From 182050107fb870be5d290923730f40ad61aecb07 Mon Sep 17 00:00:00 2001 From: andyzhangx Date: Tue, 30 Nov 2021 08:04:26 +0000 Subject: [PATCH 1/4] fix: release-image script --- hack/release-image.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/hack/release-image.sh b/hack/release-image.sh index 9c0263713..833d5ba68 100755 --- a/hack/release-image.sh +++ b/hack/release-image.sh @@ -21,6 +21,7 @@ if [[ "$#" -lt 1 ]]; then exit 1 fi +export OUTPUT_TYPE=registry export REGISTRY_NAME="$1" export REGISTRY=$REGISTRY_NAME.azurecr.io export IMAGENAME=public/k8s/csi/nfs-csi From b52b2132530959517fcf04e902202ef9207579be Mon Sep 17 00:00:00 2001 From: andyzhangx Date: Sat, 4 Dec 2021 14:15:27 +0000 Subject: [PATCH 2/4] fix: v3.0.0 chart --- charts/index.yaml | 12 ++++++------ charts/v3.0.0/csi-driver-nfs-v3.0.0.tgz | Bin 3505 -> 3501 bytes charts/v3.0.0/csi-driver-nfs/Chart.yaml | 2 +- hack/verify-helm-chart.sh | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/charts/index.yaml b/charts/index.yaml index 40d45fa3e..1a1a8c5ee 100644 --- a/charts/index.yaml +++ b/charts/index.yaml @@ -3,7 +3,7 @@ entries: csi-driver-nfs: - apiVersion: v1 appVersion: latest - created: "2021-11-29T05:33:58.291335863Z" + created: "2021-12-04T14:14:45.161037914Z" description: CSI NFS Driver for Kubernetes digest: d915fea55b4c764a1534754048210835ff42834c4c787768293b02272b5331f7 name: csi-driver-nfs @@ -11,21 +11,21 @@ entries: - https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts/latest/csi-driver-nfs-v3.0.0.tgz version: v3.0.0 - apiVersion: v1 - appVersion: latest - created: "2021-11-29T05:33:58.293553676Z" + appVersion: v3.0.0 + created: "2021-12-04T14:14:45.16202812Z" description: CSI NFS Driver for Kubernetes - digest: 360f0c7737201103c6248f1df93f44271bec501322c6a2b848e267b121abf9ae + digest: cfb3811336cdc846fb6b11c093e7f4aa0e0e8b2f8b77b7768af2f46354145113 name: csi-driver-nfs urls: - https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts/v3.0.0/csi-driver-nfs-v3.0.0.tgz version: v3.0.0 - apiVersion: v1 appVersion: v2.0.0 - created: "2021-11-29T05:33:58.292906172Z" + created: "2021-12-04T14:14:45.161380116Z" description: CSI NFS Driver for Kubernetes digest: f537a133eaa965f1c053ffac130f82c9b2b624e1f8bd42937c9c48818464eaac name: csi-driver-nfs urls: - https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts/v2.0.0/csi-driver-nfs-v2.0.0.tgz version: v2.0.0 -generated: "2021-11-29T05:33:58.290504458Z" +generated: "2021-12-04T14:14:45.160131608Z" diff --git a/charts/v3.0.0/csi-driver-nfs-v3.0.0.tgz b/charts/v3.0.0/csi-driver-nfs-v3.0.0.tgz index d16d307af79e91a3d608e6d3180dc869aa78c28e..a3a7c7c38ea5107758a0ad953232af3612e67525 100644 GIT binary patch delta 3473 zcmV;C4Q}$W8?76VK7Zr3vft18E9N@I#dhyXe&x|?ARp2s+Y_{#1aZ0tMR5?&(%9w+ zMe2~06F1HM+b>8;wj|53^Vp<|njaEdd=1H&ABVr894hKZl1@86m4Ts<@N+sq$x);7 zIEk?bWtH+KmG<6x#G6!175kqMmZExL09axF+uN;H)&4tsosIp!MxrqpVb22q;6vp; zm?SX~ifSRJJ%5Np8N@V{LW!XcLJ>Ewe^AX((Iy`%KU8#9OOw&e&huwU%GkMJG@SO} zWOyp{xkQCr+XA7Y=Tc0lK?s!f-CzHpf>9^~Dw>Lpe5HjXBQ*W{$-HhwhEC84I_t^6 z=ma?`buPsKA0-V<_ErV)bnH%vS`q;FQD&VhH_Af=pb~T%mg*P2-X0 z$pHzgLx1rA+?HkbDX-A!EMu{A&n^k0AyGXr8YWYI#y=CKjj(ofUad}zkuW_z7gG12 z^S`@0rY;ksUvPq~2Rj~s77QgZ8*OHYK3wCp2MxQpQZNjzXPd22g4p)j$d*(jrnZnh zXdK^CrB$AR!y$&c2aQwF562j#3>#~;pN%?Ugn#2xdy%L_DnrbMRB!N%##9&3Crr{F zv}a#qjII7}w_2Zbu#xzm6xCv-R=iNHlh>-X^fmi#KeO)wx~|z{=NUbEW=R*-*gW+B zVsiT{Clf*$88CExmsN2M{q5FkY^{D&l;BO*VL90TWi_Gu98DM^(W$i4jNGjEr~Xe; zq<=|{{SLA`w|Df4kQjuD24>Hp!t=Ja-~xvzk%wq7R&X@n8ViY_FqEiO2E7Jv;l^wc zW{aVG1lGw=rU{9|9*nh4RIk}AgH0qt)zm~?D}y^jI!Yz_iHI!r63S6FO?$p=%ughp z5RLg>H*I=bTb|82PZ{ewfqL-!zq~E*vwtBqvZ|&PCvxL&e;TRy{~F_j5sj*OdUko- z5A>~mejlsO|J}}Z#sA;g>F#a(|JO)xImYU#o+=oj*2Z!pOqiHrWK7#SXdz3D&k=au zrGRjZ;dQlkA|eG!6P>D$kT4_)jgQpxJOE?yp=RLw#v)ZhLfpT*gWv*fx!^Q^3V-+a zMh4fI?<-^&Y9aR<(v@7O1^4$2@ckR2!|_|s>9>@Y+W*xUS%OjpI(aS?u)_Y^t-YO! z{qJsfw>S3x8tLw?`2i+0?twxLL&{K36Wou@w1i{q!H4Gkz316t$F~XL5$G}64b>dJ z%;(T@#!AXE0RIYt)G9Zsl~%N2KxxzEP&AxTm>08y?q;i2&z z>Hw#yCNx8d&+zN}67%Z(fBUo*3Zf*}|JZ@Ia%zsLt#!b6e zrJ~tj{P~l-=AZVYYtXpyKMiPHHEdgj$$x9*-K1xyrTD+dd_0*IUV;C6-F5~4JFT70 z2LE3r`M&R6Qy%r;$hvwla_tp^LL^C4bJF%=)FdLB%uk30Ff#NmC<%9Pl9jT~oGV)A z<9T;?KzYd0r~=FZ{0Wpt$bU6-OgWXHW$)(HTYc|&zLOw#8{JtsHooC6Gqg8}B+2S= zn*P+94P zHJ&jn1y;!~P=|G4mVZp=GFPIgVnLbX4dxLHxWDhMDy_*Vb6I9~BS!_foNNt$vfpVe zJoJsUB#I;|wg27wgQKI1<9`49nt}{TgwnSfLIp3DKt8E<=cXcSu9OF0L#92j@vuIiZDXQ~;a+tJSv!0+jC23b`4j-y@ z)WvMQE0n|(S$|Xwg<)!uSa6NEx;!z7q!Y?;gwZTiI8Px-$bd4cDOTnafJ9LbesA=D z>t7uleLgvD{Hs)eFeYx!^Tv-=NEmTfYbw30UVAgDWh-8fnf_#%ie|x|$_!