Skip to content

Commit 7478ace

Browse files
behzad-mirbehzad-mir
authored
[backport v1.7] feat: adding dokcerfile templates for ACN images that are missing it and bumping Go version to 1.24.13 (#4341)
feat: adding dokcerfile templates for ACN images that are missing it an dbumping Go version to 1.24.13 (#4289) * feat: add Dockerfile templates for ACN images and bump Go to 1.24.13 This PR extends the Dockerfile template system (used by CNI/CNS) to all remaining Go-based images for consistent base image version management. Changes: - Added Dockerfile templates for azure-ipam, azure-ip-masq-merger, azure-iptables-monitor, and cilium-log-collector - Added corresponding pipeline Dockerfile templates - Updated build/images.mk with render-simple and render-pipe targets - Bumped Go version to 1.24.13 (via rolling tag 1.24-azurelinux3.0) - Bumped ipv6-hp-bpf Go version to 1.24.13 (Debian bookworm image) CVE Impact: - Fixes 5 stdlib CVEs including CRITICAL CVE-2025-68121 (crypto/tls) - Remaining: CVE-2026-25679 (requires Go 1.25.8+) * fix: use msft-go in signed pipeline Cherry-picked from jpayne3506/msft-goSigned (0ffec35) This removes the dependency on the ADO GOVERSION variable and instead extracts Go directly from the msft-go container image referenced in each project's Dockerfile, keeping the signed pipeline in sync with the Dockerfile-based build.
1 parent 9d7f533 commit 7478ace

23 files changed

Lines changed: 339 additions & 33 deletions

‎.pipelines/build/binary.steps.yaml‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,34 +10,37 @@ parameters:
1010

1111

1212
steps:
13-
- task: GoTool@0
13+
- task: ShellScript@2
14+
displayName: "Install msft-go"
1415
inputs:
15-
version: '$(GOVERSION)'
16+
scriptPath: $(REPO_ROOT)/.pipelines/build/scripts/install-go.sh
17+
env:
18+
name: $(name)
1619

1720
- bash: |
1821
# Ubuntu
1922
if [[ -f /etc/debian_version ]];then
2023
sudo apt-get update -y
2124
if [[ $GOARCH =~ amd64 ]]; then
2225
sudo apt-get install -y llvm clang linux-libc-dev linux-headers-generic libbpf-dev libc6-dev nftables iproute2 gcc-multilib tree
23-
for dir in /usr/include/x86_64-linux-gnu/*; do
24-
sudo ln -sfn "$dir" /usr/include/$(basename "$dir")
26+
for dir in /usr/include/x86_64-linux-gnu/*; do
27+
sudo ln -sfn "$dir" /usr/include/$(basename "$dir")
2528
done
26-
29+
2730
elif [[ $GOARCH =~ arm64 ]]; then
2831
sudo apt-get install -y llvm clang linux-libc-dev linux-headers-generic libbpf-dev libc6-dev nftables iproute2 gcc-aarch64-linux-gnu tree
29-
for dir in /usr/include/aarch64-linux-gnu/*; do
32+
for dir in /usr/include/aarch64-linux-gnu/*; do
3033
sudo ln -sfn "$dir" /usr/include/$(basename "$dir")
3134
done
3235
fi
3336
# Mariner
3437
else
3538
sudo tdnf install -y llvm clang libbpf-devel nftables tree
36-
for dir in /usr/include/aarch64-linux-gnu/*; do
39+
for dir in /usr/include/aarch64-linux-gnu/*; do
3740
if [[ -d $dir ]]; then
38-
sudo ln -sfn "$dir" /usr/include/$(basename "$dir")
41+
sudo ln -sfn "$dir" /usr/include/$(basename "$dir")
3942
elif [[ -f "$dir" ]]; then
40-
sudo ln -Tsfn "$dir" /usr/include/$(basename "$dir")
43+
sudo ln -Tsfn "$dir" /usr/include/$(basename "$dir")
4144
fi
4245
done
4346
fi

