feat: migrate kubezero to containerd incl. nvidia runtime

This commit is contained in:
Stefan Reimer 2024-11-08 19:37:30 +00:00
parent cd3e76dca8
commit a2e9df177b
46 changed files with 323 additions and 20541 deletions

View File

@ -34,7 +34,7 @@ aports:
mkdir -p aports && cd aports
[ -d .git ] && git pull
[ -d .git ] || git clone https://gitlab.alpinelinux.org/alpine/aports.git .
git checkout origin/$(ALPINE_MAJOR)-stable
git checkout $(ALPINE_MAJOR)-stable
apk: packages distfiles
podman run -it --rm --platform linux/$(_ARCH) \

View File

@ -0,0 +1,133 @@
# Contributor: Jake Buchholz Göktürk <tomalok@gmail.com>
# Maintainer: Jake Buchholz Göktürk <tomalok@gmail.com>
pkgname=containerd
# NOTE: containerd's Makefile tries to get REVISION from git, but we're building from a tarball.
_commit=57f17b0a6295a39009d861b89e3b3b87b005ca27
pkgver=1.7.23
pkgrel=1337
pkgdesc="An open and reliable container runtime"
url="https://containerd.io/"
arch="all"
license="Apache-2.0"
depends="runc"
makedepends="btrfs-progs-dev go go-md2man libseccomp-dev log_proxy"
subpackages="
$pkgname-ctr
$pkgname-doc
$pkgname-stress
$pkgname-openrc
"
source="containerd-$pkgver.tar.gz::https://github.com/containerd/containerd/archive/v$pkgver.tar.gz
containerd.confd
containerd.initd
config.toml
"
options="net"
# secfixes:
# 1.6.18-r0:
# - CVE-2023-25153
# - CVE-2023-25173
# 1.6.12-r0:
# - CVE-2022-23471
# 1.6.6-r0:
# - CVE-2022-31030
# 1.6.2-r0:
# - CVE-2022-24769
# 1.6.1-r0:
# - CVE-2022-23648
# 1.5.9-r0:
# - CVE-2021-43816
# 1.5.8-r0:
# - CVE-2021-41190
# 1.5.7-r0:
# - CVE-2021-41103
# 1.5.4-r0:
# - CVE-2021-32760
# 1.4.4-r0:
# - CVE-2021-21334
# 1.4.3-r0:
# - CVE-2020-15257
# 1.3.3-r0:
# - CVE-2019-19921
# - CVE-2020-0601
# - CVE-2020-7919
# - CVE-2019-11253
# 1.3.1-r0:
# - CVE-2019-17596
# 1.3.0-r0:
# - CVE-2019-16884
# 1.2.9-r0:
# - CVE-2019-9512
# - CVE-2019-9514
# - CVE-2019-9515
# 1.2.6-r0:
# - CVE-2019-9946
export GOFLAGS="$GOFLAGS -modcacherw -mod=readonly"
export GOCACHE="${GOCACHE:-"$srcdir/go-cache"}"
export GOTMPDIR="${GOTMPDIR:-"$srcdir"}"
export GOMODCACHE="${GOMODCACHE:-"$srcdir/go"}"
build() {
export GO111MODULE=on
case "$CARCH" in loongarch64)
# upgrade ebpf for loongarch64
go get -u github.com/cilium/ebpf@v0.11.0
;;
esac
go mod tidy
make SHIM_CGO_ENABLED=1 VERSION="v$pkgver" REVISION="$_commit" BUILDMODE=pie
make man
}
check() {
./bin/containerd --version
}
package() {
install -d "$pkgdir"/usr/bin/
install -Dsm755 ./bin/* "$pkgdir"/usr/bin/
# useless binary only to make manpages
rm "$pkgdir"/usr/bin/gen-manpages
install -Dm755 "$srcdir"/$pkgname.initd \
"$pkgdir"/etc/init.d/$pkgname
install -Dm644 "$srcdir"/$pkgname.confd \
"$pkgdir"/etc/conf.d/$pkgname
install -d "$pkgdir"/usr/share/man/man5/
install -Dm644 "$builddir"/man/*.5 "$pkgdir"/usr/share/man/man5/
install -d "$pkgdir"/usr/share/man/man8/
install -Dm644 "$builddir"/man/*.8 "$pkgdir"/usr/share/man/man8/
install -d "$pkgdir"/etc/containerd/conf.d
install -Dm644 "$srcdir"/config.toml "$pkgdir"/etc/containerd/config.toml
}
openrc() {
default_openrc
depends="log_proxy"
install_if="openrc $pkgname=$pkgver-r$pkgrel"
}
ctr() {
pkgdesc="unsupported debug/admin client for containerd"
amove usr/bin/ctr
}
stress() {
pkgdesc="containerd-stress utility"
amove usr/bin/containerd-stress
}
sha512sums="
4cb003a6ef2f9fe856665c3b7099e13b23cf07c77ed9a9ed50988d74de1933e3fe9463ae123635230f25cde38cd8a487133b11e20d829a79517c4d7fbe2ce012 containerd-1.7.23.tar.gz
5fb37b88554422738cc75b944b75836c123d87d418a16c6a25b9d49da023bd0e654d1aa694e60026de42c055ccf7469f5b4778a4876e94720ec2f40d618db580 containerd.confd
8315a8d58b4ba7e19ebed2cd82c7b5eaab45da630f9818a9e6cc8f3c8e88f159432474299798f79e6e465e843c91c0f50df04030083c8913c385ea1d73e81e6a containerd.initd
dfb92fffeac35310956da6c6ad5f8c43eba3a5355ecbfabeec0f9c7445a08e309312b56b6855a17a471fd6012cc099d6abb39dc8bd26279112d0fe936624023d config.toml
"

View File

@ -0,0 +1,8 @@
version = 2
imports = ["/etc/containerd/conf.d/*.toml"]
[plugins]
[plugins."io.containerd.grpc.v1.cri"]
[plugins."io.containerd.grpc.v1.cri".cni]
bin_dir = "/usr/libexec/cni"