<-%w9^P z{qNqNo*f-uogCHSDe@>0lQFg~ypV zb$I+qinzKm07Hr_y1?OLPL}5s-FRSu8MN7+YkMvZv3@&9Ilb*Qo6Eq(z{SD>&9-3| zWP2W(+dBVr;Vf5bnu@i>rAWvqGxo-hG@{b^9)wkmGv{jB%o;M^yIU?*4Bd%zt}ATFL*oOv;DiYw+H5S_Wv4b3ogf0!EXnjf3eZO+zC}sy-W)K4WXjhW6Q54EFDn} z2j?ds2LHxTD{l+*m}nppfn$hD5jh1dK&IT@6DU+03Tcmc8T(8y7QBy7AfK&U)TyMA$DT`o$Fp%OJxusi0s*7!aa(7`K%V9r`fnMNx?JU0<%lkKF z>Fgx`E%`Y+@+UKM558>h5LdT&`F16DS5swCfga#3@OF+)c?v}w6CN${Kt8PTHh)D? zA+po#tducJ-<){&zk7dlaq{K(;_Bk~r>p+i;m=p+2bcf&zP6QEM7UqyRK*^j$c*f) zG`6y4Kh^-BGYw1my}F7^f-ei?g7q{8gs4`haCS@+0}5 zrTm{9kkEgbOQ0+G|8Bcm<^S8;oz46IuaYW!P4#A-yTRw*-+R9AdzBvxaevHRzf`4$ zsxwMdKwP6(`JP{Xsr!Y=J0o%BO@Y!_tssRFX2A|e>RbqhrSaO*B-LXf=^xhI3UQJL z`N`6N@m3p0h!yYD*;lXE9+pg*!&@InLT#)=8E-UmLJPS5dn1{}Q8Jv)3QbTBY=IH# z#z$x{s_cLJ`jq+Lrp0`U41Y$Ut@nfuLq=%4cCU_Rt?R2CnyTwLD-klH)SBa5b4)lv zuAeY-*=RmOBU#qn>S2Y7n!Wf%2lT84Lm^~DdC>yu`mlEUB9k`1pg0qm>9V5B;})zAdwMGCuom5h3AAv-WG6lM^kv8NF35zj9l33 zzrGLPjI*izU5UhrWPc9zz$nMS3y%6%eJvz09F71*Iea* delta 3477 zcmV;G4QleO8?hUZK7ZS|vhQd86?2{9qT5@^kG%F8$cJo_?g_R{f;iiQ#o{2KrLoNu ziqs(~C*CyoZ@(ZZ*^(^B&ZEf|H9sV__!^QkKMsFGIaJh-Bpsvl`9L)fMnvjhLSpvj z`BJOZYVB-o+5fFptNOpy-s!w)Z?(7Et)0!*?(Umbd#lyieSZV3XOv-KN|h$^P3y^h zRR{N-B$CiCC>0gF3*)v&l4Sao5sgZF5vowqMB8Tvy<<4}*n>l>GB6MleoOl(IciiM zCoy)RtWw^1+WcnF3R>Q4k9eJmsbc?Q!ctVv3;;{)e`~ANs@i{NXKQW$FOg_WhS>E0 z0Qf+;4<<=Wgny!1$VnICPzEs#rBGs^gHXiHtDjXfRJ6$l$`2Kt*3x7+we$R0k}`HC z7!4;~I3An`eI`*M*S0{Y=$RB_Y7hctefL*Ct6&()fQqJ~Ltkkj$q-Hdeln|Dk)acG zg3f9(Fgiw#N}Wm3#|Md!*Gx>!IRUm;odhl-bbxw}Lw~BYBoChn(?)K{GH+#0q^(s% z@)XK34RJpVMas1iC6q`sc0tP&VFUg-LT*2QfUGPKS6IO{Weob5Rf+5tF%fA1J=CBD z38SjE2dSpYqQ{X(Oy1omZ<Y%da(NM(rGkm?Pd(U|H2 z`h-c^h4%DojIq`Ktyb%E4mJ}1lcJih)Qab-b@E!ZmcC-&?I-qKK-U#}>^z}I&n)S@ z8k?scKum6a=VVMMBYlRh@3Jbcpud~-8e6L$6(xApbyy6xe_Ku1e2OLvkmyv}X-00= z`+sBaS1HmY$9@M{p4&URMMw-nMFX?vP~mwS8*q*Tl*mIg7%Mm$aE*mTP#8+oDuZ5w zw{UH?2(!gdJ_PGzDAR<*K^I0^C#u_Qmcb?xp=xTPu9U%@0Uf3i{X|3-dkN(zo2EVA zHs&Xij)}&6ubVWzjSbIcou!QRoIqXp^M7C72Kd>K8d+7-iW9l3u9a|8I7-D*pfW_GWwS|Gz|nixE~&^;E$SwKkR;VZy`&BV*duK?