Resolve merge conflicts and commit

git push origin HEAD:improvement/bump-centos-base-images

salt/metalk8s/map.jinja

bert-e · 2022-05-25T09:11:34Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
one peer

Peer approvals must include at least 1 approval from the following list:

TeddyAndrieux · 2022-05-25T16:37:04Z

images/salt-master/Dockerfile

 && pip3 install pip==20.1 \
 && pip3 install "etcd3 != 0.11.0" \


nitpick: It's not consistent 😢

Suggested change

&& pip3 install pip==20.1 \

&& pip3 install "etcd3 != 0.11.0" \

&& pip3 install "pip == 20.1" \

&& pip3 install "etcd3 != 0.11.0" \

bert-e · 2022-05-25T18:42:44Z

Conflict

There is a conflict between your branch improvement/bump-centos-base-images and the
destination branch development/123.0.

Please resolve the conflict on the feature branch (improvement/bump-centos-base-images).

git fetch && \
git checkout origin/improvement/bump-centos-base-images && \
git merge origin/development/123.0

Resolve merge conflicts and commit

git push origin HEAD:improvement/bump-centos-base-images

bert-e · 2022-05-31T06:26:57Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
one peer

Peer approvals must include at least 1 approval from the following list:

The `images/metalk8s-utils/configure-repos.sh` script was taking a "CENTOS_VERSION" argument, but it appears the repository used for all Red Hat-based distros is always the same, whether it's a 7 or 8 major. So we remove this argument entirely, until this statement changes.

This will reduce the chances of being affected by CVEs on CentOS 7 not being resolved in upstream repos, and ensure a more consistent experience with the more common Red Hat 8 distributions which will be used under MetalK8s. Note that we also remove the `jnettop` tool (which is old, and not available in EPEL 8), and install `iftop` instead.

This will avoid CVEs affecting CentOS 7 packages which may not be fixed upstream.

We are not using CentOS 7 anymore (replaced by Rocky Linux), so let's not keep this variable around.

To get rid of https://nvd.nist.gov/vuln/detail/CVE-2018-25032 in salt-master and metalk8s-utils, and avoid future similar issues, we keep the images updated by issuing a `dnf update` at build-time.

gdemonet · 2022-06-01T08:07:40Z

/approve

bert-e · 2022-06-01T08:07:51Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
one peer

Peer approvals must include at least 1 approval from the following list:

The following options are set: approve

TeddyAndrieux

bert-e · 2022-06-01T08:43:04Z

In the queue

The changeset has received all authorizations and has been added to the
relevant queue(s). The queue(s) will be merged in the target development
branch(es) as soon as builds have passed.

The changeset will be merged in:

✔️ development/123.0

The following branches will NOT be impacted:

development/2.0
development/2.1
development/2.10
development/2.11
development/2.2
development/2.3
development/2.4
development/2.5
development/2.6
development/2.7
development/2.8
development/2.9

There is no action required on your side. You will be notified here once
the changeset has been merged. In the unlikely event that the changeset
fails permanently on the queue, a member of the admin team will
contact you to help resolve the matter.

IMPORTANT

Please do not attempt to modify this pull request.

Any commit you add on the source branch will trigger a new cycle after the
current queue is merged.
Any commit you add on one of the integration branches will be lost.

If you need this pull request to be removed from the queue, please contact a
member of the admin team now.

The following options are set: approve

bert-e · 2022-06-01T10:38:45Z

I have successfully merged the changeset of this pull request
into targetted development branches:

✔️ development/123.0

The following branches have NOT changed:

development/2.0
development/2.1
development/2.10
development/2.11
development/2.2
development/2.3
development/2.4
development/2.5
development/2.6
development/2.7
development/2.8
development/2.9

Please check the status of the associated issue None.

