distroless-iptables: remove dependency from conntrack binary #4223
Conversation
k8s-ci-robot
added
release-note
k8s-ci-robot
added
area/release-eng
|
Following up from #3726, |
cpanato
left a comment
cpanato
left a comment
There was a problem hiding this comment.
/approve
/hold for @BenTheElder to comment
k8s-ci-robot
added
the
do-not-merge/hold
k8s-ci-robot
added
lgtm
| mkdir -p "${STAGE_DIR}" && \ | ||
| /stage-binaries-from-package.sh "${STAGE_DIR}" conntrack \ | ||
| ebtables \ | ||
| /stage-binaries-from-package.sh "${STAGE_DIR}" ebtables \ |
There was a problem hiding this comment.
now that I see this, I think ebtables was only required for some dockershim kubelet stuff, @danwinship to keep me honest
There was a problem hiding this comment.
yeah, kubernetes/kubernetes#28717. Definitely not needed any more.
There was a problem hiding this comment.
@aroradaman can you please remove the ebtables, that is not likely going to be used anywhere , howeve, regarding the conntrack binary this image is used in another projects too https://grep.app/search?q=distroless-iptables ... I'm unclear on what contract do we have with this image or what are the expectactions
There was a problem hiding this comment.
The README says "Serves as the base image for registry.k8s.io/kube-proxy-${ARCH}." I don't think we ever implied that we supported random projects using it as a base image.
There was a problem hiding this comment.
Yeah, as a maintainer of one of those images, if we needed something missing from this image that would be our problem.
In upstream, kubernetes/dns probably isn't using conntrack, and kindnetd just needs ... iptables.
The rest of these appear to be references to Kubernetes/Kubernetes releases and this image itself (e.g. the build job)
https://cs.k8s.io/?q=distroless-iptables&i=nope&literal=nope&files=&excludeFiles=&repos=
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: aroradaman, BenTheElder, cpanato The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
needs-rebase
|
needs a rebase after the ebtables cleanup |
Signed-off-by: Daman Arora <aroradaman@gmail.com>
aroradaman
force-pushed
the
distroless-iptables-remove-conntrack
branch
from
a9a97a0 to
76e09ce
Compare
k8s-ci-robot
removed
lgtm
k8s-ci-robot
added
the
lgtm
|
LGTM |
|
/hold cancel |
k8s-ci-robot
removed
the
do-not-merge/hold
6 participants
What type of PR is this?
/kind cleanup
What this PR does / why we need it:
With kubernetes/kubernetes#126847 kube-proxy will no longer depend on
conntrackbinary to be present on the image, this PR removes the conntrack binary from the distroless-iptables image.Which issue(s) this PR fixes:
Special notes for your reviewer:
Does this PR introduce a user-facing change?