diff --git a/reweave/BUILDING.md b/reweave/BUILDING.md index 10b4a1c5..9aa8618f 100644 --- a/reweave/BUILDING.md +++ b/reweave/BUILDING.md @@ -4,16 +4,21 @@ This new build process is based on a multi-stage Dockerfile, which combines the > NOTE: The new process currently does not build the weave Docker plugin. Nor does it run any tests. This may change in the future. +The new process is controlled by a Makefile, located at `reweave/Makefile`. This calls scripts located at `reweave/tools`. In the future, we should try to maintain this "harness", and only add/change the scripts as required. So, going forward, all anyone has to do is `cd reweave && make build && make scan`, no matter how the build process is evolved. + ## What you need * Docker v23.0.1 or later * An account on an image registry, like the Docker Hub +* `make` * [grype](https://github.com/anchore/grype) 0.59.0 or later for image scanning * The `tools` directory contents. Run `git submodule update --init`. -## During development +## Build steps -At the start of each development cycle, edit [reweave/Makefile](Makefile) and set `IMAGE_VERSION` should be set to something later than the currently published version, perhaps with a prerelease suffix. Also, set `REGISTRY_USER` to a your registry user account. +### During development + +At the start of each development cycle, edit [reweave/Makefile](Makefile) and set `IMAGE_VERSION` should be set to something later than the currently published version, perhaps with a prerelease suffix. Also, set `REGISTRY_USER` to *your* registry user account. After you make code or configurations changes, run the following in the `reweave` directory: @@ -31,11 +36,11 @@ make scan This will scan the images and generate reports in the [scans](scans/) directory. -## To publish images +### To publish images 1. Change `IMAGE_VERSION` and `REGISTRY_USER` variables in [reweave/Makefile](Makefile) to their final, publishable versions. 2. Build and scan as you would for development. -3. Commit and tag your changes. +3. When satisfied, commit and tag your changes. **Do this before the next steps**. 4. Login to your registry account using `docker login`. 5. Run the following: @@ -47,11 +52,13 @@ This will build multi-architecture images, and push them to your registry. Don't forget to `docker logout` afterwards. -## Multi-stage Dockerfile +## Build Artifacts + +### Multi-stage Dockerfile The Dockerfile can be found at [reweave/build/Dockerfile](build/Dockerfile). It, and the companion [Makefile](#makefile), build multi-arch images for all weave components. -### Stage 1 (builderbase) +#### Stage 1 (builderbase) The first stage creates a build environment for cross-compiling all weave net executables for all supported architectures. It is built only once for a given build platform. It starts with `golang:1.20.2-bullseye` as a base, and does the following: @@ -59,7 +66,7 @@ The first stage creates a build environment for cross-compiling all weave net ex * Adds the Debian buster repositories. This is because the last supported version of `libpcap` that allows static linking (1.8.1) is not present in the Debian bullseye repos. * Installs `libpcap-dev`, pinned to v1.8.1. -### Stage 2 (builder) +#### Stage 2 (builder) The second stage is where the weave net executables are built. It is built once for each target architecture. @@ -70,19 +77,39 @@ It starts from `builderbase` as the base, and does the following: * Downloads modules * Uses the [Makefile](#makefile) to build all weave net executables for the target architecture -### Stage 3 (alpinebase) +#### Stage 3 (alpinebase) All weave net images ultimately derive from an Alpine base image. This stage allows customization of an official Alpine image, and using the customized image as the base for the weave net images. Currently, there is no customization required. -### Subsequent stages +#### Subsequent stages Each of the subsequent stages builds one image, corresponding to one component of weave net. These start from `alpinebase`, or `weaverimage` (Stage 4) as the base, and add what executables, scripts and configuration they need from `builder`. -## Makefile +### Makefile -The [Makefile](build/Makefile) is a distilled version of the [old Makefile](../Makefile). It only builds executables. It invokes the correct C cross-compiler, and picks up the correct static `libpcap`, based on the target architecture. It is meant be used only in Stage 2 of the build process, and not directly. +The [Makefile](build/Makefile) is a distilled version of the [old Makefile](../Makefile). It only builds executables. It invokes the correct C cross-compiler, and picks up the correct static `libpcap`, based on the target architecture. **It is meant be used only in Stage 2 of the build process, and not directly.