From cd10641e7de46629cd29c40e4227fcdb5150b1f6 Mon Sep 17 00:00:00 2001 From: Garrett Settles Date: Mon, 14 Sep 2026 22:50:03 +0000 Subject: [PATCH 1/2] chore(flannel): remove legacy wrapper after Mantle exclusions Part 2 of the published remove-flannel-wrapper PR, stacked on gsettles/remove-flannel-wrapper-1-prerequisite. Remove the remaining package sources, Portage dependency, RPM rootfs service installation, and Docker sysext injection. The combined tree exactly reproduces 6b378c657c8cd83f9b14d2f74d9068abc2ee8c43. Merge only after ACL part 1 and Mantle gsettles/remove-acl-flannel-tests have landed and validation consumes the excluded-test runner. Rebuild both the OS and Docker sysext, validate applicable etcd/kubeadm tests, and migrate legacy user configs before image rollout. --- build_library/rpm/build_image_util.sh | 25 ----------- build_library/rpm/package_catalog.yaml | 1 - .../rpm/sysext_mangle_docker-flatcar.sh | 24 ----------- .../flannel-wrapper/files/50-flannel.link | 5 --- .../flannel-wrapper/files/50-flannel.network | 5 --- .../files/flannel-docker-opts.service | 24 ----------- .../flannel-wrapper/files/flannel-wrapper | 42 ------------------- .../flannel-wrapper/files/flanneld.service | 29 ------------- .../flannel-wrapper-0.14.0-r1.ebuild | 39 ----------------- .../app-admin/flannel-wrapper/metadata.xml | 7 ---- .../coreos-base/coreos/coreos-0.0.1.ebuild | 1 - 11 files changed, 202 deletions(-) delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.link delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.network delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-docker-opts.service delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-wrapper delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flanneld.service delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/flannel-wrapper-0.14.0-r1.ebuild delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/metadata.xml diff --git a/build_library/rpm/build_image_util.sh b/build_library/rpm/build_image_util.sh index 1b370f79279..f4ac9acafd7 100644 --- a/build_library/rpm/build_image_util.sh +++ b/build_library/rpm/build_image_util.sh @@ -1091,30 +1091,6 @@ SYSUSERS_EOF sudo cp "${etcd_wrapper_src}/etcd-wrapper.conf" "${root_fs_dir}/usr/lib/tmpfiles.d/etcd-wrapper.conf" } -# Install flannel service units into the rootfs so Ignition can enable them. -# Same rationale as etcd-member.service above: Ignition runs before sysext -# merge, so it can't read [Install] sections from sysext-only unit files. -# The flannel-wrapper binary stays in the docker sysext (it depends on Docker). -_configure_flannel_services_rpm() { - local root_fs_dir="$1" - - local flannel_wrapper_src="${SCRIPT_ROOT}/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files" - local flannel_version="0.14.0" - if [[ ! -d "${flannel_wrapper_src}" ]]; then - die "flannel-wrapper source not found at ${flannel_wrapper_src}" - fi - - info "RPM mode: Installing flannel service units into rootfs (Ignition visibility)" - # flanneld.service (substitute image tag) - sed "s|@FLANNEL_IMAGE_TAG@|v${flannel_version}|g" \ - "${flannel_wrapper_src}/flanneld.service" \ - | sudo tee "${root_fs_dir}/usr/lib/systemd/system/flanneld.service" > /dev/null - # flannel-docker-opts.service (substitute image tag) - sed "s|@FLANNEL_IMAGE_TAG@|v${flannel_version}|g" \ - "${flannel_wrapper_src}/flannel-docker-opts.service" \ - | sudo tee "${root_fs_dir}/usr/lib/systemd/system/flannel-docker-opts.service" > /dev/null -} - # CIS Level 1 hardening # Addresses CIS Azure Container Linux 4 Level 1 failures without affecting # network connectivity or core system operation. All settings are safe for @@ -1393,7 +1369,6 @@ finish_image_post_tmpfiles_rpm() { _remove_unused_systemd_components_rpm "${root_fs_dir}" _configure_pcrlock_rpm "${root_fs_dir}" _configure_etcd_rpm "${root_fs_dir}" - _configure_flannel_services_rpm "${root_fs_dir}" _configure_kdump_rpm "${root_fs_dir}" _configure_misc_rpm "${root_fs_dir}" _configure_cis_hardening_rpm "${root_fs_dir}" diff --git a/build_library/rpm/package_catalog.yaml b/build_library/rpm/package_catalog.yaml index d857ba2c43b..c3ff4115732 100644 --- a/build_library/rpm/package_catalog.yaml +++ b/build_library/rpm/package_catalog.yaml @@ -262,7 +262,6 @@ packages: # Flatcar-only packages (skipped in RPM mode) app-admin/etcd-wrapper: SKIP - app-admin/flannel-wrapper: SKIP app-admin/locksmith: SKIP app-admin/mayday: SKIP app-admin/sdnotify-proxy: SKIP diff --git a/build_library/rpm/sysext_mangle_docker-flatcar.sh b/build_library/rpm/sysext_mangle_docker-flatcar.sh index 48d22334588..e7226310896 100755 --- a/build_library/rpm/sysext_mangle_docker-flatcar.sh +++ b/build_library/rpm/sysext_mangle_docker-flatcar.sh @@ -53,27 +53,3 @@ sed -i 's|-v ${ETCD_SSL_DIR}:/etc/ssl/certs:ro|-v /etc/pki/ca-trust/extracted/pe mkdir -p "${rootfs}/usr/share/ca-certificates" ln -sf /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \ "${rootfs}/usr/share/ca-certificates/ca-certificates.crt" - -# ── flannel-wrapper: Docker-based flanneld ─────────────────────────────────── -# flannel-wrapper runs flanneld in a Docker container (like etcd-wrapper). -echo ">>> NOTICE: $0: installing flannel-wrapper (Docker-based flanneld)" - -flannel_wrapper_src="${script_root}/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files" -flannel_version="0.14.0" -if [[ ! -d "${flannel_wrapper_src}" ]]; then - echo ">>> ERROR: $0: flannel-wrapper source not found at ${flannel_wrapper_src}" >&2 - exit 1 -fi - -# flannel-wrapper script -> /usr/lib/flatcar/flannel-wrapper -# (resolves via /usr/lib/coreos -> flatcar symlink created by _configure_etcd_rpm) -cp "${flannel_wrapper_src}/flannel-wrapper" "${rootfs}/usr/lib/flatcar/flannel-wrapper" -chmod 0755 "${rootfs}/usr/lib/flatcar/flannel-wrapper" -# NOTE: flanneld.service and flannel-docker-opts.service are installed in the -# rootfs by _configure_flannel_services_rpm() in build_image_util.sh. They MUST -# be in the rootfs because Ignition needs to read their [Install] sections to -# create enable symlinks, and Ignition runs before sysext merge. - -# networkd configs for flannel interfaces -cp "${flannel_wrapper_src}/50-flannel.network" "${rootfs}/usr/lib/systemd/network/50-flannel.network" -cp "${flannel_wrapper_src}/50-flannel.link" "${rootfs}/usr/lib/systemd/network/50-flannel.link" diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.link b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.link deleted file mode 100644 index 202aea5ba0d..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.link +++ /dev/null @@ -1,5 +0,0 @@ -[Match] -OriginalName=flannel* - -[Link] -MACAddressPolicy=none diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.network b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.network deleted file mode 100644 index e5d48d739b3..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.network +++ /dev/null @@ -1,5 +0,0 @@ -[Match] -Name=flannel* - -[Link] -Unmanaged=yes diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-docker-opts.service b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-docker-opts.service deleted file mode 100644 index 9ab7ddce64e..