-
Notifications
You must be signed in to change notification settings - Fork 204
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'master' into aso/fix-mysql-managed-identity-natcloud
- Loading branch information
Showing
39 changed files
with
3,747 additions
and
1,544 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,182 @@ | ||
| #!/usr/bin/env bash | ||
| #------------------------------------------------------------------------------------------------------------- | ||
| # Copyright (c) Microsoft Corporation. All rights reserved. | ||
| # Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information. | ||
| #------------------------------------------------------------------------------------------------------------- | ||
| # | ||
| # Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/docker.md | ||
| # Maintainer: The VS Code and Codespaces Teams | ||
| # | ||
| # Syntax: ./docker-debian.sh [enable non-root docker socket access flag] [source socket] [target socket] [non-root user] [use moby] | ||
|
|
||
| ENABLE_NONROOT_DOCKER=${1:-"true"} | ||
| SOURCE_SOCKET=${2:-"/var/run/docker-host.sock"} | ||
| TARGET_SOCKET=${3:-"/var/run/docker.sock"} | ||
| USERNAME=${4:-"automatic"} | ||
| USE_MOBY=${5:-"true"} | ||
|
|
||
| set -e | ||
|
|
||
| if [ "$(id -u)" -ne 0 ]; then | ||
| echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.' | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Determine the appropriate non-root user | ||
| if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then | ||
| USERNAME="" | ||
| POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)") | ||
| for CURRENT_USER in ${POSSIBLE_USERS[@]}; do | ||
| if id -u ${CURRENT_USER} > /dev/null 2>&1; then | ||
| USERNAME=${CURRENT_USER} | ||
| break | ||
| fi | ||
| done | ||
| if [ "${USERNAME}" = "" ]; then | ||
| USERNAME=root | ||
| fi | ||
| elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then | ||
| USERNAME=root | ||
| fi | ||
|
|
||
| # Function to run apt-get if needed | ||
| apt-get-update-if-needed() | ||
| { | ||
| if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then | ||
| echo "Running apt-get update..." | ||
| apt-get update | ||
| else | ||
| echo "Skipping apt-get update." | ||
| fi | ||
| } | ||
|
|
||
| # Ensure apt is in non-interactive to avoid prompts | ||
| export DEBIAN_FRONTEND=noninteractive | ||
|
|
||
| # Install apt-transport-https, curl, lsb-release, gpg if missing | ||
| if ! dpkg -s apt-transport-https curl ca-certificates lsb-release > /dev/null 2>&1 || ! type gpg > /dev/null 2>&1; then | ||
| apt-get-update-if-needed | ||
| apt-get -y install --no-install-recommends apt-transport-https curl ca-certificates lsb-release gnupg2 | ||
| fi | ||
|
|
||
| # Install Docker / Moby CLI if not already installed | ||
| if type docker > /dev/null 2>&1; then | ||
| echo "Docker / Moby CLI already installed." | ||
| else | ||
| if [ "${USE_MOBY}" = "true" ]; then | ||
| DISTRO=$(lsb_release -is | tr '[:upper:]' '[:lower:]') | ||
| CODENAME=$(lsb_release -cs) | ||
| curl -s https://packages.microsoft.com/keys/microsoft.asc | (OUT=$(apt-key add - 2>&1) || echo $OUT) | ||
| echo "deb [arch=amd64] https://packages.microsoft.com/repos/microsoft-${DISTRO}-${CODENAME}-prod ${CODENAME} main" > /etc/apt/sources.list.d/microsoft.list | ||
| apt-get update | ||
