cleanup: Base image workflow improvements #90665

justaugustus · 2020-05-01T07:22:18Z

What type of PR is this?
/kind cleanup
/area dependency security

What this PR does / why we need it:

Remove HOME env from debian-{base,iptables} GCB configs
Split out building for debian-{base,iptables} and pause images
- Eliminates a failure in one image build from prevent the others
- Allows subdir approvers ownership over individual builds
- Makes cleanup a little easier if one or more of these images go away
Add build-image OWNERS to debian-{base,iptables} and pause dirs
Add base images to dependencies.yaml
Dependencies for each image are broken up into two sections to allow the dependency check to pass:
- image:tag: versions that should be bumped in order to build the image
- image:tag: dependents: dependents that need to be bumped after the image has been built and promoted
Build pause:3.3 image
Build debian-base:v2.1.0 image
Fix base image versions on dependents

Which issue(s) this PR fixes:

Fixes #
Tracking issue: #90698

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

Signed-off-by: Stephen Augustus <saugustus@vmware.com>

- Eliminates a failure in one image build from prevent the others - Allows subdir approvers ownership over individual builds - Makes cleanup a little easier if one or more of these images go away Signed-off-by: Stephen Augustus <saugustus@vmware.com>

Signed-off-by: Stephen Augustus <saugustus@vmware.com>

justaugustus · 2020-05-01T07:37:01Z

/kind cleanup
/area dependency security
/priority important-soon

Signed-off-by: Stephen Augustus <saugustus@vmware.com>

justaugustus · 2020-05-01T08:40:05Z

/assign @dims @BenTheElder
cc: @tallclair @kubernetes/release-engineering

EDIT: moved the checklist to the PR description

BenTheElder · 2020-05-01T22:33:12Z

build/pause/Makefile

@@ -18,7 +18,7 @@ REGISTRY ?= staging-k8s.gcr.io
 IMAGE = $(REGISTRY)/pause
 IMAGE_WITH_ARCH = $(IMAGE)-$(ARCH)

-TAG = 3.2
+TAG = 4.0


what changed in pause? bumping pause is a headache

From Slack, we decided to bump the major versions to represent them being moved over to K8s Infra.

Content-wise, I'm not sure there are discernible changes.

What's involved in the pause bump?
If it's a really big hassle, I'm fine with backing that out.
Here, I'm more concerned with getting the debian-base and debian-iptables images in a buildable state on K8s Infra.

bumping pause requires all the deployment tools (kubeadm, ...) + dockershim (kubelet) + container runtimes (containerd, crio) to need to update to the new image and ideally align on this.

if there are content changes it needs bumping though ...
given that it's just switching build systems, I would expect 3.3, semantically we're not altering compatibility are we?

@BenTheElder -- Good point. We're not altering compatibility, AFAICT.
I've set the pause image version to 3.3.

Also, brought the debian-base version to v2.1.0.

justaugustus · 2020-05-01T22:55:09Z

/retest

Signed-off-by: Stephen Augustus <saugustus@vmware.com>

justaugustus · 2020-05-02T01:55:31Z

/hold for merge of kubernetes/test-infra#17485

justaugustus · 2020-05-02T06:29:26Z

/hold cancel
(Since kubernetes/test-infra#17485 has merged.)

BenTheElder · 2020-05-02T06:41:54Z

build/pause/Makefile

@@ -18,7 +18,7 @@ REGISTRY ?= staging-k8s.gcr.io
 IMAGE = $(REGISTRY)/pause
 IMAGE_WITH_ARCH = $(IMAGE)-$(ARCH)

-TAG = 3.2
+TAG = 3.3


we should make sure we follow up on this and let some folks know they need to do this again.

fyi @dims for containerd

Ack @BenTheElder

Now both of you get some sleep! it's an order

BenTheElder · 2020-05-02T06:42:08Z

/lgtm
/approve

k8s-ci-robot · 2020-05-02T06:42:53Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: BenTheElder, justaugustus