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-docker-opts.service +++ /dev/null @@ -1,24 +0,0 @@ -[Unit] -Description=flannel docker export service - Network fabric for containers (System Application Container) -Documentation=https://github.com/coreos/flannel -PartOf=flanneld.service -Requires=flanneld.service -After=flanneld.service - -[Service] -Type=oneshot -RemainAfterExit=true -Restart=on-failure -RestartSec=5s - -Environment="FLANNEL_IMAGE_URL=quay.io/coreos/flannel" -Environment="FLANNEL_IMAGE_TAG=@FLANNEL_IMAGE_TAG@" -Environment="FLANNEL_CMD=/opt/bin/mk-docker-opts.sh" -Environment="FLANNEL_CONTAINER=flannel-docker-opts" - -ExecStart=/usr/lib/flatcar/flannel-wrapper -d /run/flannel/flannel_docker_opts.env -i -ExecStop=/usr/bin/docker stop flannel-docker-opts -ExecStopPost=/usr/bin/docker rm flannel-docker-opts - -[Install] -WantedBy=multi-user.target diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-wrapper b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-wrapper deleted file mode 100644 index c8aa3b05a9d..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-wrapper +++ /dev/null @@ -1,42 +0,0 @@ -#!/bin/bash -# The "flannel-wrapper" script can't be deleted because ct overwrites -# the ExecStart directive with flannel-wrapper. Do the new action of -# ExecStart here. -set -e - -ETCD_SSL_DIR="${ETCD_SSL_DIR:-/etc/ssl/etcd}" -RUN_ARGS="" -if [[ -d "${ETCD_SSL_DIR}" ]]; then - RUN_ARGS="-v ${ETCD_SSL_DIR}:${ETCD_SSL_DIR}:ro" -fi - -mkdir --parents /run/flannel - - -WRAP="" -if [[ -S "${NOTIFY_SOCKET}" ]]; then - WRAP="/usr/libexec/sdnotify-proxy /run/${FLANNEL_CONTAINER}-notify" -fi - -# A better way to run the Flannel/etcd container image is Podman because -# Flannel depends on etcd but wants to be run before Docker so that it -# can set up the Docker networking. Etcd and Flannel are part of the -# Container Linux Config specification and thus can't be dropped easily. -# For now we have to resort to running these services with Docker and try -# to restart Docker for the Flannel options to take effect (but that also -# terminates the etcd and flannel containers, causing the services to -# restart). -RESTART_DOCKER=0 -if [ "${FLANNEL_CMD}" = "/opt/bin/mk-docker-opts.sh" ] && [ "$1" = "-d" ] && [ ! -f "$2" ]; then - # only restart Docker only on first run, propagating updates on later runs was not done before in the rkt version, so keep the behavior - # (which also helps to break the loop which otherwise exists because "restart docker" mentioned above) - RESTART_DOCKER=1 -fi -/usr/bin/docker stop ${FLANNEL_CONTAINER} || true -/usr/bin/docker rm -f ${FLANNEL_CONTAINER} || true -# mapping only /run/${FLANNEL_CONTAINER}-notify does not work and we map the full /run (using /run:/run covers /run/flannel, too), also we must set NOTIFY_SOCKET in the container but use the original for /usr/libexec/sdnotify-proxy -${WRAP} /usr/bin/docker run --name ${FLANNEL_CONTAINER} --privileged --network=host --ipc=host ${RUN_ARGS} -v /run:/run:rw -v /etc/ssl/certs:/etc/ssl/certs:ro -v /usr/share/ca-certificates:/usr/share/ca-certificates:ro --env-file <(env; echo PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; echo NOTIFY_SOCKET=/run/${FLANNEL_CONTAINER}-notify) --entrypoint ${FLANNEL_CMD} ${FLANNEL_IMAGE:-${FLANNEL_IMAGE_URL}:${FLANNEL_IMAGE_TAG}} "$@" -if [ "${RESTART_DOCKER}" = 1 ]; then - systemctl restart docker - echo "Restarted Docker to apply Flannel options" -fi diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flanneld.service b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flanneld.service deleted file mode 100644 index 7fa589d6bf3..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flanneld.service +++ /dev/null @@ -1,29 +0,0 @@ -[Unit] -Description=flannel - Network fabric for containers (System Application Container) -Documentation=https://github.com/coreos/flannel -After=etcd.service etcd2.service etcd-member.service -Requires=flannel-docker-opts.service - -[Service] -Type=notify -NotifyAccess=all -Restart=always -RestartSec=10s -TimeoutStartSec=300 -LimitNOFILE=40000 -LimitNPROC=1048576 - -Environment="FLANNEL_IMAGE_URL=quay.io/coreos/flannel" -Environment="FLANNEL_IMAGE_TAG=@FLANNEL_IMAGE_TAG@" -Environment="FLANNEL_OPTS=--ip-masq=true" -Environment="FLANNEL_CMD=/opt/bin/flanneld" -Environment="FLANNEL_CONTAINER=flannel" -EnvironmentFile=-/run/flannel/options.env - -ExecStartPre=/sbin/modprobe ip_tables -ExecStart=/usr/lib/flatcar/flannel-wrapper $FLANNEL_OPTS -ExecStop=/usr/bin/docker stop flannel -ExecStopPost=/usr/bin/docker rm flannel - -[Install] -WantedBy=multi-user.target diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/flannel-wrapper-0.14.0-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/flannel-wrapper-0.14.0-r1.ebuild deleted file mode 100644 index 089638114bf..