Merge pull request #4307 from flatcar/chewi/no-dot-env

Drop the .sdkenv and .env files by passing env vars with Docker

Author: chewi

.github/workflows/run-kola-tests.yaml

@@ -182,7 +182,6 @@ jobs:
 
           PARALLEL_ARCH=5
 
-          cat > sdk_container/.env <<EOF
           # export the QEMU_IMAGE_NAME to avoid to download it.
           export QEMU_IMAGE_NAME="/work/flatcar_production_image.bin"
           export QEMU_UEFI_FIRMWARE="/work/flatcar_production_qemu_uefi_efi_code.qcow2"
@@ -194,7 +193,6 @@ jobs:
           # The runner uses lxc containers for kola, and can't use loopback devices to
           # prepare the serial console setting - this means that kola may miss some errors
           export QEMU_KOLA_SKIP_MANGLE=true
-          EOF
 
           export MAX_RETRIES=5
           export SKIP_COPY_TO_BINCACHE=1

.gitignore

@@ -12,9 +12,7 @@
 # Flatcar SDK tarballs
 *.tar.bz2
 
-# SDK container env passing helpers
-sdk_container/.env
-sdk_container/.sdkenv
+# SDK container files
 ci-cleanup.sh
 
 # build cache / artefacts directories

build_packages

@@ -276,7 +276,7 @@ if [[ "${FLAGS_usepkgonly}" -eq "${FLAGS_FALSE}" ]]; then
   #   dropping USE=pam from sys-apps/systemd requires dropping
   #   USE=systemd from sys-auth/pambase
   # sys-auth/pambase[sssd] -> sys-auth/sssd -> sys-apps/shadow[pam] -> sys-auth/pambase
-  break_dep_loop sys-apps/util-linux cryptsetup,pam,systemd,udev \
+  break_dep_loop sys-apps/util-linux cryptsetup,pam,su,systemd,udev \
                  sys-fs/cryptsetup udev \
                  sys-fs/lvm2 systemd,udev \
                  sys-apps/systemd audit,cryptsetup,pam,selinux,tpm \

build_sdk_container_image

@@ -229,7 +229,7 @@ else
     docker_build -t "${sdk_build_image}" \
                  --build-arg VERSION="${docker_vernum}" \
                  --build-arg BINHOST="http://${binhost}" \
-                 --build-arg OFFICIAL="${official}" \
+                 --build-arg COREOS_OFFICIAL="${official}" \
                  -f sdk_lib/Dockerfile.sdk-build \
                  .
 

changelog/changes/2026-10-02-su.md

@@ -0,0 +1 @@
+- Switched from shadow's su implementation to util-linux's, as the former is deprecated upstream.

changelog/changes/2026-10-27-sdk-env.md

@@ -0,0 +1 @@
+- SDK: The .env and .sdkenv files are no longer used to pass environment variables into the SDK container as this is insecure. Use run_sdk_container's new -e option instead.

ci-automation/ci-config.env

@@ -40,11 +40,6 @@ CONTAINER_IMAGE_ROOT="/home/sdk/trunk/src/build/images"
 
 # NOTE that these settings are evaluated by the vendor-tests script inside the
 #  SDK container. To override, new values must be passed into the container.
-#  Use something like
-#    echo "export [VAR]=\"${[VALUE]}\\"" > sdk_container/.env
-#  in your CI to override, e.g.
-#    echo "export PARALLEL_TESTS=\"5\"" > sdk_container/.env
-#  to override the number of test cases to be run in parallel.
 