‎.pipelines/build/dockerfiles/azure-ip-masq-merger.Dockerfile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
# !! AUTOGENERATED - DO NOT EDIT !!
2+
# SOURCE: .pipelines/build/dockerfiles/azure-ip-masq-merger.Dockerfile.tmpl
13
ARG ARCH
24

35
FROM scratch AS linux

‎.pipelines/build/dockerfiles/azure-ip-masq-merger.Dockerfile.tmpl‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# {{.RENDER_MSG}}
2+
# SOURCE: {{.SRC_PIPE}}
3+
ARG ARCH
4+
5+
FROM scratch AS linux
6+
ARG ARTIFACT_DIR
7+
8+
COPY ${ARTIFACT_DIR}/bin/azure-ip-masq-merger /azure-ip-masq-merger
9+
ENTRYPOINT ["/azure-ip-masq-merger"]

‎.pipelines/build/dockerfiles/azure-ipam.Dockerfile‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
1+
# !! AUTOGENERATED - DO NOT EDIT !!
2+
# SOURCE: .pipelines/build/dockerfiles/azure-ipam.Dockerfile.tmpl
13
ARG ARCH
24

35

4-
# skopeo inspect docker://mcr.microsoft.com/oss/kubernetes/windows-host-process-containers-base-image:v1.0.0 --format "{{.Name}}@{{.Digest}}"
6+
# mcr.microsoft.com/oss/kubernetes/windows-host-process-containers-base-image:v1.0.0
57
FROM --platform=windows/${ARCH} mcr.microsoft.com/oss/kubernetes/windows-host-process-containers-base-image@sha256:b4c9637e032f667c52d1eccfa31ad8c63f1b035e8639f3f48a510536bf34032b as windows
68
ARG ARTIFACT_DIR .
79

‎.pipelines/build/dockerfiles/azure-ipam.Dockerfile.tmpl‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# {{.RENDER_MSG}}
2+
# SOURCE: {{.SRC_PIPE}}
3+
ARG ARCH
4+
5+
6+
# {{.WIN_HPC_IMG}}
7+
FROM --platform=windows/${ARCH} {{.WIN_HPC_PIN}} as windows
8+
ARG ARTIFACT_DIR .
9+
10+
COPY ${ARTIFACT_DIR}/bin/dropgz.exe /dropgz.exe
11+
ENTRYPOINT [ "/dropgz.exe" ]
12+
13+
14+
FROM scratch AS linux
15+
ARG ARTIFACT_DIR .
16+
17+
COPY ${ARTIFACT_DIR}/bin/dropgz /dropgz
18+
ENTRYPOINT [ "/dropgz" ]

‎.pipelines/build/dockerfiles/azure-iptables-monitor.Dockerfile‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
1+
# !! AUTOGENERATED - DO NOT EDIT !!
2+
# SOURCE: .pipelines/build/dockerfiles/azure-iptables-monitor.Dockerfile.tmpl
13
ARG ARCH
24

35
# mcr.microsoft.com/azurelinux/base/core:3.0
4-
FROM mcr.microsoft.com/azurelinux/base/core@sha256:9948138108a3d69f1dae62104599ac03132225c3b7a5ac57b85a214629c8567d AS mariner-core
6+
FROM mcr.microsoft.com/azurelinux/base/core@sha256:a452d39c91576f5a2c983c7d3b62521fabd08e16b4a7237e24bf2be3b06e1651 AS mariner-core
57

68
# mcr.microsoft.com/azurelinux/distroless/minimal:3.0
7-
FROM mcr.microsoft.com/azurelinux/distroless/minimal@sha256:0801b80a0927309572b9adc99bd1813bc680473175f6e8175cd4124d95dbd50c AS mariner-distroless
9+
FROM mcr.microsoft.com/azurelinux/distroless/minimal@sha256:22810fd97d6ad5ec7d5bdd5b00233a3050be01d9e26b47b16cb6f1a7f178834b AS mariner-distroless
810

