Skip to content

chore(flannel): remove legacy flannel wrapper #75

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Garrett Settles (gsettles01) merged 2 commits into from
Sep 22, 2026
Merged

chore(flannel): remove legacy flannel wrapper #75

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cd10641
chore(flannel): remove legacy wrapper after Mantle exclusions
gsettles01 Sep 14, 2026
e3d0165
fix(flannel): limit wrapper removal to ACL images
gsettles01 Sep 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 0 additions & 25 deletions build_library/rpm/build_image_util.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1091,30 +1091,6 @@ SYSUSERS_EOF
sudo cp "${etcd_wrapper_src}/etcd-wrapper.conf" "${root_fs_dir}/usr/lib/tmpfiles.d/etcd-wrapper.conf"
}

# Install flannel service units into the rootfs so Ignition can enable them.
# Same rationale as etcd-member.service above: Ignition runs before sysext
# merge, so it can't read [Install] sections from sysext-only unit files.
# The flannel-wrapper binary stays in the docker sysext (it depends on Docker).
_configure_flannel_services_rpm() {
local root_fs_dir="$1"

local flannel_wrapper_src="${SCRIPT_ROOT}/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files"
local flannel_version="0.14.0"
if [[ ! -d "${flannel_wrapper_src}" ]]; then
die "flannel-wrapper source not found at ${flannel_wrapper_src}"
fi

info "RPM mode: Installing flannel service units into rootfs (Ignition visibility)"
# flanneld.service (substitute image tag)
sed "s|@FLANNEL_IMAGE_TAG@|v${flannel_version}|g" \
"${flannel_wrapper_src}/flanneld.service" \
| sudo tee "${root_fs_dir}/usr/lib/systemd/system/flanneld.service" > /dev/null
# flannel-docker-opts.service (substitute image tag)
sed "s|@FLANNEL_IMAGE_TAG@|v${flannel_version}|g" \
"${flannel_wrapper_src}/flannel-docker-opts.service" \
| sudo tee "${root_fs_dir}/usr/lib/systemd/system/flannel-docker-opts.service" > /dev/null
}

# CIS Level 1 hardening
# Addresses CIS Azure Container Linux 4 Level 1 failures without affecting
# network connectivity or core system operation. All settings are safe for
Expand Down Expand Up @@ -1393,7 +1369,6 @@ finish_image_post_tmpfiles_rpm() {
_remove_unused_systemd_components_rpm "${root_fs_dir}"
_configure_pcrlock_rpm "${root_fs_dir}"
_configure_etcd_rpm "${root_fs_dir}"
_configure_flannel_services_rpm "${root_fs_dir}"
_configure_kdump_rpm "${root_fs_dir}"
_configure_misc_rpm "${root_fs_dir}"
_configure_cis_hardening_rpm "${root_fs_dir}"
Expand Down
24 changes: 0 additions & 24 deletions build_library/rpm/sysext_mangle_docker-flatcar.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,27 +53,3 @@ sed -i 's|-v ${ETCD_SSL_DIR}:/etc/ssl/certs:ro|-v /etc/pki/ca-trust/extracted/pe
mkdir -p "${rootfs}/usr/share/ca-certificates"
ln -sf /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \
"${rootfs}/usr/share/ca-certificates/ca-certificates.crt"

# ── flannel-wrapper: Docker-based flanneld ───────────────────────────────────
# flannel-wrapper runs flanneld in a Docker container (like etcd-wrapper).
echo ">>> NOTICE: $0: installing flannel-wrapper (Docker-based flanneld)"

flannel_wrapper_src="${script_root}/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files"
flannel_version="0.14.0"
if [[ ! -d "${flannel_wrapper_src}" ]]; then
echo ">>> ERROR: $0: flannel-wrapper source not found at ${flannel_wrapper_src}" >&2
exit 1
fi

# flannel-wrapper script -> /usr/lib/flatcar/flannel-wrapper
# (resolves via /usr/lib/coreos -> flatcar symlink created by _configure_etcd_rpm)
cp "${flannel_wrapper_src}/flannel-wrapper" "${rootfs}/usr/lib/flatcar/flannel-wrapper"
chmod 0755 "${rootfs}/usr/lib/flatcar/flannel-wrapper"
# NOTE: flanneld.service and flannel-docker-opts.service are installed in the
# rootfs by _configure_flannel_services_rpm() in build_image_util.sh. They MUST
# be in the rootfs because Ignition needs to read their [Install] sections to
# create enable symlinks, and Ignition runs before sysext merge.

# networkd configs for flannel interfaces
Comment thread
gsettles01 marked this conversation as resolved.
cp "${flannel_wrapper_src}/50-flannel.network" "${rootfs}/usr/lib/systemd/network/50-flannel.network"
cp "${flannel_wrapper_src}/50-flannel.link" "${rootfs}/usr/lib/systemd/network/50-flannel.link"
Loading