mirror of
https://github.com/kubernetes-sigs/kubespray.git
synced 2026-10-29 22:03:22 -02:30
Frank
1c1ed9562a
* ci: run the Ansible controller as an unprivileged user * ci: clarify non-root controller check * ci: make the sudo privilege check fail when sudo succeeds Bash does not apply errexit to the negated sudo command. The old check could not fail the job even when passwordless sudo worked. Exit explicitly when sudo succeeds. Remove --break-system-packages from both upgrade pip installs because they run inside the controller virtual environment.
67 lines
2.9 KiB
Docker
67 lines
2.9 KiB
Docker
# Use immutable image tags rather than mutable tags (like ubuntu:24.04)
|
|
FROM ubuntu:noble-20260113@sha256:cd1dba651b3080c3686ecf4e3c4220f026b521fb76978881737d24f200828b2b
|
|
# Some tools like yamllint need this
|
|
# Pip needs this as well at the moment to install ansible
|
|
# (and potentially other packages)
|
|
# See: https://github.com/pypa/pip/issues/10219
|
|
ENV VAGRANT_VERSION=2.4.1 \
|
|
VAGRANT_DEFAULT_PROVIDER=libvirt \
|
|
VAGRANT_ANSIBLE_TAGS=facts \
|
|
LANG=C.UTF-8 \
|
|
DEBIAN_FRONTEND=noninteractive \
|
|
PYTHONDONTWRITEBYTECODE=1
|
|
|
|
RUN apt update -q \
|
|
&& apt install -yq \
|
|
libssl-dev \
|
|
python3-dev \
|
|
python3-pip \
|
|
python3-venv \
|
|
sshpass \
|
|
apt-transport-https \
|
|
jq \
|
|
moreutils \
|
|
libvirt-dev \
|
|
openssh-client \
|
|
rsync \
|
|
git \
|
|
ca-certificates \
|
|
curl \
|
|
gnupg2 \
|
|
unzip \
|
|
libvirt-clients \
|
|
qemu-utils \
|
|
qemu-kvm \
|
|
dnsmasq \
|
|
&& curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc \
|
|
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
|
|
$(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | tee /etc/apt/sources.list.d/docker.list \
|
|
&& apt update -q \
|
|
&& apt install --no-install-recommends -yq docker-ce \
|
|
&& apt autoremove -yqq --purge && apt clean && rm -rf /var/lib/apt/lists/* /var/log/*
|
|
|
|
WORKDIR /kubespray
|
|
ADD ./requirements.txt /kubespray/requirements.txt
|
|
ADD ./tests/requirements.txt /kubespray/tests/requirements.txt
|
|
|
|
RUN update-alternatives --install /usr/bin/python python /usr/bin/python3 1 \
|
|
&& curl -L https://dl.k8s.io/release/v{{ kube_version }}/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
|
|
&& echo $(curl -L https://dl.k8s.io/release/v{{ kube_version }}/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
|
|
&& chmod a+x /usr/local/bin/kubectl \
|
|
# Install Vagrant
|
|
&& curl -LO https://releases.hashicorp.com/vagrant/${VAGRANT_VERSION}/vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb \
|
|
&& dpkg -i vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb \
|
|
&& rm vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb
|
|
|
|
RUN useradd --create-home --uid 1001 kubespray
|
|
ENV HOME=/home/kubespray \
|
|
PATH="/home/kubespray/.local/bin:/home/kubespray/venv/bin:${PATH}"
|
|
USER kubespray
|
|
|
|
RUN python3 -m venv /home/kubespray/venv \
|
|
&& pip install --no-compile --no-cache-dir -r tests/requirements.txt \
|
|
&& vagrant plugin install vagrant-libvirt \
|
|
# Install Kubernetes collections
|
|
&& pip install --no-compile --no-cache-dir kubernetes==35.0.0 \
|
|
&& ansible-galaxy collection install kubernetes.core:==6.4.0
|