Skip to content

Commit c2ecaba

Browse files
kcp-ci-botkcp-ci-bot
authoredMar 24, 2025··
Merge pull request #94 from xrstf/go1241
update build image for Go 1.24.1, kind 0.27, Docker 27.3
2 parents eb7dc75 + 8dcf9e7 commit c2ecaba

File tree

11 files changed

+234
-30
lines changed

11 files changed

+234
-30
lines changed
 

‎.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,5 @@
1919

2020
# Go workspace file
2121
go.work
22+
23+
kindest.tar

‎.prow.yaml

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
presubmits:
2+
- name: pull-infra-images-1.23-build
3+
decorate: true
4+
clone_uri: "ssh://git@github.com/kcp-dev/infra.git"
5+
run_if_changed: '^images/build/go-1.23'
6+
labels:
7+
preset-goproxy: "true"
8+
spec:
9+
containers:
10+
- image: quay.io/containers/buildah:v1.39.2
11+
command:
12+
- images/build/hack/build-image.sh
13+
- go-1.23
14+
# docker-in-docker needs privileged mode
15+
securityContext:
16+
privileged: true
17+
env:
18+
- name: DRY_RUN
19+
value: '1'
20+
resources:
21+
requests:
22+
memory: 1Gi
23+
cpu: 1
24+
25+
- name: pull-infra-images-1.24-build
26+
decorate: true
27+
clone_uri: "ssh://git@github.com/kcp-dev/infra.git"
28+
run_if_changed: '^images/build/go-1.24'
29+
labels:
30+
preset-goproxy: "true"
31+
spec:
32+
containers:
33+
- image: quay.io/containers/buildah:v1.39.2
34+
command:
35+
- images/build/hack/build-image.sh
36+
- go-1.24
37+
# docker-in-docker needs privileged mode
38+
securityContext:
39+
privileged: true
40+
env:
41+
- name: DRY_RUN
42+
value: '1'
43+
resources:
44+
requests:
45+
memory: 1Gi
46+
cpu: 1

‎images/build/Dockerfile ‎images/build/go-1.23/Dockerfile

File renamed without changes.

‎images/build/env ‎images/build/go-1.23/env

File renamed without changes.

‎images/build/start-docker.sh ‎images/build/go-1.23/start-docker.sh

File renamed without changes.

‎images/build/go-1.24/Dockerfile

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
ARG GO_VERSION
2+
3+
FROM --platform=${BUILDPLATFORM} docker.io/library/golang:${GO_VERSION} as download
4+
5+
# the Kubernetes version that is used to determine which kubectl to install.
6+
ENV KUBECTL_VERSION=1.32.3 \
7+
# the kind version installed into this image.
8+
# https://github.com/kubernetes-sigs/kind/releases
9+
KIND_VERSION=0.27.0 \
10+
# the Helm version installed into this image.
11+
# https://github.com/helm/helm/releases
12+
HELM_VERSION=3.17.2 \
13+
# the kubeconform version installed into this image.
14+
# https://github.com/yannh/kubeconform/releases
15+
KUBECONFORM_VERSION=0.6.7
16+
17+
WORKDIR /tmp
18+
19+
RUN curl --fail -L https://get.helm.sh/helm-v${HELM_VERSION}-linux-$(dpkg --print-architecture).tar.gz | tar -xzO linux-$(dpkg --print-architecture)/helm > helm && \
20+
chmod +x helm && \
21+
./helm version --short
22+
23+
RUN curl --fail -Lo kubectl https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/$(dpkg --print-architecture)/kubectl && \
24+
chmod +x kubectl && \
25+
./kubectl version --client
26+
27+
RUN curl --fail -Lo kind https://github.com/kubernetes-sigs/kind/releases/download/v${KIND_VERSION}/kind-linux-$(dpkg --print-architecture) && \
28+
chmod +x kind && \
29+
./kind version
30+
31+
RUN curl --fail -L https://github.com/yannh/kubeconform/releases/download/v${KUBECONFORM_VERSION}/kubeconform-linux-$(dpkg --print-architecture).tar.gz | tar -xzO kubeconform > kubeconform && \
32+
chmod +x kubeconform && \
33+
./kubeconform -v
34+
35+
FROM docker.io/library/golang:${GO_VERSION}
36+
37+
# this is used by docker as data root
38+
VOLUME /docker-graph
39+
40+
COPY --from=download /tmp/kubectl /usr/local/bin/
41+
COPY --from=download /tmp/kind /usr/local/bin/
42+
COPY --from=download /tmp/helm /usr/local/bin/
43+
COPY --from=download /tmp/kubeconform /usr/local/bin/
44+
45+
COPY start-docker.sh /usr/local/bin/
46+
# this pre-loads the kindest/node image so it can be loaded via docker
47+
# when starting a container based on this image
48+
COPY kindest.tar /kindest.tar
49+
50+
RUN apt-get update && \
51+
apt-get install -y \
52+
git \
53+
curl \
54+
jq \
55+
buildah \
56+
&& rm -rf /var/lib/apt/lists/*
57+
58+
# install Docker (and socat for tunneling the docker registry later)
59+
RUN curl -fsSL https://download.docker.com/linux/$(. /etc/os-release; echo "$ID")/gpg | gpg --dearmor > /usr/share/keyrings/docker.com.gpg && \
60+
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker.com.gpg] https://download.docker.com/linux/$(. /etc/os-release; echo "$ID") $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list && \
61+
apt-get update && \
62+
apt-get install -y --no-install-recommends docker-ce=5:27.3.* socat && \
63+
sed -i 's/cgroupfs_mount$/#cgroupfs_mount\n/' /etc/init.d/docker && \
64+
sed -i 's/ulimit -Hn/#ulimit -Hn/g' /etc/init.d/docker && \
65+
mkdir -p /etc/docker && \
66+
echo '{"data-root":"/docker-graph"}' | jq '.' > /etc/docker/daemon.json && \
67+
rm -rf /var/lib/apt/lists/*