| apt-get -y install --no-install-recommends moby-cli moby-buildx | ||
| else | ||
| curl -fsSL https://download.docker.com/linux/$(lsb_release -is | tr '[:upper:]' '[:lower:]')/gpg | (OUT=$(apt-key add - 2>&1) || echo $OUT) | ||
| echo "deb [arch=amd64] https://download.docker.com/linux/$(lsb_release -is | tr '[:upper:]' '[:lower:]') $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list | ||
| apt-get update | ||
| apt-get -y install --no-install-recommends docker-ce-cli | ||
| fi | ||
| fi | ||
|
|
||
| # Install Docker Compose if not already installed | ||
| if type docker-compose > /dev/null 2>&1; then | ||
| echo "Docker Compose already installed." | ||
| else | ||
| LATEST_COMPOSE_VERSION=$(basename "$(curl -fsSL -o /dev/null -w "%{url_effective}" https://github.com/docker/compose/releases/latest)") | ||
| curl -fsSL "https://github.com/docker/compose/releases/download/${LATEST_COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose | ||
| chmod +x /usr/local/bin/docker-compose | ||
| fi | ||
|
|
||
| # If init file already exists, exit | ||
| if [ -f "/usr/local/share/docker-init.sh" ]; then | ||
| exit 0 | ||
| fi | ||
|
|
||
| # By default, make the source and target sockets the same | ||
| if [ "${SOURCE_SOCKET}" != "${TARGET_SOCKET}" ]; then | ||
| touch "${SOURCE_SOCKET}" | ||
| ln -s "${SOURCE_SOCKET}" "${TARGET_SOCKET}" | ||
| fi | ||
|
|
||
| # Add a stub if not adding non-root user access, user is root | ||
| if [ "${ENABLE_NONROOT_DOCKER}" = "false" ] || [ "${USERNAME}" = "root" ]; then | ||
| echo '/usr/bin/env bash -c "\$@"' > /usr/local/share/docker-init.sh | ||
| chmod +x /usr/local/share/docker-init.sh | ||
| exit 0 | ||
| fi | ||
|
|
||
| # If enabling non-root access and specified user is found, setup socat and add script | ||
| chown -h "${USERNAME}":root "${TARGET_SOCKET}" | ||
| if ! dpkg -s socat > /dev/null 2>&1; then | ||
| apt-get-update-if-needed | ||
| apt-get -y install socat | ||
| fi | ||
| tee /usr/local/share/docker-init.sh > /dev/null \ | ||
| << EOF | ||
| #!/usr/bin/env bash | ||
| #------------------------------------------------------------------------------------------------------------- | ||
| # Copyright (c) Microsoft Corporation. All rights reserved. | ||
| # Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information. | ||
| #------------------------------------------------------------------------------------------------------------- | ||
| set -e | ||
| SOCAT_PATH_BASE=/tmp/vscr-docker-from-docker | ||
| SOCAT_LOG=\${SOCAT_PATH_BASE}.log | ||
| SOCAT_PID=\${SOCAT_PATH_BASE}.pid | ||
| # Wrapper function to only use sudo if not already root | ||
| sudoIf() | ||
| { | ||
| if [ "\$(id -u)" -ne 0 ]; then | ||
| sudo "\$@" | ||
| else | ||
| "\$@" | ||
| fi | ||
| } | ||
| # Log messages | ||
| log() | ||
| { | ||
| echo -e "[\$(date)] \$@" | sudoIf tee -a \${SOCAT_LOG} > /dev/null | ||
| } | ||
| echo -e "\n** \$(date) **" | sudoIf tee -a \${SOCAT_LOG} > /dev/null | ||
| log "Ensuring ${USERNAME} has access to ${SOURCE_SOCKET} via ${TARGET_SOCKET}" | ||
| # If enabled, try to add a docker group with the right GID. If the group is root, | ||
| # fall back on using socat to forward the docker socket to another unix socket so | ||
| # that we can set permissions on it without affecting the host. | ||
| if [ "${ENABLE_NONROOT_DOCKER}" = "true" ] && [ "${SOURCE_SOCKET}" != "${TARGET_SOCKET}" ] && [ "${USERNAME}" != "root" ] && [ "${USERNAME}" != "0" ]; then | ||
