From 3accf36d2132b8f38ff3fbf9aa9a368e5c0673bb Mon Sep 17 00:00:00 2001 From: Garrett Settles Date: Wed, 2 Sep 2026 16:39:03 +0000 Subject: [PATCH] chore(flannel): remove legacy Docker wrapper Remove the ACL-specific wrapper package, RPM and sysext installation paths, and obsolete enforcing entries. Keep modern kubeadm Flannel coverage and etcd wrapper support intact. --- acl/tests/kola_enforcing.yaml | 28 ------------- build_library/rpm/build_image_util.sh | 25 ----------- build_library/rpm/package_catalog.yaml | 1 - .../rpm/sysext_mangle_docker-flatcar.sh | 24 ----------- .../flannel-wrapper/files/50-flannel.link | 5 --- .../flannel-wrapper/files/50-flannel.network | 5 --- .../files/flannel-docker-opts.service | 24 ----------- .../flannel-wrapper/files/flannel-wrapper | 42 ------------------- .../flannel-wrapper/files/flanneld.service | 29 ------------- .../flannel-wrapper-0.14.0-r1.ebuild | 39 ----------------- .../app-admin/flannel-wrapper/metadata.xml | 7 ---- .../coreos-base/coreos/coreos-0.0.1.ebuild | 1 - 12 files changed, 230 deletions(-) delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.link delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.network delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-docker-opts.service delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-wrapper delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flanneld.service delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/flannel-wrapper-0.14.0-r1.ebuild delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/metadata.xml diff --git a/acl/tests/kola_enforcing.yaml b/acl/tests/kola_enforcing.yaml index d4216c4ea7a..9687db7283f 100644 --- a/acl/tests/kola_enforcing.yaml +++ b/acl/tests/kola_enforcing.yaml @@ -43,34 +43,6 @@ tests: and docker has no RPM replacement (same as docker.*) — so no etcd server can start for the test to drive. - - name: acl.flannel.udp - exceptions: - - architectures: [aarch64] - reason: Flannel UDP coverage is registered only for amd64 - - platforms: [azure] - reason: Azure version depends on discovery.etcd.io, which is unmaintained. - - imageVariants: [acl-t] - reason: | - flanneld runs in a docker container (flanneld.service via - flannel-wrapper) and the test drives docker on each node; - acl-t has no docker daemon — the standalone `docker` sysext is - not carried and docker has no RPM replacement (same as - docker.*) — so flanneld cannot start. - - name: acl.flannel.vxlan - exceptions: - - platforms: [qemu] - architectures: [aarch64] - reason: Flakiness on TCG-emulated arm64 in aclmain, failures due to slow device enumeration. - - platforms: [azure] - reason: Azure version depends on discovery.etcd.io, which is unmaintained. - - imageVariants: [acl-t] - reason: | - flanneld runs in a docker container (flanneld.service via - flannel-wrapper) and the test drives docker on each node; - acl-t has no docker daemon — the standalone `docker` sysext is - not carried and docker has no RPM replacement (same as - docker.*) — so flanneld cannot start. - - name: acl.internet exceptions: - platforms: [qemu] diff --git a/build_library/rpm/build_image_util.sh b/build_library/rpm/build_image_util.sh index 1b370f79279..f4ac9acafd7 100644 --- a/build_library/rpm/build_image_util.sh +++ b/build_library/rpm/build_image_util.sh @@ -1091,30 +1091,6 @@ SYSUSERS_EOF sudo cp "${etcd_wrapper_src}/etcd-wrapper.conf" "${root_fs_dir}/usr/lib/tmpfiles.d/etcd-wrapper.conf" } -# Install flannel service units into the rootfs so Ignition can enable them. -# Same rationale as etcd-member.service above: Ignition runs before sysext -# merge, so it can't read [Install] sections from sysext-only unit files. -# The flannel-wrapper binary stays in the docker sysext (it depends on