‎images/build/go-1.24/env

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# the tag used for the final image. Update the suffix when you want
2+
# a new version of the image to be built.
3+
BUILD_IMAGE_TAG=1.24.1-0
4+
# the Go version used for the images.
5+
GO_VERSION=1.24.1
6+
# the kindest image that matches the kind version above
7+
KINDEST_IMAGE=kindest/node:v1.32.2@sha256:f226345927d7e348497136874b6d207e0b32cc52154ad8323129352923a3142f

‎images/build/go-1.24/start-docker.sh

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
#!/usr/bin/env bash
2+
3+
## This script should be called by all containers that
4+
## want to use docker-in-docker. This ensures a consistent
5+
## setup instead of homegrown custom hacks in each
6+
## repository.
7+
## It is safe to call this multiple times, only the first
8+
## invocation will start the daemon.
9+
10+
set -euo pipefail
11+
12+
retry() {
13+
# Works only with bash but doesn't fail on other shells
14+
set +e
15+
actual_retry $@
16+
rc=$?
17+
set -e
18+
return $rc
19+
}
20+
21+
# We use an extra wrapping to write junit and have a timer
22+
actual_retry() {
23+
retries=$1
24+
shift
25+
26+
count=0
27+
delay=1
28+
until "$@"; do
29+
rc=$?
30+
count=$((count + 1))
31+
if [ $count -lt "$retries" ]; then
32+
echo "Retry $count/$retries exited $rc, retrying in $delay seconds..." > /dev/stderr
33+
sleep $delay
34+
else
35+
echo "Retry $count/$retries exited $rc, no more retries left." > /dev/stderr
36+
return $rc
37+
fi
38+
delay=$((delay + 1))
39+
done
40+
return 0
41+
}
42+
43+
echodate() {
44+
# do not use -Is to keep this compatible with macOS
45+
echo "[$(date +%Y-%m-%dT%H:%M:%S%:z)]" "$@"
46+
}
47+
48+
# does Docker already run?
49+
if docker stats --no-stream > /dev/null 2>&1; then
50+
exit 0
51+
fi
52+
53+
echodate "Starting Docker"
54+
55+
# This is needed so Docker-In-Docker still works when the peer doesn't allow ICMP packages and hence path mtu discovery cant work
56+
# Most notably, pmtud doesn't work with the hoster of the Alpine package mirror, fastly, causing dind builds of alpine to hang
57+
# forever. Upstream issue: See https://github.com/gliderlabs/docker-alpine/issues/307#issuecomment-427246497
58+
echodate "Configuring iptables"
59+
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
60+
61+
# Configure a registry mirror. This will help only the `docker build` commands during
62+
# regular Prow job, but will not affect any kind clusters that are started from within
63+
# Prow jobs.
64+
registryMirror="${DOCKER_REGISTRY_MIRROR:-}"
65+
if [ -n "$registryMirror" ]; then
66+
echodate "Configuring registry mirror"
67+
jq --arg mirror "$registryMirror" '."registry-mirrors" = [$mirror]' /etc/docker/daemon.json > /etc/docker/daemon.new.json
68+
mv /etc/docker/daemon.new.json /etc/docker/daemon.json
69+
fi
70+
71+
mtu=${DOCKER_MTU:-0}
72+
if [[ $mtu -gt 0 ]]; then
73+
echodate "Configuring MTU"
74+
jq --argjson mtu $mtu '.mtu = $mtu' /etc/docker/daemon.json > /etc/docker/daemon.new.json
75+
mv /etc/docker/daemon.new.json /etc/docker/daemon.json
76+
fi
77+
78+
# start Docker daemon
79+
service docker start
80+
81+
# wait for Docker to start
82+
retry 5 docker stats --no-stream
83+
echodate "Docker became ready"

