Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update init image version and dependencies #179

Merged
merged 2 commits into from
Dec 21, 2021

Conversation

rainest
Copy link

@rainest rainest commented Dec 20, 2021

This PR updates the Alpine version in the init image to match the trace runner (3.15) to fix an outdated root certificate, adds several dependencies needed for newer kernel builds, and fixes a minor bug in the install script.

Attempting to run with --fetch-headers didn't actually fetch headers. Init container logs show:

+ curl -sL https://www.kernel.org/pub/linux/kernel/v5.x/linux-5.14.16.tar.gz
+ tar --strip-components=1 -xzf - -C /linux-generic-5.14.16-arch1-1
tar: invalid magic
tar: short read

Running the same curl command manually within the container indicated a certificate was expired. Adding OpenSSL clarified that this was due to the old LetsEncrypt DST root's presence in the chain:

/ # openssl s_client -connect www.kernel.org:443
CONNECTED(00000003)
depth=3 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
---
Certificate chain
 0 s:/CN=dfw.source.kernel.org
   i:/C=US/O=Let's Encrypt/CN=R3
 1 s:/C=US/O=Let's Encrypt/CN=R3
   i:/C=US/O=Internet Security Research Group/CN=ISRG Root X1
 2 s:/C=US/O=Internet Security Research Group/CN=ISRG Root X1
   i:/O=Digital Signature Trust Co./CN=DST Root CA X3

After bumping the version, I hit several build failures building linux-generic-5.14.16. Adding the additional packages fixed those.

There was a final remaining touch: /usr/src/linux-generic-5.14.16-arch1-1/.installed: No such file or directory error in the install script. That may have been benign/ignored (it should have occurred regardless of the kernel version), but I figure it's worth ensuring that directory exists regardless so that the script can run as expected.

Afterwards, --fetch-headers created a pod that could run traces successfully.

Travis Raines added 2 commits December 20, 2021 12:03
Update the Alpine version to 3.15 and add several dependencies required
for newer kernel builds.
@dalehamel
Copy link
Member

Looks like the 16.04 runners are gone, i'll remove them in a separate PR. LGTM thanks for this

@dalehamel dalehamel merged commit 09d8338 into iovisor:master Dec 21, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants