From e7a4d071ba07fe3668f871d967dda27c697d84cc Mon Sep 17 00:00:00 2001
From: Diogo Souza <diogo.souza@suse.com>
Date: Fri, 12 Jun 2026 00:29:10 -0300
Subject: [PATCH] build kubectl bins

---
 package/Dockerfile | 51 ++++++++++++++++++++++++++++++++++++----------
 1 file changed, 40 insertions(+), 11 deletions(-)

diff --git a/package/Dockerfile b/package/Dockerfile
index 9176266..d6a222c 100644
--- a/package/Dockerfile
+++ b/package/Dockerfile
@@ -1,4 +1,40 @@
 ARG BCI_VERSION=16.0
+ARG GO_IMAGE=rancher/hardened-build-base:v1.26.4b1
+
+# xx provides cross-compilation helpers so the builder always runs on the build
+# machine's native arch while targeting TARGETPLATFORM.
+FROM --platform=$BUILDPLATFORM rancher/mirrored-tonistiigi-xx:1.6.1 AS xx
+
+# Single stage builds all kubectl versions listed in kubectl-versions.txt.
+FROM --platform=$BUILDPLATFORM ${GO_IMAGE}  AS kubectl-builder
+COPY --from=xx / /
+ARG TARGETPLATFORM
+RUN xx-go --wrap
+
+WORKDIR /build
+COPY kubectl-versions.txt .
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    set -e && \
+    mkdir -p /kubectl-bins && \
+    while read -r version; do \
+        echo "==> Building kubectl ${version}"; \
+        curl -fsSL \
+            https://github.com/kubernetes/kubernetes/archive/refs/tags/${version}.tar.gz | \
+            tar -xz && \
+        cd kubernetes-${version#v} && \
+        KUBE_GIT_VERSION=${version} \
+        KUBE_GIT_COMMIT=unknown \
+        KUBE_GIT_TREE_STATE=clean \
+        KUBE_BUILD_PLATFORMS=$(xx-info os)/$(xx-info arch) \
+        GOFLAGS="-tags=providerless" \
+        CGO_ENABLED=0 \
+        make WHAT=cmd/kubectl && \
+        xx-verify --static _output/local/bin/$(xx-info os)/$(xx-info arch)/kubectl && \
+        cp _output/local/bin/$(xx-info os)/$(xx-info arch)/kubectl /kubectl-bins/kubectl${version#v} && \
+        cd /build && rm -rf kubernetes-${version#v}; \
+    done < kubectl-versions.txt
+
 FROM ghcr.io/flavio/kuberlr:v0.7.0 AS kuberlr
 FROM registry.suse.com/bci/bci-busybox:${BCI_VERSION} AS final
 FROM registry.suse.com/bci/bci-base:${BCI_VERSION} AS zypper
@@ -6,7 +42,7 @@ FROM registry.suse.com/bci/bci-base:${BCI_VERSION} AS zypper
 ARG TARGETPLATFORM
 ARG TARGETARCH
 
-# Creates the based dir for the target image, and hydrates it with the
+# Creates the base dir for the target image, and hydrates it with the
 # original contents of the final image.
 RUN mkdir /chroot
 COPY --from=final / /chroot/
@@ -26,15 +62,8 @@ COPY --from=kuberlr /bin/kuberlr /chroot/bin/
 RUN cd /chroot/bin && ln -s ./kuberlr ./kubectl
 COPY --from=kuberlr /home/kuberlr /chroot/home/kuberlr
 
-WORKDIR /tmp
-COPY kubectl-versions.txt /tmp/kubectl-versions.txt
-# kuberlr get verifies bin hash for us
-RUN while read -r version; do \
-    /chroot/bin/kuberlr get $version; \
-    done < ./kubectl-versions.txt; \
-    /chroot/bin/kuberlr bins \
-    && cp -a /root/.kuberlr/linux-*/* /chroot/usr/bin/ \
-    && /chroot/bin/kuberlr bins
+# Copy all kubectl binaries built from source
+COPY --from=kubectl-builder /kubectl-bins/ /chroot/usr/bin/
 
 # Disable ability to download kubectl due to air-gap support
 RUN sed -i 's/AllowDownload = true/AllowDownload = false/' /chroot/home/kuberlr/.kuberlr/kuberlr.conf
@@ -52,4 +81,4 @@ COPY --from=zypper /chroot /
 USER kuberlr
 WORKDIR /home/kuberlr
 ENTRYPOINT ["/bin/kubectl"]
-CMD ["help"]
\ No newline at end of file
+CMD ["help"]