View File

@ -0,0 +1,47 @@
# config file for /etc/init.d/containerd
# overrides the main command executed by the supervise daemon
#containerd_command="/usr/bin/containerd"
# any other options you want to pass to containerd_command
#containerd_opts=""
# Settings for process limits (ulimit)
#ulimit_opts="-c unlimited -n 1048576 -u unlimited"
# seconds to wait for sending SIGTERM and SIGKILL signals when stopping containerd
#signal_retry="TERM/60/KILL/10"
# where containerd stdout (and perhaps stderr) goes.
#log_file="/var/log/containerd.log"
# where containerd stderr optionally goes.
# if this is not set, the value in 'logfile' is used
#err_file="/var/log/containerd-err.log"
# mode of the log files
#log_mode=0644
# user:group that owns the log files
#log_owner=root:root
# to override the default supervise_daemon_args
#supervise_daemon_args=""
# log directory (defaults to current directory)
#LOGPROXY_LOG_DIRECTORY=/var/log
# rotate when log exceeds size (bytes, 0 = no max)
#LOGPROXY_ROTATION_SIZE=104857600
# rotate log after time elapses (seconds, 0 = no max)
#LOGPROXY_ROTATION_TIME=86400
# rotated file suffix (strftime based)
#LOGPROXY_ROTATION_SUFFIX=".%Y%m%d%H%M%S"
# rotated logs to keep (0 = keep all)
#LOGPROXY_ROTATED_FILES=5
# additional log_proxy options
#LOGPROXY_OPTS=

View File

@ -0,0 +1,46 @@
#!/sbin/openrc-run
supervisor=supervise-daemon
name="Container Daemon"
description="Standalone containerd (usually started by Docker)"
extra_started_commands="reload"
description_reload="Reload configuration without exiting"
command="${containerd_command:-/usr/bin/containerd}"
command_args="${containerd_opts}"
rc_ulimit="${ulimit_opts:--c unlimited -n 1048576 -u unlimited}"
retry="${signal_retry:-TERM/60/KILL/10}"
log_file="${log_file:-/var/log/${RC_SVCNAME}.log}"
err_file="${err_file:-${log_file}}"
log_mode="${log_mode:-0644}"
log_owner="${log_owner:-root:root}"
if [ "$log_file" = "$err_file" ]; then
LOGPROXY_OPTS="$LOGPROXY_OPTS -m"
fi
export \
LOGPROXY_CHMOD="$log_mode" \
LOGPROXY_LOG_DIRECTORY="${LOGPROXY_LOG_DIRECTORY:-/var/log}" \
LOGPROXY_ROTATION_SIZE="${LOGPROXY_ROTATION_SIZE:-104857600}" \
LOGPROXY_ROTATION_TIME="${LOGPROXY_ROTATION_TIME:-86400}" \
LOGPROXY_ROTATION_SUFFIX="${LOGPROXY_ROTATION_SUFFIX:-.%Y%m%d%H%M%S}" \
LOGPROXY_ROTATED_FILES="${LOGPROXY_ROTATE_FILES:-5}"
output_logger="log_proxy $LOGPROXY_OPTS $log_file"
error_logger="log_proxy $LOGPROXY_OPTS $err_file"
depend() {
need sysfs cgroups
}
start_pre() {
checkpath -f -m "$log_mode" -o "$log_owner" "$log_file" "$err_file"
}
reload() {
ebegin "Reloading configuration"
$supervisor $RC_SVCNAME --signal HUP
eend $?
}

View File

@ -1,116 +0,0 @@
# Contributor: ungleich <foss@ungleich.ch>
# Contributor: Francesco Colista <fcolista@alpinelinux.org>
# Contributor: TBK <alpine@jjtc.eu>
# Maintainer: ungleich <foss@ungleich.ch>
pkgname=cri-o
pkgver=1.30.6
pkgrel=0
pkgdesc="OCI-based implementation of Kubernetes Container Runtime Interface"
url="https://github.com/cri-o/cri-o/"
arch="all"
license="Apache-2.0"
# Most tests will fail if not ran as root
# since it tries to create network interfaces
options="net chmod-clean !check"
depends="
cni-plugins
conmon
conntrack-tools
containers-common
iproute2
iptables
oci-runtime
"
makedepends="
bash
btrfs-progs-dev
eudev-dev
glib-dev
go
go-md2man
gpgme-dev
libseccomp-dev
libselinux-dev
lvm2-dev
ostree-dev
sqlite-dev
tzdata
"
checkdepends="bats cri-tools jq parallel sudo conmon"
subpackages="
$pkgname-doc
$pkgname-bash-completion
$pkgname-zsh-completion
$pkgname-fish-completion
$pkgname-openrc
"
#$pkgname-fish-completion
source="
$pkgname-$pkgver.tar.gz::https://github.com/cri-o/cri-o/archive/v$pkgver/cri-o-$pkgver.tar.gz
crio.conf
crio.initd
crio.logrotated
cni-plugins-path.patch
makefile-fix-install.patch
fix-test.patch
remove-systemd-files.patch
crictl.yaml
"
# secfixes:
# 1.23.2-r0:
# - CVE-2022-0811
# 1.24.1-r0:
# - CVE-2022-1708
# 1.26.2-r0:
# - CVE-2022-4318
export GOCACHE="${GOCACHE:-"$srcdir/go-cache"}"
export GOTMPDIR="${GOTMPDIR:-"$srcdir"}"
export GOMODCACHE="${GOMODCACHE:-"$srcdir/go"}"
export GOBIN="$GOPATH/bin"
build() {
# https://github.com/cri-o/cri-o/blob/master/install.md#build-tags
make BUILDTAGS="libsqlite3 seccomp selinux apparmor containers_image_openpgp containers_image_ostree_stub"
}
check() {
make localintegration
}
package() {
make \
DESTDIR="$pkgdir" \
PREFIX=/usr \
CRICTL_CONFIG_DIR="/etc/crio" \
OCIUMOUNTINSTALLDIR="/etc/crio" \
FISHINSTALLDIR=/usr/share/fish/vendor_completions.d \
install.bin-nobuild install.man-nobuild install.completions install.config-nobuild
# We want it in etc so apk does not overwrite it
mkdir -p "$pkgdir"/usr/share/oci-umount/oci-umount.d/
ln -sf ../../../../etc/crio/crio-umount.conf "$pkgdir"/usr/share/oci-umount/oci-umount.d/crio-umount.conf
# The CNI plugins are recommended to be installed as examples
install -Dm644 contrib/cni/*.conflist -t "$pkgdir"/usr/share/doc/cri-o/examples/cni/
install -Dm755 "$srcdir"/crio.initd "$pkgdir"/etc/init.d/crio
install -Dm644 "$srcdir"/crio.conf "$pkgdir"/etc/crio/crio.conf
install -Dm644 "$srcdir"/crio.logrotated "$pkgdir"/etc/logrotate.d/crio
install -Dm644 "$srcdir"/crictl.yaml "$pkgdir"/etc/crictl.yaml
}
sha512sums="
3e8e3422a0fac9b603775a9b05626134b0e8b37425ddbbf39e155283ecdc7ac50184bb578179bc25585711286320034251318c599039d3b539d0f4d7f334c341 cri-o-1.30.6.tar.gz
469eddef2e7b24f3ac7b192da3851ada7332f8f93cd4503d8c4d62cc39f669d7893e69c654bc2d86e3d89919fa6da765a393576bcdeb94f1a024bec4fa5cbe2f crio.conf
e9149cc2ddd24328c5290d3aea895c01e2798e066897535384f615a556496acdd52a603a0f4ac3c4c70bd5c363592f23c8b4d1987bf738300112fc62e1def555 crio.initd
1115228546a696eeebeb6d4b3e5c3152af0c99a2559097fc5829d8b416d979c457b4b1789e0120054babf57f585d3f63cbe49949d40417ae7aab613184bf4516 crio.logrotated
0a567dfa431ab1e53f2a351689be8d588a60cc5fcdbda403ec4f8b6ab9b1c18ad425f6c47f9a5ab1491e3a61a269dc4efa6a59e91e7521fa2b6bb165074aa8e0 cni-plugins-path.patch
09025bff1fed5004a15696cbc7c63260ae7c206ffe2c8506e6063e8889b7aa98bd5c7df2f0c109860d8432ddf5f3b6326dbfd46589d05cf87f26c38e4bdadb9c makefile-fix-install.patch
b0fdaf2280968a69e05ef72288bbf6fc03787616c6b6fca1e4398f9849167f4773e5e6e72bf1738d1fff2a84e97aa00f23aabcd50898ba8ed130969f50363006 fix-test.patch
ae7e4a43f18076f19f3ae37d7302bfdf7a3befadf33e46bc9b1b14d50b605e8ba0d06d479568c24e8bf68f17c80ae48798068b2a46c3bcab565a5d225779f30e remove-systemd-files.patch
79e1a7c6183ba56f55d923e9d738be945564494042bc011d31e9195f66c268d702ee5c86711d4b46618285fc1b10b59ea55c321390feca770cfc7de334e103bd crictl.yaml
"

