Skip to content

Commit 11a6a74

Browse files
nddqnddq
committed
build: update Dockerfiles, Makefile, and CI for Cilium v1.19
- Bump Go base images to 1.25.7 across all Dockerfiles - Add ARG BUILDPLATFORM before first FROM in Windows Dockerfiles - Fix CGO_ENABLED handling and use -run bpf2go in test image Dockerfile - Add _cprog to golangci-lint excluded paths - Update Makefile, CI workflows, devcontainer, and .gitignore Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
1 parent 714e923 commit 11a6a74

19 files changed

Lines changed: 142 additions & 131 deletions

‎.devcontainer/devcontainer.json‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@
77
"ghcr.io/devcontainers/features/github-cli:1": {},
88
"ghcr.io/devcontainers/features/go:1": {},
99
"ghcr.io/devcontainers/features/kubectl-helm-minikube:1": {},
10-
"ghcr.io/devcontainers-contrib/features/kind:1": {},
1110
"ghcr.io/devcontainers/features/azure-cli:1": {}
1211
},
1312
"postCreateCommand": "bash .devcontainer/installMoreTools.sh && kind create cluster",
@@ -22,4 +21,4 @@
2221
]
2322
}
2423
}
25-
}
24+
}

‎.github/workflows/golangci-lint.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ jobs:
1919
IS_NOT_MERGE_GROUP: ${{ github.event_name != 'merge_group' }}
2020
GOOS: ${{ matrix.goos }}
2121
GOARCH: ${{ matrix.goarch }}
22+
CGO_ENABLED: "0"
2223
steps:
2324
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2425
if: env.IS_NOT_MERGE_GROUP
@@ -28,6 +29,9 @@ jobs:
2829
if: env.IS_NOT_MERGE_GROUP
2930
with:
3031
go-version-file: go.mod
32+
- name: Check BPF object stubs
33+
if: env.IS_NOT_MERGE_GROUP
34+
run: make lint-bpf-objects
3135
- name: golangci-lint
3236
if: env.IS_NOT_MERGE_GROUP
3337
uses: golangci/golangci-lint-action@v9

‎.github/workflows/images.yaml‎

Lines changed: 8 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ jobs:
6767
build-windows-binaries:
6868
name: Build Windows Binaries
6969
runs-on: ubuntu-latest
70-
70+
7171
steps:
7272
- name: Checkout code
7373
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -133,7 +133,7 @@ jobs:
133133
TAG=$(make version)
134134
echo "TAG=$TAG" >> "$GITHUB_ENV"
135135
if [ "$IS_MERGE_GROUP" == "true" ]; then
136-
az acr login -n ${{ vars.ACR_NAME }}
136+
az acr login -n ${{ vars.ACR_NAME }}
137137
make retina-image-win \
138138
IMAGE_NAMESPACE=${{ github.repository }} \
139139
PLATFORM=${{ matrix.platform }}/${{ matrix.arch }} \
@@ -207,18 +207,13 @@ jobs:
207207
IS_MERGE_GROUP: ${{ github.event_name == 'merge_group' }}
208208

209209
retina-shell-images:
210-
name: Build Retina Shell Images (${{ matrix.platform }}, ${{ matrix.arch }})
211-
runs-on: ${{ matrix.runner }}
210+
name: Build Retina Shell Images
211+
runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
212212

213213
strategy:
214214
matrix:
215-
include:
216-
- platform: linux
217-
arch: amd64
218-
runner: ubuntu-latest
219-
- platform: linux
220-
arch: arm64
221-
runner: ubuntu-24.04-arm
215+
platform: ["linux"]
216+
arch: ["amd64", "arm64"]
222217

223218
steps:
224219
- name: Checkout code
@@ -343,7 +338,7 @@ jobs:
343338
shell: bash
344339
run: |
345340
set -euo pipefail
346-
az acr login -n ${{ vars.ACR_NAME }}
341+
az acr login -n ${{ vars.ACR_NAME }}
347342
make manifest COMPONENT=${{ matrix.components }} \
348343
IMAGE_REGISTRY=${{ vars.ACR_NAME }} \
349344
@@ -395,7 +390,7 @@ jobs:
395390
azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
396391
azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
397392
azure-app-insights-key: ${{ secrets.AZURE_APP_INSIGHTS_KEY }}
398-
393+
399394
perf-test-advanced:
400395
if: ${{ github.event_name == 'merge_group'}}
401396
needs: [manifests]

