Copilot commented on code in PR #12619: URL: https://github.com/apache/cloudstack/pull/12619#discussion_r2815531597
########## scripts/util/create-kubernetes-binaries-iso-with-cilium.sh: ########## @@ -0,0 +1,265 @@ +#!/usr/bin/env bash +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +set -e + +if [ $# -lt 8 ]; then + echo "============================================================================================================" + echo "CloudStack Kubernetes Service (CKS) - ISO Creation Script with Cilium" + echo "============================================================================================================" + echo "" + echo "This script creates an ISO image containing Kubernetes binaries and dependencies for CKS with Cilium CNI." + echo "" + echo "Usage:" + echo " ./create-kubernetes-binaries-iso-with-cilium.sh OUTPUT_PATH KUBERNETES_VERSION CNI_VERSION CRICTL_VERSION BUILD_NAME ARCH ETCD_VERSION CILIUM_VERSION" + echo "" + echo "Parameters:" + echo " OUTPUT_PATH - Directory where the ISO file will be saved (e.g., ./ or /tmp/)" + echo " KUBERNETES_VERSION - Kubernetes version without 'v' prefix (e.g., 1.35.0)" + echo " CNI_VERSION - CNI Plugins version without 'v' prefix (e.g., 1.9.0)" + echo " CRICTL_VERSION - CRI Tools version without 'v' prefix (e.g., 1.35.0)" + echo " BUILD_NAME - Name for the output ISO file without extension (e.g., cks-v1.35.0)" + echo " ARCH - Target architecture: amd64, x86_64, arm64, or aarch64" + echo " ETCD_VERSION - etcd version without 'v' prefix (e.g., 3.6.7)" + echo " CILIUM_VERSION - Cilium version without 'v' prefix (e.g., 1.19.0)" + echo "" + echo "Example:" + echo " ./create-kubernetes-binaries-iso-with-cilium.sh ./ 1.35.0 1.9.0 1.35.0 cks-v1.35.0 amd64 3.6.7 1.19.0" + echo "" + echo "Output:" + echo " The script will generate: cks-v1.35.0-x86_64.iso (or cks-v1.35.0-aarch64.iso for ARM)" + echo "============================================================================================================" + exit 1 +fi + +ARCH="amd64" +ARCH_SUFFIX="x86_64" +if [ "${6}" = "x86_64" ] || [ "${6}" = "amd64" ]; then + ARCH="amd64" + ARCH_SUFFIX="x86_64" +elif [ "${6}" = "aarch64" ] || [ "${6}" = "arm64" ]; then + ARCH="arm64" + ARCH_SUFFIX="aarch64" +else + echo "ERROR: ARCH must be 'x86_64' or 'aarch64'." Review Comment: The ARCH validation error message is inconsistent with the accepted values. The script accepts `amd64`/`arm64` as aliases, but the error only mentions `x86_64`/`aarch64`, which can confuse users troubleshooting invalid input. Update the message (and/or the usage text) to reflect all accepted values. ```suggestion echo "ERROR: ARCH must be one of: x86_64, amd64, aarch64, or arm64." ``` ########## scripts/util/create-kubernetes-binaries-iso-with-cilium.sh: ########## @@ -0,0 +1,265 @@ +#!/usr/bin/env bash +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +set -e + +if [ $# -lt 8 ]; then + echo "============================================================================================================" + echo "CloudStack Kubernetes Service (CKS) - ISO Creation Script with Cilium" + echo "============================================================================================================" + echo "" + echo "This script creates an ISO image containing Kubernetes binaries and dependencies for CKS with Cilium CNI." + echo "" + echo "Usage:" + echo " ./create-kubernetes-binaries-iso-with-cilium.sh OUTPUT_PATH KUBERNETES_VERSION CNI_VERSION CRICTL_VERSION BUILD_NAME ARCH ETCD_VERSION CILIUM_VERSION" + echo "" + echo "Parameters:" + echo " OUTPUT_PATH - Directory where the ISO file will be saved (e.g., ./ or /tmp/)" + echo " KUBERNETES_VERSION - Kubernetes version without 'v' prefix (e.g., 1.35.0)" + echo " CNI_VERSION - CNI Plugins version without 'v' prefix (e.g., 1.9.0)" + echo " CRICTL_VERSION - CRI Tools version without 'v' prefix (e.g., 1.35.0)" + echo " BUILD_NAME - Name for the output ISO file without extension (e.g., cks-v1.35.0)" + echo " ARCH - Target architecture: amd64, x86_64, arm64, or aarch64" + echo " ETCD_VERSION - etcd version without 'v' prefix (e.g., 3.6.7)" + echo " CILIUM_VERSION - Cilium version without 'v' prefix (e.g., 1.19.0)" + echo "" + echo "Example:" + echo " ./create-kubernetes-binaries-iso-with-cilium.sh ./ 1.35.0 1.9.0 1.35.0 cks-v1.35.0 amd64 3.6.7 1.19.0" + echo "" + echo "Output:" + echo " The script will generate: cks-v1.35.0-x86_64.iso (or cks-v1.35.0-aarch64.iso for ARM)" + echo "============================================================================================================" + exit 1 +fi + +ARCH="amd64" +ARCH_SUFFIX="x86_64" +if [ "${6}" = "x86_64" ] || [ "${6}" = "amd64" ]; then + ARCH="amd64" + ARCH_SUFFIX="x86_64" +elif [ "${6}" = "aarch64" ] || [ "${6}" = "arm64" ]; then + ARCH="arm64" + ARCH_SUFFIX="aarch64" +else + echo "ERROR: ARCH must be 'x86_64' or 'aarch64'." + exit 1 +fi + +RELEASE="v${2}" +VAL="1.18.0" +output_dir="${1}" +start_dir="$PWD" +iso_dir=$(mktemp -d) +trap 'rm -rf "${iso_dir}"' EXIT +working_dir="${iso_dir}/" +if [ -n "${5}" ]; then + build_name="${5}-${ARCH_SUFFIX}.iso" +else + build_name="setup-${RELEASE}-${ARCH_SUFFIX}.iso" +fi + +CNI_VERSION="v${3}" +echo "Downloading CNI ${CNI_VERSION}..." +cni_dir="${working_dir}/cni/" +mkdir -p "${cni_dir}" +if ! curl -sSf -L "https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-linux-${ARCH}-${CNI_VERSION}.tgz"; -o "${cni_dir}/cni-plugins-${ARCH}.tgz" 2>/dev/null; then + echo "Primary CNI URL failed, trying legacy URL format..." + if ! curl -sSf -L "https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-${ARCH}-${CNI_VERSION}.tgz"; -o "${cni_dir}/cni-plugins-${ARCH}.tgz"; then + echo "ERROR: Failed to download CNI plugins ${CNI_VERSION} for ${ARCH} from both URL formats." + exit 1 + fi +fi + +CRICTL_VERSION="v${4}" +echo "Downloading CRI tools ${CRICTL_VERSION}..." +crictl_dir="${working_dir}/cri-tools/" +mkdir -p "${crictl_dir}" +curl -sS -L "https://github.com/kubernetes-incubator/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-${ARCH}.tar.gz"; -o "${crictl_dir}/crictl-linux-${ARCH}.tar.gz" + +echo "Downloading Kubernetes tools ${RELEASE}..." +k8s_dir="${working_dir}/k8s" +mkdir -p "${k8s_dir}" +cd "${k8s_dir}" +curl -sS -L --remote-name-all https://dl.k8s.io/release/"${RELEASE}"/bin/linux/${ARCH}/{kubeadm,kubelet,kubectl} +kubeadm_file_permissions=$(stat --format '%a' kubeadm) +chmod +x kubeadm + +echo "Downloading kubelet.service ${RELEASE}..." +cd "${start_dir}" +kubelet_service_file="${working_dir}/kubelet.service" +touch "${kubelet_service_file}" +if [[ $(echo "${2} $VAL" | awk '{print ($1 < $2)}') == 1 ]]; then + curl -sSL "https://raw.githubusercontent.com/kubernetes/kubernetes/${RELEASE}/build/debs/kubelet.service"; | sed "s:/usr/bin:/opt/bin:g" > "${kubelet_service_file}" +else + curl -sSL "https://raw.githubusercontent.com/shapeblue/cloudstack-nonoss/main/cks/kubelet.service"; | sed "s:/usr/bin:/opt/bin:g" > "${kubelet_service_file}" +fi Review Comment: The `curl | sed > file` pipelines can silently succeed even if `curl` fails (because the pipeline exit status is from `sed` unless `pipefail` is set). With `set -e` alone, this can leave empty/partial `kubelet.service` (and similarly `10-kubeadm.conf`) in the ISO without failing the script. Consider enabling `set -o pipefail` and/or avoiding pipelines by downloading to a temp file and transforming it after a successful `curl --fail`. ########## scripts/util/create-kubernetes-binaries-iso-with-cilium.sh: ########## @@ -0,0 +1,265 @@ +#!/usr/bin/env bash +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +set -e + +if [ $# -lt 8 ]; then + echo "============================================================================================================" + echo "CloudStack Kubernetes Service (CKS) - ISO Creation Script with Cilium" + echo "============================================================================================================" + echo "" + echo "This script creates an ISO image containing Kubernetes binaries and dependencies for CKS with Cilium CNI." + echo "" + echo "Usage:" + echo " ./create-kubernetes-binaries-iso-with-cilium.sh OUTPUT_PATH KUBERNETES_VERSION CNI_VERSION CRICTL_VERSION BUILD_NAME ARCH ETCD_VERSION CILIUM_VERSION" + echo "" + echo "Parameters:" + echo " OUTPUT_PATH - Directory where the ISO file will be saved (e.g., ./ or /tmp/)" + echo " KUBERNETES_VERSION - Kubernetes version without 'v' prefix (e.g., 1.35.0)" + echo " CNI_VERSION - CNI Plugins version without 'v' prefix (e.g., 1.9.0)" + echo " CRICTL_VERSION - CRI Tools version without 'v' prefix (e.g., 1.35.0)" + echo " BUILD_NAME - Name for the output ISO file without extension (e.g., cks-v1.35.0)" + echo " ARCH - Target architecture: amd64, x86_64, arm64, or aarch64" + echo " ETCD_VERSION - etcd version without 'v' prefix (e.g., 3.6.7)" + echo " CILIUM_VERSION - Cilium version without 'v' prefix (e.g., 1.19.0)" + echo "" + echo "Example:" + echo " ./create-kubernetes-binaries-iso-with-cilium.sh ./ 1.35.0 1.9.0 1.35.0 cks-v1.35.0 amd64 3.6.7 1.19.0" + echo "" + echo "Output:" + echo " The script will generate: cks-v1.35.0-x86_64.iso (or cks-v1.35.0-aarch64.iso for ARM)" + echo "============================================================================================================" + exit 1 +fi + +ARCH="amd64" +ARCH_SUFFIX="x86_64" +if [ "${6}" = "x86_64" ] || [ "${6}" = "amd64" ]; then + ARCH="amd64" + ARCH_SUFFIX="x86_64" +elif [ "${6}" = "aarch64" ] || [ "${6}" = "arm64" ]; then + ARCH="arm64" + ARCH_SUFFIX="aarch64" +else + echo "ERROR: ARCH must be 'x86_64' or 'aarch64'." + exit 1 +fi + +RELEASE="v${2}" +VAL="1.18.0" +output_dir="${1}" +start_dir="$PWD" +iso_dir=$(mktemp -d) +trap 'rm -rf "${iso_dir}"' EXIT +working_dir="${iso_dir}/" +if [ -n "${5}" ]; then + build_name="${5}-${ARCH_SUFFIX}.iso" +else + build_name="setup-${RELEASE}-${ARCH_SUFFIX}.iso" +fi + +CNI_VERSION="v${3}" +echo "Downloading CNI ${CNI_VERSION}..." +cni_dir="${working_dir}/cni/" +mkdir -p "${cni_dir}" +if ! curl -sSf -L "https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-linux-${ARCH}-${CNI_VERSION}.tgz"; -o "${cni_dir}/cni-plugins-${ARCH}.tgz" 2>/dev/null; then + echo "Primary CNI URL failed, trying legacy URL format..." + if ! curl -sSf -L "https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-${ARCH}-${CNI_VERSION}.tgz"; -o "${cni_dir}/cni-plugins-${ARCH}.tgz"; then + echo "ERROR: Failed to download CNI plugins ${CNI_VERSION} for ${ARCH} from both URL formats." + exit 1 + fi +fi + +CRICTL_VERSION="v${4}" +echo "Downloading CRI tools ${CRICTL_VERSION}..." +crictl_dir="${working_dir}/cri-tools/" +mkdir -p "${crictl_dir}" +curl -sS -L "https://github.com/kubernetes-incubator/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-${ARCH}.tar.gz"; -o "${crictl_dir}/crictl-linux-${ARCH}.tar.gz" + +echo "Downloading Kubernetes tools ${RELEASE}..." +k8s_dir="${working_dir}/k8s" +mkdir -p "${k8s_dir}" +cd "${k8s_dir}" +curl -sS -L --remote-name-all https://dl.k8s.io/release/"${RELEASE}"/bin/linux/${ARCH}/{kubeadm,kubelet,kubectl} +kubeadm_file_permissions=$(stat --format '%a' kubeadm) +chmod +x kubeadm + +echo "Downloading kubelet.service ${RELEASE}..." +cd "${start_dir}" +kubelet_service_file="${working_dir}/kubelet.service" +touch "${kubelet_service_file}" +if [[ $(echo "${2} $VAL" | awk '{print ($1 < $2)}') == 1 ]]; then + curl -sSL "https://raw.githubusercontent.com/kubernetes/kubernetes/${RELEASE}/build/debs/kubelet.service"; | sed "s:/usr/bin:/opt/bin:g" > "${kubelet_service_file}" +else + curl -sSL "https://raw.githubusercontent.com/shapeblue/cloudstack-nonoss/main/cks/kubelet.service"; | sed "s:/usr/bin:/opt/bin:g" > "${kubelet_service_file}" +fi + +echo "Downloading 10-kubeadm.conf ${RELEASE}..." +kubeadm_conf_file="${working_dir}/10-kubeadm.conf" +touch "${kubeadm_conf_file}" +if [[ $(echo "${2} $VAL" | awk '{print ($1 < $2)}') == 1 ]]; then + curl -sSL "https://raw.githubusercontent.com/kubernetes/kubernetes/${RELEASE}/build/debs/10-kubeadm.conf"; | sed "s:/usr/bin:/opt/bin:g" > "${kubeadm_conf_file}" +else + curl -sSL "https://raw.githubusercontent.com/shapeblue/cloudstack-nonoss/main/cks/10-kubeadm.conf"; | sed "s:/usr/bin:/opt/bin:g" > "${kubeadm_conf_file}" +fi Review Comment: These `curl` calls fetch `kubelet.service` and `10-kubeadm.conf` directly from the shapeblue GitHub repository `main` branch at ISO build time and embed them as systemd unit/config files that will later be executed with root privileges. Because they are pinned only to a mutable branch and no checksum or signature verification is performed, a compromise of that repository (or its branch) would silently inject arbitrary code into all clusters built with this script. To reduce supply-chain risk, vendor these files into this repository or pin them to immutable commits/tags and validate their integrity before packaging them into the ISO. ########## scripts/util/create-kubernetes-binaries-iso-with-cilium.sh: ########## @@ -0,0 +1,265 @@ +#!