From 857b693f571233914836cab990f7d89b7e576b24 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Anders=20F=20Bj=C3=B6rklund?= Date: Mon, 6 Jul 2020 07:47:31 +0200 Subject: [PATCH 1/6] Revert "The config flag for go packages were both changed" Need to use the old config flag again for the old Buildroot This reverts commit 661feaca3fb47ea9e257bac2428633cd3bf0e06d. --- deploy/iso/minikube-iso/package/cni-plugins/Config.in | 2 +- deploy/iso/minikube-iso/package/cni/Config.in | 2 +- deploy/iso/minikube-iso/package/conmon/Config.in | 4 ++-- deploy/iso/minikube-iso/package/containerd-bin/Config.in | 4 ++-- deploy/iso/minikube-iso/package/crio-bin/Config.in | 4 ++-- deploy/iso/minikube-iso/package/podman/Config.in | 4 ++-- deploy/iso/minikube-iso/package/runc-master/Config.in | 8 ++++---- 7 files changed, 14 insertions(+), 14 deletions(-) diff --git a/deploy/iso/minikube-iso/package/cni-plugins/Config.in b/deploy/iso/minikube-iso/package/cni-plugins/Config.in index cdca8f72dd..9566518974 100644 --- a/deploy/iso/minikube-iso/package/cni-plugins/Config.in +++ b/deploy/iso/minikube-iso/package/cni-plugins/Config.in @@ -2,4 +2,4 @@ config BR2_PACKAGE_CNI_PLUGINS bool "cni-plugins" default y depends on BR2_x86_64 - depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS + depends on BR2_PACKAGE_HOST_GO_ARCH_SUPPORTS diff --git a/deploy/iso/minikube-iso/package/cni/Config.in b/deploy/iso/minikube-iso/package/cni/Config.in index b711219701..ca60da49fc 100644 --- a/deploy/iso/minikube-iso/package/cni/Config.in +++ b/deploy/iso/minikube-iso/package/cni/Config.in @@ -2,4 +2,4 @@ config BR2_PACKAGE_CNI bool "cni" default y depends on BR2_x86_64 - depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS + depends on BR2_PACKAGE_HOST_GO_ARCH_SUPPORTS diff --git a/deploy/iso/minikube-iso/package/conmon/Config.in b/deploy/iso/minikube-iso/package/conmon/Config.in index 6d4df09cf9..0dd4344dc9 100644 --- a/deploy/iso/minikube-iso/package/conmon/Config.in +++ b/deploy/iso/minikube-iso/package/conmon/Config.in @@ -1,7 +1,7 @@ config BR2_PACKAGE_CONMON bool "conmon" - depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS - depends on BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS + depends on BR2_PACKAGE_HOST_GO_ARCH_SUPPORTS + depends on BR2_PACKAGE_HOST_GO_CGO_LINKING_SUPPORTS depends on BR2_TOOLCHAIN_HAS_THREADS select BR2_PACKAGE_LIBGLIB2 select BR2_PACKAGE_SYSTEMD diff --git a/deploy/iso/minikube-iso/package/containerd-bin/Config.in b/deploy/iso/minikube-iso/package/containerd-bin/Config.in index fc5f328248..988ab2c4db 100644 --- a/deploy/iso/minikube-iso/package/containerd-bin/Config.in +++ b/deploy/iso/minikube-iso/package/containerd-bin/Config.in @@ -2,8 +2,8 @@ config BR2_PACKAGE_CONTAINERD_BIN bool "containerd-bin" default y depends on BR2_x86_64 - depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS - depends on BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS + depends on BR2_PACKAGE_HOST_GO_ARCH_SUPPORTS + depends on BR2_PACKAGE_HOST_GO_CGO_LINKING_SUPPORTS depends on BR2_TOOLCHAIN_HAS_THREADS depends on BR2_USE_MMU # lvm2 depends on !BR2_STATIC_LIBS # lvm2 diff --git a/deploy/iso/minikube-iso/package/crio-bin/Config.in b/deploy/iso/minikube-iso/package/crio-bin/Config.in index 22d2c45e9d..3dd6743912 100644 --- a/deploy/iso/minikube-iso/package/crio-bin/Config.in +++ b/deploy/iso/minikube-iso/package/crio-bin/Config.in @@ -2,8 +2,8 @@ config BR2_PACKAGE_CRIO_BIN bool "crio-bin" default y depends on BR2_x86_64 - depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS - depends on BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS + depends on BR2_PACKAGE_HOST_GO_ARCH_SUPPORTS + depends on BR2_PACKAGE_HOST_GO_CGO_LINKING_SUPPORTS depends on BR2_TOOLCHAIN_HAS_THREADS depends on BR2_USE_MMU # lvm2 depends on !BR2_STATIC_LIBS # lvm2 diff --git a/deploy/iso/minikube-iso/package/podman/Config.in b/deploy/iso/minikube-iso/package/podman/Config.in index d73162af7f..f0d92a2cdc 100644 --- a/deploy/iso/minikube-iso/package/podman/Config.in +++ b/deploy/iso/minikube-iso/package/podman/Config.in @@ -2,8 +2,8 @@ config BR2_PACKAGE_PODMAN bool "podman" default y depends on BR2_x86_64 - depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS - depends on BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS + depends on BR2_PACKAGE_HOST_GO_ARCH_SUPPORTS + depends on BR2_PACKAGE_HOST_GO_CGO_LINKING_SUPPORTS depends on BR2_TOOLCHAIN_HAS_THREADS select BR2_PACKAGE_RUNC_MASTER select BR2_PACKAGE_CONMON diff --git a/deploy/iso/minikube-iso/package/runc-master/Config.in b/deploy/iso/minikube-iso/package/runc-master/Config.in index e3e4a58454..c33153880e 100644 --- a/deploy/iso/minikube-iso/package/runc-master/Config.in +++ b/deploy/iso/minikube-iso/package/runc-master/Config.in @@ -1,7 +1,7 @@ config BR2_PACKAGE_RUNC_MASTER bool "runc-master" - depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS - depends on BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS + depends on BR2_PACKAGE_HOST_GO_ARCH_SUPPORTS + depends on BR2_PACKAGE_HOST_GO_CGO_LINKING_SUPPORTS depends on BR2_TOOLCHAIN_HAS_THREADS help runC is a CLI tool for spawning and running containers @@ -12,6 +12,6 @@ config BR2_PACKAGE_RUNC_MASTER https://github.com/opencontainers/runc comment "runc needs a toolchain w/ threads" - depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS && \ - BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS + depends on BR2_PACKAGE_HOST_GO_ARCH_SUPPORTS && \ + BR2_PACKAGE_HOST_GO_CGO_LINKING_SUPPORTS depends on !BR2_TOOLCHAIN_HAS_THREADS From dfb970ab3764bcd88380f617c9140778b32f44dc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Anders=20F=20Bj=C3=B6rklund?= Date: Mon, 6 Jul 2020 10:19:48 +0200 Subject: [PATCH 2/6] Revert "Upgrade crio to 1.18.2" This reverts commit 514dda8f2eeb458b469b16e801a1a671473918ad. --- .../patches/crio-bin/v1.18.1/version.patch | 78 +++++++++++++++++++ .../package/crio-bin/crio-bin.hash | 1 - .../minikube-iso/package/crio-bin/crio-bin.mk | 4 +- 3 files changed, 80 insertions(+), 3 deletions(-) create mode 100644 deploy/iso/minikube-iso/board/coreos/minikube/patches/crio-bin/v1.18.1/version.patch diff --git a/deploy/iso/minikube-iso/board/coreos/minikube/patches/crio-bin/v1.18.1/version.patch b/deploy/iso/minikube-iso/board/coreos/minikube/patches/crio-bin/v1.18.1/version.patch new file mode 100644 index 0000000000..882bc9eadc --- /dev/null +++ b/deploy/iso/minikube-iso/board/coreos/minikube/patches/crio-bin/v1.18.1/version.patch @@ -0,0 +1,78 @@ +diff --git a/Makefile b/Makefile +index 764a0136a..4148d81eb 100644 +--- a/Makefile ++++ b/Makefile +@@ -100,7 +100,7 @@ BASE_LDFLAGS = ${SHRINKFLAGS} \ + -X ${PROJECT}/internal/version.gitCommit=${COMMIT_NO} \ + -X ${PROJECT}/internal/version.gitTreeState=${GIT_TREE_STATE} \ + +-LDFLAGS = -ldflags '${BASE_LDFLAGS} ${EXTRA_LDFLAGS}' ++GO_LDFLAGS = -ldflags '${BASE_LDFLAGS} ${EXTRA_LDFLAGS}' + + TESTIMAGE_VERSION := master-1.3.6 + TESTIMAGE_REGISTRY := quay.io/crio +@@ -157,16 +157,16 @@ bin/pinns: + $(MAKE) -C pinns + + test/copyimg/copyimg: $(GO_FILES) .gopathok +- $(GO_BUILD) $(GCFLAGS) $(LDFLAGS) -tags "$(BUILDTAGS)" -o $@ $(PROJECT)/test/copyimg ++ $(GO_BUILD) $(GCFLAGS) $(GO_LDFLAGS) -tags "$(BUILDTAGS)" -o $@ $(PROJECT)/test/copyimg + + test/checkseccomp/checkseccomp: $(GO_FILES) .gopathok +- $(GO_BUILD) $(GCFLAGS) $(LDFLAGS) -tags "$(BUILDTAGS)" -o $@ $(PROJECT)/test/checkseccomp ++ $(GO_BUILD) $(GCFLAGS) $(GO_LDFLAGS) -tags "$(BUILDTAGS)" -o $@ $(PROJECT)/test/checkseccomp + + bin/crio: $(GO_FILES) .gopathok +- $(GO_BUILD) $(GCFLAGS) $(LDFLAGS) -tags "$(BUILDTAGS)" -o $@ $(PROJECT)/cmd/crio ++ $(GO_BUILD) $(GCFLAGS) $(GO_LDFLAGS) -tags "$(BUILDTAGS)" -o $@ $(PROJECT)/cmd/crio + + bin/crio-status: $(GO_FILES) .gopathok +- $(GO_BUILD) $(GCFLAGS) $(LDFLAGS) -tags "$(BUILDTAGS)" -o $@ $(PROJECT)/cmd/crio-status ++ $(GO_BUILD) $(GCFLAGS) $(GO_LDFLAGS) -tags "$(BUILDTAGS)" -o $@ $(PROJECT)/cmd/crio-status + + build-static: + $(CONTAINER_RUNTIME) run --rm -it -v $(shell pwd):/cri-o $(TESTIMAGE_NIX) sh -c \ +@@ -216,7 +216,7 @@ bin/crio.cross.