‎.gitignore‎

Lines changed: 26 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,43 @@
1-
# If you prefer the allow list template instead of the deny list, see community template:
2-
# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
3-
#
4-
# Binaries for programs and plugins
1+
# Binaries
52
*.exe
63
*.exe~
74
*.dll
85
*.so
96
*.dylib
10-
11-
# Avoid checking in keys
12-
*.pem
13-
14-
# Test binary, built with `go test -c`
157
*.test
16-
17-
# Output of the go coverage tool, specifically when used with LiteIDE
18-
*.out
19-
20-
# logs
21-
*.log
22-
23-
# Dependency directories (remove the comment below to include it)
24-
# vendor/
25-
26-
# Go workspace file
27-
go.work
28-
29-
# Object files
308
*.o
9+
bin/
10+
dist/
3111

32-
# docusaurus
33-
site/yarn.lock
34-
site/.docusaurus/
35-
site/node_modules/
12+
# Go
13+
go.work
3614

37-
output
38-
#vscode
39-
.vscode/
15+
# Keys and certificates
16+
*.pem
17+
.certs/
4018

41-
dist/
42-
bin/
19+
# Logs and output
20+
*.log
21+
*.out
22+
.output/
4323

44-
image-metadata-*.json
45-
*packetmonitorsupport*/
46-
*.pem
24+
# Test artifacts
4725
*results*.json
4826
netperf-*.json
4927
netperf-*.csv
28+
image-metadata-*.json
29+
*packetmonitorsupport*/
30+
test-summary
5031

51-
.certs/
32+
# Build artifacts
33+
.artifacts/
5234

53-
artifacts/
35+
# Documentation site
36+
site/yarn.lock
37+
site/.docusaurus/
38+
site/node_modules/
5439

55-
test-summary
40+
# IDE and editor
41+
.vscode/
42+
.clangd
43+
.clang-format

‎Makefile‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ help: ## Display this help
9696
##@ Tools
9797

9898
GOFUMPT = go tool mvdan.cc/gofumpt
99-
GOLANGCI_LINT = go tool github.com/golangci/golangci-lint/cmd/golangci-lint
99+
GOLANGCI_LINT = go tool github.com/golangci/golangci-lint/v2/cmd/golangci-lint
100100
GORELEASER = go tool github.com/goreleaser/goreleaser
101101
CONTROLLER_GEN = go tool sigs.k8s.io/controller-tools/cmd/controller-gen
102102
GINKGO = go tool github.com/onsi/ginkgo
@@ -141,10 +141,24 @@ fmt: ## run gofumpt on $FMT_PKG (default "retina").
141141
$(GOFUMPT) -w $(FMT_PKG)
142142

143143
lint: ## Fast lint vs default branch showing only new issues.
144-
$(GOLANGCI_LINT) run --new-from-rev main --timeout 10m -v $(LINT_PKG)/...
144+
CGO_ENABLED=0 $(GOLANGCI_LINT) run --new-from-rev main --timeout 10m -v $(LINT_PKG)/...
145145

146146
lint-existing: ## Lint the current branch in entirety.
147-
$(GOLANGCI_LINT) run -v $(LINT_PKG)/...
147+
CGO_ENABLED=0 $(GOLANGCI_LINT) run -v $(LINT_PKG)/...
148+
149+
lint-bpf-objects: ## Check that committed .o files are empty stubs (build generates real ones).
150+
@echo "Checking for non-empty .o files..."
151+
@non_empty=$$(git ls-files '*.o' | xargs -I{} sh -c 'test -s "{}" && echo "{}"'); \
152+
if [ -n "$$non_empty" ]; then \
153+
echo "ERROR: The following .o files must be empty stubs:"; \
154+
echo "$$non_empty"; \
155+
echo "Run 'make empty-bpf-objects' to fix."; \
156+
exit 1; \
157+
fi
158+
@echo "All .o files are empty stubs. OK."
159+
160+
empty-bpf-objects: ## Empty all tracked .o files (they are stubs for the linter).
161+
git ls-files '*.o' | xargs -I{} truncate -s 0 {}
148162

149163
clean: ## clean build artifacts
150164
$(RMDIR) $(OUTPUT_DIR)

‎cli/Dockerfile‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.24.11-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
2-
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang@sha256:531bd02db17b0c2ec919f10fc203a6a8c825e8ca01f40c3a1e32e1cf7119c6d8 AS builder
1+
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.25.7-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
2+
FROM mcr.microsoft.com/oss/go/microsoft/golang@sha256:408661cbcfcbf24c06fc4f85c23566b42af722fdef5a5044782859e682916be7 AS builder
33