Docker). -_configure_flannel_services_rpm() { - local root_fs_dir="$1" - - local flannel_wrapper_src="${SCRIPT_ROOT}/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files" - local flannel_version="0.14.0" - if [[ ! -d "${flannel_wrapper_src}" ]]; then - die "flannel-wrapper source not found at ${flannel_wrapper_src}" - fi - - info "RPM mode: Installing flannel service units into rootfs (Ignition visibility)" - # flanneld.service (substitute image tag) - sed "s|@FLANNEL_IMAGE_TAG@|v${flannel_version}|g" \ - "${flannel_wrapper_src}/flanneld.service" \ - | sudo tee "${root_fs_dir}/usr/lib/systemd/system/flanneld.service" > /dev/null - # flannel-docker-opts.service (substitute image tag) - sed "s|@FLANNEL_IMAGE_TAG@|v${flannel_version}|g" \ - "${flannel_wrapper_src}/flannel-docker-opts.service" \ - | sudo tee "${root_fs_dir}/usr/lib/systemd/system/flannel-docker-opts.service" > /dev/null -} - # CIS Level 1 hardening # Addresses CIS Azure Container Linux 4 Level 1 failures without affecting # network connectivity or core system operation. All settings are safe for @@ -1393,7 +1369,6 @@ finish_image_post_tmpfiles_rpm() { _remove_unused_systemd_components_rpm "${root_fs_dir}" _configure_pcrlock_rpm "${root_fs_dir}" _configure_etcd_rpm "${root_fs_dir}" - _configure_flannel_services_rpm "${root_fs_dir}" _configure_kdump_rpm "${root_fs_dir}" _configure_misc_rpm "${root_fs_dir}" _configure_cis_hardening_rpm "${root_fs_dir}" diff --git a/build_library/rpm/package_catalog.yaml b/build_library/rpm/package_catalog.yaml index d857ba2c43b..c3ff4115732 100644 --- a/build_library/rpm/package_catalog.yaml +++ b/build_library/rpm/package_catalog.yaml @@ -262,7 +262,6 @@ packages: # Flatcar-only packages (skipped in RPM mode) app-admin/etcd-wrapper: SKIP - app-admin/flannel-wrapper: SKIP app-admin/locksmith: SKIP app-admin/mayday: SKIP app-admin/sdnotify-proxy: SKIP diff --git a/build_library/rpm/sysext_mangle_docker-flatcar.sh b/build_library/rpm/sysext_mangle_docker-flatcar.sh index 48d22334588..e7226310896 100755 --- a/build_library/rpm/sysext_mangle_docker-flatcar.sh +++ b/build_library/rpm/sysext_mangle_docker-flatcar.sh @@ -53,27 +53,3 @@ sed -i 's|-v ${ETCD_SSL_DIR}:/etc/ssl/certs:ro|-v /etc/pki/ca-trust/extracted/pe mkdir -p "${rootfs}/usr/share/ca-certificates" ln -sf /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \ "${rootfs}/usr/share/ca-certificates/ca-certificates.crt" - -# ── flannel-wrapper: Docker-based flanneld ─────────────────────────────────── -# flannel-wrapper runs flanneld in a Docker container (like etcd-wrapper). -echo ">>> NOTICE: $0: installing flannel-wrapper (Docker-based flanneld)" - -flannel_wrapper_src="${script_root}/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files" -flannel_version="0.14.0" -if [[ ! -d "${flannel_wrapper_src}" ]]; then - echo ">>> ERROR: $0: flannel-wrapper source not found at ${flannel_wrapper_src}" >&2 - exit 1 -fi - -# flannel-wrapper script -> /usr/lib/flatcar/flannel-wrapper -# (resolves via /usr/lib/coreos -> flatcar symlink created by _configure_etcd_rpm) -cp "${flannel_wrapper_src}/flannel-wrapper" "${rootfs}/usr/lib/flatcar/flannel-wrapper" -chmod 0755 "${rootfs}/usr/lib/flatcar/flannel-wrapper" -# NOTE: flanneld.service and flannel-docker-opts.service are installed in the -# rootfs by _configure_flannel_services_rpm() in build_image_util.sh. They MUST -# be in the rootfs because Ignition needs to read their [Install] sections to -# create enable symlinks, and Ignition runs before sysext merge. - -# networkd configs for flannel interfaces -cp "${flannel_wrapper_src}/50-flannel.network" "${rootfs}/usr/lib/systemd/network/50-flannel.network" -cp "${flannel_wrapper_src}/50-flannel.link" "${rootfs}/usr/lib/systemd/network/50-flannel.link" diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.link b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.link deleted file mode 100644 index 202aea5ba0d..