%: .gopathok .explicit_phony + TARGET="$*"; \ + GOOS="$${TARGET%%.*}" \ + GOARCH="$${TARGET##*.}" \ +- $(GO_BUILD) $(LDFLAGS) -tags "containers_image_openpgp btrfs_noversion" -o "$@" $(PROJECT)/cmd/crio ++ $(GO_BUILD) $(GO_LDFLAGS) -tags "containers_image_openpgp btrfs_noversion" -o "$@" $(PROJECT)/cmd/crio + + local-image: + $(TESTIMAGE_SCRIPT) +diff --git a/cmd/crio/main.go b/cmd/crio/main.go +index ab033a47d..fa10f170a 100644 +--- a/cmd/crio/main.go ++++ b/cmd/crio/main.go +@@ -120,7 +120,7 @@ func main() { + app.Authors = []*cli.Author{{Name: "The CRI-O Maintainers"}} + app.UsageText = usage + app.Description = app.Usage +- app.Version = "\n" + version.Get().String() ++ app.Version = version.Version + "\n" + version.Get().String() + + var err error + app.Flags, app.Metadata, err = criocli.GetFlagsAndMetadata() +diff --git a/internal/version/version.go b/internal/version/version.go +index 7ab5da5a2..19692595e 100644 +--- a/internal/version/version.go ++++ b/internal/version/version.go +@@ -6,6 +6,7 @@ import ( + "fmt" + "io/ioutil" + "os" ++ "os/exec" + "path/filepath" + "reflect" + "runtime" +@@ -171,6 +172,9 @@ func getLinkmode() string { + return "" + } + ++ if _, err := exec.LookPath("ldd"); err != nil { ++ return "" ++ } + if _, err := utils.ExecCmd("ldd", abspath); err != nil { + if strings.Contains(err.Error(), "not a dynamic executable") { + return "static" diff --git a/deploy/iso/minikube-iso/package/crio-bin/crio-bin.hash b/deploy/iso/minikube-iso/package/crio-bin/crio-bin.hash index debd789bc5..baddc429e9 100644 --- a/deploy/iso/minikube-iso/package/crio-bin/crio-bin.hash +++ b/deploy/iso/minikube-iso/package/crio-bin/crio-bin.hash @@ -14,4 +14,3 @@ sha256 23a797762e4544ee7c171ef138cfc1141a3f0acc2838d9965c2a58e53b16c3ae v1.17.0. sha256 7967e9218fdfb59d6005a9e19c1668469bc5566c2a35927cffe7de8656bb22c7 v1.17.1.tar.gz sha256 865ded95aceb3a33a391b252522682de6b37b39498704c490b3a321dbefaafcb v1.18.0.tar.gz sha256 794ddc36c2a20fde91fc6cc2c6f02ebdaea85c69b51b67f3994090dbbdbc2a50 v1.18.1.tar.gz -sha256 25dc558fbabc987bd58c7eab5230121b258a7b0eb34a49dc6595f1c6f3969116 v1.18.2.tar.gz diff --git a/deploy/iso/minikube-iso/package/crio-bin/crio-bin.mk b/deploy/iso/minikube-iso/package/crio-bin/crio-bin.mk index c7181af967..23fce96cc3 100644 --- a/deploy/iso/minikube-iso/package/crio-bin/crio-bin.mk +++ b/deploy/iso/minikube-iso/package/crio-bin/crio-bin.mk @@ -4,8 +4,8 @@ # ################################################################################ -CRIO_BIN_VERSION = v1.18.2 -CRIO_BIN_COMMIT = 7f261aeebffed079b4475dde8b9d602b01973d33 +CRIO_BIN_VERSION = v1.18.1 +CRIO_BIN_COMMIT = 5cbf694c34f8d1af19eb873e39057663a4830635 CRIO_BIN_SITE = https://github.com/cri-o/cri-o/archive CRIO_BIN_SOURCE = $(CRIO_BIN_VERSION).tar.gz CRIO_BIN_DEPENDENCIES = host-go libgpgme From 00db37da3bf7a3298fd8cd0729cd7178b28bdad3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Anders=20F=20Bj=C3=B6rklund?= Date: Mon, 6 Jul 2020 10:22:22 +0200 Subject: [PATCH 3/6] Revert "The name of the make variable was changed" This reverts commit 6e619bd5c7653e01c908db88513d3abb0cedeb9b. --- deploy/iso/minikube-iso/package/crio-bin/crio-bin.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/iso/minikube-iso/package/crio-bin/crio-bin.mk b/deploy/iso/minikube-iso/package/crio-bin/crio-bin.mk index 23fce96cc3..231ae37866 100644 --- a/deploy/iso/minikube-iso/package/crio-bin/crio-bin.mk +++ b/deploy/iso/minikube-iso/package/crio-bin/crio-bin.mk @@ -32,7 +32,7 @@ endef define CRIO_BIN_BUILD_CMDS mkdir -p $(@D)/bin - $(CRIO_BIN_ENV) $(MAKE) $(TARGET_CONFIGURE_OPTS) -C $(@D) COMMIT_NO=$(CRIO_BIN_COMMIT) PREFIX=/usr binaries + $(CRIO_BIN_ENV) $(MAKE) $(TARGET_CONFIGURE_OPTS) -C $(@D) GIT_COMMIT=$(CRIO_BIN_COMMIT) PREFIX=/usr binaries endef define CRIO_BIN_INSTALL_TARGET_CMDS From 5ab9c542a94e4f55809b5f9372e2f28a8f8a73b6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Anders=20F=20Bj=C3=B6rklund?