/usr/bin/env bash +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +set -e + +if [ $# -lt 8 ]; then + echo "============================================================================================================" + echo "CloudStack Kubernetes Service (CKS) - ISO Creation Script with Cilium" + echo "============================================================================================================" + echo "" + echo "This script creates an ISO image containing Kubernetes binaries and dependencies for CKS with Cilium CNI." + echo "" + echo "Usage:" + echo " ./create-kubernetes-binaries-iso-with-cilium.sh OUTPUT_PATH KUBERNETES_VERSION CNI_VERSION CRICTL_VERSION BUILD_NAME ARCH ETCD_VERSION CILIUM_VERSION" + echo "" + echo "Parameters:" + echo " OUTPUT_PATH - Directory where the ISO file will be saved (e.g., ./ or /tmp/)" + echo " KUBERNETES_VERSION - Kubernetes version without 'v' prefix (e.g., 1.35.0)" + echo " CNI_VERSION - CNI Plugins version without 'v' prefix (e.g., 1.9.0)" + echo " CRICTL_VERSION - CRI Tools version without 'v' prefix (e.g., 1.35.0)" + echo " BUILD_NAME - Name for the output ISO file without extension (e.g., cks-v1.35.0)" + echo " ARCH - Target architecture: amd64, x86_64, arm64, or aarch64" + echo " ETCD_VERSION - etcd version without 'v' prefix (e.g., 3.6.7)" + echo " CILIUM_VERSION - Cilium version without 'v' prefix (e.g., 1.19.0)" + echo "" + echo "Example:" + echo " ./create-kubernetes-binaries-iso-with-cilium.sh ./ 1.35.0 1.9.0 1.35.0 cks-v1.35.0 amd64 3.6.7 1.19.0" + echo "" + echo "Output:" + echo " The script will generate: cks-v1.35.0-x86_64.iso (or cks-v1.35.0-aarch64.iso for ARM)" + echo "============================================================================================================" + exit 1 +fi + +ARCH="amd64" +ARCH_SUFFIX="x86_64" +if [ "${6}" = "x86_64" ] || [ "${6}" = "amd64" ]; then + ARCH="amd64" + ARCH_SUFFIX="x86_64" +elif [ "${6}" = "aarch64" ] || [ "${6}" = "arm64" ]; then + ARCH="arm64" + ARCH_SUFFIX="aarch64" +else + echo "ERROR: ARCH must be 'x86_64' or 'aarch64'." + exit 1 +fi + +RELEASE="v${2}" +VAL="1.18.0" +output_dir="${1}" +start_dir="$PWD" +iso_dir=$(mktemp -d) +trap 'rm -rf "${iso_dir}"' EXIT +working_dir="${iso_dir}/" +if [ -n "${5}" ]; then + build_name="${5}-${ARCH_SUFFIX}.iso" +else + build_name="setup-${RELEASE}-${ARCH_SUFFIX}.iso" +fi + +CNI_VERSION="v${3}" +echo "Downloading CNI ${CNI_VERSION}..." +cni_dir="${working_dir}/cni/" +mkdir -p "${cni_dir}" +if ! curl -sSf -L "https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-linux-${ARCH}-${CNI_VERSION}.tgz"; -o "${cni_dir}/cni-plugins-${ARCH}.tgz" 2>/dev/null; then + echo "Primary CNI URL failed, trying legacy URL format..." + if ! curl -sSf -L "https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-${ARCH}-${CNI_VERSION}.tgz"; -o "${cni_dir}/cni-plugins-${ARCH}.tgz"; then + echo "ERROR: Failed to download CNI plugins ${CNI_VERSION} for ${ARCH} from both URL formats." + exit 1 + fi +fi + +CRICTL_VERSION="v${4}" +echo "Downloading CRI tools ${CRICTL_VERSION}..." +crictl_dir="${working_dir}/cri-tools/" +mkdir -p "${crictl_dir}" +curl -sS -L "https://github.com/kubernetes-incubator/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-${ARCH}.tar.gz"; -o "${crictl_dir}/crictl-linux-${ARCH}.tar.gz" + +echo "Downloading Kubernetes tools ${RELEASE}..." +k8s_dir="${working_dir}/k8s" +mkdir -p "${k8s_dir}" +cd "${k8s_dir}" +curl -sS -L --remote-name-all https://dl.k8s.io/release/"${RELEASE}"/bin/linux/${ARCH}/{kubeadm,kubelet,kubectl} +kubeadm_file_permissions=$(stat --format '%a' kubeadm) +chmod +x kubeadm + +echo "Downloading kubelet.service ${RELEASE}..." +cd "${start_dir}" +kubelet_service_file="${working_dir}/kubelet.service" +touch "${kubelet_service_file}" +if [[ $(echo "${2} $VAL" | awk '{print ($1 < $2)}') == 1 ]]; then + curl -sSL "https://raw.githubusercontent.com/kubernetes/kubernetes/${RELEASE}/build/debs/kubelet.service"; | sed "s:/usr/bin:/opt/bin:g" > "${kubelet_service_file}" +else + curl -sSL "https://raw.githubusercontent.com/shapeblue/cloudstack-nonoss/main/cks/kubelet.service"; | sed "s:/usr/bin:/opt/bin:g" > "${kubelet_service_file}" +fi + +echo "Downloading 10-kubeadm.conf ${RELEASE}..." +kubeadm_conf_file="${working_dir}/10-kubeadm.conf" +touch "${kubeadm_conf_file}" +if [[ $(echo "${2} $VAL" | awk '{print ($1 < $2)}') == 1 ]]; then + curl -sSL "https://raw.githubusercontent.com/kubernetes/kubernetes/${RELEASE}/build/debs/10-kubeadm.conf"; | sed "s:/usr/bin:/opt/bin:g" > "${kubeadm_conf_file}" +else + curl -sSL "https://raw.githubusercontent.com/shapeblue/cloudstack-nonoss/main/cks/10-kubeadm.conf"; | sed "s:/usr/bin:/opt/bin:g" > "${kubeadm_conf_file}" +fi + +AUTOSCALER_URL="https://raw.githubusercontent.com/kubernetes/autoscaler/master/cluster-autoscaler/cloudprovider/cloudstack/examples/cluster-autoscaler-standard.yaml"; +echo "Downloading kubernetes cluster autoscaler ${AUTOSCALER_URL}" +autoscaler_conf_file="${working_dir}/autoscaler.yaml" +curl -sSL "${AUTOSCALER_URL}" -o "${autoscaler_conf_file}" + +PROVIDER_URL="https://raw.githubusercontent.com/apache/cloudstack-kubernetes-provider/main/deployment.yaml"; +echo "Downloading kubernetes cluster provider ${PROVIDER_URL}" +provider_conf_file="${working_dir}/provider.yaml" +curl -sSL "${PROVIDER_URL}" -o "${provider_conf_file}" + +CILIUM_VERSION="${8}" +echo "Generating Cilium ${CILIUM_VERSION} manifest..." +network_conf_file="${working_dir}/network.yaml" + +# Check if helm is installed +if ! command -v helm > /dev/null 2>&1; then + echo "ERROR: Helm is required to generate Cilium manifests. Please install Helm first." + echo "Visit: https://helm.sh/docs/intro/install/"; + exit 1 +fi + +helm repo add cilium https://helm.cilium.io/ > /dev/null 2>&1 || true +echo "Updating Helm repositories..." +helm repo update +echo "Generating Cilium manifest with Helm..." +if ! helm template cilium cilium/cilium --version "${CILIUM_VERSION}" \ + --kube-version "${RELEASE}" \ + --namespace kube-system \ + --set kubeProxyReplacement=true \ + --set socketLB.hostNamespaceOnly=true \ + --set cni.exclusive=true \ + --set cni.chainingMode=portmap \ + --set bgpControlPlane.enabled=true \ + --set encryption.enabled=true \ + --set encryption.type=wireguard \ + --set encryption.nodeEncryption=true \ + --set gatewayAPI.enabled=false \ + --set ingressController.enabled=false \ + --set l2announcements.enabled=true \ + --set l2podAnnouncements.enabled=true \ + --set l2podAnnouncements.interfacePattern=eth.* \ + --set ipam.mode=cluster-pool \ + --set ipam.operator.clusterPoolIPv4PodCIDRList={10.168.0.0/16} \ + --set ipam.operator.clusterPoolIPv4MaskSize=24 \ + --set hubble.relay.enabled=false \ + --set hubble.ui.enabled=false > "${network_conf_file}"; then + echo "ERROR: Failed to generate Cilium manifest with Helm" + echo "Check if Cilium version ${CILIUM_VERSION} exists in the Helm repository" + exit 1 +fi +echo "Cilium manifest generated successfully" + +DASHBOARD_VERSION="2.7.0" +echo "Downloading Kubernetes Dashboard v${DASHBOARD_VERSION}..." +dashboard_conf_file="${working_dir}/dashboard.yaml" +curl -sSL "https://raw.githubusercontent.com/kubernetes/dashboard/v${DASHBOARD_VERSION}/aio/deploy/recommended.yaml"; -o "${dashboard_conf_file}" + +csi_conf_file="${working_dir}/manifest.yaml" +echo "Including CloudStack CSI Driver manifest" +wget https://github.com/cloudstack/cloudstack-csi-driver/releases/download/v3.0.0/snapshot-crds.yaml -O "${working_dir}/snapshot-crds.yaml" +wget https://github.com/cloudstack/cloudstack-csi-driver/releases/download/v3.0.0/manifest.yaml -O "${csi_conf_file}" + +echo "Fetching k8s docker images..." +if ! ctr -v > /dev/null 2>&1; then + echo "Installing containerd..." + if [ -f /etc/redhat-release ]; then + if command -v dnf > /dev/null 2>&1; then + PKG_MGR="dnf" + else + PKG_MGR="yum" + fi + sudo $PKG_MGR --assumeyes remove docker-common docker container-selinux docker-selinux docker-engine + sudo $PKG_MGR --assumeyes install lvm2 device-mapper device-mapper-persistent-data device-mapper-event device-mapper-libs device-mapper-event-libs container-selinux containerd.io + elif [ -f /etc/debian_version ] || command -v apt-get > /dev/null 2>&1; then + sudo apt-get update && sudo apt-get install containerd.io --yes + fi + sudo systemctl enable --now containerd +fi +mkdir -p "${working_dir}/docker" +output=$("${k8s_dir}/kubeadm" config images list --kubernetes-version="${RELEASE}") + +# Don't forget about the other image ! +autoscaler_image=$(grep "image:" "${autoscaler_conf_file}" | cut -d ':' -f2- | tr -d ' ') +output=$(printf "%s\n" "${output}" "${autoscaler_image}") + +provider_image=$(grep "image:" "${provider_conf_file}" | cut -d ':' -f2- | tr -d ' ') +output=$(printf "%s\n" "${output}" "${provider_image}") + +# Extract images from manifest.yaml and add to output +csi_images=$(grep "image:" "${csi_conf_file}" | cut -d ':' -f2- | tr -d ' ' | tr -d "'") +output=$(printf "%s\n%s" "${output}" "${csi_images}") + +# Extract all images from yaml manifests (including Cilium network.yaml and Dashboard) +echo "Extracting images from manifest files..." +for i in "${network_conf_file}" "${dashboard_conf_file}"; do + images=$(grep "image:" "$i" | cut -d ':' -f2- | tr -d ' ' | tr -d "'" | tr -d '"') + output=$(printf "%s\n" "${output}" "${images}") +done + +while read -r line; do + echo "Downloading image $line ---" + if [[ $line == kubernetesui* ]] || [[ $line == apache* ]] || [[ $line == weaveworks* ]]; then + line="docker.io/${line}" + fi + if [[ $line == kong* ]]; then + line="docker.io/library/${line}" + fi + line=$(echo "$line" | tr -d '"' | tr -d "'") + + # Pull image using containerd with k8s.io namespace + if ! sudo ctr -n k8s.io images pull "$line"; then + echo "ERROR: Failed to pull image $line" + echo "Trying with default namespace..." + if ! sudo ctr images pull "$line"; then + echo "ERROR: Failed to pull image $line with both namespaces. Skipping..." + continue + fi + # If successful with default namespace, use it for export + image_name=$(echo "$line" | grep -oE "[^/]+$") + sudo ctr images export "${working_dir}/docker/$image_name.tar" "$line" + sudo ctr images rm "$line" + else + # If successful with k8s.io namespace + image_name=$(echo "$line" | grep -oE "[^/]+$") + sudo ctr -n k8s.io images export "${working_dir}/docker/$image_name.tar" "$line" + sudo ctr -n k8s.io images rm "$line" + fi +done <<< "$output" + +echo "Restore kubeadm permissions..." +if [ -z "${kubeadm_file_permissions}" ]; then + kubeadm_file_permissions=644 +fi +chmod "${kubeadm_file_permissions}" "${working_dir}/k8s/kubeadm" + +echo "Updating imagePullPolicy to IfNotPresent in yaml files..." +sed -i "s/imagePullPolicy:.*/imagePullPolicy: IfNotPresent/g" "${working_dir}"/*.yaml + +etcd_dir="${working_dir}/etcd" +mkdir -p "${etcd_dir}" +ETCD_VERSION=v${7} +echo "Downloading etcd ${ETCD_VERSION}..." +curl -sS -L "https://github.com/etcd-io/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-${ARCH}.tar.gz"; -o "${etcd_dir}/etcd-linux-${ARCH}.tar.gz" + Review Comment: This `curl -sS -L` download won’t fail the script on HTTP errors (e.g., 404/500) because `--fail` isn’t used; the ISO could be generated with an HTML error page instead of the etcd tarball. Add `--fail`/`--fail-with-body` (and optionally validate the archive) so the script reliably stops on download problems. ```suggestion curl -sS -L --fail "https://github.com/etcd-io/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-${ARCH}.tar.gz"; -o "${etcd_dir}/etcd-linux-${ARCH}.tar.gz" # Validate that the downloaded etcd archive is a valid tar.gz if ! tar -tzf "${etcd_dir}/etcd-linux-${ARCH}.tar.gz" > /dev/null; then echo "ERROR: Downloaded etcd archive is invalid or corrupted." exit 1 fi ``` ########## scripts/util/create-kubernetes-binaries-iso-with-cilium.sh: ########## @@ -0,0 +1,265 @@ +#!/usr/bin/env bash +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +set -e + +if [ $# -lt 8 ]; then + echo "============================================================================================================" + echo "CloudStack Kubernetes Service (CKS) - ISO Creation Script with Cilium" + echo "============================================================================================================" + echo "" + echo "This script creates an ISO image containing Kubernetes binaries and dependencies for CKS with Cilium CNI." + echo "" + echo "Usage:" + echo " ./create-kubernetes-binaries-iso-with-cilium.sh OUTPUT_PATH KUBERNETES_VERSION CNI_VERSION CRICTL_VERSION BUILD_NAME ARCH ETCD_VERSION CILIUM_VERSION" + echo "" + echo "Parameters:" + echo " OUTPUT_PATH - Directory where the ISO file will be saved (e.g., ./ or /tmp/)" + echo " KUBERNETES_VERSION - Kubernetes version without 'v' prefix (e.g., 1.35.0)" + echo " CNI_VERSION - CNI Plugins version without 'v' prefix (e.g., 1.9.0)" + echo " CRICTL_VERSION - CRI Tools version without 'v' prefix (e.g., 1.35.0)" + echo " BUILD_NAME - Name for the output ISO file without extension (e.g., cks-v1.35.0)" + echo " ARCH - Target architecture: amd64, x86_64, arm64, or aarch64" + echo " ETCD_VERSION - etcd version without 'v' prefix (e.g., 3.6.7)" + echo " CILIUM_VERSION - Cilium version without 'v' prefix (e.g., 1.19.0)" + echo "" + echo "Example:" + echo " ./create-kubernetes-binaries-iso-with-cilium.sh ./ 1.35.0 1.9.0 1.35.0 cks-v1.35.0 amd64 3.6.7 1.19.0" + echo "" + echo "Output:" + echo " The script will generate: cks-v1.35.0-x86_64.iso (or cks-v1.35.0-aarch64.iso for ARM)" + echo "============================================================================================================" + exit 1 +fi + +ARCH="amd64" +ARCH_SUFFIX="x86_64" +if [ "${6}" = "x86_64" ] || [ "${6}" = "amd64" ]; then + ARCH="amd64" + ARCH_SUFFIX="x86_64" +elif [ "${6}" = "aarch64" ] || [ "${6}" = "arm64" ]; then + ARCH="arm64" + ARCH_SUFFIX="aarch64" +else + echo "ERROR: ARCH must be 'x86_64' or 'aarch64'." + exit 1 +fi + +RELEASE="v${2}" +VAL="1.18.0" +output_dir="${1}" +start_dir="$PWD" +iso_dir=$(mktemp -d) +trap 'rm -rf "${iso_dir}"' EXIT +working_dir="${iso_dir}/" +if [ -n "${5}" ]; then + build_name="${5}-${ARCH_SUFFIX}.iso" +else + build_name="setup-${RELEASE}-${ARCH_SUFFIX}.iso" +fi + +CNI_VERSION="v${3}" +echo "Downloading CNI ${CNI_VERSION}..." +cni_dir="${working_dir}/cni/" +mkdir -p "${cni_dir}" +if ! curl -sSf -L "https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-linux-${ARCH}-${CNI_VERSION}.tgz"; -o "${cni_dir}/cni-plugins-${ARCH}.tgz" 2>/dev/null; then + echo "Primary CNI URL failed, trying legacy URL format..." + if ! curl -sSf -L "https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-${ARCH}-${CNI_VERSION}.tgz"; -o "${cni_dir}/cni-plugins-${ARCH}.tgz"; then + echo "ERROR: Failed to download CNI plugins ${CNI_VERSION} for ${ARCH} from both URL formats." + exit 1 + fi +fi + +CRICTL_VERSION="v${4}" +echo "Downloading CRI tools ${CRICTL_VERSION}..." +crictl_dir="${working_dir}/cri-tools/" +mkdir -p "${crictl_dir}" +curl -sS -L "https://github.com/kubernetes-incubator/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-${ARCH}.tar.gz"; -o "${crictl_dir}/crictl-linux-${ARCH}.tar.gz" + +echo "Downloading Kubernetes tools ${RELEASE}..." +k8s_dir="${working_dir}/k8s" +mkdir -p "${k8s_dir}" +cd "${k8s_dir}" +curl -sS -L --remote-name-all https://dl.k8s.io/release/"${RELEASE}"/bin/linux/${ARCH}/{kubeadm,kubelet,kubectl} +kubeadm_file_permissions=$(stat --format '%a' kubeadm) +chmod +x kubeadm + +echo "Downloading kubelet.service ${RELEASE}..." +cd "${start_dir}" +kubelet_service_file="${working_dir}/kubelet.service" +touch "${kubelet_service_file}" +if [[ $(echo "${2} $VAL" | awk '{print ($1 < $2)}') == 1 ]]; then + curl -sSL "https://raw.githubusercontent.com/kubernetes/kubernetes/${RELEASE}/build/debs/kubelet.service"; | sed "s:/usr/bin:/opt/bin:g" > "${kubelet_service_file}" +else + curl -sSL "https://raw.githubusercontent.com/shapeblue/cloudstack-nonoss/main/cks/kubelet.service"; | sed "s:/usr/bin:/opt/bin:g" > "${kubelet_service_file}" +fi + +echo "Downloading 10-kubeadm.conf ${RELEASE}..." +kubeadm_conf_file="${working_dir}/10-kubeadm.conf" +touch "${kubeadm_conf_file}" +if [[ $(echo "${2} $VAL" | awk '{print ($1 < $2)}') == 1 ]]; then + curl -sSL "https://raw.githubusercontent.com/kubernetes/kubernetes/${RELEASE}/build/debs/10-kubeadm.conf"; | sed "s:/usr/bin:/opt/bin:g" > "${kubeadm_conf_file}" +else + curl -sSL "https://raw.githubusercontent.com/shapeblue/cloudstack-nonoss/main/cks/10-kubeadm.conf"; | sed "s:/usr/bin:/opt/bin:g" > "${kubeadm_conf_file}" +fi + +AUTOSCALER_URL="https://raw.githubusercontent.com/kubernetes/autoscaler/master/cluster-autoscaler/cloudprovider/cloudstack/examples/cluster-autoscaler-standard.yaml"; +echo "Downloading kubernetes cluster autoscaler ${AUTOSCALER_URL}" +autoscaler_conf_file="${working_dir}/autoscaler.yaml" +curl -sSL "${AUTOSCALER_URL}" -o "${autoscaler_conf_file}" + +PROVIDER_URL="https://raw.githubusercontent.com/apache/cloudstack-kubernetes-provider/main/deployment.yaml"; +echo "Downloading kubernetes cluster provider ${PROVIDER_URL}" +provider_conf_file="${working_dir}/provider.yaml" +curl -sSL "${PROVIDER_URL}" -o "${provider_conf_file}" + +CILIUM_VERSION="${8}" +echo "Generating Cilium ${CILIUM_VERSION} manifest..." +network_conf_file="${working_dir}/network.yaml" + +# Check if helm is installed +if ! command -v helm > /dev/null 2>&1; then + echo "ERROR: Helm is required to generate Cilium manifests. Please install Helm first." + echo "Visit: https://helm.sh/docs/intro/install/"; + exit 1 +fi + +helm repo add cilium https://helm.cilium.io/ > /dev/null 2>&1 || true Review Comment: `helm repo add ... || true` suppresses failures (e.g., network/DNS issues), which can turn an actionable error into a later, less-clear failure during `helm template`. It’s better to either let `helm repo add` fail normally or only ignore the specific “already exists” case (e.g., by checking `helm repo list`). ```suggestion # Add the Cilium Helm repository only if it is not already configured if ! helm repo list 2>/dev/null | awk 'NR>1 {print $1}' | grep -qx "cilium"; then helm repo add cilium https://helm.cilium.io/ > /dev/null 2>&1 fi ``` ########## scripts/util/create-kubernetes-binaries-iso-with-cilium.sh: ########## @@ -0,0 +1,265 @@ +#!