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/flannel-wrapper-0.14.0-r1.ebuild +++ /dev/null @@ -1,39 +0,0 @@ -# Copyright (c) 2014 CoreOS, Inc.. All rights reserved. -# Distributed under the terms of the GNU General Public License v2 - -EAPI=8 - -inherit systemd - -DESCRIPTION="flannel (System Application Container)" -HOMEPAGE="https://github.com/flannel-io/flannel" -S="${WORKDIR}" -LICENSE="Apache-2.0" -SLOT="0" -KEYWORDS="amd64 arm64" - -RDEPEND=" - >=app-admin/sdnotify-proxy-0.1.0 -" - -src_install() { - local tag="v${PV}" - if [[ "${ARCH}" != "amd64" ]]; then - tag+="-${ARCH}" - fi - - exeinto /usr/lib/flatcar - doexe "${FILESDIR}"/flannel-wrapper - - sed "s|@FLANNEL_IMAGE_TAG@|${tag}|g" \ - "${FILESDIR}"/flanneld.service > "${T}"/flanneld.service - systemd_dounit "${T}"/flanneld.service - - sed "s|@FLANNEL_IMAGE_TAG@|${tag}|g" \ - "${FILESDIR}"/flannel-docker-opts.service > "${T}"/flannel-docker-opts.service - systemd_dounit "${T}"/flannel-docker-opts.service - - insinto /usr/lib/systemd/network - doins "${FILESDIR}"/50-flannel.network - doins "${FILESDIR}"/50-flannel.link -} diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/metadata.xml b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/metadata.xml deleted file mode 100644 index 946ad159982..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/metadata.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - - flannel-io/flannel - - diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild index 22564c301cc..ef591d8d53d 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild @@ -81,7 +81,6 @@ RDEPEND="${RDEPEND} # sys-devel/gettext: it embeds 'envsubst' binary which is useful for simple file templating. RDEPEND="${RDEPEND} app-admin/etcd-wrapper - app-admin/flannel-wrapper app-admin/locksmith app-admin/mayday app-admin/sdnotify-proxy From e3d0165afca4b2ceeac7065517c8a0a87c31835c Mon Sep 17 00:00:00 2001 From: Garrett Settles Date: Wed, 16 Sep 2026 23:06:53 +0000 Subject: [PATCH 2/2] fix(flannel): limit wrapper removal to ACL images --- build_library/rpm/package_catalog.yaml | 1 + .../flannel-wrapper/files/50-flannel.link | 5 +++ .../flannel-wrapper/files/50-flannel.network | 5 +++ .../files/flannel-docker-opts.service | 24 +++++++++++ .../flannel-wrapper/files/flannel-wrapper | 42 +++++++++++++++++++ .../flannel-wrapper/files/flanneld.service | 29 +++++++++++++ .../flannel-wrapper-0.14.0-r1.ebuild | 39 +++++++++++++++++ .../app-admin/flannel-wrapper/metadata.xml | 7 ++++ .../coreos-base/coreos/coreos-0.0.1.ebuild | 1 + 9 files changed, 153 insertions(+) create mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.link create mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.network create mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-docker-opts.service create mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-wrapper create mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flanneld.service create mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/flannel-wrapper-0.14.0-r1.ebuild create mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/metadata.xml diff --git a/build_library/rpm/package_catalog.yaml b/build_library/rpm/package_catalog.yaml index c3ff4115732..d857ba2c43b 100644 --- a/build_library/rpm/package_catalog.yaml +++ b/build_library/rpm/package_catalog.yaml @@ -262,6 +262,7 @@ packages: # Flatcar-only packages (skipped in RPM mode) app-admin/etcd-wrapper: SKIP + app-admin/flannel-wrapper: SKIP app-admin/locksmith: SKIP app-admin/mayday: SKIP app-admin/sdnotify-proxy: SKIP diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.link b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.link new file mode 100644 index 00000000000..202aea5ba0d --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.link @@ -0,0 +1,5 @@ +[Match] +OriginalName=flannel* + +[Link] +MACAddressPolicy=none diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.network b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.network new file mode 100644 index 00000000000..e5d48d739b3 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.network @@ -0,0 +1,5 @@ +[Match] +Name=flannel* + +[Link] +Unmanaged=yes diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-docker-opts.service b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-docker-opts.service new file mode 100644 index 00000000000..9ab7ddce64e --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-docker-opts.service @@ -0,0 +1,24 @@ +[Unit] +Description=flannel docker export service - Network fabric for containers (System Application Container) +Documentation=https://github.com/coreos/flannel +PartOf=flanneld.service +Requires=flanneld.service +After=flanneld.service + +[Service] +Type=oneshot +RemainAfterExit=true +Restart=on-failure +RestartSec=5s + +Environment="FLANNEL_IMAGE_URL=quay.io/coreos/flannel" +Environment="FLANNEL_IMAGE_TAG=@FLANNEL_IMAGE_TAG@" +Environment="FLANNEL_CMD=/opt/bin/mk-docker-opts.sh" +Environment="FLANNEL_CONTAINER=flannel-docker-opts" + +ExecStart=/usr/lib/flatcar/flannel-wrapper -d /run/flannel/flannel_docker_opts.env -i +ExecStop=/usr/bin/docker stop flannel-docker-opts +ExecStopPost=/usr/bin/docker rm flannel-docker-opts + +[Install] +WantedBy=multi-user.target diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-wrapper b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-wrapper new file mode 100644 index 00000000000..c8aa3b05a9d --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-wrapper @@ -0,0 +1,42 @@ +#!/bin/bash +# The "flannel-wrapper" script can't be deleted because ct overwrites +# the ExecStart directive with flannel-wrapper. Do the new action of +# ExecStart here. +set -e + +ETCD_SSL_DIR="${ETCD_SSL_DIR:-/etc/ssl/etcd}" +RUN_ARGS="" +if [[ -d "${ETCD_SSL_DIR}" ]]; then + RUN_ARGS="-v ${ETCD_SSL_DIR}:${ETCD_SSL_DIR}:ro" +fi + +mkdir --parents /run/flannel + + +WRAP="" +if [[ -S "${NOTIFY_SOCKET}" ]]; then + WRAP="/usr/libexec/sdnotify-proxy /run/${FLANNEL_CONTAINER}-notify" +fi + +# A better way to run the Flannel/etcd container image is Podman because +# Flannel depends on etcd but wants to be run before Docker so that it +# can set up the Docker networking. Etcd and Flannel are part of the +# Container Linux Config specification and thus can't be dropped easily. +# For now we have to resort to running these services with Docker and try +# to restart Docker for the Flannel options to take effect (but that also +# terminates the etcd and flannel containers, causing the services to +# restart). +RESTART_DOCKER=0 +if [ "${FLANNEL_CMD}" = "/opt/bin/mk-docker-opts.sh" ] && [ "$1" = "-d" ] && [ ! -f "$2" ]; then + # only restart Docker only on first run, propagating updates on later runs was not done before in the rkt version, so keep the behavior + # (which also helps to break the loop which otherwise exists because "restart docker" mentioned above) + RESTART_DOCKER=1 +fi +/usr/bin/docker stop ${FLANNEL_CONTAINER} || true +/usr/bin/docker rm -f ${FLANNEL_CONTAINER} || true +# mapping only /run/${FLANNEL_CONTAINER}-notify does not work and we map the full /run (using /run:/run covers /run/flannel, too), also