= Date: Mon, 6 Jul 2020 10:22:40 +0200 Subject: [PATCH 4/6] Revert "Upgrade crio.conf to version v1.18.1" This reverts commit f19ca1597cfe41e7042b601274f5123c7badd2e6. --- .../minikube-iso/package/crio-bin/crio.conf | 97 ++++++------------ .../package/crio-bin/crio.conf.default | 99 ++++++------------- 2 files changed, 61 insertions(+), 135 deletions(-) diff --git a/deploy/iso/minikube-iso/package/crio-bin/crio.conf b/deploy/iso/minikube-iso/package/crio-bin/crio.conf index efbfae47d6..36dc1725ea 100644 --- a/deploy/iso/minikube-iso/package/crio-bin/crio.conf +++ b/deploy/iso/minikube-iso/package/crio-bin/crio.conf @@ -35,15 +35,8 @@ storage_driver = "overlay" # the kubelet. The log directory specified must be an absolute directory. log_dir = "/var/log/crio/pods" -# Location for CRI-O to lay down the temporary version file. -# It is used to check if crio wipe should wipe containers, which should -# always happen on a node reboot -version_file = "/var/run/crio/version" - -# Location for CRI-O to lay down the persistent version file. -# It is used to check if crio wipe should wipe images, which should -# only happen when CRI-O has been upgraded -version_file_persist = "/var/lib/crio/version" +# Location for CRI-O to lay down the version file +version_file = "/var/lib/crio/version" # The crio.api table contains settings for the kubelet/gRPC interface. [crio.api] @@ -51,11 +44,13 @@ version_file_persist = "/var/lib/crio/version" # Path to AF_LOCAL socket on which CRI-O will listen. listen = "/var/run/crio/crio.sock" +# Host IP considered as the primary IP to use by CRI-O for things such as host network IP. +host_ip = "" + # IP address on which the stream server will listen. stream_address = "127.0.0.1" -# The port on which the stream server will listen. If the port is set to "0", then -# CRI-O will allocate a random free port number. +# The port on which the stream server will listen. stream_port = "0" # Enable encrypted TLS transport of the stream server. @@ -99,10 +94,6 @@ default_runtime = "runc" # If true, the runtime will not use pivot_root, but instead use MS_MOVE. no_pivot = false -# decryption_keys_path is the path where the keys required for -# image decryption are stored. This option supports live configuration reload. -decryption_keys_path = "/etc/crio/keys/" - # Path to the conmon binary, used for monitoring the OCI runtime. # Will be searched for using $PATH if empty. conmon = "/usr/libexec/crio/conmon" @@ -116,26 +107,17 @@ conmon_env = [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", ] -# Additional environment variables to set for all the -# containers. These are overridden if set in the -# container image spec or in the container runtime configuration. -default_env = [ -] - # If true, SELinux will be used for pod separation on the host. selinux = false # Path to the seccomp.json profile which is used as the default seccomp profile # for the runtime. If not specified, then the internal default seccomp profile -# will be used. This option supports live configuration reload. +# will be used. seccomp_profile = "" # Used to change the name of the default AppArmor profile of CRI-O. The default -# profile name is "crio-default". This profile only takes effect if the user -# does not specify a profile via the Kubernetes Pod's metadata annotation. If -# the profile is set to "unconfined", then this equals to disabling AppArmor. -# This option supports live configuration reload. -apparmor_profile = "crio-default" +# profile name is "crio-default-" followed by the version string of CRI-O. +apparmor_profile = "crio-default-1.16.1" # Cgroup management implementation used for the runtime. cgroup_manager = "systemd" @@ -144,15 +126,17 @@ cgroup_manager = "systemd" # only the capabilities defined in the containers json file by the user/kube # will be added. default_capabilities = [ - "CHOWN", - "DAC_OVERRIDE", - "FSETID", - "FOWNER", - "SETGID", - "SETUID", - "SETPCAP", - "NET_BIND_SERVICE", - "KILL", + "CHOWN", + "DAC_OVERRIDE", + "FSETID", + "FOWNER", + "NET_RAW", + "SETGID", + "SETUID", + "SETPCAP", + "NET_BIND_SERVICE", + "SYS_CHROOT", + "KILL", ] # List of default sysctls. If it is empty or commented out, only