** -## build-images.sh +## Build Tools + +### reweave/Makefile + +This makefile controls the build and scan processes. It provides the following parameters: + +|Parameter|Description|Default value| +|---|---|---| +|IMAGE_VERSION|The tag part of the name (after `:`) for all weave net images.|*version set in makefile*| +|REGISTRY_USER|The account name (with optional registry name in front) used to tag all weave net images.|`weaveworks`| +|ALPINE_BASEIMAGE|The qualified name for the base Alpine image used to build all weave net images.|`alpine:3.17.2`| + +and the following targets: + +|Target|Description| +|build|Builds images matching the architecture of the local Docker engine, and loads it into the local Docker engine.| +|scan|Scans the weave-kube and weave-npc images using the configured scanner (currently grype), and stores the results in `reweave/scans`.| +|publish|Builds multi-architecture images for all configured architectures, and pushes them to the registry.| +|clean|Deletes images from the local Docker engine, and deletes scan results.| + +### reweave/tools/build-images.sh This script invokes `docker buildx build` for each stage from stage 4 onwards. By default, it builds for all supported platforms, tags the image as `weaveworks/IMAGENAME:CURRENTVERSION`, and keeps them in the build cache. This behavior can be controlled by setting the following environment variables before invoking the script. @@ -90,6 +117,18 @@ This script invokes `docker buildx build` for each stage from stage 4 onwards. B |---|---|---| |IMAGE_VERSION|The tag part of the name (after `:`) for all weave net images.|*version set in script file*| |REGISTRY_USER|The account name (with optional registry name in front) used to tag all weave net images.|`weaveworks`| +|ALPINE_BASEIMAGE|The qualified name for the base Alpine image used to build all weave net images.|`alpine:3.17.2`| |PLATFORMS|Comma-separated list of the target platforms for which the weave net images will be built.|`linux/amd64,linux/arm,linux/arm64,linux/ppc64le,linux/s390x`| |POSTBUILD|Whether to push the images after build (`--push`) , or load them to the local Docker engine (`--load`). `--load` is only possible if PLATFORMS has the same value as the build platform. If left empty, the images will be built in the build cache only.|| -|ALPINE_BASEIMAGE|The qualified name for the base Alpine image used to build all weave net images.|`alpine:3.17.2`| + +### reweave/tools/scan-images.sh + +This script scans the weave-kube and weave-npc images using grype. It saves scan results in the directory `reweave/scans`. + +### reweave/tools/clean-images.sh + +This script deletes the built images from the local Docker engine. + +### reweave/tools/clean-scans.sh + +This script clears the `reweave/scans` directory. diff --git a/reweave/CHANGELOG.md b/reweave/CHANGELOG.md index 8f9df709..0ae2ebd6 100644 --- a/reweave/CHANGELOG.md +++ b/reweave/CHANGELOG.md @@ -2,6 +2,15 @@ All changes made to the weave net codebase during the reweave effort will be documented in this file. +## 2.8.2-beta6 + +## Changed +* Alpine base image was changed to `alpine:3.17.3` + +## Fixed +* Corrections were made in `reweave/build/Dockerfile` to ensure it builds everywhere, specifically on M1 Macs too +* `ALPINE_BASEIMAGE` was added as a parameter to `reweave/Makefile`. Now all changeable parameters are in one place + ## 2.8.2-beta5 Docker, containerd and runc dependencies were upgraded here. diff --git a/reweave/Makefile b/reweave/Makefile index 326550ab..6bc7958f 100644 --- a/reweave/Makefile +++ b/reweave/Makefile @@ -1,11 +1,14 @@ -IMAGE_VERSION ?