| SOCKET_GID=\$(stat -c '%g' ${SOURCE_SOCKET}) | ||
| if [ "\${SOCKET_GID}" != "0" ]; then | ||
| log "Adding user to group with GID \${SOCKET_GID}." | ||
| if [ "\$(cat /etc/group | grep :\${SOCKET_GID}:)" = "" ]; then | ||
| sudoIf groupadd --gid \${SOCKET_GID} docker-host | ||
| fi | ||
| # Add user to group if not already in it | ||
| if [ "\$(id ${USERNAME} | grep -E "groups.*(=|,)\${SOCKET_GID}\(")" = "" ]; then | ||
| sudoIf usermod -aG \${SOCKET_GID} ${USERNAME} | ||
| fi | ||
| else | ||
| # Enable proxy if not already running | ||
| if [ ! -f "\${SOCAT_PID}" ] || ! ps -p \$(cat \${SOCAT_PID}) > /dev/null; then | ||
| log "Enabling socket proxy." | ||
| log "Proxying ${SOURCE_SOCKET} to ${TARGET_SOCKET} for vscode" | ||
| sudoIf rm -rf ${TARGET_SOCKET} | ||
| (sudoIf socat UNIX-LISTEN:${TARGET_SOCKET},fork,mode=660,user=${USERNAME} UNIX-CONNECT:${SOURCE_SOCKET} 2>&1 | sudoIf tee -a \${SOCAT_LOG} > /dev/null & echo "\$!" | sudoIf tee \${SOCAT_PID} > /dev/null) | ||
| else | ||
| log "Socket proxy already running." | ||
| fi | ||
| fi | ||
| log "Success" | ||
| fi | ||
| # Execute whatever commands were passed in (if any). This allows us | ||
| # to set this script to ENTRYPOINT while still executing the default CMD. | ||
| set +e | ||
| exec "\$@" | ||
| EOF | ||
| chmod +x /usr/local/share/docker-init.sh | ||
| chown ${USERNAME}:root /usr/local/share/docker-init.sh | ||
| echo "Done!" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,36 +1,9 @@ | ||
| # Build the manager binary | ||
| FROM golang:1.13.15 as builder | ||
|
|
||
| WORKDIR /workspace | ||
|
|
||
| # Copy the Go Modules manifests | ||
| COPY go.mod go.mod | ||
| COPY go.sum go.sum | ||
| # cache deps before building and copying source so that we don't need to re-download as much | ||
| # and so that source changes don't invalidate our downloaded layer | ||
| RUN go mod download | ||
|
|
||
| # Copy the go source | ||
| # COPY . ./ | ||
| COPY main.go main.go | ||
| COPY apis/ apis/ | ||
| COPY controllers/ controllers/ | ||
| COPY pkg/ pkg/ | ||
|
|
||
| # Build | ||
| # TODO: Use Makefile here -- right now it's awkward to do so because: | ||
| # 1. tools.mk is required for the makefile from the above directory, but Dockerfile can only look in its directory and below. | ||
| # 2. Having Dockerfile here but building it from above could work except that there's another Dockerfile and a .dockerignore | ||
| # up above that break things. For now we just build by hand | ||
| # RUN make build | ||
|
|
||
| # TODO: Do we want CGO_ENALBED=0 and the other options below in the makefile? | ||
| RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build -a -o k8sinfra-controller main.go | ||
| # Note: This Dockerfile assumes that the binary has been built using the top-level Taskfile.yml | ||
|
|
||
| # Use distroless as minimal base image to package the manager binary | ||
| # Refer to https://github.com/GoogleContainerTools/distroless for more details | ||
| FROM gcr.io/distroless/static:nonroot | ||
| WORKDIR / | ||
| COPY --from=builder /workspace/k8sinfra-controller . | ||
| COPY ./bin/aso-controller . | ||
| USER nonroot:nonroot | ||
| ENTRYPOINT ["/k8sinfra-controller"] | ||
| ENTRYPOINT ["/aso-controller"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.