Goodbye gdemonet.

gdemonet force-pushed the improvement/bump-centos-base-images branch from 6b9a30e to a514e5b Compare May 18, 2022 07:44

gdemonet marked this pull request as ready for review May 18, 2022 07:45

gdemonet requested a review from a team as a code owner May 18, 2022 07:45

gdemonet force-pushed the improvement/bump-centos-base-images branch from 4d5d863 to 1034c82 Compare May 18, 2022 08:36

TeddyAndrieux reviewed May 18, 2022

View reviewed changes

gdemonet force-pushed the improvement/bump-centos-base-images branch from 1034c82 to 006c3e1 Compare May 18, 2022 17:37

gdemonet force-pushed the improvement/bump-centos-base-images branch 4 times, most recently from 6c537c8 to 563b5a4 Compare May 25, 2022 06:10

TeddyAndrieux reviewed May 25, 2022

View reviewed changes

salt/metalk8s/map.jinja Outdated Show resolved Hide resolved

gdemonet force-pushed the improvement/bump-centos-base-images branch from 563b5a4 to a63bbc9 Compare May 25, 2022 09:11

TeddyAndrieux reviewed May 25, 2022

View reviewed changes

gdemonet force-pushed the improvement/bump-centos-base-images branch from 3398ee5 to e59df61 Compare May 31, 2022 06:26

gdemonet force-pushed the improvement/bump-centos-base-images branch from e59df61 to f8ef487 Compare May 31, 2022 06:31

gdemonet added 5 commits May 31, 2022 16:06

build: Change base to rockylinux for salt-master

82fe23a

This will avoid CVEs affecting CentOS 7 packages which may not be fixed upstream.

build: Remove CentOS 7 base image reference

64fd213

We are not using CentOS 7 anymore (replaced by Rocky Linux), so let's not keep this variable around.

build: Keep rockylinux-based images updated

e4b7c6c

To get rid of https://nvd.nist.gov/vuln/detail/CVE-2018-25032 in salt-master and metalk8s-utils, and avoid future similar issues, we keep the images updated by issuing a `dnf update` at build-time.

gdemonet force-pushed the improvement/bump-centos-base-images branch from f8ef487 to e4b7c6c Compare May 31, 2022 14:06

TeddyAndrieux approved these changes Jun 1, 2022

View reviewed changes

bert-e merged commit 50ff721 into development/123.0 Jun 1, 2022

bert-e deleted the improvement/bump-centos-base-images branch June 1, 2022 10:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build: Replace CentOS 7 base images with Rocky Linux #3773

build: Replace CentOS 7 base images with Rocky Linux #3773

gdemonet commented May 18, 2022

bert-e commented May 18, 2022

bert-e commented May 18, 2022

TeddyAndrieux left a comment

TeddyAndrieux May 18, 2022

gdemonet May 18, 2022

TeddyAndrieux May 18, 2022

gdemonet May 18, 2022

gdemonet commented May 18, 2022

bert-e commented May 19, 2022

bert-e commented May 23, 2022

bert-e commented May 25, 2022

bert-e commented May 25, 2022

TeddyAndrieux May 25, 2022

bert-e commented May 25, 2022

bert-e commented May 31, 2022

gdemonet commented Jun 1, 2022

bert-e commented Jun 1, 2022

TeddyAndrieux left a comment

bert-e commented Jun 1, 2022

bert-e commented Jun 1, 2022

		baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el$CENTOS_VERSION-x86_64
		baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64

		&& pip3 install pip==20.1 \
		&& pip3 install "etcd3 != 0.11.0" \

build: Replace CentOS 7 base images with Rocky Linux #3773

build: Replace CentOS 7 base images with Rocky Linux #3773

Conversation

gdemonet commented May 18, 2022

bert-e commented May 18, 2022

Hello gdemonet,

bert-e commented May 18, 2022

Waiting for approval

TeddyAndrieux left a comment

Choose a reason for hiding this comment

TeddyAndrieux May 18, 2022

Choose a reason for hiding this comment

gdemonet May 18, 2022

Choose a reason for hiding this comment

TeddyAndrieux May 18, 2022

Choose a reason for hiding this comment

gdemonet May 18, 2022

Choose a reason for hiding this comment

gdemonet commented May 18, 2022

bert-e commented May 19, 2022

Waiting for approval

bert-e commented May 23, 2022

Waiting for approval

bert-e commented May 25, 2022

Conflict

bert-e commented May 25, 2022

Waiting for approval

TeddyAndrieux May 25, 2022

Choose a reason for hiding this comment

bert-e commented May 25, 2022

Conflict

bert-e commented May 31, 2022

Waiting for approval

gdemonet commented Jun 1, 2022

bert-e commented Jun 1, 2022

Waiting for approval

TeddyAndrieux left a comment

Choose a reason for hiding this comment

bert-e commented Jun 1, 2022

In the queue

bert-e commented Jun 1, 2022