[WIP] chore(flannel): remove unused Quay-dependent wrapper

acl/tests/kola_enforcing.yaml

@@ -43,34 +43,6 @@ tests:
           and docker has no RPM replacement (same as docker.*) — so no
           etcd server can start for the test to drive.
 
-  - name: acl.flannel.udp
-    exceptions:
-      - architectures: [aarch64]
-        reason: Flannel UDP coverage is registered only for amd64
-      - platforms: [azure]
-        reason: Azure version depends on discovery.etcd.io, which is unmaintained.
-      - imageVariants: [acl-t]
-        reason: |
-          flanneld runs in a docker container (flanneld.service via
-          flannel-wrapper) and the test drives docker on each node;
-          acl-t has no docker daemon — the standalone `docker` sysext is
-          not carried and docker has no RPM replacement (same as
-          docker.*) — so flanneld cannot start.
-  - name: acl.flannel.vxlan
-    exceptions:
-      - platforms: [qemu]
-        architectures: [aarch64]
-        reason: Flakiness on TCG-emulated arm64 in aclmain, failures due to slow device enumeration.
-      - platforms: [azure]
-        reason: Azure version depends on discovery.etcd.io, which is unmaintained.
-      - imageVariants: [acl-t]
-        reason: |
-          flanneld runs in a docker container (flanneld.service via
-          flannel-wrapper) and the test drives docker on each node;
-          acl-t has no docker daemon — the standalone `docker` sysext is
-          not carried and docker has no RPM replacement (same as
-          docker.*) — so flanneld cannot start.
-
   - name: acl.internet
     exceptions:
       - platforms: [qemu]

build_library/rpm/build_image_util.sh

@@ -1091,30 +1091,6 @@ SYSUSERS_EOF
     sudo cp "${etcd_wrapper_src}/etcd-wrapper.conf" "${root_fs_dir}/usr/lib/tmpfiles.d/etcd-wrapper.conf"
 }
 
-# Install flannel service units into the rootfs so Ignition can enable them.
-# Same rationale as etcd-member.service above: Ignition runs before sysext
-# merge, so it can't read [Install] sections from sysext-only unit files.
-# The flannel-wrapper binary stays in the docker sysext (it depends on Docker).
-_configure_flannel_services_rpm() {
-    local root_fs_dir="$1"
-
-    local flannel_wrapper_src="${SCRIPT_ROOT}/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files"
-    local flannel_version="0.14.0"
-    if [[ ! -d "${flannel_wrapper_src}" ]]; then
-        die "flannel-wrapper source not found at ${flannel_wrapper_src}"
-    fi
-
-    info "RPM mode: Installing flannel service units into rootfs (Ignition visibility)"
-    # flanneld.service (substitute image tag)
-    sed "s|@FLANNEL_IMAGE_TAG@|v${flannel_version}|g" \
-        "${flannel_wrapper_src}/flanneld.service" \
-        | sudo tee "${root_fs_dir}/usr/lib/systemd/system/flanneld.service" > /dev/null
-    # flannel-docker-opts.service (substitute image tag)
-    sed "s|@FLANNEL_IMAGE_TAG@|v${flannel_version}|g" \
-        "${flannel_wrapper_src}/flannel-docker-opts.service" \
-        | sudo tee "${root_fs_dir}/usr/lib/systemd/system/flannel-docker-opts.service" > /dev/null
-}
-
 # CIS Level 1 hardening
 # Addresses CIS Azure Container Linux 4 Level 1 failures without affecting
 # network connectivity or core system operation. All settings are safe for
@@ -1393,7 +1369,6 @@ finish_image_post_tmpfiles_rpm() {
     _remove_unused_systemd_components_rpm "${root_fs_dir}"
     _configure_pcrlock_rpm "${root_fs_dir}"
     _configure_etcd_rpm "${root_fs_dir}"
-    _configure_flannel_services_rpm "${root_fs_dir}"
     _configure_kdump_rpm "${root_fs_dir}"
     _configure_misc_rpm "${root_fs_dir}"
     _configure_cis_hardening_rpm "${root_fs_dir}"

build_library/rpm/package_catalog.yaml

@@ -262,7 +262,6 @@ packages:
 
   # Flatcar-only packages (skipped in RPM mode)
   app-admin/etcd-wrapper: SKIP
-  app-admin/flannel-wrapper: SKIP
   app-admin/locksmith: SKIP
   app-admin/mayday: SKIP
   app-admin/sdnotify-proxy: SKIP

build_library/rpm/sysext_mangle_docker-flatcar.sh

@@ -53,27 +53,3 @@ sed -i 's|-v ${ETCD_SSL_DIR}:/etc/ssl/certs:ro|-v /etc/pki/ca-trust/extracted/pe
 mkdir -p "${rootfs}/usr/share/ca-certificates"
 ln -sf /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \
     "${rootfs}/usr/share/ca-certificates/ca-certificates.crt"
-
-# ── flannel-wrapper: Docker-based flanneld ───────────────────────────────────
-# flannel-wrapper runs flanneld in a Docker container (like etcd-wrapper).
-echo ">>> NOTICE: $0: installing flannel-wrapper (Docker-based flanneld)"
-
-flannel_wrapper_src="${script_root}/sdk_container/src/third_party/coreos-overlay/app-admin/flannel-wrapper/files"
-flannel_version="0.14.0"
-if [[ ! -d "${flannel_wrapper_src}" ]]; then
-  echo ">>> ERROR: $0: flannel-wrapper source not found at ${flannel_wrapper_src}" >&2
-  exit 1
-fi
-
-# flannel-wrapper script -> /usr/lib/flatcar/flannel-wrapper
-# (resolves via /usr/lib/coreos -> flatcar symlink created by _configure_etcd_rpm)
-cp "${flannel_wrapper_src}/flannel-wrapper" "${rootfs}/usr/lib/flatcar/flannel-wrapper"
-chmod 0755 "${rootfs}/usr/lib/flatcar/flannel-wrapper"
-# NOTE: flanneld.service and flannel-docker-opts.service are installed in the
-# rootfs by _configure_flannel_services_rpm() in build_image_util.sh. They MUST
-# be in the rootfs because Ignition needs to read their [Install] sections to
-# create enable symlinks, and Ignition runs before sysext merge.
-
-# networkd configs for flannel interfaces
-cp "${flannel_wrapper_src}/50-flannel.network" "${rootfs}/usr/lib/systemd/network/50-flannel.network"
-cp "${flannel_wrapper_src}/50-flannel.link" "${rootfs}/usr/lib/systemd/network/50-flannel.link"

sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild

@@ -81,7 +81,6 @@ RDEPEND="${RDEPEND}
 # sys-devel/gettext: it embeds 'envsubst' binary which is useful for simple file templating.
 RDEPEND="${RDEPEND}
 	app-admin/etcd-wrapper
-	app-admin/flannel-wrapper
 	app-admin/locksmith
 	app-admin/mayday
 	app-admin/sdnotify-proxy