From 1b4c8b6246ff34897816e05955261f1ad5d3d349 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Tue, 23 Jun 2026 01:19:33 +0300 Subject: [PATCH] chore(kilo): rebuild kilo image on current upstream and alpine 3.24 Rebuilds the first-party kilo image to clear the published libpng advisories carried by the stale pinned layers and to pick up current upstream: - ARG VERSION: squat/kilo main fbce60d8 -> 944dff57 (the rebuild also refreshes the golang:1.25 stdlib compiled into the kg / kgctl binaries) - runtime and cni base: alpine 3.23 -> 3.24, which clears the libpng16-16 / libpng advisories pulled in through the graphviz / font-noto chain - CNI plugins: v1.9.0 -> v1.9.1 - values.yaml: re-pinned to the rebuilt multi-arch digest; the tag handle moves from latest to v to match the sibling first-party images The in-repo cross-mesh-granularity feature patch still applies cleanly on the new HEAD and is verified in the built binary (kg --mesh-granularity lists `cross`). Adds the package's first helm-unittest coverage, pinning the image ref and the default mesh-arg wiring. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/system/kilo/Makefile | 3 + packages/system/kilo/images/kilo/Dockerfile | 8 +-- packages/system/kilo/tests/kilo_test.yaml | 66 +++++++++++++++++++++ packages/system/kilo/values.yaml | 2 +- 4 files changed, 74 insertions(+), 5 deletions(-) create mode 100644 packages/system/kilo/tests/kilo_test.yaml diff --git a/packages/system/kilo/Makefile b/packages/system/kilo/Makefile index 981d7b369..47eabe143 100644 --- a/packages/system/kilo/Makefile +++ b/packages/system/kilo/Makefile @@ -4,6 +4,9 @@ export NAMESPACE=cozy-$(NAME) include ../../../hack/common-envs.mk include ../../../hack/package.mk +test: + helm unittest . + update: sha=$$(git ls-remote https://github.com/squat/kilo refs/heads/main | awk '{print $$1}') && \ sed -i "/ARG VERSION/ s|=.*|=$${sha}|g" images/kilo/Dockerfile diff --git a/packages/system/kilo/images/kilo/Dockerfile b/packages/system/kilo/images/kilo/Dockerfile index 101863f7c..e1d5f0094 100644 --- a/packages/system/kilo/images/kilo/Dockerfile +++ b/packages/system/kilo/images/kilo/Dockerfile @@ -1,7 +1,7 @@ # Build the kg binary FROM --platform=$BUILDPLATFORM golang:1.25 AS builder -ARG VERSION=fbce60d8033da073748f5b0d6ce0f1e216f03e7f +ARG VERSION=944dff5745d747c06555a964c2137b9a986ff6ec ARG TARGETOS ARG TARGETARCH @@ -23,14 +23,14 @@ RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build \ -a -o kgctl ./cmd/kgctl # Download CNI plugins -FROM alpine:3.23 AS cni +FROM alpine:3.24 AS cni ARG TARGETARCH -ARG CNI_PLUGINS_VERSION=v1.9.0 +ARG CNI_PLUGINS_VERSION=v1.9.1 RUN apk add --no-cache curl && \ curl -Lo cni.tar.gz https://github.com/containernetworking/plugins/releases/download/$CNI_PLUGINS_VERSION/cni-plugins-linux-$TARGETARCH-$CNI_PLUGINS_VERSION.tgz && \ tar -xf cni.tar.gz -FROM alpine:3.23 +FROM alpine:3.24 RUN apk add --no-cache ipset iptables ip6tables graphviz font-noto COPY --from=cni bridge host-local loopback portmap /opt/cni/bin/ ADD https://raw.githubusercontent.com/kubernetes-sigs/iptables-wrappers/e139a115350974aac8a82ec4b815d2845f86997e/iptables-wrapper-installer.sh / diff --git a/packages/system/kilo/tests/kilo_test.yaml b/packages/system/kilo/tests/kilo_test.yaml new file mode 100644 index 000000000..d12e3a4ef --- /dev/null +++ b/packages/system/kilo/tests/kilo_test.yaml @@ -0,0 +1,66 @@ +suite: kilo DaemonSet image pin and mesh-arg wiring + +# Pins the surface this package owns on top of the vendored squat/kilo binary: +# - the kilo DaemonSet pulls the first-party image from the cozystack +# registry (repository is the load-bearing ref re-pinned by `make image`); +# - the default mesh args (location granularity, transit subnet, auto MTU, +# cni disabled, crosssubnet encapsulation) render as the kg binary expects; +# - meshGranularity plumbs through verbatim, including the `cross` value that +# the in-repo feat-add-cross-mesh-granularity.diff teaches the image to +# accept (the chart passes it straight to --mesh-granularity); +# - the cilium compatibility overlay adds --compatibility=cilium, and the +# default render carries no --compatibility arg. + +templates: + - templates/kilo.yaml + +tests: + - it: "DaemonSet pulls the first-party kilo image from the cozystack registry" + asserts: + - isKind: + of: DaemonSet + - matchRegex: + path: spec.template.spec.containers[0].image + pattern: "^ghcr\\.io/cozystack/cozystack/kilo:" + + - it: "default mesh args render as the kg binary expects" + asserts: + - contains: + path: spec.template.spec.containers[0].args + content: "--cni=false" + - contains: + path: spec.template.spec.containers[0].args + content: "--encapsulate=crosssubnet" + - contains: + path: spec.template.spec.containers[0].args + content: "--mesh-granularity=location" + - contains: + path: spec.template.spec.containers[0].args + content: "--subnet=100.66.0.0/16" + - contains: + path: spec.template.spec.containers[0].args + content: "--mtu=auto" + + - it: "meshGranularity=cross plumbs through to the patched binary" + set: + kilo: + meshGranularity: cross + asserts: + - contains: + path: spec.template.spec.containers[0].args + content: "--mesh-granularity=cross" + + - it: "cilium compatibility overlay adds --compatibility=cilium" + set: + kilo: + compatibility: cilium + asserts: + - contains: + path: spec.template.spec.containers[0].args + content: "--compatibility=cilium" + + - it: "no --compatibility arg in the default render" + asserts: + - notContains: + path: spec.template.spec.containers[0].args + content: "--compatibility=cilium" diff --git a/packages/system/kilo/values.yaml b/packages/system/kilo/values.yaml index 9645fba94..56dae259f 100644 --- a/packages/system/kilo/values.yaml +++ b/packages/system/kilo/values.yaml @@ -1,7 +1,7 @@ kilo: image: pullPolicy: IfNotPresent - tag: latest@sha256:016d054fcbb31d77ecfc8a0e7ead9f8cc01fb2f5a12b619d4fb0b7d745414df0 + tag: v1.5.0@sha256:fe837f428504f6c6e9e4582326a3bf9cd507a9cca58c975952f5cc0b34728f63 repository: ghcr.io/cozystack/cozystack/kilo transitCIDR: 100.66.0.0/16 meshGranularity: location