 # -- General --
 
@@ -81,10 +76,6 @@ QEMU_DEVCONTAINER_URL="${QEMU_DEVCONTAINER_URL:-}"
 QEMU_DEVCONTAINER_BINHOST_URL="${QEMU_DEVCONTAINER_BINHOST_URL:-}"
 QEMU_DEVCONTAINER_FILE="${QEMU_DEVCONTAINER_FILE:-}"
 
-# -- PXE --
-PXE_KERNEL_NAME="flatcar_production_pxe.vmlinuz"
-PXE_IMAGE_NAME="flatcar_production_pxe_image.cpio.gz"
-
 GCE_IMAGE_NAME="flatcar_production_gce.tar.gz"
 GCE_GCS_IMAGE_UPLOAD="gs://flatcar-jenkins/developer/gce-ci"
 GCE_MACHINE_TYPE="${GCE_MACHINE_TYPE:-n1-standard-2}"
@@ -99,13 +90,13 @@ GCE_PARALLEL="${PARALLEL_TESTS:-4}"
 : ${DIGITALOCEAN_MACHINE_SIZE:='s-2vcpu-2gb'}
 DIGITALOCEAN_PARALLEL="${PARALLEL_TESTS:-8}"
 # DIGITALOCEAN_TOKEN_JSON env var is used for credentials, and should
-# come from sdk_container/.env. It must be base64-encoded.
+# come from the caller. It must be base64-encoded.
 
 # -- VMware ESX --
 
 : ${VMWARE_ESX_IMAGE_NAME:='flatcar_production_vmware_ova.ova'}
 VMWARE_ESX_PARALLEL="${PARALLEL_TESTS:-4}"
-# VMWARE_ESX_CREDS should come from sdk_container/.env and must be
+# VMWARE_ESX_CREDS should come from the caller and must be
 # base64-encoded.
 
 # -- AWS --
@@ -122,8 +113,7 @@ VMWARE_ESX_PARALLEL="${PARALLEL_TESTS:-4}"
 : ${AWS_REGION:="us-east-1"}
 : ${AWS_AMI_ID:=""}
 AWS_PARALLEL="${PARALLEL_TESTS:-8}"
-# AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY should come from
-# sdk_container/.env
+# AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY should come from the caller.
 
 # -- Azure --
 : ${AZURE_IMAGE_NAME:="flatcar_production_azure_image.vhd"}
@@ -132,7 +122,6 @@ AWS_PARALLEL="${PARALLEL_TESTS:-8}"
 : ${AZURE_USE_GALLERY:=""}
 : ${AZURE_KOLA_VNET:=""}
 : ${AZURE_USE_PRIVATE_IPS:=true}
-: ${AZURE_VNET_SUBNET_NAME:="jenkins-vnet-westeurope"}
 AZURE_PARALLEL="${PARALLEL_TESTS:-20}"
 AZURE_LOCATION="${AZURE_LOCATION:-westeurope}"
 

ci-automation/garbage_collect.sh

@@ -255,21 +255,7 @@ function _garbage_collect_impl() {
 
     local mantle_ref
     mantle_ref=$(cat sdk_container/.repo/manifests/mantle-container)
-    docker run --pull always --rm --net host \
-      --env AWS_ACCESS_KEY_ID --env AWS_SECRET_ACCESS_KEY \
-      --env AWS_CREDENTIALS \
-      --env DIGITALOCEAN_TOKEN_JSON \
-      --env GCP_JSON_KEY \
-      --env VMWARE_ESX_CREDS \
-      --env BRIGHTBOX_CLIENT_ID --env BRIGHTBOX_CLIENT_SECRET \
-      --env AKAMAI_TOKEN \
-      --env STACKIT_SERVICE_ACCOUNT \
-      --env STACKIT_PROJECT_ID \
-      --env ORACLECLOUD_TENANCY \
-      --env ORACLECLOUD_USER \
-      --env ORACLECLOUD_FINGERPRINT \
-      --env ORACLECLOUD_PRIVATE_KEY \
-      --env ORACLECLOUD_COMPARTMENT_ID \
+    docker run --pull always --rm --net host --env-file="sdk_lib/env_mantle.txt" \
       -w /work -v "$PWD":/work "${mantle_ref}" /work/ci-automation/garbage_collect_cloud.sh
 
     echo

ci-automation/garbage_collect_cloud.sh

@@ -2,14 +2,14 @@
 set -euo pipefail
 source ci-automation/ci_automation_common.sh
 timeout --signal=SIGQUIT 60m ore aws gc --access-id "${AWS_ACCESS_KEY_ID}" --secret-key "${AWS_SECRET_ACCESS_KEY}"
-timeout --signal=SIGQUIT 60m ore gcloud gc --json-key <(echo "${GCP_JSON_KEY}" | base64 --decode)
+timeout --signal=SIGQUIT 60m ore gcloud gc --json-key <(base64 --decode <<< "${GCP_JSON_KEY}")
 timeout --signal=SIGQUIT 60m ore azure gc --duration 6h
 timeout --signal=SIGQUIT 60m ore brightbox gc --duration 6h \
   --brightbox-client-id="${BRIGHTBOX_CLIENT_ID}" --brightbox-client-secret="${BRIGHTBOX_CLIENT_SECRET}"
 timeout --signal=SIGQUIT 60m ore akamai gc --duration 6h \
   --akamai-token="${AKAMAI_TOKEN}"
 timeout --signal=SIGQUIT 60m ore stackit gc --duration 6h \
-  --stackit-service-account-key-path=<(echo "${STACKIT_SERVICE_ACCOUNT}" | base64 --decode) \
+  --stackit-service-account-key-path=<(base64 --decode <<< "${STACKIT_SERVICE_ACCOUNT}") \
   --stackit-project-id="${STACKIT_PROJECT_ID}"
 secret_to_file aws_credentials_config_file "${AWS_CREDENTIALS}"
 for channel in alpha beta stable lts; do
@@ -29,5 +29,5 @@ timeout --signal=SIGQUIT 60m ore oraclecloud gc --duration 6h \
   --oraclecloud-tenancy="${ORACLECLOUD_TENANCY}" \
   --oraclecloud-user="${ORACLECLOUD_USER}" \
   --oraclecloud-fingerprint="${ORACLECLOUD_FINGERPRINT}" \
-  --oraclecloud-private-key="$(echo "${ORACLECLOUD_PRIVATE_KEY}" | base64 --decode)" \
+  --oraclecloud-private-key="$(base64 --decode <<< "${ORACLECLOUD_PRIVATE_KEY}")" \
   --oraclecloud-compartment-id="${ORACLECLOUD_COMPARTMENT_ID}"

ci-automation/release.sh

@@ -75,8 +75,6 @@ function _inside_mantle() {
     source sdk_lib/sdk_container_common.sh
     source ci-automation/ci_automation_common.sh
     source sdk_container/.repo/manifests/version.txt
-    # Needed because we are not the SDK container here
-    source sdk_container/.env
     CHANNEL="$(get_git_channel)"
     VERSION="${FLATCAR_VERSION}"
     aws_credentials_config_file=""
@@ -240,8 +238,6 @@ function _release_build_impl() {
     source ci-automation/gpg_setup.sh
 
     source sdk_container/.repo/manifests/version.txt
-    # Needed because we are not the SDK container here
-    source sdk_container/.env
     local sdk_version="${FLATCAR_SDK_VERSION}"
     local docker_sdk_vernum=""
     docker_sdk_vernum="$(vernum_to_docker_image_version "${sdk_version}")"
@@ -257,9 +253,9 @@ function _release_build_impl() {
     # A job on each worker prunes old mantle images (docker image prune), no need to do it here
     echo "docker rm -f '${container_name}'" >> ./ci-cleanup.sh
 
-    touch sdk_container/.env # This file should already contain the required credentials as env vars
     docker run --pull always --rm --name="${container_name}" --net host \
-      -w /work -v "$PWD":/work "${mantle_ref}" bash -c "git config --global --add safe.directory /work && source ci-automation/release.sh && _inside_mantle"
+      -w /work -v "$PWD":/work --env-file="sdk_lib/env_mantle.txt" "${mantle_ref}" \
+      bash -c "git config --global --add safe.directory /work && source ci-automation/release.sh && _inside_mantle"
     # Push flatcar_production_ami_*txt and flatcar_production_ami_*json to the right bincache folder
     for arch in amd64 arm64; do
       sudo chown -R "$USER:$USER" "aws-${arch}"