Skip to content

Conversation

@universal-itengineer
Copy link
Member

@universal-itengineer universal-itengineer commented Mar 29, 2025

Description

This PR refactors container images to improve security and efficiency. Changes impact the following components:

  • bounder
  • cdi-artifact
  • cdi-cloner
  • cdi-importer
  • dvcr-artifact
  • virt-artifact
  • virt-handler
  • virt-launcher
  • virt-operator

Key changes:

  1. Shell removal: Replaced bash/sh dependencies with statically compiled binaries (e.g., temp_pod), eliminating shell-based commands like echo.
  2. KubeVirt patches:
    • 041-rename-node-labeller-virt-launcher-init.patch: Replace "/bin/sh","-c","node-labeller" to "node-labeller"
    • 045-virt-launcher-image-holder-command-sleep.patch: Simplified virt-launcher-image-holder command from sh -c "sleep infinity" to sleep infinity.
    • 046-hotplug-attachment-trigger-pod-remove-bash.patch: Replaced shell invocations in init containers with direct binary execution.
    • 047-node-labeller-replace-sysctl-command-with-readfile.patch: replacing linux util sysctl to os.ReadFile("/proc/sys/kernel/sched_rt_runtime_us") in virt-handler
  3. Test fixes: Updated vmi_test.go assertions to align with new command syntax (e.g., Equal("temp_pod")).
  4. virt-launcher enhancements:
    • Fixed library inclusion steps in the image build process.

Why do we need it, and what problem does it solve?

  • Reduces attack surface by removing unnecessary shell utilities from production images.
  • Aligns with security best practices for Kubernetes workloads.
  • Improves resource efficiency by eliminating shell interpreter overhead.

Problem Solved

  • Shell dependency risks: Previous use of bash/sh introduced potential security vulnerabilities and increased image size.
  • Fragile command syntax: Shell-based commands (sh -c "...") complicated maintenance and auditing

What is the expected result?

  • Secure images: Minimalist containers with no shell access, adhering to compliance standards.
  • Stable operations: Direct binary execution avoids shell-related failures.
  • Improved maintainability: Simplified command syntax reduces technical debt.

Checklist

  • The code is covered by unit tests.
  • e2e tests passed.
  • Documentation updated according to the changes.
  • Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: core
type: chore
summary:  refactor build core components, shell removal
impact_level: low

@universal-itengineer universal-itengineer added this to the v0.18.0 milestone Mar 29, 2025
@universal-itengineer universal-itengineer force-pushed the chore/core/cleanup-unnecessary-binaries branch 16 times, most recently from 84365b2 to 9ad0388 Compare April 1, 2025 16:51
@universal-itengineer universal-itengineer changed the title chore(core): remove unnecessary binaries refactor(core): remove unnecessary binaries Apr 1, 2025
@universal-itengineer universal-itengineer changed the title refactor(core): remove unnecessary binaries refactor(core): add binaries, remove unnecessary, change build images Apr 1, 2025
@universal-itengineer universal-itengineer force-pushed the chore/core/cleanup-unnecessary-binaries branch 10 times, most recently from 232e2ef to e177493 Compare April 1, 2025 19:13
universal-itengineer and others added 16 commits April 9, 2025 23:45
Signed-off-by: Nikita Korolev <[email protected]>
Signed-off-by: Nikita Korolev <[email protected]>
Signed-off-by: Nikita Korolev <[email protected]>
Signed-off-by: Nikita Korolev <[email protected]>
Signed-off-by: Nikita Korolev <[email protected]>
Signed-off-by: Nikita Korolev <[email protected]>
Signed-off-by: Nikita Korolev <[email protected]>
Signed-off-by: Nikita Korolev <[email protected]>
Signed-off-by: Nikita Korolev <[email protected]>
Co-authored-by: Ivan Mikheykin <[email protected]>
Signed-off-by: Nikita Korolev <[email protected]>
Co-authored-by: Ivan Mikheykin <[email protected]>
Signed-off-by: Nikita Korolev <[email protected]>
Co-authored-by: Ivan Mikheykin <[email protected]>
Signed-off-by: Nikita Korolev <[email protected]>
Signed-off-by: Nikita Korolev <[email protected]>
@universal-itengineer universal-itengineer force-pushed the chore/core/cleanup-unnecessary-binaries branch from a87319b to 3026d20 Compare April 9, 2025 20:46
Signed-off-by: Nikita Korolev <[email protected]>
Signed-off-by: Nikita Korolev <[email protected]>
@universal-itengineer universal-itengineer merged commit 3428989 into main Apr 11, 2025
16 checks passed
@universal-itengineer universal-itengineer deleted the chore/core/cleanup-unnecessary-binaries branch April 11, 2025 09:47
@Isteb4k Isteb4k modified the milestones: v0.18.0, v0.17.0 Apr 28, 2025
yachmenevas pushed a commit that referenced this pull request Oct 15, 2025
…#895)

This PR refactors container images to improve security and efficiency. Changes impact the following components:

bounder
cdi-artifact
cdi-cloner
cdi-importer
dvcr-artifact
virt-artifact
virt-handler
virt-launcher
virt-operator
Key changes:

Shell removal: Replaced bash/sh dependencies with statically compiled binaries (e.g., temp_pod), eliminating shell-based commands like echo.
KubeVirt patches:
041-rename-node-labeller-virt-launcher-init.patch: Replace "/bin/sh","-c","node-labeller" to "node-labeller"
045-virt-launcher-image-holder-command-sleep.patch: Simplified virt-launcher-image-holder command from sh -c "sleep infinity" to sleep infinity.
046-hotplug-attachment-trigger-pod-remove-bash.patch: Replaced shell invocations in init containers with direct binary execution.
047-node-labeller-replace-sysctl-command-with-readfile.patch: replacing linux util sysctl to os.ReadFile("/proc/sys/kernel/sched_rt_runtime_us") in virt-handler
Test fixes: Updated vmi_test.go assertions to align with new command syntax (e.g., Equal("temp_pod")).
virt-launcher enhancements:
Fixed library inclusion steps in the image build process
---------

Signed-off-by: Nikita Korolev <[email protected]>
Co-authored-by: Ivan Mikheykin <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants