From 107cb7f5499c59fff8a456f11c3ee539c6026262 Mon Sep 17 00:00:00 2001
From: Aleksey Karpov <86011874+alekseyolg@users.noreply.github.com>
Date: Tue, 11 Apr 2023 12:47:18 +0300
Subject: [PATCH] Adding checksum verification kubectl (#9963)
* Adding checksum verification kubectl
Added checksum check of binary file, added PYTHONDONTWRITEBYTECODE variable to improve stability of pip after installing packages and deleting cache, added --no-compile switch to pip package installation to improve performance after deleting cache.
* Update Dockerfile
---
Dockerfile | 43 +++++++++++++++++++++++++------------------
1 file changed, 25 insertions(+), 18 deletions(-)
diff --git a/Dockerfile b/Dockerfile
index 45b89a750..51b0bf8b5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,9 +5,8 @@ FROM ubuntu:focal-20220531
# (and potentially other packages)
# See: https://github.com/pypa/pip/issues/10219
ENV LANG=C.UTF-8 \
- DEBIAN_FRONTEND=noninteractive
-ARG ARCH=amd64
-
+ DEBIAN_FRONTEND=noninteractive \
+ PYTHONDONTWRITEBYTECODE=1
WORKDIR /kubespray
COPY *yml .
COPY roles ./roles
@@ -16,19 +15,27 @@ COPY inventory ./inventory
COPY library ./library
COPY extra_playbooks ./extra_playbooks
-RUN apt update && apt install -y --no-install-recommends \
- curl python3 python3-pip sshpass vim rsync openssh-client \
- && rm -rf /var/lib/apt/lists/* /var/log/* \
- && pip install --no-cache-dir \
- ansible==5.7.1 \
- ansible-core==2.12.5 \
- cryptography==3.4.8 \
- jinja2==2.11.3 \
- netaddr==0.7.19 \
- jmespath==1.0.1 \
- MarkupSafe==1.1.1 \
- ruamel.yaml==0.17.21 \
- && find / -type d -name '*__pycache__' -prune -exec rm -rf {} \; \
+RUN apt update -q \
+ && apt install -yq --no-install-recommends \
+ curl \
+ python3 \
+ python3-pip \
+ sshpass \
+ vim \
+ rsync \
+ openssh-client \
+ && pip install --no-compile --no-cache-dir \
+ ansible==5.7.1 \
+ ansible-core==2.12.5 \
+ cryptography==3.4.8 \
+ jinja2==2.11.3 \
+ netaddr==0.7.19 \
+ jmespath==1.0.1 \
+ MarkupSafe==1.1.1 \
+ ruamel.yaml==0.17.21 \
&& KUBE_VERSION=$(sed -n 's/^kube_version: //p' roles/kubespray-defaults/defaults/main.yaml) \
- && curl -L https://storage.googleapis.com/kubernetes-release/release/$KUBE_VERSION/bin/linux/$ARCH/kubectl -o /usr/local/bin/kubectl \
- && chmod a+x /usr/local/bin/kubectl
+ && curl -L https://storage.googleapis.com/kubernetes-release/release/$KUBE_VERSION/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
+ && echo $(curl -L https://storage.googleapis.com/kubernetes-release/release/$KUBE_VERSION/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
+ && chmod a+x /usr/local/bin/kubectl \
+ && rm -rf /var/lib/apt/lists/* /var/log/* \
+ && find / -type d -name '*__pycache__' -prune -exec rm -rf {} \;
--
GitLab