we must set NOTIFY_SOCKET in the container but use the original for /usr/libexec/sdnotify-proxy +${WRAP} /usr/bin/docker run --name ${FLANNEL_CONTAINER} --privileged --network=host --ipc=host ${RUN_ARGS} -v /run:/run:rw -v /etc/ssl/certs:/etc/ssl/certs:ro -v /usr/share/ca-certificates:/usr/share/ca-certificates:ro --env-file <(env; echo PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; echo NOTIFY_SOCKET=/run/${FLANNEL_CONTAINER}-notify) --entrypoint ${FLANNEL_CMD} ${FLANNEL_IMAGE:-${FLANNEL_IMAGE_URL}:${FLANNEL_IMAGE_TAG}} "$@" +if [ "${RESTART_DOCKER}" = 1 ]; then + systemctl restart docker + echo "Restarted Docker to apply Flannel options" +fi diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flanneld.service b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flanneld.service new file mode 100644 index 00000000000..7fa589d6bf3 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flanneld.service @@ -0,0 +1,29 @@ +[Unit] +Description=flannel - Network fabric for containers (System Application Container) +Documentation=https://github.com/coreos/flannel +After=etcd.service etcd2.service etcd-member.service +Requires=flannel-docker-opts.service + +[Service] +Type=notify +NotifyAccess=all +Restart=always +RestartSec=10s +TimeoutStartSec=300 +LimitNOFILE=40000 +LimitNPROC=1048576 + +Environment="FLANNEL_IMAGE_URL=quay.io/coreos/flannel" +Environment="FLANNEL_IMAGE_TAG=@FLANNEL_IMAGE_TAG@" +Environment="FLANNEL_OPTS=--ip-masq=true" +Environment="FLANNEL_CMD=/opt/bin/flanneld" +Environment="FLANNEL_CONTAINER=flannel" +EnvironmentFile=-/run/flannel/options.env + +ExecStartPre=/sbin/modprobe ip_tables +ExecStart=/usr/lib/flatcar/flannel-wrapper $FLANNEL_OPTS +ExecStop=/usr/bin/docker stop flannel +ExecStopPost=/usr/bin/docker rm flannel + +[Install] +WantedBy=multi-user.target diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/flannel-wrapper-0.14.0-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/flannel-wrapper-0.14.0-r1.ebuild new file mode 100644 index 00000000000..089638114bf --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/flannel-wrapper-0.14.0-r1.ebuild @@ -0,0 +1,39 @@ +# Copyright (c) 2014 CoreOS, Inc.. All rights reserved. +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +inherit systemd + +DESCRIPTION="flannel (System Application Container)" +HOMEPAGE="https://github.com/flannel-io/flannel" +S="${WORKDIR}" +LICENSE="Apache-2.0" +SLOT="0" +KEYWORDS="amd64 arm64" + +RDEPEND=" + >=app-admin/sdnotify-proxy-0.1.0 +" + +src_install() { + local tag="v${PV}" + if [[ "${ARCH}" != "amd64" ]]; then + tag+="-${ARCH}" + fi + + exeinto /usr/lib/flatcar + doexe "${FILESDIR}"/flannel-wrapper + + sed "s|@FLANNEL_IMAGE_TAG@|${tag}|g" \ + "${FILESDIR}"/flanneld.service > "${T}"/flanneld.service + systemd_dounit "${T}"/flanneld.service + + sed "s|@FLANNEL_IMAGE_TAG@|${tag}|g" \ + "${FILESDIR}"/flannel-docker-opts.service > "${T}"/flannel-docker-opts.service + systemd_dounit "${T}"/flannel-docker-opts.service + + insinto /usr/lib/systemd/network + doins "${FILESDIR}"/50-flannel.network + doins "${FILESDIR}"/50-flannel.link +} diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/metadata.xml b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/metadata.xml new file mode 100644 index 00000000000..946ad159982 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/metadata.xml @@ -0,0 +1,7 @@ + + + + + flannel-io/flannel + + diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild index ef591d8d53d..22564c301cc 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild @@ -81,6 +81,7 @@ RDEPEND="${RDEPEND} # sys-devel/gettext: it embeds 'envsubst' binary which is useful for simple file templating. RDEPEND="${RDEPEND} app-admin/etcd-wrapper + app-admin/flannel-wrapper app-admin/locksmith app-admin/mayday app-admin/sdnotify-proxy