= 2.8.2-beta5 +IMAGE_VERSION ?= 2.8.2-beta6 REGISTRY_USER ?= weaveworks +ALPINE_BASEIMAGE ?= alpine:3.17.3 + # Targets .PHONY: build build: submodule REGISTRY_USER=${REGISTRY_USER} IMAGE_VERSION=${IMAGE_VERSION} \ PLATFORMS="$$(docker version -f '{{ .Server.Arch }}')" \ + ALPINE_BASEIMAGE=$(ALPINE_BASEIMAGE) \ POSTBUILD=--load \ tools/build-images.sh @@ -17,6 +20,7 @@ scan: .PHONY: publish publish: submodule REGISTRY_USER=${REGISTRY_USER} IMAGE_VERSION=${IMAGE_VERSION} \ + ALPINE_BASEIMAGE=$(ALPINE_BASEIMAGE) \ POSTBUILD=--push tools/build-images.sh .PHONY: clean-images diff --git a/reweave/README.md b/reweave/README.md index 5c1ce619..5f3a84a6 100644 --- a/reweave/README.md +++ b/reweave/README.md @@ -16,9 +16,10 @@ The current focus of this effort is running weave net as a CNI plugin on Kuberne * ~~Create a image scanning process and scan current image~~Image scanning process created, scan reports generated for 2.8.1 * ~~Create a new build process~~New build process created, documented in [BUILDING.md](BUILDING.md) * ~~Build, generate and test current images~~Built and scanned v2.8.2-beta0 -* Upgrade Go compiler version +* ~~Upgrade Go compiler version~~Go version upgraded to 1.20 * Scan images for CVEs * While there are fixable CVEs: * Upgrade dependencies using CVE list as guideline * Build, generate new images, test * Scan new images for CVEs +After a few rounds of the above, the current image version is v2.8.2-beta6, and several components have been upgraded (details in the [CHANGELOG](CHANGELOG.md)). \ No newline at end of file diff --git a/reweave/scans/images-version.txt b/reweave/scans/images-version.txt index 50b3f3a7..c66cc076 100644 --- a/reweave/scans/images-version.txt +++ b/reweave/scans/images-version.txt @@ -1 +1 @@ -Image version: 2.8.2-beta5 +Image version: 2.8.2-beta6 diff --git a/reweave/scans/weave-kube-count-vulns.txt b/reweave/scans/weave-kube-count-vulns.txt index 77900dcd..cc8f3d81 100644 --- a/reweave/scans/weave-kube-count-vulns.txt +++ b/reweave/scans/weave-kube-count-vulns.txt @@ -1 +1 @@ -weave-kube CVE Count: 4 +weave-kube CVE Count: 0 diff --git a/reweave/scans/weave-kube-list-vulns.txt b/reweave/scans/weave-kube-list-vulns.txt index 14843b52..0aac19f3 100644 --- a/reweave/scans/weave-kube-list-vulns.txt +++ b/reweave/scans/weave-kube-list-vulns.txt @@ -1,6 +1,2 @@ NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY -github.com/opencontainers/runc v1.1.4 go-module GHSA-vpvm-3wq2-2wvm High -libcrypto3 3.0.8-r0 3.0.8-r1 apk CVE-2023-0464 Unknown -libcrypto3 3.0.8-r0 3.0.8-r2 apk CVE-2023-0465 Unknown -libssl3 3.0.8-r0 3.0.8-r1 apk CVE-2023-0464 Unknown -libssl3 3.0.8-r0 3.0.8-r2 apk CVE-2023-0465 Unknown +github.com/opencontainers/runc v1.1.4 1.1.5 go-module GHSA-vpvm-3wq2-2wvm High diff --git a/reweave/scans/weave-npc-count-vulns.txt b/reweave/scans/weave-npc-count-vulns.txt index 33521d90..f1d6653e 100644 --- a/reweave/scans/weave-npc-count-vulns.txt +++ b/reweave/scans/weave-npc-count-vulns.txt @@ -1 +1 @@ -weave-npc CVE Count: 3 +weave-npc CVE Count: 0 diff --git a/reweave/scans/weave-npc-list-vulns.txt b/reweave/scans/weave-npc-list-vulns.txt index b5e4b86a..8900c02c 100644 --- a/reweave/scans/weave-npc-list-vulns.txt +++ b/reweave/scans/weave-npc-list-vulns.txt @@ -1,5 +1 @@ -NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY -libcrypto3 3.0.8-r0 3.0.8-r1 apk CVE-2023-0464 Unknown -libcrypto3 3.0.8-r0 3.0.8-r2 apk CVE-2023-0465 Unknown -libssl3 3.0.8-r0 3.0.8-r1 apk CVE-2023-0464 Unknown -libssl3 3.0.8-r0 3.0.8-r2 apk CVE-2023-0465 Unknown +No vulnerabilities found diff --git a/reweave/tools/build-images.sh b/reweave/tools/build-images.sh index ce5a80ee..4bf4b4ed 100755 --- a/reweave/tools/build-images.sh +++ b/reweave/tools/build-images.sh @@ -13,7 +13,7 @@ fi # These variables are used to control the build process # Change with care. -: "${ALPINE_BASEIMAGE:=alpine:3.17.2}" +: "${ALPINE_BASEIMAGE:=alpine:3.17.3}" : "${WEAVE_VERSION=git-$(git rev-parse --short=12 HEAD)}" : "${GIT_REVISION=$(git rev-parse HEAD)}" : "${PLATFORMS:=linux/amd64,linux/arm,linux/arm64,linux/ppc64le,linux/s390x}"