911
FROM mariner-core AS iptables
1012
RUN tdnf install -y iptables

‎.pipelines/build/dockerfiles/azure-iptables-monitor.Dockerfile.tmpl‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# {{.RENDER_MSG}}
2+
# SOURCE: {{.SRC_PIPE}}
3+
ARG ARCH
4+
5+
# {{.MARINER_CORE_IMG}}
6+
FROM {{.MARINER_CORE_PIN}} AS mariner-core
7+
8+
# {{.MARINER_DISTROLESS_IMG}}
9+
FROM {{.MARINER_DISTROLESS_PIN}} AS mariner-distroless
10+
11+
FROM mariner-core AS iptools
12+
RUN tdnf install -y iptables iproute
13+
14+
FROM mariner-distroless AS linux
15+
ARG ARTIFACT_DIR
16+
COPY --from=iptools /usr/sbin/*tables* /usr/sbin/
17+
COPY --from=iptools /usr/sbin/ip /usr/sbin/
18+
COPY --from=iptools /usr/lib /usr/lib
19+
COPY --from=iptools /usr/lib64 /usr/lib64
20+
COPY ${ARTIFACT_DIR}/bin/azure-iptables-monitor /azure-iptables-monitor
21+
COPY ${ARTIFACT_DIR}/bin/azure-block-iptables /azure-block-iptables
22+
23+
ENTRYPOINT ["/azure-iptables-monitor"]

‎.pipelines/build/dockerfiles/cilium-log-collector.Dockerfile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
# !! AUTOGENERATED - DO NOT EDIT !!
2+
# SOURCE: .pipelines/build/dockerfiles/cilium-log-collector.Dockerfile.tmpl
13
ARG ARCH
24

35
FROM mcr.microsoft.com/oss/v2/fluent/fluent-bit:v4.2.2 as linux

‎.pipelines/build/dockerfiles/cilium-log-collector.Dockerfile.tmpl‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# {{.RENDER_MSG}}
2+
# SOURCE: {{.SRC_PIPE}}
3+
ARG ARCH
4+
5+
FROM mcr.microsoft.com/oss/v2/fluent/fluent-bit:v4.2.2 as linux
6+
ARG ARTIFACT_DIR
7+
COPY ${ARTIFACT_DIR}/bin/out_azure_app_insights.so /out_azure_app_insights.so

‎.pipelines/build/images.jobs.yaml‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,17 @@ jobs:
4949
targetPath: $(REPO_ROOT)
5050
artifact: '${{ job_data.templateContext.repositoryArtifact }}'
5151

52-
- task: GoTool@0
52+
- task: ShellScript@2
53+
displayName: "Install crane"
54+
inputs:
55+
scriptPath: $(REPO_ROOT)/.pipelines/build/scripts/install-crane.sh
56+
57+
- task: ShellScript@2
58+
displayName: "Install msft-go"
5359
inputs:
54-
version: '$(GOVERSION)'
60+
scriptPath: $(REPO_ROOT)/.pipelines/build/scripts/install-go.sh
61+
env:
62+
name: $(name)
5563

5664
- task: ShellScript@2
5765
inputs:
@@ -76,15 +84,15 @@ jobs:
7684
- task: ShellScript@2
7785
displayName: "Package with DropGZ"
7886
condition: and(
79-
succeeded(),
87+
succeeded(),
8088
eq(variables.packageWithDropGZ, 'True'))
8189
inputs:
8290
scriptPath: $(REPO_ROOT)/.pipelines/build/scripts/dropgz.sh
8391

8492
- ${{ if not(contains(job_data.job, 'linux')) }}:
8593
- task: onebranch.pipeline.signing@1
8694
condition: and(
87-
succeeded(),
95+
succeeded(),
8896
eq(variables.packageWithDropGZ, 'True'))
8997
inputs:
9098
command: 'sign'
@@ -94,7 +102,7 @@ jobs:
94102

95103
# OneBranch artifacts are stored on a Windows machine which obliterates
96104
# Linux file permissions.
97-
# This task is added (along with ob_extract_root_artifact in jobs that
105+
# This task is added (along with ob_extract_root_artifact in jobs that
98106
# download the artifact) to protect those file permissions from changing
99107
# during image build time.
100108
#

0 commit comments

Comments
 (0)