View File

@ -1,23 +0,0 @@
Alpine's cni-plugins are installs at /usr/libexec/cni/
--- a/docs/crio.conf.5.md
+++ b/docs/crio.conf.5.md
@@ -301,7 +301,7 @@
**network_dir**="/etc/cni/net.d/"
Path to the directory where CNI configuration files are located.
-**plugin_dirs**=["/opt/cni/bin/",]
+**plugin_dirs**=["/usr/libexec/cni/",]
List of paths to directories where CNI plugin binaries are located.
## CRIO.METRICS TABLE
--- a/pkg/config/config_unix.go
+++ b/pkg/config/config_unix.go
@@ -5,7 +5,7 @@
// Defaults for linux/unix if none are specified
const (
cniConfigDir = "/etc/cni/net.d/"
- cniBinDir = "/opt/cni/bin/"
+ cniBinDir = "/usr/libexec/cni/"
containerExitsDir = "/var/run/crio/exits"
ContainerAttachSocketDir = "/var/run/crio"

View File

@ -1,5 +0,0 @@
# runtime entpoint, see https://github.com/kubernetes/enhancements/issues/2371 might be fixed with 1.29 ?
runtime-endpoint: unix:///run/crio/crio.sock
image-endpoint: unix:///var/run/crio/crio.sock
timeout: 60
debug: false

View File

@ -1,10 +0,0 @@
[crio.runtime]
cgroup_manager = "cgroupfs"
default_runtime = "crun"
[crio.runtime.runtimes.crun]
runtime_path = "/usr/bin/crun"
runtime_type = "oci"
runtime_root = "/run/crun"
monitor_cgroup = "pod"
monitor_exec_cgroup = "container"

View File

@ -1,40 +0,0 @@
#!/sbin/openrc-run
# Copyright 2015-2019 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
description="OCI Kubernetes Container Runtime daemon"
pidfile=${pidfile:-"/run/${RC_SVCNAME}.pid"}
extra_started_commands="reload"
command="/usr/bin/${RC_SVCNAME}"
command_args="${command_args}"
command_background="true"
# We run all containers with nice level 1
start_stop_daemon_args="-N 1 \
--stdout /var/log/${RC_SVCNAME}/${RC_SVCNAME}.log \
--stderr /var/log/${RC_SVCNAME}/${RC_SVCNAME}.log"
depend() {
need net
use dns
}
checkconfig() {
checkpath --directory --owner root:root --mode 0775 \
/var/log/${RC_SVCNAME}
checkpath --file --owner root:root --mode 0644 \
/var/log/${RC_SVCNAME}/${RC_SVCNAME}.log
checkpath --directory --owner root:root --mode 0750 \
/var/lib/crio
}
start() {
checkconfig
default_start
}
reload() {
ebegin "Reloading ${RC_SVCNAME}"
start-stop-daemon --signal HUP --pidfile "${pidfile}"
eend $?
}

View File

@ -1,7 +0,0 @@
/var/log/crio/crio.log {
missingok
size 5M
rotate 3
compress
copytruncate
}

