85 lines
4.1 KiB
Docker
85 lines
4.1 KiB
Docker
FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
|
|
|
|
# Everything `bootstrap.sh vmtest` needs, so the rebuild test can run as a Job in
|
|
# the cluster instead of on a workstation. The workstation has 31G and the test
|
|
# wants ~14.5G for four VMs — a single run left under 1G headroom, and two
|
|
# overlapping runs OOM-killed the session. The nodes have ~94G with 70G free.
|
|
#
|
|
# Separate from ci-k8s rather than built on it: that image pins talosctl v1.12.6,
|
|
# and this test creates a cluster at the version talos/patches/cluster.yaml
|
|
# installs. A talosctl older than the Talos it provisions is exactly the kind of
|
|
# skew the test exists to catch, so it must not be baked in here.
|
|
#
|
|
# KEEP TALOS_VERSION IN STEP with the installer image tag in
|
|
# kubernetes/talos/patches/cluster.yaml. The phase reads the version from that
|
|
# file at run time and passes it to the provisioner; this pin only decides which
|
|
# client talks to it.
|
|
ARG TALOS_VERSION=v1.13.10
|
|
ARG KUBECTL_VERSION=v1.36.2
|
|
ARG FLUX_VERSION=2.9.2
|
|
ARG KOPIA_VERSION=0.23.1
|
|
|
|
# qemu-system-x86_64 and qemu-img are the provisioner's actual backend, and ovmf
|
|
# supplies the UEFI firmware those VMs boot from — without it the provisioner
|
|
# stops with "the required flash image was not found in any of the expected
|
|
# paths", having already downloaded the ISO and generated the PKI. Note the
|
|
# firmware comes from ovmf specifically: qemu-system-x86_64 ships an edk2 CODE
|
|
# image but no VARS, which is the half the provisioner needs.
|
|
#
|
|
# iptables is shelled out to by the CNI plugins that build the VM network; the
|
|
# provisioner fails with "error accessing iptables" without it. The rest is
|
|
# what the phase shells out to: helm for the Cilium install, yq to read the
|
|
# HelmRelease and the installer image, jq for OpenBao's seal status.
|
|
#
|
|
# Versions come from the digest-pinned base rather than being pinned one by one,
|
|
# the same way ci-ansible does it.
|
|
RUN apk add --no-cache \
|
|
bash \
|
|
ca-certificates \
|
|
curl \
|
|
git \
|
|
helm \
|
|
iptables \
|
|
jq \
|
|
openssl \
|
|
ovmf \
|
|
qemu-img \
|
|
qemu-system-x86_64 \
|
|
yq
|
|
|
|
RUN curl -sfL -o /usr/local/bin/talosctl \
|
|
"https://github.com/siderolabs/talos/releases/download/${TALOS_VERSION}/talosctl-linux-amd64" \
|
|
&& echo "28e9ccd9aebd690fa03d8cf2582221d87ea38b2a1704f411d75a03589c58f2aa /usr/local/bin/talosctl" | sha256sum -c - \
|
|
&& chmod +x /usr/local/bin/talosctl
|
|
|
|
RUN curl -sfL -o /usr/local/bin/kubectl \
|
|
"https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
|
|
&& curl -sfL -o /tmp/kubectl.sha256 \
|
|
"https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256" \
|
|
&& echo "$(cat /tmp/kubectl.sha256) /usr/local/bin/kubectl" | sha256sum -c - \
|
|
&& rm -f /tmp/kubectl.sha256 \
|
|
&& chmod +x /usr/local/bin/kubectl
|
|
|
|
RUN curl -sfL -o /tmp/flux.tar.gz \
|
|
"https://github.com/fluxcd/flux2/releases/download/v${FLUX_VERSION}/flux_${FLUX_VERSION}_linux_amd64.tar.gz" \
|
|
&& echo "4092b367fd060097976fb7261601f79420ecf7266328417dfd8dfee27de0e6a3 /tmp/flux.tar.gz" | sha256sum -c - \
|
|
&& tar -xzf /tmp/flux.tar.gz -C /usr/local/bin flux \
|
|
&& chmod +x /usr/local/bin/flux \
|
|
&& rm -f /tmp/flux.tar.gz
|
|
|
|
# kopia reads the Velero backup repository directly, which is what the OpenBao
|
|
# restore does when there is no Velero yet to do it: the credentials Velero
|
|
# needs live in OpenBao, so OpenBao cannot be restored by Velero. Its absence
|
|
# was found by a rebuild rehearsal reaching the restore for the first time and
|
|
# stopping at "kopia not found".
|
|
#
|
|
# Same checksum-verified download as the tools above; the tarball unpacks into
|
|
# a versioned directory, so the binary is pulled out by name.
|
|
RUN curl -sfL -o /tmp/kopia.tar.gz \
|
|
"https://github.com/kopia/kopia/releases/download/v${KOPIA_VERSION}/kopia-${KOPIA_VERSION}-linux-x64.tar.gz" \
|
|
&& echo "416d0f84a3dbb321a8b2d8f0997b1a0a6e915babe79ee76fa6e4d2bd1e1c5178 /tmp/kopia.tar.gz" | sha256sum -c - \
|
|
&& tar -xzf /tmp/kopia.tar.gz -C /tmp \
|
|
&& mv "/tmp/kopia-${KOPIA_VERSION}-linux-x64/kopia" /usr/local/bin/kopia \
|
|
&& chmod +x /usr/local/bin/kopia \
|
|
&& rm -rf /tmp/kopia.tar.gz "/tmp/kopia-${KOPIA_VERSION}-linux-x64"
|