Libyaml and cfssl install from apt

This PS is to install libyaml and cfssl from apt instead of building it from source. Also we upgrade the Helm version to 3.17.3 because of CVE. In order to decrease the image size *-dev libs are installed only when needed to build/install Python packages. Change-Id: Ia83805799f46f5b20008f0a9393ab508078926e4
2025-04-24 19:58:44 +00:00
parent 4f719460e6
commit e96713115f
13 changed files with 46 additions and 39 deletions
--- a/bindep.txt
+++ b/bindep.txt
@@ -10,4 +10,5 @@ libpq-dev [platform:dpkg]
 libsasl2-dev [platform:dpkg]
 libssl-dev [platform:dpkg]
 libre2-dev [platform:dpkg]
+libyaml-dev [platform:dpkg]
 apt-utils [platform:dpkg]
--- a/doc/source/configuration/host-system.rst
+++ b/doc/source/configuration/host-system.rst
@@ -22,7 +22,7 @@ Sample Document to run containers in Docker runtime
      images:
        haproxy: haproxy:2.4
        helm:
-          helm: lachlanevenson/k8s-helm:v3.16.4
+          helm: lachlanevenson/k8s-helm:v3.17.3
        monitoring_image: busybox:1.28.3
      packages:
        repositories:
@@ -121,7 +121,7 @@ Sample Document to run containers in Containerd runtime
      images:
        haproxy: haproxy:2.4
        helm:
-          helm: lachlanevenson/k8s-helm:v3.16.4
+          helm: lachlanevenson/k8s-helm:v3.17.3
        monitoring_image: busybox:1.28.3
      packages:
        additional:
--- a/examples/basic/HostSystem.yaml
+++ b/examples/basic/HostSystem.yaml
@@ -85,7 +85,7 @@ data:
    monitoring_image: &busybox busybox:1.28.3
    haproxy: haproxy:2.4
    helm:
-      helm: lachlanevenson/k8s-helm:v3.16.4
+      helm: lachlanevenson/k8s-helm:v3.17.3
  packages:
    common:
      repositories:
--- a/examples/complete/HostSystem.yaml
+++ b/examples/complete/HostSystem.yaml
@@ -85,7 +85,7 @@ data:
    monitoring_image: busybox:1.28.3
    haproxy: haproxy:2.4
    helm:
-      helm: lachlanevenson/k8s-helm:v3.16.4
+      helm: lachlanevenson/k8s-helm:v3.17.3
  packages:
    common:
      repositories:
--- a/examples/containerd/HostSystem.yaml
+++ b/examples/containerd/HostSystem.yaml
@@ -85,7 +85,7 @@ data:
    monitoring_image: &busybox busybox:1.28.3
    haproxy: haproxy:2.4
    helm:
-      helm: lachlanevenson/k8s-helm:v3.16.4
+      helm: lachlanevenson/k8s-helm:v3.17.3
  packages:
    common:
      additional:
--- a/examples/gate/HostSystem.yaml
+++ b/examples/gate/HostSystem.yaml
@@ -85,7 +85,7 @@ data:
    monitoring_image: &busybox busybox:1.28.3
    haproxy: haproxy:2.4
    helm:
-      helm: lachlanevenson/k8s-helm:v3.16.4
+      helm: lachlanevenson/k8s-helm:v3.17.3
  packages:
    common:
      repositories:
--- a/images/promenade/Dockerfile.ubuntu_jammy
+++ b/images/promenade/Dockerfile.ubuntu_jammy
@@ -49,48 +49,54 @@ RUN set -ex \
    && apt update -qq \
    && apt upgrade -y \
    && apt-get install --no-install-recommends -y \
-        automake \
        ca-certificates \
        curl \
        dnsutils \
-        gcc \
-        git \
        gpg \
        gpg-agent \
-        libpcre3-dev \
-        libtool \
-        libpq-dev \
-        make \
        python3-dev \
-        python3-pip \
        python3-setuptools \
        rsync \
+        # this will install golang-cfssl 1.2.0 in Jammy
+        golang-cfssl \
    && ln -s /usr/bin/python3 /usr/bin/python \
-    && curl -Lo /usr/local/bin/cfssl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 \
-    && chmod 555 /usr/local/bin/cfssl \
-    && python3 -m pip install -U pip \
    && apt-get autoremove -yqq --purge \
    && apt-get clean \
    && useradd -u 1000 -g users -d /opt/promenade promenade \
    && rm -rf /var/lib/apt/lists/*