44
ARG VERSION
55
ARG APP_INSIGHTS_ID
@@ -16,21 +16,21 @@ ARG GOARCH=amd64
1616
ENV GOARCH=${GOARCH}
1717

1818
RUN --mount=type=cache,target="/root/.cache/go-build" \
19-
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
19+
GOOS=$GOOS GOARCH=$GOARCH go build \
2020
-ldflags "-X github.com/microsoft/retina/internal/buildinfo.Version="$VERSION" \
2121
-X "github.com/microsoft/retina/internal/buildinfo.ApplicationInsightsID"="$APP_INSIGHTS_ID" \
2222
-X "github.com/microsoft/retina/internal/buildinfo.RetinaAgentImageName"="$AGENT_IMAGE_NAME"" \
2323
-a -o kubectl-retina cli/main.go
2424

2525
# Target 1: Distroless (secure, minimal)
2626
# skopeo inspect docker://mcr.microsoft.com/azurelinux/distroless/minimal:3.0 --format "{{.Name}}@{{.Digest}}"
27-
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/azurelinux/distroless/minimal@sha256:0801b80a0927309572b9adc99bd1813bc680473175f6e8175cd4124d95dbd50c AS distroless-target
27+
FROM mcr.microsoft.com/azurelinux/distroless/minimal@sha256:0801b80a0927309572b9adc99bd1813bc680473175f6e8175cd4124d95dbd50c AS distroless-target
2828
WORKDIR /
2929
COPY --from=builder /workspace/kubectl-retina .
3030

3131
# Target 2: Shell-enabled (operational, init container support)
3232
# skopeo inspect docker://mcr.microsoft.com/cbl-mariner/base/core:2.0 --format "{{.Name}}@{{.Digest}}"
33-
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/cbl-mariner/base/core@sha256:4d97d662d71c1fda938ed9df36d8f490d9107cff37e89c0efa932d073285ad85 AS shell-target
33+
FROM mcr.microsoft.com/cbl-mariner/base/core@sha256:4d97d662d71c1fda938ed9df36d8f490d9107cff37e89c0efa932d073285ad85 AS shell-target
3434
WORKDIR /
3535
COPY --from=builder /workspace/kubectl-retina /bin/kubectl-retina
3636
RUN chmod +x /bin/kubectl-retina

‎controller/Dockerfile‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# pinned base images
22

3-
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.24.11-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
4-
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang@sha256:531bd02db17b0c2ec919f10fc203a6a8c825e8ca01f40c3a1e32e1cf7119c6d8 AS golang
3+
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.25.7-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
4+
FROM mcr.microsoft.com/oss/go/microsoft/golang@sha256:408661cbcfcbf24c06fc4f85c23566b42af722fdef5a5044782859e682916be7 AS golang
55

66
# skopeo inspect docker://mcr.microsoft.com/azurelinux/base/core:3.0 --format "{{.Name}}@{{.Digest}}"
77
FROM mcr.microsoft.com/azurelinux/base/core@sha256:9948138108a3d69f1dae62104599ac03132225c3b7a5ac57b85a214629c8567d AS azurelinux-core
@@ -19,21 +19,23 @@ ARG GOOS=linux # default to linux
1919
ENV GOARCH=${GOARCH}
2020
ENV GOOS=${GOOS}
2121
RUN if [ "$GOOS" = "linux" ] ; then \
22-
tdnf install -y clang lld bpftool libbpf-devel; \
22+
tdnf install -y clang lld bpftool libbpf-devel; \
2323
fi
2424
COPY ./pkg/plugin /go/src/github.com/microsoft/retina/pkg/plugin
2525
WORKDIR /go/src/github.com/microsoft/retina
2626
RUN if [ "$GOOS" = "linux" ] ; then \
27-
go mod init github.com/microsoft/retina; \
28-
go generate -skip "mockgen" -x /go/src/github.com/microsoft/retina/pkg/plugin/...; \
29-
tar czf /gen.tar.gz ./pkg/plugin; \
30-
rm go.mod; \
27+
go mod init github.com/microsoft/retina; \
28+
go generate -skip "mockgen" -x /go/src/github.com/microsoft/retina/pkg/plugin/...; \
29+
tar czf /gen.tar.gz ./pkg/plugin; \
30+
rm go.mod; \
3131
fi
3232
COPY ./go.mod ./go.sum ./
3333
RUN go mod download
3434
COPY . .
3535
RUN if [ "$GOOS" = "linux" ] ; then \
36-
rm -rf ./pkg/plugin && tar xvf /gen.tar.gz ./pkg/plugin; \
36+
rm -rf ./pkg/plugin && tar xvf /gen.tar.gz ./pkg/plugin; \
37+
find ./pkg/plugin -path "*/_cprog/*.go" -delete; \
38+
find ./pkg/plugin -name "*.go" -exec sed -i '/^[[:space:]]*_[[:space:]]*".*\/_cprog"/d' {} \;; \
3739
fi
3840