/usr/bin/env bash +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +set -e + +if [ $# -lt 8 ]; then + echo "============================================================================================================" + echo "CloudStack Kubernetes Service (CKS) - ISO Creation Script with Cilium" + echo "============================================================================================================" + echo "" + echo "This script creates an ISO image containing Kubernetes binaries and dependencies for CKS with Cilium CNI." + echo "" + echo "Usage:" + echo " ./create-kubernetes-binaries-iso-with-cilium.sh OUTPUT_PATH KUBERNETES_VERSION CNI_VERSION CRICTL_VERSION BUILD_NAME ARCH ETCD_VERSION CILIUM_VERSION" + echo "" + echo "Parameters:" + echo " OUTPUT_PATH - Directory where the ISO file will be saved (e.g., ./ or /tmp/)" + echo " KUBERNETES_VERSION - Kubernetes version without 'v' prefix (e.g., 1.35.0)" + echo " CNI_VERSION - CNI Plugins version without 'v' prefix (e.g., 1.9.0)" + echo " CRICTL_VERSION - CRI Tools version without 'v' prefix (e.g., 1.35.0)" + echo " BUILD_NAME - Name for the output ISO file without extension (e.g., cks-v1.35.0)" + echo " ARCH - Target architecture: amd64, x86_64, arm64, or aarch64" + echo " ETCD_VERSION - etcd version without 'v' prefix (e.g., 3.6.7)" + echo " CILIUM_VERSION - Cilium version without 'v' prefix (e.g., 1.19.0)" + echo "" + echo "Example:" + echo " ./create-kubernetes-binaries-iso-with-cilium.sh ./ 1.35.0 1.9.0 1.35.0 cks-v1.35.0 amd64 3.6.7 1.19.0" + echo "" + echo "Output:" + echo " The script will generate: cks-v1.35.0-x86_64.iso (or cks-v1.35.0-aarch64.iso for ARM)" + echo "============================================================================================================" + exit 1 +fi + +ARCH="amd64" +ARCH_SUFFIX="x86_64" +if [ "${6}" = "x86_64" ] || [ "${6}" = "amd64" ]; then + ARCH="amd64" + ARCH_SUFFIX="x86_64" +elif [ "${6}" = "aarch64" ] || [ "${6}" = "arm64" ]; then + ARCH="arm64" + ARCH_SUFFIX="aarch64" +else + echo "ERROR: ARCH must be 'x86_64' or 'aarch64'." + exit 1 +fi + +RELEASE="v${2}" +VAL="1.18.0" +output_dir="${1}" +start_dir="$PWD" +iso_dir=$(mktemp -d) +trap 'rm -rf "${iso_dir}"' EXIT +working_dir="${iso_dir}/" +if [ -n "${5}" ]; then + build_name="${5}-${ARCH_SUFFIX}.iso" +else + build_name="setup-${RELEASE}-${ARCH_SUFFIX}.iso" +fi + +CNI_VERSION="v${3}" +echo "Downloading CNI ${CNI_VERSION}..." +cni_dir="${working_dir}/cni/" +mkdir -p "${cni_dir}" +if ! curl -sSf -L "https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-linux-${ARCH}-${CNI_VERSION}.tgz"; -o "${cni_dir}/cni-plugins-${ARCH}.tgz" 2>/dev/null; then + echo "Primary CNI URL failed, trying legacy URL format..." + if ! curl -sSf -L "https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-${ARCH}-${CNI_VERSION}.tgz"; -o "${cni_dir}/cni-plugins-${ARCH}.tgz"; then + echo "ERROR: Failed to download CNI plugins ${CNI_VERSION} for ${ARCH} from both URL formats." + exit 1 + fi +fi + +CRICTL_VERSION="v${4}" +echo "Downloading CRI tools ${CRICTL_VERSION}..." +crictl_dir="${working_dir}/cri-tools/" +mkdir -p "${crictl_dir}" +curl -sS -L "https://github.com/kubernetes-incubator/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-${ARCH}.tar.gz"; -o "${crictl_dir}/crictl-linux-${ARCH}.tar.gz" + +echo "Downloading Kubernetes tools ${RELEASE}..." +k8s_dir="${working_dir}/k8s" +mkdir -p "${k8s_dir}" +cd "${k8s_dir}" +curl -sS -L --remote-name-all https://dl.k8s.io/release/"${RELEASE}"/bin/linux/${ARCH}/{kubeadm,kubelet,kubectl} +kubeadm_file_permissions=$(stat --format '%a' kubeadm) +chmod +x kubeadm + +echo "Downloading kubelet.service ${RELEASE}..." +cd "${start_dir}" +kubelet_service_file="${working_dir}/kubelet.service" +touch "${kubelet_service_file}" +if [[ $(echo "${2} $VAL" | awk '{print ($1 < $2)}') == 1 ]]; then + curl -sSL "https://raw.githubusercontent.com/kubernetes/kubernetes/${RELEASE}/build/debs/kubelet.service"; | sed "s:/usr/bin:/opt/bin:g" > "${kubelet_service_file}" Review Comment: The Kubernetes version comparison `echo "${2} $VAL" | awk '{print ($1 < $2)}'` is not a reliable semver comparison (e.g., `1.9.0` is treated as `1.9` and compares as greater than `1.18.0`). This can select the wrong source for `kubelet.service`/`10-kubeadm.conf`. Use a version-aware compare (e.g., `sort -V`, `dpkg --compare-versions`, or parsing major/minor/patch) instead of numeric `awk`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