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~build/OWNERS~~ [BenTheElder]
~~cluster/OWNERS~~ [BenTheElder]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

justaugustus · 2020-05-02T06:50:21Z

Thanks Ben! ❤️

justaugustus added 3 commits May 1, 2020 03:20

build: Remove HOME env from debian-{base,iptables} GCB configs

42bb148

Signed-off-by: Stephen Augustus <saugustus@vmware.com>

build: Add build-image OWNERS to debian-{base,iptables} and pause dirs

8b47cbb

Signed-off-by: Stephen Augustus <saugustus@vmware.com>

k8s-ci-robot requested review from BenTheElder and freehan May 1, 2020 07:23

justaugustus mentioned this pull request May 1, 2020

releng: Split out building for debian-{base,iptables} and pause images kubernetes/test-infra#17476

Merged

k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels May 1, 2020

build: Alpha-sort dependencies.yaml

82c2ce9

Signed-off-by: Stephen Augustus <saugustus@vmware.com>

justaugustus changed the title ~~[WIP] Base images~~ [WIP] cleanup: Base image workflow improvements May 1, 2020

k8s-ci-robot assigned BenTheElder and dims May 1, 2020

justaugustus added sig/release Categorizes an issue or PR as relevant to SIG Release. and removed priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. labels May 1, 2020

k8s-ci-robot removed the needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. label May 1, 2020

BenTheElder reviewed May 1, 2020

View reviewed changes

justaugustus added 3 commits May 1, 2020 20:35

build: Build pause:3.3 image

03a1489

Signed-off-by: Stephen Augustus <saugustus@vmware.com>

build: Build debian-base:v2.1.0 image

99e6e06

Signed-off-by: Stephen Augustus <saugustus@vmware.com>

build: Fix base image versions on dependents

410b388

Signed-off-by: Stephen Augustus <saugustus@vmware.com>

justaugustus force-pushed the base-images branch from a3ed250 to 410b388 Compare May 2, 2020 00:39

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 2, 2020

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 2, 2020

BenTheElder reviewed May 2, 2020

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 2, 2020

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 2, 2020

k8s-ci-robot merged commit 4a7360d into kubernetes:master May 2, 2020

k8s-ci-robot added this to the v1.19 milestone May 2, 2020

This was referenced May 9, 2020

[1.17] base-images: Use debian-base:v2.1.0 and debian-iptables:v12.1.0 (includes CVE fixes) #90938

Merged

[1.16] base-images: Use debian-base:v2.1.0 and debian-iptables:v12.1.0 (includes CVE fixes) #90940

Merged

rphillips mentioned this pull request May 10, 2020

Automated Debian Base Images #58012

Closed

14 tasks

justaugustus mentioned this pull request May 13, 2020

Release blocking issues (1.19.0-beta.0, 1.18.3, 1.17.6, 1.16.10) kubernetes/release#1281

Closed

19 tasks

justaugustus mentioned this pull request Aug 18, 2020

images: Use OS codenames to construct clearer versions for Debian images kubernetes/release#1496

Merged

pacoxu mentioned this pull request Jan 20, 2021

update pause image to 3.4.1 and also update the change log #98205

Merged

10 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

cleanup: Base image workflow improvements #90665

cleanup: Base image workflow improvements #90665

justaugustus commented May 1, 2020 •

edited

justaugustus commented May 1, 2020

justaugustus commented May 1, 2020 •

edited

BenTheElder May 1, 2020

justaugustus May 1, 2020

BenTheElder May 1, 2020

BenTheElder May 1, 2020

justaugustus May 2, 2020 •

edited

justaugustus commented May 1, 2020

justaugustus commented May 2, 2020

justaugustus commented May 2, 2020

BenTheElder May 2, 2020

justaugustus May 2, 2020

dims May 2, 2020

dims May 2, 2020

BenTheElder commented May 2, 2020

k8s-ci-robot commented May 2, 2020

justaugustus commented May 2, 2020

cleanup: Base image workflow improvements #90665

cleanup: Base image workflow improvements #90665

Conversation

justaugustus commented May 1, 2020 • edited

justaugustus commented May 1, 2020

justaugustus commented May 1, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

justaugustus May 2, 2020 • edited

Choose a reason for hiding this comment

justaugustus commented May 1, 2020

justaugustus commented May 2, 2020

justaugustus commented May 2, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

BenTheElder commented May 2, 2020

k8s-ci-robot commented May 2, 2020

justaugustus commented May 2, 2020

justaugustus commented May 1, 2020 •

edited

justaugustus commented May 1, 2020 •

edited

justaugustus May 2, 2020 •

edited