-# Install LibYAML
-ENV LD_LIBRARY_PATH=/usr/local/lib
-
-ARG LIBYAML_VERSION=0.2.5
-RUN set -ex \
-    && git clone https://github.com/yaml/libyaml.git \
-    && cd libyaml \
-    && git checkout $LIBYAML_VERSION \
-    && ./bootstrap \
-    && ./configure \
-    && make \
-    && make install \
-    && cd .. \
-    && rm -fr libyaml
-
 COPY requirements-frozen.txt /opt/promenade
-RUN pip3 install --no-cache-dir -r requirements-frozen.txt
+
+RUN set -ex \
+        && buildDeps=' \
+        automake \
+        gcc \
+        libpcre3-dev \
+        libffi-dev \
+        libpq-dev \
+        libssl-dev \
+        libtool \
+        libyaml-dev \
+        libvirt-dev \
+        make \
+        python3-pip \
+        pkg-config \
+        ' \
+        && apt-get -qq update \
+        # Keep git separate so it's not removed below
+        && apt-get install -y $buildDeps git --no-install-recommends \
+        && python3 -m pip install -U pip \
+        && pip3 install --no-cache-dir -r requirements-frozen.txt \
+        && apt-get purge -y --auto-remove $buildDeps \
+        && apt-get autoremove -yqq --purge \
+        && apt-get clean \
+        && rm -rf \
+            /var/lib/apt/lists/* \
+            /tmp/* \
+            /var/tmp/* \
+            /usr/share/man \
+            /usr/share/doc \
+            /usr/share/doc-base

 # Setting promenade version for BPR
 ENV PBR_VERSION 0.9.0
--- a/tests/unit/api/test_validatedesign.py
+++ b/tests/unit/api/test_validatedesign.py
@@ -153,7 +153,7 @@ VALID_DOCS = [
            'images': {
                'haproxy': 'haproxy:2.4',
                'helm': {
-                    'helm': 'lachlanevenson/k8s-helm:v3.16.4'
+                    'helm': 'lachlanevenson/k8s-helm:v3.17.3'
                }
            },
            'packages': {
--- a/tests/unit/builder_data/simple/HostSystem.yaml
+++ b/tests/unit/builder_data/simple/HostSystem.yaml
@@ -38,7 +38,7 @@ data:
    monitoring_image: &busybox busybox:1.28.3
    haproxy: haproxy:2.4
    helm:
-      helm: lachlanevenson/k8s-helm:v3.16.4
+      helm: lachlanevenson/k8s-helm:v3.17.3
  packages:
    common:
      repositories:
--- a/tools/gate/default-config-env
+++ b/tools/gate/default-config-env
@@ -9,7 +9,7 @@ IMAGE_DEP_CHECK=quay.io/airshipit/kubernetes-entrypoint:latest-ubuntu_focal
 IMAGE_ETCD=quay.io/coreos/etcd:v3.5.12
 IMAGE_ETCDCTL=quay.io/airshipit/porthole-etcdctl-utility:latest-ubuntu_focal
 IMAGE_HAPROXY=haproxy:2.4
-IMAGE_HELM=lachlanevenson/k8s-helm:v3.16.4
+IMAGE_HELM=lachlanevenson/k8s-helm:v3.17.3
 IMAGE_APISERVER=registry.k8s.io/kube-apiserver-amd64:v1.32.1
 IMAGE_CONTROLLER_MANAGER=registry.k8s.io/kube-controller-manager-amd64:v1.32.1
 IMAGE_SCHEDULER=registry.k8s.io/kube-scheduler-amd64:v1.32.1
--- a/tools/helm_install.sh
+++ b/tools/helm_install.sh
@@ -17,7 +17,7 @@
 set -x

 HELM=$1
-HELM_ARTIFACT_URL=${HELM_ARTIFACT_URL:-"https://get.helm.sh/helm-v3.16.4-linux-amd64.tar.gz"}
+HELM_ARTIFACT_URL=${HELM_ARTIFACT_URL:-"https://get.helm.sh/helm-v3.17.3-linux-amd64.tar.gz"}


 function install_helm_binary {
--- a/tools/image_tags.py
+++ b/tools/image_tags.py
@@ -1,4 +1,4 @@
-#!/bin/python
+#!/bin/python3

 import json
 import logging
--- a/tools/registry/IMAGES
+++ b/tools/registry/IMAGES
@@ -6,7 +6,7 @@ registry.k8s.io/kube-apiserver-amd64,v1.32.1,apiserver
 registry.k8s.io/kube-controller-manager-amd64,v1.32.1,controller-manager
 registry.k8s.io/kube-scheduler-amd64,v1.32.1,scheduler
 registry.k8s.io/kube-proxy-amd64,v1.32.1,proxy
-lachlanevenson/k8s-helm,v3.16.4,helm
+lachlanevenson/k8s-helm,v3.17.3,helm
 quay.io/airshipit/armada,master,armada
 quay.io/airshipit/armada-operator,latest,armada-operator
 quay.io/calico/cni,v3.4.0,calico-cni