View File

@ -1,72 +0,0 @@
diff --git a/test/cgroups.bats b/test/cgroups.bats
index 8beb6f06..80193413 100644
--- a/test/cgroups.bats
+++ b/test/cgroups.bats
@@ -45,6 +45,10 @@ EOF
}
@test "conmon pod cgroup" {
+ if [[ "$CONTAINER_CGROUP_MANAGER" != "systemd" ]]; then
+ skip "need systemd cgroup manager"
+ fi
+
CONTAINER_CGROUP_MANAGER="systemd" CONTAINER_DROP_INFRA_CTR=false CONTAINER_CONMON_CGROUP="pod" start_crio
jq ' .linux.cgroup_parent = "Burstablecriotest123.slice"' \
@@ -61,6 +65,10 @@ EOF
skip "not yet supported by conmonrs"
fi
+ if [[ "$CONTAINER_CGROUP_MANAGER" != "systemd" ]]; then
+ skip "need systemd cgroup manager"
+ fi
+
CONTAINER_CGROUP_MANAGER="systemd" CONTAINER_DROP_INFRA_CTR=false CONTAINER_CONMON_CGROUP="customcrioconmon.slice" start_crio
jq ' .linux.cgroup_parent = "Burstablecriotest123.slice"' \
@@ -77,6 +85,10 @@ EOF
skip "not supported for conmon"
fi
+ if [[ "$CONTAINER_CGROUP_MANAGER" != "systemd" ]]; then
+ skip "need systemd cgroup manager"
+ fi
+
configure_monitor_cgroup_for_conmonrs "customcrioconmon.slice"
CONTAINER_CGROUP_MANAGER="systemd" CONTAINER_DROP_INFRA_CTR=true start_crio
diff --git a/test/cni_plugin_helper.bash b/test/cni_plugin_helper.bash
index 04492172..abae521e 100755
--- a/test/cni_plugin_helper.bash
+++ b/test/cni_plugin_helper.bash
@@ -48,7 +48,7 @@ EOT
. "$TEST_DIR"/cni_plugin_helper_input.env
rm -f "$TEST_DIR"/cni_plugin_helper_input.env
-result=$(/opt/cni/bin/bridge "$@") || exit $?
+result=$(/usr/libexec/cni/bridge "$@") || exit $?
if [[ "${DEBUG_ARGS}" == "malformed-result" ]]; then
cat <<-EOF
diff --git a/test/common.sh b/test/common.sh
index f7f8e1f2..45b7dd58 100644
--- a/test/common.sh
+++ b/test/common.sh
@@ -41,7 +41,7 @@ # CNI path
if command -v host-local >/dev/null; then
CONTAINER_CNI_PLUGIN_DIR=${CONTAINER_CNI_PLUGIN_DIR:-$(dirname "$(readlink "$(command -v host-local)")")}
else
- CONTAINER_CNI_PLUGIN_DIR=${CONTAINER_CNI_PLUGIN_DIR:-/opt/cni/bin}
+ CONTAINER_CNI_PLUGIN_DIR=${CONTAINER_CNI_PLUGIN_DIR:-/usr/libexec/cni}
fi
# Runtime
CONTAINER_DEFAULT_RUNTIME=${CONTAINER_DEFAULT_RUNTIME:-runc}
@@ -74,7 +74,7 @@ CHECKCRIU_BINARY=${CHECKCRIU_BINARY:-${CRIO_ROOT}/test/checkcriu/checkcriu}
# The default log directory where all logs will go unless directly specified by the kubelet
DEFAULT_LOG_PATH=${DEFAULT_LOG_PATH:-/var/log/crio/pods}
# Cgroup manager to be used
-CONTAINER_CGROUP_MANAGER=${CONTAINER_CGROUP_MANAGER:-systemd}
+CONTAINER_CGROUP_MANAGER=${CONTAINER_CGROUP_MANAGER:-cgroupfs}
# Image volumes handling
CONTAINER_IMAGE_VOLUMES=${CONTAINER_IMAGE_VOLUMES:-mkdir}
# Container pids limit

View File

@ -1,122 +0,0 @@
--- a/Makefile
+++ b/Makefile
@@ -9,11 +9,11 @@
PROJECT := github.com/cri-o/cri-o
CRIO_INSTANCE := crio_dev
-PREFIX ?= ${DESTDIR}/usr/local
+PREFIX ?= /usr/local
BINDIR ?= ${PREFIX}/bin
LIBEXECDIR ?= ${PREFIX}/libexec
MANDIR ?= ${PREFIX}/share/man
-ETCDIR ?= ${DESTDIR}/etc
+ETCDIR ?= /etc
ETCDIR_CRIO ?= ${ETCDIR}/crio
DATAROOTDIR ?= ${PREFIX}/share/containers
BUILDTAGS ?= containers_image_ostree_stub \
@@ -26,7 +26,7 @@
$(shell hack/seccomp_tag.sh) \
$(shell hack/selinux_tag.sh) \
$(shell hack/libsubid_tag.sh)
-CRICTL_CONFIG_DIR=${DESTDIR}/etc
+CRICTL_CONFIG_DIR = /etc
CONTAINER_RUNTIME ?= podman
BUILD_PATH := $(shell pwd)/build
BUILD_BIN_PATH := ${BUILD_PATH}/bin
@@ -420,60 +420,62 @@
install: install.bin install.man install.completions install.systemd install.config
install.bin-nobuild:
- install ${SELINUXOPT} -D -m 755 bin/crio $(BINDIR)/crio
- install ${SELINUXOPT} -D -m 755 bin/pinns $(BINDIR)/pinns
+ install ${SELINUXOPT} -D -m 755 bin/crio ${DESTDIR}$(BINDIR)/crio
+ install ${SELINUXOPT} -D -m 755 bin/pinns ${DESTDIR}$(BINDIR)/pinns
install.bin: binaries install.bin-nobuild
install.man-nobuild:
- install ${SELINUXOPT} -d -m 755 $(MANDIR)/man5
- install ${SELINUXOPT} -d -m 755 $(MANDIR)/man8
- install ${SELINUXOPT} -m 644 $(filter %.5,$(MANPAGES)) -t $(MANDIR)/man5
- install ${SELINUXOPT} -m 644 $(filter %.8,$(MANPAGES)) -t $(MANDIR)/man8
+ install ${SELINUXOPT} -d -m 755 ${DESTDIR}$(MANDIR)/man5
+ install ${SELINUXOPT} -d -m 755 ${DESTDIR}$(MANDIR)/man8
+ install ${SELINUXOPT} -m 644 $(filter %.5,$(MANPAGES)) -t ${DESTDIR}$(MANDIR)/man5
+ install ${SELINUXOPT} -m 644 $(filter %.8,$(MANPAGES)) -t ${DESTDIR}$(MANDIR)/man8
install.man: $(MANPAGES) install.man-nobuild
install.config-nobuild:
- install ${SELINUXOPT} -d $(DATAROOTDIR)/oci/hooks.d
- install ${SELINUXOPT} -d $(ETCDIR_CRIO)/crio.conf.d
- install ${SELINUXOPT} -D -m 644 crio.conf $(ETCDIR_CRIO)/crio.conf
- install ${SELINUXOPT} -D -m 644 crio-umount.conf $(OCIUMOUNTINSTALLDIR)/crio-umount.conf
- install ${SELINUXOPT} -D -m 644 crictl.yaml $(CRICTL_CONFIG_DIR)
+ install ${SELINUXOPT} -d ${DESTDIR}$(ETCDIR_CRIO)/crio.conf.d
+ install ${SELINUXOPT} -d ${DESTDIR}$(ETCDIR)/containers/oci/hooks.d
+ install ${SELINUXOPT} -d ${DESTDIR}$(DATAROOTDIR)/oci/hooks.d
+ install ${SELINUXOPT} -D -m 644 crio.conf ${DESTDIR}$(ETCDIR_CRIO)/crio.conf
+ install ${SELINUXOPT} -D -m 644 crio-umount.conf ${DESTDIR}$(OCIUMOUNTINSTALLDIR)/crio-umount.conf
+ install ${SELINUXOPT} -D -m 644 crictl.yaml ${DESTDIR}$(CRICTL_CONFIG_DIR)
install.config: crio.conf install.config-nobuild
install.completions:
- install ${SELINUXOPT} -d -m 755 ${BASHINSTALLDIR}
- install ${SELINUXOPT} -d -m 755 ${FISHINSTALLDIR}
- install ${SELINUXOPT} -d -m 755 ${ZSHINSTALLDIR}
- install ${SELINUXOPT} -D -m 644 -t ${BASHINSTALLDIR} completions/bash/crio
- install ${SELINUXOPT} -D -m 644 -t ${FISHINSTALLDIR} completions/fish/crio.fish
- install ${SELINUXOPT} -D -m 644 -t ${ZSHINSTALLDIR} completions/zsh/_crio
+ install ${SELINUXOPT} -d -m 755 ${DESTDIR}${BASHINSTALLDIR}
+ install ${SELINUXOPT} -d -m 755 ${DESTDIR}${FISHINSTALLDIR}
+ install ${SELINUXOPT} -d -m 755 ${DESTDIR}${ZSHINSTALLDIR}
+ install ${SELINUXOPT} -D -m 644 -t ${DESTDIR}${BASHINSTALLDIR} completions/bash/crio
+ install ${SELINUXOPT} -D -m 644 -t ${DESTDIR}${FISHINSTALLDIR} completions/fish/crio.fish
+ install ${SELINUXOPT} -D -m 644 -t ${DESTDIR}${ZSHINSTALLDIR} completions/zsh/_crio
install.systemd:
- install ${SELINUXOPT} -D -m 644 contrib/systemd/crio.service $(PREFIX)/lib/systemd/system/crio.service
- install ${SELINUXOPT} -D -m 644 contrib/systemd/crio-wipe.service $(PREFIX)/lib/systemd/system/crio-wipe.service
+ install ${SELINUXOPT} -D -m 644 contrib/systemd/crio.service ${DESTDIR}$(PREFIX)/lib/systemd/system/crio.service
+ install ${SELINUXOPT} -D -m 644 contrib/systemd/crio-wipe.service ${DESTDIR}$(PREFIX)/lib/systemd/system/crio-wipe.service
uninstall:
- rm -f $(BINDIR)/crio
- rm -f $(BINDIR)/pinns
+ rm -f $(DESTDIR)$(BINDIR)/crio
+ rm -f $(DESTDIR)$(BINDIR)/pinns
for i in $(filter %.5,$(MANPAGES)); do \
- rm -f $(MANDIR)/man5/$$(basename $${i}); \
+ rm -f $(DESTDIR)$(MANDIR)/man5/$$(basename $${i}); \
done
for i in $(filter %.8,$(MANPAGES)); do \
- rm -f $(MANDIR)/man8/$$(basename $${i}); \
+ rm -f $(DESTDIR)$(MANDIR)/man8/$$(basename $${i}); \
done
- rm -f ${BASHINSTALLDIR}/crio
- rm -f ${FISHINSTALLDIR}/crio.fish
- rm -f ${ZSHINSTALLDIR}/_crio
- rm -f $(PREFIX)/lib/systemd/system/crio-wipe.service
- rm -f $(PREFIX)/lib/systemd/system/crio.service
- rm -f $(PREFIX)/lib/systemd/system/cri-o.service
- rm -rf $(DATAROOTDIR)/oci/hooks.d
- rm -f $(ETCDIR_CRIO)/crio.conf
- rm -rf $(ETCDIR_CRIO)/crio.conf.d
- rm -f $(OCIUMOUNTINSTALLDIR)/crio-umount.conf
- rm -f $(CRICTL_CONFIG_DIR)/crictl.yaml
+ rm -f $(DESTDIR)${BASHINSTALLDIR}/crio
+ rm -f $(DESTDIR)${FISHINSTALLDIR}/crio.fish
+ rm -f $(DESTDIR)${ZSHINSTALLDIR}/_crio
+ rm -f $(DESTDIR)$(PREFIX)/lib/systemd/system/crio-wipe.service
+ rm -f $(DESTDIR)$(PREFIX)/lib/systemd/system/crio.service
+ rm -f $(DESTDIR)$(PREFIX)/lib/systemd/system/cri-o.service
+ rm -f $(DESTDIR)$(ETCDIR_CRIO)/crio.conf
+ rm -rf $(DESTDIR)$(ETCDIR_CRIO)/crio.conf.d
+ rm -rf $(DESTDIR)$(ETCDIR)/containers/oci/hooks.d
+ rm -rf $(DESTDIR)$(DATAROOTDIR)/oci/hooks.d
+ rm -f $(DESTDIR)$(OCIUMOUNTINSTALLDIR)/crio-umount.conf
+ rm -f $(DESTDIR)$(CRICTL_CONFIG_DIR)/crictl.yaml
docs-validation:
$(GO_RUN) -tags "$(BUILDTAGS)" ./test/docs-validation

View File

@ -1,13 +0,0 @@
diff --git a/Makefile b/Makefile
index 19f8052..135385c 100644
--- a/Makefile
+++ b/Makefile
@@ -403,7 +403,7 @@ get-script:
sed -i '/# INCLUDE/q' scripts/get
cat contrib/bundle/install-paths contrib/bundle/install >> scripts/get
-install: install.bin install.man install.completions install.systemd install.config
+install: install.bin install.man install.completions install.config
install.bin-nobuild:
install ${SELINUXOPT} -D -m 755 bin/crio $(BINDIR)/crio

View File

@ -228,7 +228,7 @@ d7e022ee22da191bda7382f87cb293d9c9d115a3df0c2054bf918279eb866f99c6d5c21e4c98eae8
561bef5633ba4b9021720624443d9c279a561e5fabea76e5d0fbee2e7ad8999029a2511a45895fbec8448026212a3c5b4c197b248a6afa7f8bd945f705524ea7 kube-scheduler.initd
af88b382ab75657d0ff13c3f8f6d924cef9f2df7807a9a27daa63495981801bc4b607998f65c0758c11a7e070e43c24f7184ba7720711109c74b1c4d57919e34 kube-scheduler.confd
3692da349dd6ed0f5acc09d7b95ac562ffecb103e2270bebdfe4a7808d48dada9d2debff262d85b11c47f9ca3f0c20000712d03629ed813ff08a3e02d69267e6 kube-scheduler.logrotated
372cdf2fbb24a229ed7b3450b54197c006928cb8d2fd756f2713e1e6961849c7aaa35b20b14fb75d1a12ef1e35258048738aa22b5f9783af8fa0a31dfd1b5bbd kubelet.initd
dc0888af4b0083b0de335122cd0715854a505c1c7ba3298f1461a3d5dbdbd6cc2e925298856f923f65fa4004687df2fdac10433836f343929183c26466b54f00 kubelet.initd
cc4fd92a9f288336cf204a38d6913ca25e20b78d0c4abb74b6b2b8cf634d7df774144bde1101048d9d9ab0f140ffb62ce31cf3bb2a69ddeadd04c273dfcb58a0 kubelet.confd
941f4a7579dcf78da2d323ac69195e95eba6600e6fcefe9231447f11c9867a7aa57b4189ee1fefb10eab19c89665ea2e7696b539c92e99fbcde905d2ff85be58 kubelet.logrotated
"

View File

@ -25,5 +25,5 @@ pidfile="${KUBELET_PIDFILE:-/run/${RC_SVCNAME}.pid}"
depend() {
after net cloudbender
need cgroups
want containerd crio
want containerd
}

View File

@ -2,7 +2,7 @@
# Maintainer: Stefan Reimer <stefan@zero-downtime.net>
pkgname=kubezero
pkgver=1.30.6
_crio=1.30.6
_containerd=1.7.23-r1337
_ecr=1.30.3
pkgrel=0
@ -10,11 +10,15 @@ pkgdesc="KubeZero release package"
url="https://git.zero-downtime.net/ZeroDownTime/alpine-overlay/src/branch/master/kubezero/kubezero"
arch="x86_64"
license="AGPL-3.0"
makedepends="podman"
depends="
podman
xz
cri-tools
cri-o~$_crio
crun
containerd=$_containerd
containerd-ctr=$_containerd
nerdctl
kubelet~$pkgver
kubectl~$pkgver
ecr-credential-provider~$_ecr
@ -39,12 +43,12 @@ source="
evictLocalNode.sh
credential-provider.yaml
kubelet.monit
crio.monit
crio.conf
containerd.conf
crictl.yaml
"
#multus-"$multus_version".tar.gz::https://github.com/k8snetworkplumbingwg/multus-cni/releases/download/v"$multus_version"/multus-cni_"$multus_version"_linux_amd64.tar.gz
# get multus and cilium binaries and drop them in /usr/libexec/cni
# preinstall multus and cilium images
build() {
# pre loaded images
for i in $IMAGES; do
@ -61,12 +65,14 @@ package() {
mkdir -p $pkgdir/etc/kubernetes/manifests
install -Dm644 "$srcdir"/credential-provider.yaml "$pkgdir/etc/kubernetes/credential-provider.yaml"
# crio settings
install -Dm644 "$srcdir"/crio.conf "$pkgdir/etc/crio/crio.conf.d/01-kubezero.conf"
# containerd settings
install -Dm644 "$srcdir"/containerd.conf "$pkgdir/etc/containerd/conf.d/kubezero.toml"
# crictl
install -Dm644 "$srcdir"/crictl.yaml "$pkgdir/etc/crictl.yaml"
# monit
install -Dm644 "$srcdir"/kubelet.monit "$pkgdir/etc/monit.d/kubelet.conf"
install -Dm644 "$srcdir"/crio.monit "$pkgdir/etc/monit.d/crio.conf"
# multus
#install -Dm755 "$srcdir"/multus-cni_"$multus_version"_linux_amd64/multus $pkgdir/usr/libexec/cni/multus
@ -87,6 +93,6 @@ ecb33fc3a0ffc378723624858002f9f5e180e851b55b98ab6611ecc6a73d4719bc7de240f87683fc
fce1013f7b1bfa8ee526de62e642a37fda3168889723e873d3fb69e257f4caa1423b5a14b9343b12a87f3b6f93c7d3861b854efda67ef2d6a42a5ca8cf3d1593 evictLocalNode.sh
92499ec9a8b3634c42b16c01d27f1c1bb650bcc074a2c8d9d16cfe2ea08942948989c6aae79bd2df562ff17df11bbc329e0971f15c4e64f944457825dee7aa79 credential-provider.yaml
8b81eb0fb66e6a739965db6af6a31c443e8f612c06146bd51107372abd833b527423299ee11b27e011f46cfbee11415234b3fa0dea695dbbb06711e0ad58f08d kubelet.monit
e801df9ede6065395db75154735ca9368882d4225452a33f2b54b98cd0c4f3ceb730762d8745c6aea350a3a50a1df0c79ab46f422f94e9a40e621528e9d82055 crio.monit
064fc245b7ffd67834a2f5fd13cb0bcb5f4a5caf79b8113b3669bf1d0e1a4af2042e69f8f496991de76d621fd01bc7e67de37c59f034584d12622c6af96376ff crio.conf
001a34dcbfafb7f66c6b91d8de249a990d627f6dc5133a4e56e2cc357495dad333e03be408ee0d118ed99dba9d9a17d02165c336893b6bf51f689378ccc5de42 containerd.conf
b112ffd86f095aec47bf75179659af20720792c453d6cc9d11db26446aa2f3c237fe59b793dd8ef3ee93f6fd4230ff8abadfdada76e6452779b982a71eb37cb9 crictl.yaml
"

View File

@ -0,0 +1,39 @@
version = 2
oom_score = -999
[plugins]
[plugins."io.containerd.grpc.v1.cri"]
enable_cdi = true
sandbox_image = "registry.k8s.io/pause:3.9"
tolerate_missing_hugetlb_controller = false
[plugins."io.containerd.grpc.v1.cri".cni]
bin_dir = "/usr/libexec/cni"
[plugins."io.containerd.grpc.v1.cri".containerd]
default_runtime_name = "crun"
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.crun]
runtime_type = "io.containerd.runc.v2"
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.crun.options]
BinaryName = "/usr/bin/crun"
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.nvidia]
runtime_type = "io.containerd.runc.v2"
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.nvidia.options]
BinaryName = "/usr/bin/nvidia-container-runtime"
[plugins."io.containerd.grpc.v1.cri".registry]
config_path = "/etc/containerd/certs.d"
[plugins."io.containerd.runtime.v1.linux"]
runtime = "crun"
[plugins."io.containerd.monitor.v1.cgroups"]
no_prometheus = true

View File

@ -0,0 +1 @@
runtime-endpoint: unix:///run/containerd/containerd.sock

View File

@ -1,8 +0,0 @@
[crio.metrics]
enable_metrics = true
[crio.runtime]
default_ulimits = [ "nofile=65535:65535", "memlock=-1:-1" ]
[crio.network]
cni_default_network="multus-cni-network"

View File

@ -1,4 +0,0 @@
check process crio pidfile /run/crio.pid
start program = "/sbin/rc-service crio start"
stop program = "/sbin/rc-service crio stop"
restart program = "/sbin/rc-service crio restart"

View File

@ -1,28 +0,0 @@
From b4d7a16d2b76e09ec88ff53a86f6e263c329e160 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 28 Nov 2023 14:35:54 +0100
Subject: [PATCH 1/5] powerpc/boot/wrapper: Add "-z notext" flag for ppc64le
This is a follow up to commit 4c078c86b4a4 (powerpc/boot/wrapper: Add
"-z notext" flag to disable diagnostic)
Ref: https://gitlab.alpinelinux.org/alpine/aports/-/issues/14560
---
arch/powerpc/boot/wrapper | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/powerpc/boot/wrapper b/arch/powerpc/boot/wrapper
index 352d7de24018..ceaef956f821 100755
--- a/arch/powerpc/boot/wrapper
+++ b/arch/powerpc/boot/wrapper
@@ -268,6 +268,7 @@ pseries)
if [ "$format" != "elf32ppc" ]; then
link_address=
pie=-pie
+ notext='-z notext'
fi
make_space=n
;;
--
2.43.0

View File

@ -1,30 +0,0 @@
From b7a5aef6b0d761be21e8df6cd11a963f762768ea Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 13 Dec 2022 16:45:51 +0100
Subject: [PATCH 2/5] x86: Compress vmlinux with zstd -19 instead of -22
This gives slightly bigger kernel but it avoids run out of memory on 32
bit kernels with the error:
zstd kernel compression error 11
https://forums.gentoo.org/viewtopic-p-8641020.html#8641020
---
arch/x86/boot/compressed/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index 71fc531b95b4..260d38e772b0 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -147,7 +147,7 @@ $(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y) FORCE
$(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y) FORCE
$(call if_changed,lz4_with_size)
$(obj)/vmlinux.bin.zst: $(vmlinux.bin.all-y) FORCE
- $(call if_changed,zstd22_with_size)
+ $(call if_changed,zstd_with_size)
suffix-$(CONFIG_KERNEL_GZIP) := gz
suffix-$(CONFIG_KERNEL_BZIP2) := bz2
--
2.43.0

View File

@ -1,36 +0,0 @@
From cf29b5a58ef88adf96317c3c933a16f9c865e09a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 14 Jul 2022 13:23:51 +0200
Subject: [PATCH 3/5] kexec: add kexec_load_disabled boot option
Make kexec_load disabled by default and add a boot option to enable it:
kexec_load_disabled=0
---
kernel/kexec_core.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
index 9dc728982d79..7650ffe5631e 100644
--- a/kernel/kexec_core.c
+++ b/kernel/kexec_core.c
@@ -942,7 +942,16 @@ static struct kexec_load_limit load_limit_panic = {
struct kimage *kexec_image;
struct kimage *kexec_crash_image;
-static int kexec_load_disabled;
+static int kexec_load_disabled = 1;
+
+static int __init kexec_load_disabled_setup(char *str)
+{
+ unsigned long disabled;
+ if (!kstrtoul(str, 0, &disabled))
+ kexec_load_disabled = disabled ? 1 : 0;
+ return 1;
+}
+__setup("kexec_load_disabled=", kexec_load_disabled_setup);
#ifdef CONFIG_SYSCTL
static int kexec_limit_handler(struct ctl_table *table, int write,
--
2.43.0

View File

@ -1,26 +0,0 @@
From dc34b09b20b7aa88ca55742a113d223f33c09c32 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 28 Nov 2023 14:22:46 +0100
Subject: [PATCH 4/5] objtool: respect AWK setting
AWK= is not passed on as an makefile argument so we need pass it as an env.
---
tools/objtool/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile
index 83b100c1e7f6..6ccddfa6de4f 100644
--- a/tools/objtool/Makefile
+++ b/tools/objtool/Makefile
@@ -42,7 +42,7 @@ OBJTOOL_CFLAGS += $(if $(elfshdr),,-DLIBELF_USE_DEPRECATED)
# Always want host compilation.
HOST_OVERRIDES := CC="$(HOSTCC)" LD="$(HOSTLD)" AR="$(HOSTAR)"
-AWK = awk
+AWK ?= awk
MKDIR = mkdir
ifeq ($(V),1)
--
2.43.0

View File

@ -1,35 +0,0 @@
From 0306d648bbd12489c9ffbe8f5bd9cc82fa5eadd8 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@dereferenced.org>
Date: Tue, 18 Feb 2020 21:10:22 +0000
Subject: [PATCH 5/5] powerpc: config: defang gcc check for stack-protector
support
When we rebase kernel configs in Alpine, it is common to do so from
an environment where CARCH does not match CHOST.
Accordingly, we assume that the gcc check will always pass, and
simply remove it in preference for always enabling the
HAVE_STACKPROTECTOR config option.
Signed-off-by: Ariadne Conill <ariadne@dereferenced.org>
---
arch/powerpc/Kconfig | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index d5d5388973ac..0ba9d88de22f 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -271,8 +271,7 @@ config PPC
select HAVE_RSEQ
select HAVE_SETUP_PER_CPU_AREA if PPC64
select HAVE_SOFTIRQ_ON_OWN_STACK
- select HAVE_STACKPROTECTOR if PPC32 && $(cc-option,-mstack-protector-guard=tls -mstack-protector-guard-reg=r2)
- select HAVE_STACKPROTECTOR if PPC64 && $(cc-option,-mstack-protector-guard=tls -mstack-protector-guard-reg=r13)
+ select HAVE_STACKPROTECTOR
select HAVE_STATIC_CALL if PPC32
select HAVE_SYSCALL_TRACEPOINTS
select HAVE_VIRT_CPU_ACCOUNTING
--
2.43.0

