From 6e06a10613ea99293f40bb01e4717bd425dcbc19 Mon Sep 17 00:00:00 2001 From: Ali Afsharzadeh Date: Thu, 24 Sep 2026 15:48:20 +0330 Subject: [PATCH] Update youki to 0.7.0 and download the static musl build (#13564) Add the 0.6.0 and 0.7.0 checksums, drop 0.4.x, and move youki back into the blocking molecule matrix. The seccomp bug behind the old FIXME (youki#3479) is fixed in 0.7.0. The 0.7.0 gnu tarball is linked against glibc 2.39, because cross-rs moved its base image to Ubuntu 24.04 and youki installs cross from git. It does not run on EL9, Amazon Linux 2023, Ubuntu 22.04 or Debian 12, and it needs libseccomp on the host. The musl tarball is static, has the same default features and no runtime requirements. It is the build upstream recommends in its setup docs. Signed-off-by: Ali Afsharzadeh --- .gitlab-ci/molecule.yml | 5 +-- .../defaults/main/download.yml | 2 +- .../vars/main/checksums.yml | 40 +++++++++---------- .../src/component_hash_update/components.py | 2 +- 4 files changed, 24 insertions(+), 25 deletions(-) diff --git a/.gitlab-ci/molecule.yml b/.gitlab-ci/molecule.yml index 68d847444..f9c4ae8fc 100644 --- a/.gitlab-ci/molecule.yml +++ b/.gitlab-ci/molecule.yml @@ -32,6 +32,7 @@ molecule: - container-engine/cri-o - container-engine/gvisor - container-engine/kata-containers + - container-engine/youki - adduser - bastion_ssh_config - bootstrap_os @@ -46,6 +47,4 @@ molecule_full: extends: molecule parallel: matrix: - - ROLE: - # FIXME: until youki release 0.6.1 - - container-engine/youki + - ROLE: [] diff --git a/roles/kubespray_defaults/defaults/main/download.yml b/roles/kubespray_defaults/defaults/main/download.yml index b70fa0a4d..e5a422c56 100644 --- a/roles/kubespray_defaults/defaults/main/download.yml +++ b/roles/kubespray_defaults/defaults/main/download.yml @@ -165,7 +165,7 @@ crio_download_url: "{{ storage_googleapis_url }}/cri-o/artifacts/cri-o.{{ image_ helm_download_url: "{{ get_helm_url }}/helm-v{{ helm_version }}-linux-{{ image_arch }}.tar.gz" runc_download_url: "{{ github_url }}/opencontainers/runc/releases/download/v{{ runc_version }}/runc.{{ image_arch }}" crun_download_url: "{{ github_url }}/containers/crun/releases/download/{{ crun_version }}/crun-{{ crun_version }}-linux-{{ image_arch }}" -youki_download_url: "{{ github_url }}/youki-dev/youki/releases/download/v{{ youki_version }}/youki-{{ youki_version }}-{{ ansible_facts['architecture'] }}-gnu.tar.gz" +youki_download_url: "{{ github_url }}/youki-dev/youki/releases/download/v{{ youki_version }}/youki-{{ youki_version }}-{{ ansible_facts['architecture'] }}-musl.tar.gz" kata_containers_download_url: "{{ github_url }}/kata-containers/kata-containers/releases/download/{{ kata_containers_version }}/kata-static-{{ kata_containers_version }}-{{ image_arch }}.tar.zst" # gVisor only supports amd64 and uses x86_64 to in the download link gvisor_runsc_download_url: "{{ storage_googleapis_url }}/gvisor/releases/release/{{ gvisor_version }}/{{ ansible_facts['architecture'] }}/runsc" diff --git a/roles/kubespray_defaults/vars/main/checksums.yml b/roles/kubespray_defaults/vars/main/checksums.yml index 2f6027237..b92848b6d 100644 --- a/roles/kubespray_defaults/vars/main/checksums.yml +++ b/roles/kubespray_defaults/vars/main/checksums.yml @@ -819,27 +819,27 @@ crun_checksums: '1.16': sha256:fc7199a2faac1ca0e3e58dee4dd369b9065aa0d95f3257d8803e521213f1bd9b youki_checksums: amd64: - 0.5.7: sha256:10077b1a4f013990a416acf15e6b397cf64b5d62008516a9711abc22730d8203 - 0.5.6: sha256:c372ad70d4107174064225848e686e84ddb597cb44ac7a540e0c47a86e6e6081 - 0.5.5: sha256:7a6844c2e529daa54c6d7558572269508faa26e3b14b5440f9502c413fef558c - 0.5.4: sha256:69709a8739c868071e8e7e4bdcbcab41b28524c2adb2f0af0c1a4d6ba4691ae0 - 0.5.3: sha256:173b8998cd0abf22e38e36611b34cc19a16431b353dd893e3d988cfc77b4e6ac - 0.5.2: sha256:361c7187939eab02039fa4289d33158fe4bf4d21ab8cc7139ace8f52081524ba - 0.5.1: sha256:554dea487dcb54b34fff003fc047458cecf073337d20b77e69c22918c2986aaf - 0.5.0: sha256:d7ec0cd5f69ecd96b41df13cc38a970ab217aa9c4b2262ca4843a68595975d91 - 0.4.1: sha256:6f7ea3651b284a808f344ad40f9f8315b3b02b76a3ee6c6af7bfff65753284c9 - 0.4.0: sha256:7cf3ae3d1be19a731378b289000cb36ba9cedcbff8a0cabe38edb782e8c55f72 + 0.7.0: sha256:a211a16b6b1a985f8ca61bba9a30b9ae40352d04dd7eca04cdecfe7b98b47038 + 0.6.0: sha256:fe692a0bcaa5e4ef9b06fb50a92d37c4e8779169f68373d09c6b2668cd39c1d8 + 0.5.7: sha256:a9003472a6e959f345db8e48371a335ab98fae53a5e71a4339b5fe54f0691f60 + 0.5.6: sha256:f7cbbb78415106c40297adbd4b4e1f0037b663140dd8950f128250e74357b5c5 + 0.5.5: sha256:af4c89a4a9ce5704be6a227c996b035f08da2e80f3c189bc0ae054438e0e34d5 + 0.5.4: sha256:95859e85834b86a99ed867dda4326dc1b01b0a0a09061cb2b06ce0ab63709239 + 0.5.3: sha256:087ae98517bc6033ed48a2a8b3eb71b63b2b612e065639893d7ce02fb53aec02 + 0.5.2: sha256:481eadb82a02c7974f476bc4678feb26426bc84abcb991174b1579b74a25b8d0 + 0.5.1: sha256:273684688f8d71327b237a568bfc9e396105220683d65b80425ec7734f59bd2a + 0.5.0: sha256:e4f129b95cf8fba720d7e9aedb5013b5b66647251325c15e599f4ae8a68c68ba arm64: - 0.5.7: sha256:d51990751e796391254c36d40f05b0624017cb544284f9721a645d05747b3d84 - 0.5.6: sha256:df078232fd5e4af822be2d35e0614715dfa781a3e5790b66b71d1d89a2247692 - 0.5.5: sha256:83069dd0ac11dca04f5a2376f27538f86ae5304db0ba148b20d342afe62d6069 - 0.5.4: sha256:2a8d55a7127c751d088ab9ef989496b700afde414296139d5461606527869c42 - 0.5.3: sha256:a15dfe9a1eec2d595b9a972a8a0fa1a919ee3d3523e77ca8c22099bfadf7e88d - 0.5.2: sha256:8df7e4898088e6fcf942f2e145b0a50c1ad81f5109044e48897c0af9bb3f83e6 - 0.5.1: sha256:ed8e2f5ac03553d0a8ac641339a9f94f42baee652e2afdc1afae08529807a796 - 0.5.0: sha256:1e504e01caf396e8ab87de24bcdde0adaf6251ff2a3dcd0d8622cba0132caadc - 0.4.1: sha256:c954397353340a013d77d63cda9b074e5f1de57e06fe6f8d44f508b5dc03c998 - 0.4.0: sha256:0d897debaee98a937188317304a9caafb0da5bf798717aefedf113c108f73263 + 0.7.0: sha256:b96c05c2c82f1d20a74b611188fa120894c50a6128f73856bb371604ecb69bd0 + 0.6.0: sha256:eb4d0e6e28ab9bd391ae84f3b9408821fc68dc8976f8b2a721f8ae5caeadb462 + 0.5.7: sha256:b3002d9d39b04f797e783745f92cffec9e0caa464254be98aa0b4dfc184f0233 + 0.5.6: sha256:e3d16fc2d894d357f663afbedd76e80ba5b5dce13586a8a7a5a1e72d498a8e07 + 0.5.5: sha256:9bea06fbdab98a1ef0662f9ec78c52e52248c810d0804342adf3c03b4209b0cf + 0.5.4: sha256:7d20449550e58e6c3c34be6c35f971c9f41cf73c9fe869c59c21781943187637 + 0.5.3: sha256:237346a6b5ee8e500465a605bdb888dbe3b96278468b00e421a49eeb4fd3a239 + 0.5.2: sha256:d21717321d9dcc109cb21d3f75fec90c525d84de1cf2b7550fea25495d4f4d1f + 0.5.1: sha256:812de17f73d7d526b9b0bd7dab584ce9734a4380a87b2e78a8662e65ceb901c6 + 0.5.0: sha256:8d4115c7e30b5309b6eca969d59f248bb0a8254d0ad1bc922cde4a20b2955bbd kata_containers_binary_checksums: amd64: 3.32.0: sha256:1449ecea50bd91fa73a94648db195d18950fe869ba4b1f12d05f55f1fa7c1b01 diff --git a/scripts/component_hash_update/src/component_hash_update/components.py b/scripts/component_hash_update/src/component_hash_update/components.py index 27d7dc881..576c40379 100644 --- a/scripts/component_hash_update/src/component_hash_update/components.py +++ b/scripts/component_hash_update/src/component_hash_update/components.py @@ -96,7 +96,7 @@ infos = { "graphql_id": "R_kgDOHQ6J9w", }, "youki": { - "url": "https://github.com/youki-dev/youki/releases/download/v{version}/youki-{version}-{alt_arch}-gnu.tar.gz", + "url": "https://github.com/youki-dev/youki/releases/download/v{version}/youki-{version}-{alt_arch}-musl.tar.gz", "binary": True, "graphql_id": "R_kgDOFPvgPg", },