_-G ze2&2LE(C-l46mxS6A>v;n&?!0fP^7YXndru=K&at4>bedHx{W965`(NEd=Li%YOwY z`BS*NGcvfwd|x5MPz$-&kgnuhEx5aDfbU-u9gbdmPQRzL(Ecw+$P$z)(8*J&fF<_d zZtZSY?0;vgv$MAUmq@p_&G#^-aTgS77*K|KlHgu!rX?I<7v4AT?mW*HJGw~-k3f&m zZm8z)Wj=?NGq&Y!Z+(bxKsiFgIDZhPSOff74oR7Yz_HBMY=bY3aWW-O$0#L@5Wbqz z84qD+(|)9JFC7f%4K(~&W5^@>*@?zTADOa;%@MMA=5Ru-T&}ol%zZYF4@r{B0f=&? z2@j3$PzN}*bz;KF5F@`osnp63s*5USPRi{qx zNs{H`$ZaBPWjYTl$iCxRctB?W`A|(VSW5@f8rAddto6B*uaQoRKS<0L*Pe>`^Q@s9 z-KP&mLg^FK*Fs)p{4Z=2_*o!K3E+s4J^sg*g5?AI#Zj#g(VU2mxPQu7hXZ$x_(-MF z|D<~K57$jru*^W8RMoAVU6{z3*jz-|D=oiC<&9IQE-=c|n`wS!zKe=AV|fcpT5eAY zhFx%^Y^h1)(X>(`sgP7p4j56&jZ96H#@Nq}R(>d{rXgW=r@f|nR3}e?d7BNoM8_2r zpt90)YdmFG3apY}pnneQ!YrB2Wv)a~#ey=&8_XgYaCg^TR$7x`=CVxfMh**dIoTTi zc(2o#d*~Z!Nfb#`YVYm4{lmlaqh9Z)nt}{TgwnSfLIp3DKt8T^=cXcSu9OF0L#AD@ z@vub*@hSHRKYej=pas|WY8h%*|!yu7Zp@m}Xax>IiZF{*Qqa+tJOvmT*3C25yx z4j-sh)WvMQOMjHa6q#2Ig<)!uSa6Lux;!z7q+`l(h|x4uI7=Z(NS`vQDOTnafJ9Lj z{%rLA=w0p~em*{F{Hs)eFea|g^2U!;NEmTfYbw1gUwbpEMJry9nf`c@ie|x|$_!<- z%w9^Py|?d9P7jYRj}Pnc6nT^g%JtsccL%-W%cGOSvwzd$lZ(2d?zmyrxG0T#ntMVk z;c+HT9Ugy_BCf6sz%zssSs`!1T?jitgtAoP#YmzW2^P6P;Vg}`PJTsQ zo!i7=$A1Db>_F@CD5shdc8H8jdKd~GsV;1`N@X%so@Tep*$GN2qWa3q5it>w@-6x; zLB%nVO-B1Rn#E8zO~u;cQY2)U8GGXw8d2$d55lTO@{-%R@zv{**v(OmOSo`q%vr&T z?bT?&(s|O81iNr(r$xxgT(`9&#yHWFLn^y)dw=)C2lF10mhwL?lk$Q1R{T$EvwHux z)7skIUh_XMk&0ALcAqQ@`8UVyj2SxU9lO}x{UlI%2cJ?lL~9a`&hbAfmByROuShv~ z`9ud8PC|yCMTFB!Bxgn>rQHR&%Aq{F&k)pHX0XsTP^Ie)A1Onxcnp8-8UK5wrS@<9 zpnoUc2fp9_+pXPByAuD~?QCzZ?f)gx23(A&f`v1mID{lkzh-e@Zfn$hD5jg=ZK&IT@6DU+02x*Ua8T(8y7QBa#AfK&< zep}i(O(LSPrzO!ioH&#+o)qQ7-)&az@qbir)>XwU=jXnb^L);W4L*jwu1v(Y;;k#) zdU)TyMA*DT|o0rns@UTr znUU?K##YwshZ^8hrePt!S66XC@MVr%us+7ri*;WYiSK&*?e|}fE-j^avj6$$#Yn{! zc-|Tdcu^#oRW2>>{Y?~$J{FZ~Mt}amsKIx@@jq)!!`L<~BmUj4x2F96)|CH)T$44~ ze;?WZv{2eNhSb-JGdv84A08yAos@?K2c&?g~llR zw!jc|;{!ApRrbGqead`r(|=+RFY&0LBku2(N`LIGo&0hSh1A0<}p%5~nyl4S+eOSAFmPwo4P%oI~FO)}= z55I+lRxZ5y{j95%V+N^?wRNk+`jhC zwoa?0ivJgkki~S!g~aFUW7++W?at2J?>}v|*8bm1qzyPD+8DikW5cby`|*Z;N|^yZ zNJw}^hNuEB3l^(1v1A6Q5i$ltCi*TsN%`;tNMuCQG1}u!;W^=vw*eg8(G=b#5(o4K zBNz7iub%=qCTg2UcrPYa3O1{{bu7974D^dO>AdBKqCrv2;0 z_k#XkvT6V34@SeL`ICQDW8R!K)FB>p*Z!Z|DP(;{VW8XTh(>i?z=??z`00960P71F^09F71 DQF_+$ diff --git a/charts/v3.0.0/csi-driver-nfs/Chart.yaml b/charts/v3.0.0/csi-driver-nfs/Chart.yaml index 56ef84c1b..13125d574 100755 --- a/charts/v3.0.0/csi-driver-nfs/Chart.yaml +++ b/charts/v3.0.0/csi-driver-nfs/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v1 -appVersion: latest +appVersion: v3.0.0 description: CSI NFS Driver for Kubernetes