Skip to content

Commit 5ad5fa2

Browse files
diafourdiafour
committed
Add pre-created mount points to images:
- cdi-apiserver - cdi-cloner - cdi-controller - cdi-importer - cdi-operator - dvcr - dvcr-importer - dvcr-uploader - kube-api-rewriter - virt-api - virt-controller - virt-handler - virt-launcher - virt-operator - virtualization-api - virtualization-audit - virtualization-controller - hp pods Some notes: - Create /var/run subdirectories in /run, as /var/run is a symlink to ../run. - Add /var, /run and symlink /var/run -> ../run in 'distroless' base image. - Pre-create /var, /run and symlink /var/run -> ../run in kube-api-rewriter image. - Remove unused extraheaders settings in dvcr-importer and dvcr-uploader. Signed-off-by: Ivan Mikheykin <[email protected]>
1 parent 4cf28b0 commit 5ad5fa2

File tree

45 files changed

+233
-74
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+233
-74
lines changed

‎.prettierignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
**/*.git
22
**/.svn
33
**/.hg
4+
images/**/mount-points.yaml
45
**/werf*.yaml
56
**/werf*.yml
67
.werf/**

‎.werf/defines/image-mountpoints.tmpl‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,30 @@
1-
# add mount points from file mount_points.yaml in the build dir
1+
{{/*
22

3+
Template to bake mount points in the image. These static mount points
4+
are required so containerd can start a container with image integrity check.
5+
6+
Problem: each directory specified in volumeMounts items should exist
7+
in image, containerd is unable to create mount point for us when
8+
integrity check is enabled.
9+
10+
Solution: define all possible mount points in mount-points.yaml file and
11+
include this template in git section of the werf.inc.yaml.
12+
13+
*/}}
14+
{{/* NOTE: Keep in sync with version in Deckhouse CSE */}}
315
{{- define "image mount points" }}
416
{{- $mountPoints := ($.Files.Get (printf "images/%s/mount-points.yaml" $.ImageName) | fromYaml) }}
517
{{- $context := . }}
618
{{- range $v := $mountPoints.dirs }}
7-
- add: {{ $context.ModuleDir }}/tools/mounts/mountdir
8-
to: {{ $v }}
9-
owner: 64535
10-
group: 64535
19+
- add: /tools/mounts/mountdir
20+
to: {{ $v | trimSuffix "/" }}
1121
stageDependencies:
1222
install:
1323
- "**/*"
1424
{{- end }}
1525
{{- range $v := $mountPoints.files }}
16-
- add: {{ $context.ModuleDir }}/tools/mounts/mountfile
26+
- add: /tools/mounts/mountfile
1727
to: {{ $v }}
18-
owner: 64535
19-
group: 64535
2028
stageDependencies:
2129
install:
2230
- "**/*"

‎.werf/images.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@ dockerfile: Dockerfile
4242
{{- $_ := set $ctx "SVACE_ANALYZE_SSH_USER" $Root.SVACE_ANALYZE_SSH_USER }}
4343
{{- $_ := set $ctx "SVACE_ANALYZE_HOST" $Root.SVACE_ANALYZE_HOST }}
4444
{{- $_ := set $ctx "SVACE_IMAGE_SUFFIX" $Root.SVACE_IMAGE_SUFFIX }}
45-
{{- $_ := set $ctx "Files" $.Files }}
4645

4746

4847
{{- include "module_image_template" $ctx }}

‎images/cdi-apiserver/mount-points.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# A list of pre-created mount points for containerd strict mode.
2+
3+
dirs:
4+
# Create dirs in /run, as /var/run is a symlink to /run.
5+
- /run/certs/cdi-apiserver-signer-bundle
6+
- /run/certs/cdi-apiserver-server-cert
7+
- /kubeconfig.local

‎images/cdi-apiserver/werf.inc.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
---
22
image: {{ .ModuleNamePrefix }}{{ .ImageName }}
33
fromImage: {{ .ModuleNamePrefix }}distroless
4+
git:
5+
{{- include "image mount points" . }}
46
import:
57
- image: {{ .ModuleNamePrefix }}cdi-artifact
68
add: /cdi-binaries

‎images/cdi-cloner/mount-points.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# A list of pre-created mount points for containerd strict mode.
2+
#
3+
# See https://github.com/deckhouse/3p-containerized-data-importer/blob/80d763d788e06b3decaf22e4762076cec64582b3/pkg/controller/clone-controller.go#L699
4+
5+
dirs:
6+
# Create dirs in /run, as /var/run is a symlink to /run.
7+
- /run/cdi/clone/source

‎images/cdi-cloner/werf.inc.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
---
22
image: {{ .ModuleNamePrefix }}{{ .ImageName }}
33
fromImage: {{ .ModuleNamePrefix }}distroless
4+
git:
5+
{{- include "image mount points" . }}
46
import:
57
- image: {{ .ModuleNamePrefix }}{{ .ImageName }}-bins
68
add: /relocate

‎images/cdi-controller/mount-points.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# A list of pre-created mount points for containerd strict mode.
2+
#
3+
# Some volume mounts are ignored:
4+
# - /tmp - already in the 'distroless' base image.
5+
6+
dirs:
7+
# Create dirs in /run, as /var/run is a symlink to /run.
8+
- /run/cdi/token/keys
9+
- /run/certs/cdi-uploadserver-signer
10+
- /run/certs/cdi-uploadserver-client-signer
11+
- /run/ca-bundle/cdi-uploadserver-signer-bundle
12+
- /run/ca-bundle/cdi-uploadserver-client-signer-bundle
13+
- /kubeconfig.local

‎images/cdi-controller/werf.inc.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
---
22
image: {{ .ModuleNamePrefix }}{{ .ImageName }}
33
fromImage: {{ .ModuleNamePrefix }}distroless
4+
git:
5+
{{- include "image mount points" . }}
46
import:
57
- image: {{ .ModuleNamePrefix }}{{ .ImageName }}-bins
68
add: /relocate

‎images/cdi-importer/mount-points.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# A list of pre-created mount points for containerd strict mode.
2+
#
3+
# See https://github.com/deckhouse/3p-containerized-data-importer/blob/d5fa5124b8a645521843814fffecdf385b74b379/pkg/controller/import-controller.go#L962
4+
#
5+
# Some volume mounts are ignored:
6+
# - /extraheaders - Etra headers not implemented in virtualization-controller.
7+
# - /google - No support for GCS data source in VirtualImage.
8+
# - /tmp - already in the 'distroless' base image.
9+
10+
dirs:
11+
- /certs
12+
- /data
13+
- /opt
14+
- /proxycerts
15+
- /scratch
16+
- /shared
17+

0 commit comments

Comments
 (0)