the sysctls @@ -167,10 +151,8 @@ default_sysctls = [ additional_devices = [ ] -# Path to OCI hooks directories for automatically executed hooks. If one of the -# directories does not exist, then CRI-O will automatically skip them. +# Path to OCI hooks directories for automatically executed hooks. hooks_dir = [ - "/usr/share/containers/oci/hooks.d", ] # List of default mounts for each container. **Deprecated:** this option will @@ -218,13 +200,9 @@ bind_mount_prefix = "" read_only = false # Changes the verbosity of the logs based on the level it is set to. Options -# are fatal, panic, error, warn, info, debug and trace. This option supports -# live configuration reload. -log_level = "info" - -# Filter the log messages by the provided regular expression. -# This option supports live configuration reload. -log_filter = "" +# are fatal, panic, error, warn, info, and debug. This option supports live +# configuration reload. +log_level = "error" # The UID mappings for the user namespace of each container. A range is # specified in the form containerUID:HostUID:Size. Multiple ranges must be @@ -237,23 +215,12 @@ uid_mappings = "" gid_mappings = "" # The minimal amount of time in seconds to wait before issuing a timeout -# regarding the proper termination of the container. The lowest possible -# value is 30s, whereas lower values are not considered by CRI-O. -ctr_stop_timeout = 30 +# regarding the proper termination of the container. +ctr_stop_timeout = 0 -# **DEPRECATED** this option is being replaced by manage_ns_lifecycle, which is described below. -# manage_network_ns_lifecycle = false - -# manage_ns_lifecycle determines whether we pin and remove namespaces -# and manage their lifecycle -manage_ns_lifecycle = false - -# The directory where the state of the managed namespaces gets tracked. -# Only used when manage_ns_lifecycle is true. -namespaces_dir = "/var/run" - -# pinns_path is the path to find the pinns binary, which is needed to manage namespace lifecycle -pinns_path = "/usr/bin/pinns" +# ManageNetworkNSLifecycle determines whether we pin and remove network namespace +# and manage its lifecycle. +manage_network_ns_lifecycle = false # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes. # The runtime to use is picked based on the runtime_handler provided by the CRI. @@ -314,7 +281,7 @@ global_auth_file = "" # The image used to instantiate infra containers. # This option supports live configuration reload. -pause_image = "k8s.gcr.io/pause:3.2" +pause_image = "k8s.gcr.io/pause:3.1" # The path to a file containing credentials specific for pulling the pause_image from # above. The file is similar to that of /var/lib/kubelet/config.json @@ -357,10 +324,6 @@ registries = [ # CNI plugins. [crio.network] -# The default CNI network name to be selected. If not set or "", then -# CRI-O will pick-up the first one found in network_dir. -# cni_default_network = "" - # Path to the directory where CNI configuration files are located. network_dir = "/etc/cni/net.d/" diff --git a/deploy/iso/minikube-iso/package/crio-bin/crio.conf.default b/deploy/iso/minikube-iso/package/crio-bin/crio.conf.default index 2696dc4a10..e456ca42da 100644 --- a/deploy/iso/minikube-iso/package/crio-bin/crio.conf.default +++ b/deploy/iso/minikube-iso/package/crio-bin/crio.conf.default @@ -35,15 +35,8 @@ # the kubelet. The log directory specified must be an absolute directory. log_dir = "/var/log/crio/pods" -# Location for CRI-O to lay down the temporary version file. -# It is used to check if crio wipe should wipe containers, which should -# always happen on a node reboot -version_file = "/var/run/crio/version" - -# Location for CRI-O to lay down the persistent version file. -# It is used to check if crio wipe should wipe images, which should -# only happen when CRI-O has been upgraded -version_file_persist = "/var/lib/crio/version" +# Location for CRI-O to lay down the version file +version_file = "/var/lib/crio/version" # The crio.api table contains settings for the kubelet/gRPC interface. [crio.api] @@ -51,11 +44,13 @@ version_file_persist = "/var/lib/crio/version" # Path to AF_LOCAL socket on which CRI-O will listen. listen = "/var/run/crio/crio.sock" +# Host IP considered as the primary IP to use by CRI-O for things such as host network IP. +host_ip = "" + # IP address on which the stream server will listen. stream_address = "127.0.0.1" -# The port on which the stream server will listen. If the port is set to "0", then -# CRI-O will allocate a random free port number. +# The port on which the stream server will listen. stream_port = "0" # Enable encrypted TLS transport of the stream server. @@ -99,10 +94,6 @@ default_runtime = "runc" # If true, the runtime will not use pivot_root, but instead use MS_MOVE. no_pivot = false -# decryption_keys_path is the path where the keys required for -# image decryption are stored. This option supports live configuration reload. -decryption_keys_path = "/etc/crio/keys/" - # Path to the conmon binary, used for monitoring the OCI runtime. # Will be searched for using $PATH if empty. conmon = "" @@ -116,43 +107,36 @@ conmon_env = [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", ] -# Additional environment variables to set for all the -# containers. These are overridden if set in the -# container image spec or in the container runtime configuration. -default_env = [ -] - # If true, SELinux will be used for pod separation on the host. selinux = false # Path to the seccomp.json profile which is used as the default seccomp profile # for the runtime. If not specified, then the internal default seccomp profile -# will be used. This option supports live configuration reload. +# will be used. seccomp_profile = "" # Used to change the name of the default AppArmor profile of CRI-O. The default -# profile name is "crio-default". This profile only takes effect if the user -# does not specify a profile via the Kubernetes Pod's metadata annotation. If -# the profile is set to "unconfined", then this equals to disabling AppArmor. -# This option supports live configuration reload. -apparmor_profile = "crio-default" +# profile name is "crio-default-" followed by the version string of CRI-O. +apparmor_profile = "crio-default-1.16.1" # Cgroup management implementation used for the runtime. -cgroup_manager = "systemd" +cgroup_manager = "cgroupfs" # List of default capabilities for containers. If it is empty or commented out, # only the capabilities defined in the containers json file by the user/kube # will be added. default_capabilities = [ - "CHOWN", - "DAC_OVERRIDE", - "FSETID", - "FOWNER", - "SETGID", - "SETUID", - "SETPCAP", - "NET_BIND_SERVICE", - "KILL", + "CHOWN", + "DAC_OVERRIDE", + "FSETID", + "FOWNER", + "NET_RAW", + "SETGID", + "SETUID", + "SETPCAP", + "NET_BIND_SERVICE", + "SYS_CHROOT", + "KILL", ] # List of default sysctls. If it is empty or commented out, only the sysctls @@ -167,10 +151,8 @@ default_sysctls = [ additional_devices = [ ] -# Path to OCI hooks directories for automatically executed hooks. If one of the -# directories does not exist, then CRI-O will automatically skip them. +# Path to OCI hooks directories for automatically executed hooks. hooks_dir = [ - "/usr/share/containers/oci/hooks.d", ] # List of default mounts for each container. **Deprecated:** this option will @@ -218,13 +200,9 @@ bind_mount_prefix = "" read_only = false # Changes the verbosity of the logs based on the level it is set to. Options -# are fatal, panic, error, warn, info, debug and trace. This option supports -# live configuration reload. -log_level = "info" - -# Filter the log messages by the provided regular expression. -# This option supports live configuration reload. -log_filter = "" +# are fatal, panic, error, warn, info, and debug. This option supports live +# configuration reload. +log_level = "error" # The UID mappings for the user namespace of each container. A range is # specified in the form containerUID:HostUID:Size. Multiple ranges must be @@ -237,23 +215,12 @@ uid_mappings = "" gid_mappings = "" # The minimal amount of time in seconds to wait before