name: csi-driver-nfs version: v3.0.0 diff --git a/hack/verify-helm-chart.sh b/hack/verify-helm-chart.sh index cf0668342..82bb752cb 100755 --- a/hack/verify-helm-chart.sh +++ b/hack/verify-helm-chart.sh @@ -49,7 +49,7 @@ if [[ -z "$(command -v jq)" ]]; then fi # jq-equivalent for yaml -pip install yq +pip install yq --ignore-installed PyYAML # Extract images from csi-nfs-controller.yaml expected_csi_provisioner_image="$(cat ${PKG_ROOT}/deploy/csi-nfs-controller.yaml | yq -r .spec.template.spec.containers[0].image | head -n 1)" From d1409ab179feb8ee5cffcd63fd236b5bc69c39de Mon Sep 17 00:00:00 2001 From: andyzhangx Date: Mon, 6 Dec 2021 11:08:41 +0000 Subject: [PATCH 3/4] feat: support NFSv3 protocol --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 80601e6ba..04ca3c233 100644 --- a/Dockerfile +++ b/Dockerfile @@ -21,7 +21,7 @@ ARG ARCH COPY bin/${ARCH}/nfsplugin /nfsplugin RUN apt update && apt-mark unhold libcap2 -RUN clean-install ca-certificates mount nfs-common +RUN clean-install ca-certificates mount nfs-common netbase # install updated packages to fix CVE issues RUN clean-install libssl1.1 libgssapi-krb5-2 libk5crypto3 libkrb5-3 libkrb5support0 From 4f86151e0b758c0f76778c9b123c6ec5295063c2 Mon Sep 17 00:00:00 2001 From: andyzhangx Date: Wed, 30 Mar 2022 11:32:41 +0000 Subject: [PATCH 4/4] fix: CVE issues in image build on release-3.0 --- Dockerfile | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/Dockerfile b/Dockerfile index 04ca3c233..dbd045134 100644 --- a/Dockerfile +++ b/Dockerfile @@ -12,17 +12,15 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM k8s.gcr.io/build-image/debian-base:bullseye-v1.0.0 +FROM k8s.gcr.io/build-image/debian-base:bullseye-v1.1.0 -# Architecture for bin folder ARG ARCH - -# Copy nfsplugin from build _output directory -COPY bin/${ARCH}/nfsplugin /nfsplugin +ARG binary=./bin/${ARCH}/nfsplugin +COPY ${binary} /nfsplugin RUN apt update && apt-mark unhold libcap2 RUN clean-install ca-certificates mount nfs-common netbase # install updated packages to fix CVE issues -RUN clean-install libssl1.1 libgssapi-krb5-2 libk5crypto3 libkrb5-3 libkrb5support0 +RUN clean-install libgmp10 bsdutils libssl1.1 openssl libc6 libc-bin libsystemd0 libudev1 ENTRYPOINT ["/nfsplugin"]