3941
# capture binary

‎controller/Dockerfile.gogen‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.24.11-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
2-
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang@sha256:531bd02db17b0c2ec919f10fc203a6a8c825e8ca01f40c3a1e32e1cf7119c6d8
1+
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.25.7-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
2+
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang@sha256:408661cbcfcbf24c06fc4f85c23566b42af722fdef5a5044782859e682916be7
33

44
# Default linux/architecture.
55
ARG GOOS=linux

‎controller/Dockerfile.proto‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.24.11-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
2-
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang@sha256:531bd02db17b0c2ec919f10fc203a6a8c825e8ca01f40c3a1e32e1cf7119c6d8
1+
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.25.7-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
2+
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang@sha256:408661cbcfcbf24c06fc4f85c23566b42af722fdef5a5044782859e682916be7
33

44
LABEL Name=retina-builder Version=0.0.1
55

‎controller/Dockerfile.windows-2019‎

Lines changed: 25 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,29 @@
1-
# pinned base image
1+
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.25.7-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
2+
ARG BUILDPLATFORM
3+
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang@sha256:408661cbcfcbf24c06fc4f85c23566b42af722fdef5a5044782859e682916be7 AS builder
4+
5+
# Build args
6+
ARG VERSION
7+
ARG APP_INSIGHTS_ID
8+
9+
ENV GOOS=windows
10+
ENV GOARCH=amd64
11+
12+
WORKDIR /usr/src/retina
13+
# Copy the source
14+
COPY . .
15+
16+
RUN --mount=type=cache,target="/root/.cache/go-build" go build -v -o /usr/bin/controller.exe -ldflags "-X github.com/microsoft/retina/internal/buildinfo.Version="$VERSION" -X "github.com/microsoft/retina/internal/buildinfo.ApplicationInsightsID"="$APP_INSIGHTS_ID"" ./controller/
17+
RUN --mount=type=cache,target="/root/.cache/go-build" go build -v -o /usr/bin/captureworkload.exe ./captureworkload/
18+
19+
# Copy into final image
220
# skopeo inspect docker://mcr.microsoft.com/windows/servercore:ltsc2019 --override-os windows --format "{{.Name}}@{{.Digest}}"
3-
FROM mcr.microsoft.com/windows/servercore@sha256:a3d7773c4a836c2efd3ecb89f4fcb41199ee56d454225cf72a65b603bf569eca AS ltsc2019
21+
FROM mcr.microsoft.com/windows/servercore@sha256:a3d7773c4a836c2efd3ecb89f4fcb41199ee56d454225cf72a65b603bf569eca AS agent-win
22+
COPY --from=builder /usr/src/retina/windows/kubeconfigtemplate.yaml kubeconfigtemplate.yaml
23+
COPY --from=builder /usr/src/retina/windows/setkubeconfigpath.ps1 setkubeconfigpath.ps1
24+
COPY --from=builder /usr/bin/controller.exe controller.exe
25+
COPY --from=builder /usr/bin/captureworkload.exe captureworkload.exe
426

5-
FROM ltsc2019 AS agent-win
6-
ARG GOARCH=amd64 # default to amd64
7-
ARG GOOS=windows # default to windows
8-
ARG OS_VERSION=ltsc2019
9-
ARG REPO_PATH
10-
ARG BINARIES_PATH
11-
ENV GOARCH=${GOARCH}
12-
ENV GOOS=${GOOS}
13-
ENV OS_VERSION=${OS_VERSION}
14-
ENV BINARIES_PATH=${BINARIES_PATH}
15-
ENV REPO_PATH=${REPO_PATH}
16-
# CVE-2013-3900 Mitigation
17-
RUN reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config" /v "EnableCertPaddingCheck" /t REG_DWORD /d "1" /f
18-
RUN reg add "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" /v "EnableCertPaddingCheck" /t REG_DWORD /d "1" /f
19-
COPY ${REPO_PATH}/windows/kubeconfigtemplate.yaml kubeconfigtemplate.yaml
20-
COPY ${REPO_PATH}/windows/setkubeconfigpath.ps1 setkubeconfigpath.ps1
21-
COPY ${BINARIES_PATH}/captureworkload.exe captureworkload.exe
22-
COPY ${BINARIES_PATH}/controller.exe controller.exe
2327
ADD https://github.com/microsoft/etl2pcapng/releases/download/v1.10.0/etl2pcapng.exe /etl2pcapng.exe
28+
2429
CMD ["controller.exe", "start", "--kubeconfig=.\\kubeconfig"]

0 commit comments

Comments
 (0)