issuing a timeout -# regarding the proper termination of the container. The lowest possible -# value is 30s, whereas lower values are not considered by CRI-O. -ctr_stop_timeout = 30 +# regarding the proper termination of the container. +ctr_stop_timeout = 0 -# **DEPRECATED** this option is being replaced by manage_ns_lifecycle, which is described below. -# manage_network_ns_lifecycle = false - -# manage_ns_lifecycle determines whether we pin and remove namespaces -# and manage their lifecycle -manage_ns_lifecycle = false - -# The directory where the state of the managed namespaces gets tracked. -# Only used when manage_ns_lifecycle is true. -namespaces_dir = "/var/run" - -# pinns_path is the path to find the pinns binary, which is needed to manage namespace lifecycle -pinns_path = "" +# ManageNetworkNSLifecycle determines whether we pin and remove network namespace +# and manage its lifecycle. +manage_network_ns_lifecycle = false # The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes. # The runtime to use is picked based on the runtime_handler provided by the CRI. @@ -314,7 +281,7 @@ global_auth_file = "" # The image used to instantiate infra containers. # This option supports live configuration reload. -pause_image = "k8s.gcr.io/pause:3.2" +pause_image = "k8s.gcr.io/pause:3.1" # The path to a file containing credentials specific for pulling the pause_image from # above. The file is similar to that of /var/lib/kubelet/config.json @@ -356,10 +323,6 @@ image_volumes = "mkdir" # CNI plugins. [crio.network] -# The default CNI network name to be selected. If not set or "", then -# CRI-O will pick-up the first one found in network_dir. -# cni_default_network = "" - # Path to the directory where CNI configuration files are located. network_dir = "/etc/cni/net.d/" From 53073506d1321a352fb8203e22f22fdb177a4392 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Anders=20F=20Bj=C3=B6rklund?= Date: Mon, 6 Jul 2020 10:22:49 +0200 Subject: [PATCH 5/6] Revert "Upgrade crio to 1.18.1" This reverts commit de7ea0b270018cb23805cf9dfda8173fbba748b0. --- deploy/iso/minikube-iso/package/crio-bin/conmon-config.h | 9 +++++++++ deploy/iso/minikube-iso/package/crio-bin/crio-bin.hash | 2 -- deploy/iso/minikube-iso/package/crio-bin/crio-bin.mk | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) create mode 100755 deploy/iso/minikube-iso/package/crio-bin/conmon-config.h diff --git a/deploy/iso/minikube-iso/package/crio-bin/conmon-config.h b/deploy/iso/minikube-iso/package/crio-bin/conmon-config.h new file mode 100755 index 0000000000..1783492d0d --- /dev/null +++ b/deploy/iso/minikube-iso/package/crio-bin/conmon-config.h @@ -0,0 +1,9 @@ + +#if !defined(CONFIG_H) +#define CONFIG_H + +#define BUF_SIZE 8192 +#define STDIO_BUF_SIZE 8192 +#define DEFAULT_SOCKET_PATH "/var/run/crio" + +#endif // CONFIG_H diff --git a/deploy/iso/minikube-iso/package/crio-bin/crio-bin.hash b/deploy/iso/minikube-iso/package/crio-bin/crio-bin.hash index baddc429e9..d0f12d3d77 100644 --- a/deploy/iso/minikube-iso/package/crio-bin/crio-bin.hash +++ b/deploy/iso/minikube-iso/package/crio-bin/crio-bin.hash @@ -12,5 +12,3 @@ sha256 05f9614c4d5970b4662499b84c270b0ab953596ee863dcd09c9dc7a2d2f09789 v1.16.0. sha256 57e1ee990ef2d5af8b32c33a21b4998682608e3556dcf1d3349666f55e7d95b9 v1.16.1.tar.gz sha256 23a797762e4544ee7c171ef138cfc1141a3f0acc2838d9965c2a58e53b16c3ae v1.17.0.tar.gz sha256 7967e9218fdfb59d6005a9e19c1668469bc5566c2a35927cffe7de8656bb22c7 v1.17.1.tar.gz -sha256 865ded95aceb3a33a391b252522682de6b37b39498704c490b3a321dbefaafcb v1.18.0.tar.gz -sha256 794ddc36c2a20fde91fc6cc2c6f02ebdaea85c69b51b67f3994090dbbdbc2a50 v1.18.1.tar.gz diff --git a/deploy/iso/minikube-iso/package/crio-bin/crio-bin.mk b/deploy/iso/minikube-iso/package/crio-bin/crio-bin.mk index 231ae37866..f1a58a31b7 100644 --- a/deploy/iso/minikube-iso/package/crio-bin/crio-bin.mk +++ b/deploy/iso/minikube-iso/package/crio-bin/crio-bin.mk @@ -4,8 +4,8 @@ # ################################################################################ -CRIO_BIN_VERSION = v1.18.1 -CRIO_BIN_COMMIT = 5cbf694c34f8d1af19eb873e39057663a4830635 +CRIO_BIN_VERSION = v1.17.1 +CRIO_BIN_COMMIT = ee2de87bd8e2a7a84799476cb4fc4ce8a78fdf6d CRIO_BIN_SITE = https://github.com/cri-o/cri-o/archive CRIO_BIN_SOURCE = $(CRIO_BIN_VERSION).tar.gz CRIO_BIN_DEPENDENCIES = host-go libgpgme From 9bc5cf83532c10c9ad67df1d0e72eb0fcc9c02bf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Anders=20F=20Bj=C3=B6rklund?