atlas-botandClaude Opus 5.5
b6226b483b
Refresh the plugins pin alongside multus v4.3.1 (#1131), as the cni-plugins-installer.yaml comment asks. SHA256 cross-checked against upstream's cni-plugins-linux-amd64-v1.9.1.tgz.sha256 asset. The tarball still ships macvlan, static, host-local and dhcp. Image only: CI builds cni-plugins:<date>. The DaemonSet tag bump follows in a separate PR once the image exists. Refs: REN-722 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
69 lines
3.6 KiB
Docker
69 lines
3.6 KiB
Docker
# Upstream containernetworking/plugins binaries, baked in at build time.
|
|
#
|
|
# WHY THIS IMAGE EXISTS
|
|
# The multus cni-plugins-installer DaemonSet used to fetch this tarball from
|
|
# GitHub on the node itself, at node-provisioning time, and extract it straight
|
|
# into /opt/cni/bin. Two problems with that:
|
|
#
|
|
# 1. Security. The download had NO integrity verification — wget, then tar,
|
|
# into a directory whose contents are executed as root in the CNI path on
|
|
# every node. A tampered or MITM'd artifact would have got privileged
|
|
# execution cluster-wide, with nothing to detect it.
|
|
# 2. Node rebuild. It put a live dependency on github.com (and previously the
|
|
# Alpine package index too) on the critical path of bringing a node up, so
|
|
# a GitHub outage or slow transfer stalled or broke CNI installation
|
|
# exactly when a node was being rebuilt.
|
|
#
|
|
# Baking the binaries in fixes both: the fetch happens once, here, where the
|
|
# checksum IS verified, and the installer becomes a local file copy with no
|
|
# network at all.
|
|
#
|
|
# The version and digest are pinned literals, so bumping them is a reviewable
|
|
# commit rather than a silent change in what runs on every node. The digest was
|
|
# cross-checked against upstream's own published
|
|
# cni-plugins-linux-amd64-<version>.tgz.sha256 asset rather than merely recorded
|
|
# from a local download — a download can be tampered with; the point of the
|
|
# check is to compare against what upstream states.
|
|
#
|
|
# amd64 only, matching the ARCH the installer already hardcoded and the cluster's
|
|
# node architecture. Add a second stage if a different arch is ever needed.
|
|
|
|
FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS fetch
|
|
|
|
ARG CNI_PLUGINS_VERSION=v1.9.1
|
|
ARG CNI_PLUGINS_SHA256=b98f74a0f8522f0a83867178729c1aa70f2158f90c45a2ca8fa791db1c76b303
|
|
|
|
# busybox wget and tar are already in the base; nothing is installed here
|
|
# either. sha256sum -c fails the BUILD if the artifact does not match, which is
|
|
# the whole point — a bad download must never reach a node.
|
|
RUN set -eu; \
|
|
F="cni-plugins-linux-amd64-${CNI_PLUGINS_VERSION}.tgz"; \
|
|
wget -q -O "/tmp/${F}" \
|
|
"https://github.com/containernetworking/plugins/releases/download/${CNI_PLUGINS_VERSION}/${F}"; \
|
|
echo "${CNI_PLUGINS_SHA256} /tmp/${F}" | sha256sum -c -; \
|
|
mkdir -p /plugins; \
|
|
tar -xzf "/tmp/${F}" -C /plugins; \
|
|
rm -f "/tmp/${F}"; \
|
|
# Drop the non-executable payload: the tarball ships LICENSE and README.md,
|
|
# which the old installer extracted into /opt/cni/bin alongside the binaries.
|
|
rm -f /plugins/LICENSE /plugins/README.md; \
|
|
# Fail loudly here rather than shipping an image that silently installs
|
|
# nothing, if upstream ever restructures the archive.
|
|
#
|
|
# This list must cover every plugin the repo actually depends on, not just
|
|
# the ones the installer happens to log. `dhcp` is included because the
|
|
# sibling cni-dhcp-daemon DaemonSet runs that binary and documents that it
|
|
# ships from here (see kubernetes/infrastructure/multus/cni-dhcp-daemon.yaml)
|
|
# — without it in the check, upstream dropping `dhcp` while keeping the
|
|
# others would build green and only surface later as a broken DHCP daemon on
|
|
# whichever node rolled first.
|
|
for p in macvlan static host-local dhcp; do \
|
|
[ -x "/plugins/$p" ] || { echo "FATAL: /plugins/$p missing or not executable" >&2; exit 1; }; \
|
|
done
|
|
|
|
FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
|
|
|
|
# Alpine rather than scratch: the installer needs a shell to copy the binaries
|
|
# onto the host. busybox covers cp/mv/chown/ls, so nothing is added.
|
|
COPY --from=fetch /plugins/ /opt/cni-plugins/
|