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.link +++ /dev/null @@ -1,5 +0,0 @@ -[Match] -OriginalName=flannel* - -[Link] -MACAddressPolicy=none diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.network b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.network deleted file mode 100644 index e5d48d739b3..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/50-flannel.network +++ /dev/null @@ -1,5 +0,0 @@ -[Match] -Name=flannel* - -[Link] -Unmanaged=yes diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-docker-opts.service b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-docker-opts.service deleted file mode 100644 index 9ab7ddce64e..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-docker-opts.service +++ /dev/null @@ -1,24 +0,0 @@ -[Unit] -Description=flannel docker export service - Network fabric for containers (System Application Container) -Documentation=https://github.com/coreos/flannel -PartOf=flanneld.service -Requires=flanneld.service -After=flanneld.service - -[Service] -Type=oneshot -RemainAfterExit=true -Restart=on-failure -RestartSec=5s - -Environment="FLANNEL_IMAGE_URL=quay.io/coreos/flannel" -Environment="FLANNEL_IMAGE_TAG=@FLANNEL_IMAGE_TAG@" -Environment="FLANNEL_CMD=/opt/bin/mk-docker-opts.sh" -Environment="FLANNEL_CONTAINER=flannel-docker-opts" - -ExecStart=/usr/lib/flatcar/flannel-wrapper -d /run/flannel/flannel_docker_opts.env -i -ExecStop=/usr/bin/docker stop flannel-docker-opts -ExecStopPost=/usr/bin/docker rm flannel-docker-opts - -[Install] -WantedBy=multi-user.target diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-wrapper b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-wrapper deleted file mode 100644 index c8aa3b05a9d..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flannel-wrapper +++ /dev/null @@ -1,42 +0,0 @@ -#!/bin/bash -# The "flannel-wrapper" script can't be deleted because ct overwrites -# the ExecStart directive with flannel-wrapper. Do the new action of -# ExecStart here. -set -e - -ETCD_SSL_DIR="${ETCD_SSL_DIR:-/etc/ssl/etcd}" -RUN_ARGS="" -if [[ -d "${ETCD_SSL_DIR}" ]]; then - RUN_ARGS="-v ${ETCD_SSL_DIR}:${ETCD_SSL_DIR}:ro" -fi - -mkdir --parents /run/flannel - - -WRAP="" -if [[ -S "${NOTIFY_SOCKET}" ]]; then - WRAP="/usr/libexec/sdnotify-proxy /run/${FLANNEL_CONTAINER}-notify" -fi - -# A better way to run the Flannel/etcd container image is Podman because -# Flannel depends on etcd but wants to be run before Docker so that it -# can set up the Docker networking. Etcd and Flannel are part of the -# Container Linux Config specification and thus can't be dropped easily. -# For now we have to resort to running these services with Docker and try -# to restart Docker for the Flannel options to take effect (but that also -# terminates the etcd and flannel containers, causing the services to -# restart). -RESTART_DOCKER=0 -if [ "${FLANNEL_CMD}" = "/opt/bin/mk-docker-opts.sh" ] && [ "$1" = "-d" ] && [ ! -f "$2" ]; then - # only restart Docker only on first run, propagating updates on later runs was not done before in the rkt version, so keep the behavior - # (which also helps to break the loop which otherwise exists because "restart docker" mentioned above) - RESTART_DOCKER=1 -fi -/usr/bin/docker stop ${FLANNEL_CONTAINER} || true -/usr/bin/docker rm -f ${FLANNEL_CONTAINER} || true -# mapping only /run/${FLANNEL_CONTAINER}-notify does not work and we map the full /run (using /run:/run covers /run/flannel, too), also we must set NOTIFY_SOCKET in the container but use the original for /usr/libexec/sdnotify-proxy -${WRAP} /usr/bin/docker run --name ${FLANNEL_CONTAINER} --privileged --network=host --ipc=host ${RUN_ARGS} -v /run:/run:rw -v /etc/ssl/certs:/etc/ssl/certs:ro -v /usr/share/ca-certificates:/usr/share/ca-certificates:ro --env-file <(env; echo PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; echo NOTIFY_SOCKET=/run/${FLANNEL_CONTAINER}-notify) --entrypoint ${FLANNEL_CMD} ${FLANNEL_IMAGE:-${FLANNEL_IMAGE_URL}:${FLANNEL_IMAGE_TAG}} "$@" -if [ "${RESTART_DOCKER}" = 1 ]; then - systemctl restart docker - echo "Restarted Docker to apply Flannel options" -fi diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flanneld.service b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flanneld.service deleted file mode 100644 index 7fa589d6bf3..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files/flanneld.service +++ /dev/null @@ -1,29 +0,0 @@ -[Unit] -Description=flannel - Network fabric for containers (System Application Container) -Documentation=https://github.com/coreos/flannel -After=etcd.service etcd2.service etcd-member.service -Requires=flannel-docker-opts.service - -[Service] -Type=notify -NotifyAccess=all -Restart=always -RestartSec=10s -TimeoutStartSec=300 -LimitNOFILE=40000 -LimitNPROC=1048576 - -Environment="FLANNEL_IMAGE_URL=quay.io/coreos/flannel" -Environment="FLANNEL_IMAGE_TAG=@FLANNEL_IMAGE_TAG@" -Environment="FLANNEL_OPTS=--ip-masq=true" -Environment="FLANNEL_CMD=/opt/bin/flanneld" -Environment="FLANNEL_CONTAINER=flannel" -EnvironmentFile=-/run/flannel/options.env - -ExecStartPre=/sbin/modprobe ip_tables -ExecStart=/usr/lib/flatcar/flannel-wrapper $FLANNEL_OPTS -ExecStop=/usr/bin/docker stop flannel -ExecStopPost=/usr/bin/docker rm flannel - -[Install] -WantedBy=multi-user.target diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/flannel-wrapper-0.14.0-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/flannel-wrapper-0.14.0-r1.ebuild deleted file mode 100644 index 089638114bf..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/flannel-wrapper-0.14.0-r1.ebuild +++ /dev/null @@ -1,39 +0,0 @@ -# Copyright (c) 2014 CoreOS, Inc.. All rights reserved. -# Distributed under the terms of the GNU General Public License v2 - -EAPI=8 - -inherit systemd - -DESCRIPTION="flannel (System Application Container)" -HOMEPAGE="https://github.com/flannel-io/flannel" -S="${WORKDIR}" -LICENSE="Apache-2.0" -SLOT="0" -KEYWORDS="amd64 arm64" - -RDEPEND=" - >=app-admin/sdnotify-proxy-0.1.0 -" - -src_install() { - local tag="v${PV}" - if [[ "${ARCH}" != "amd64" ]]; then - tag+="-${ARCH}" - fi - - exeinto /usr/lib/flatcar - doexe "${FILESDIR}"/flannel-wrapper - - sed "s|@FLANNEL_IMAGE_TAG@|${tag}|g" \ - "${FILESDIR}"/flanneld.service > "${T}"/flanneld.service - systemd_dounit "${T}"/flanneld.service - - sed "s|@FLANNEL_IMAGE_TAG@|${tag}|g" \ - "${FILESDIR}"/flannel-docker-opts.service > "${T}"/flannel-docker-opts.service - systemd_dounit "${T}"/flannel-docker-opts.service - - insinto /usr/lib/systemd/network - doins "${FILESDIR}"/50-flannel.network - doins "${FILESDIR}"/50-flannel.link -} diff --git a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/metadata.xml b/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/metadata.xml deleted file mode 100644 index 946ad159982..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/metadata.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - - flannel-io/flannel - - diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild index 22564c301cc..ef591d8d53d 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild @@ -81,7 +81,6 @@ RDEPEND="${RDEPEND} # sys-devel/gettext: it embeds 'envsubst' binary which is useful for simple file templating. RDEPEND="${RDEPEND} app-admin/etcd-wrapper - app-admin/flannel-wrapper app-admin/locksmith app-admin/mayday app-admin/sdnotify-proxy