= Date: Mon, 6 Jul 2020 10:35:38 +0200 Subject: [PATCH 6/6] Delete cri-o patch file now unused after revert --- .../patches/crio-bin/v1.18.1/version.patch | 78 ------------------- 1 file changed, 78 deletions(-) delete mode 100644 deploy/iso/minikube-iso/board/coreos/minikube/patches/crio-bin/v1.18.1/version.patch diff --git a/deploy/iso/minikube-iso/board/coreos/minikube/patches/crio-bin/v1.18.1/version.patch b/deploy/iso/minikube-iso/board/coreos/minikube/patches/crio-bin/v1.18.1/version.patch deleted file mode 100644 index 882bc9eadc..0000000000 --- a/deploy/iso/minikube-iso/board/coreos/minikube/patches/crio-bin/v1.18.1/version.patch +++ /dev/null @@ -1,78 +0,0 @@ -diff --git a/Makefile b/Makefile -index 764a0136a..4148d81eb 100644 ---- a/Makefile -+++ b/Makefile -@@ -100,7 +100,7 @@ BASE_LDFLAGS = ${SHRINKFLAGS} \ - -X ${PROJECT}/internal/version.gitCommit=${COMMIT_NO} \ - -X ${PROJECT}/internal/version.gitTreeState=${GIT_TREE_STATE} \ - --LDFLAGS = -ldflags '${BASE_LDFLAGS} ${EXTRA_LDFLAGS}' -+GO_LDFLAGS = -ldflags '${BASE_LDFLAGS} ${EXTRA_LDFLAGS}' - - TESTIMAGE_VERSION := master-1.3.6 - TESTIMAGE_REGISTRY := quay.io/crio -@@ -157,16 +157,16 @@ bin/pinns: - $(MAKE) -C pinns - - test/copyimg/copyimg: $(GO_FILES) .gopathok -- $(GO_BUILD) $(GCFLAGS) $(LDFLAGS) -tags "$(BUILDTAGS)" -o $@ $(PROJECT)/test/copyimg -+ $(GO_BUILD) $(GCFLAGS) $(GO_LDFLAGS) -tags "$(BUILDTAGS)" -o $@ $(PROJECT)/test/copyimg - - test/checkseccomp/checkseccomp: $(GO_FILES) .gopathok -- $(GO_BUILD) $(GCFLAGS) $(LDFLAGS) -tags "$(BUILDTAGS)" -o $@ $(PROJECT)/test/checkseccomp -+ $(GO_BUILD) $(GCFLAGS) $(GO_LDFLAGS) -tags "$(BUILDTAGS)" -o $@ $(PROJECT)/test/checkseccomp - - bin/crio: $(GO_FILES) .gopathok -- $(GO_BUILD) $(GCFLAGS) $(LDFLAGS) -tags "$(BUILDTAGS)" -o $@ $(PROJECT)/cmd/crio -+ $(GO_BUILD) $(GCFLAGS) $(GO_LDFLAGS) -tags "$(BUILDTAGS)" -o $@ $(PROJECT)/cmd/crio - - bin/crio-status: $(GO_FILES) .gopathok -- $(GO_BUILD) $(GCFLAGS) $(LDFLAGS) -tags "$(BUILDTAGS)" -o $@ $(PROJECT)/cmd/crio-status -+ $(GO_BUILD) $(GCFLAGS) $(GO_LDFLAGS) -tags "$(BUILDTAGS)" -o $@ $(PROJECT)/cmd/crio-status - - build-static: - $(CONTAINER_RUNTIME) run --rm -it -v $(shell pwd):/cri-o $(TESTIMAGE_NIX) sh -c \ -@@ -216,7 +216,7 @@ bin/crio.cross.%: .gopathok .explicit_phony - TARGET="$*"; \ - GOOS="$${TARGET%%.*}" \ - GOARCH="$${TARGET##*.}" \ -- $(GO_BUILD) $(LDFLAGS) -tags "containers_image_openpgp btrfs_noversion" -o "$@" $(PROJECT)/cmd/crio -+ $(GO_BUILD) $(GO_LDFLAGS) -tags "containers_image_openpgp btrfs_noversion" -o "$@" $(PROJECT)/cmd/crio - - local-image: - $(TESTIMAGE_SCRIPT) -diff --git a/cmd/crio/main.go b/cmd/crio/main.go -index ab033a47d..fa10f170a 100644 ---- a/cmd/crio/main.go -+++ b/cmd/crio/main.go -@@ -120,7 +120,7 @@ func main() { - app.Authors = []*cli.Author{{Name: "The CRI-O Maintainers"}} - app.UsageText = usage - app.Description = app.Usage -- app.Version = "\n" + version.Get().String() -+ app.Version = version.Version + "\n" + version.Get().String() - - var err error - app.Flags, app.Metadata, err = criocli.GetFlagsAndMetadata() -diff --git a/internal/version/version.go b/internal/version/version.go -index 7ab5da5a2..19692595e 100644 ---- a/internal/version/version.go -+++ b/internal/version/version.go -@@ -6,6 +6,7 @@ import ( - "fmt" - "io/ioutil" - "os" -+ "os/exec" - "path/filepath" - "reflect" - "runtime" -@@ -171,6 +172,9 @@ func getLinkmode() string { - return "" - } - -+ if _, err := exec.LookPath("ldd"); err != nil { -+ return "" -+ } - if _, err := utils.ExecCmd("ldd", abspath); err != nil { - if strings.Contains(err.Error(), "not a dynamic executable") { - return "static"