‎images/build/hack/build-image.sh

+2-1
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,8 @@ fi
3434
repository=ghcr.io/kcp-dev/infra/build
3535
architectures="amd64 arm64"
3636

37-
cd images/build
37+
# cd into the desired go-* Docker image
38+
cd "$(dirname "$0")/../$1"
3839

3940
# read configuration file for build image
4041
source ./env

‎prow/jobs/kcp-dev/infra/infra-postsubmits.yaml

+27-5
Original file line numberDiff line numberDiff line change
@@ -42,22 +42,44 @@ postsubmits:
4242
- name: KUBE_CONTEXT
4343
value: default
4444

45-
- name: post-infra-publish-images-build
45+
- name: post-infra-publish-images-1.23-build
4646
decorate: true
4747
clone_uri: "ssh://git@github.com/kcp-dev/infra.git"
4848
cluster: prow # GHCR credentials are only available here
4949
labels:
5050
preset-ghcr-credentials: "true"
5151
branches:
5252
- ^main$
53-
# this forces to bump the image tag in this file to get a
54-
# new image build
55-
run_if_changed: '^images/build/env$'
53+
run_if_changed: '^images/build/go-1.23'
5654
spec:
5755
containers:
58-
- image: quay.io/containers/buildah:v1.30.0
56+
- image: quay.io/containers/buildah:v1.39.2
5957
command:
6058
- images/build/hack/build-image.sh
59+
- go-1.23
60+
# docker-in-docker needs privileged mode
61+
securityContext:
62+
privileged: true
63+
resources:
64+
requests:
65+
cpu: 2
66+
memory: 3Gi
67+
68+
- name: post-infra-publish-images-1.24-build
69+
decorate: true
70+
clone_uri: "ssh://git@github.com/kcp-dev/infra.git"
71+
cluster: prow # GHCR credentials are only available here
72+
labels:
73+
preset-ghcr-credentials: "true"
74+
branches:
75+
- ^main$
76+
run_if_changed: '^images/build/go-1.24'
77+
spec:
78+
containers:
79+
- image: quay.io/containers/buildah:v1.39.2
80+
command:
81+
- images/build/hack/build-image.sh
82+
- go-1.24
6183
# docker-in-docker needs privileged mode
6284
securityContext:
6385
privileged: true

‎prow/jobs/kcp-dev/infra/infra-presubmits.yaml

-24
Original file line numberDiff line numberDiff line change
@@ -59,27 +59,3 @@ presubmits:
5959
- name: oauth-token
6060
secret:
6161
secretName: github-token
62-
63-
- name: pull-infra-images-build
64-
decorate: true
65-
clone_uri: "ssh://git@github.com/kcp-dev/infra.git"
66-
# this forces to bump the image tag in this file to get a
67-
# new image build
68-
run_if_changed: '^images/build/env$'
69-
labels:
70-
preset-goproxy: "true"
71-
spec:
72-
containers:
73-
- image: quay.io/containers/buildah:v1.30.0
74-
command:
75-
- images/build/hack/build-image.sh
76-
# docker-in-docker needs privileged mode
77-
securityContext:
78-
privileged: true
79-
env:
80-
- name: DRY_RUN
81-
value: '1'
82-
resources:
83-
requests:
84-
memory: 1Gi
85-
cpu: 1

0 commit comments

Comments
 (0)
Please sign in to comment.