Skip to content

distroless-iptables: remove dependency from conntrack binary #4223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
aroradaman wants to merge 1 commit into
base: master
Choose a base branch
from
Open

distroless-iptables: remove dependency from conntrack binary #4223

aroradaman wants to merge 1 commit into from
+1 −2

Conversation

@aroradaman
Copy link
Member

@aroradaman aroradaman commented Jan 2, 2026

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

With kubernetes/kubernetes#126847 kube-proxy will no longer depend on conntrack binary to be present on the image, this PR removes the conntrack binary from the distroless-iptables image.

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

The distroless iptables binary will no longer have conntrack binary

@aroradaman
distroless-iptables: remove dependency from conntrack binary
a9a97a0 
Signed-off-by: Daman Arora <aroradaman@gmail.com>
@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. needs-priority labels Jan 2, 2026
@k8s-ci-robot k8s-ci-robot added area/release-eng Issues or PRs related to the Release Engineering subproject sig/release Categorizes an issue or PR as relevant to SIG Release. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jan 2, 2026
@aroradaman
Copy link
Member Author

aroradaman commented Jan 2, 2026

Following up from #3726,
I think it is safe to remove the dependency now, from k/k 1.32 we no longer depend on the conntrack binary.

/cc @aojea @danwinship @BenTheElder

cpanato
cpanato approved these changes Jan 2, 2026
View reviewed changes
Copy link
Member

@cpanato cpanato left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

/hold for @BenTheElder to comment

@k8s-ci-robot k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 2, 2026
@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jan 2, 2026
@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Jan 2, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aroradaman, cpanato

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 2, 2026
aojea
aojea reviewed Jan 2, 2026
View reviewed changes
images/build/distroless-iptables/distroless-bookworm/Dockerfile
mkdir -p "${STAGE_DIR}" && \
/stage-binaries-from-package.sh "${STAGE_DIR}" conntrack \
ebtables \
/stage-binaries-from-package.sh "${STAGE_DIR}" ebtables \
Copy link
Member

@aojea aojea Jan 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

now that I see this, I think ebtables was only required for some dockershim kubelet stuff, @danwinship to keep me honest

Copy link
Contributor

@danwinship danwinship Jan 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, kubernetes/kubernetes#28717. Definitely not needed any more.

Copy link
Member

@aojea aojea Jan 5, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@aroradaman can you please remove the ebtables, that is not likely going to be used anywhere , howeve, regarding the conntrack binary this image is used in another projects too https://grep.app/search?q=distroless-iptables ... I'm unclear on what contract do we have with this image or what are the expectactions

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cpanato cpanato cpanato approved these changes

@jimangel jimangel Awaiting requested review from jimangel

@MrHohn MrHohn Awaiting requested review from MrHohn

@BenTheElder BenTheElder Awaiting requested review from BenTheElder

@danwinship danwinship Awaiting requested review from danwinship

+1 more reviewer

@aojea aojea aojea left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@cpanato cpanato

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. area/release-eng Issues or PRs related to the Release Engineering subproject cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/release Categorizes an issue or PR as relevant to SIG Release. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@aroradaman @k8s-ci-robot @danwinship @cpanato @aojea