View File

@ -1,38 +0,0 @@
diff --git a/net/netfilter/xt_NFLOG.c b/net/netfilter/xt_NFLOG.c
index d80abd6ccaf8f71fa70605fef7edada827a19ceb..6dcf4bc7e30b2ae364a1cd9ac8df954a90905c52 100644
--- a/net/netfilter/xt_NFLOG.c
+++ b/net/netfilter/xt_NFLOG.c
@@ -79,7 +79,7 @@ static struct xt_target nflog_tg_reg[] __read_mostly = {
{
.name = "NFLOG",
.revision = 0,
- .family = NFPROTO_IPV4,
+ .family = NFPROTO_IPV6,
.checkentry = nflog_tg_check,
.destroy = nflog_tg_destroy,
.target = nflog_tg,
diff --git a/net/netfilter/xt_TRACE.c b/net/netfilter/xt_TRACE.c
index f3fa4f11348cd8ad796ce94f012cd48aa7a9020f..2a029b4adbcadf95e493b153f613a210624a9101 100644
--- a/net/netfilter/xt_TRACE.c
+++ b/net/netfilter/xt_TRACE.c
@@ -49,6 +49,7 @@ static struct xt_target trace_tg_reg[] __read_mostly = {
.target = trace_tg,
.checkentry = trace_tg_check,
.destroy = trace_tg_destroy,
+ .me = THIS_MODULE,
},
#endif
};
diff --git a/net/netfilter/xt_mark.c b/net/netfilter/xt_mark.c
index f76fe04fc9a4e19f18ac323349ba6f22a00eafd7..65b965ca40ea7ea5d9feff381b433bf267a424c4 100644
--- a/net/netfilter/xt_mark.c
+++ b/net/netfilter/xt_mark.c
@@ -62,7 +62,7 @@ static struct xt_target mark_tg_reg[] __read_mostly = {
{
.name = "MARK",
.revision = 2,
- .family = NFPROTO_IPV4,
+ .family = NFPROTO_IPV6,
.target = mark_tg,
.targetsize = sizeof(struct xt_mark_tginfo2),
.me = THIS_MODULE,

View File

@ -1,378 +0,0 @@
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
_flavor=lts
pkgname=linux-$_flavor
pkgver=6.6.58
_kernver=${pkgver%.*}
pkgrel=0
pkgdesc="Linux lts kernel"
url="https://www.kernel.org"
depends="initramfs-generator"
_depends_dev="perl gmp-dev mpc1-dev mpfr-dev elfutils-dev bash flex bison zstd"
makedepends="$_depends_dev sed installkernel bc linux-headers linux-firmware-any openssl-dev>3 mawk
diffutils findutils zstd pahole python3 gcc>=13.1.1_git20230624"
options="!strip !check"
_config=${config:-config-lts.${CARCH}}
source="https://cdn.kernel.org/pub/linux/kernel/v${pkgver%%.*}.x/linux-$_kernver.tar.xz
0001-powerpc-boot-wrapper-Add-z-notext-flag-for-ppc64le.patch
0002-x86-Compress-vmlinux-with-zstd-19-instead-of-22.patch
0003-kexec-add-kexec_load_disabled-boot-option.patch
0004-objtool-respect-AWK-setting.patch
0005-powerpc-config-defang-gcc-check-for-stack-protector-.patch
1337-nftables-ipv6.patch
lts.aarch64.config
lts.armv7.config
lts.x86.config
lts.x86_64.config
lts.ppc64le.config
lts.s390x.config
lts.loongarch64.config
virt.aarch64.config
virt.armv7.config
virt.ppc64le.config
virt.x86.config
virt.x86_64.config
"
subpackages="$pkgname-dev:_dev:$CBUILD_ARCH $pkgname-doc"
for _i in $source; do
case $_i in
*.$CARCH.config)
_f=${_i%."$CARCH".config}
_flavors="$_flavors $_f"
if [ "linux-$_f" != "$pkgname" ]; then
subpackages="$subpackages linux-$_f::$CBUILD_ARCH linux-$_f-dev:_dev:$CBUILD_ARCH"
fi
;;
esac
done
builddir="$srcdir"/linux-$_kernver
if [ "${pkgver%.0}" = "$pkgver" ]; then
source="$source
https://cdn.kernel.org/pub/linux/kernel/v${pkgver%%.*}.x/patch-$pkgver.xz"
fi
arch="all !armhf !riscv64"
license="GPL-2.0-only"
# secfixes:
# 5.10.4-r0:
# - CVE-2020-29568
# - CVE-2020-29569
# 5.15.74-r0:
# - CVE-2022-41674
# - CVE-2022-42719
# - CVE-2022-42720
# - CVE-2022-42721
# - CVE-2022-42722
# 6.1.27-r3:
# - CVE-2023-32233
# 6.6.13-r1:
# - CVE-46838
prepare() {
if [ "$_kernver" != "$pkgver" ]; then
msg "Applying patch-$pkgver.xz"
unxz -c < "$srcdir"/patch-$pkgver.xz | patch -p1 -N
fi
default_prepare
# remove localversion from patch if any
rm -f localversion*
}
_kernelarch() {
local arch="$1"
case "$arch" in
aarch64*) arch="arm64" ;;
arm*) arch="arm" ;;
ppc*) arch="powerpc" ;;
s390*) arch="s390" ;;
riscv*) arch="riscv" ;;
loongarch64) arch="loongarch" ;;
esac
echo "$arch"
}
_prepareconfig() {
local _flavor="$1"
local _arch="$2"
local _config=$_flavor.$_arch.config
local _builddir="$srcdir"/build-$_flavor.$_arch
mkdir -p "$_builddir"
echo "-$pkgrel-$_flavor" > "$_builddir"/localversion-alpine
cp "$srcdir"/$_config "$_builddir"/.config
msg "Configuring $_flavor kernel ($_arch)"
make -C "$builddir" \
O="$_builddir" \
ARCH="$(_kernelarch $_arch)" \
olddefconfig
if grep "CONFIG_MODULE_SIG=y" "$_builddir"/.config >/dev/null; then
if [ -f "$KERNEL_SIGNING_KEY" ]; then
sed -i -e "s:^CONFIG_MODULE_SIG_KEY=.*:CONFIG_MODULE_SIG_KEY=\"$KERNEL_SIGNING_KEY\":" \
"$_builddir"/.config
msg "Using $KERNEL_SIGNING_KEY to sign $_flavor kernel ($_arch) modules"
else
warning "KERNEL_SIGNING_KEY was not set. A signing key will be generated, but 3rd"
warning "party modules can not be signed"
fi
fi
}
listconfigs() {
for i in $source; do
case "$i" in
*.config) echo $i;;
esac
done
}
prepareconfigs() {
for _config in $(listconfigs); do
local _flavor=${_config%%.*}
local _arch=${_config%.config}
_arch=${_arch#*.}
local _builddir="$srcdir"/build-$_flavor.$_arch
_prepareconfig "$_flavor" "$_arch"
done
}
# this is supposed to be run before version is bumped so we can compare
# what new kernel config knobs are introduced
prepareupdate() {
clean && fetch && unpack && prepare && deps
prepareconfigs
rm -r "$builddir"
}
updateconfigs() {
if ! [ -d "$builddir" ]; then
deps && fetch && unpack && prepare
fi
for _config in ${CONFIGS:-$(listconfigs)}; do
msg "updating $_config"
local _flavor=${_config%%.*}
local _arch=${_config%.config}
_arch=${_arch#*.}
local _builddir="$srcdir"/build-$_flavor.$_arch
mkdir -p "$_builddir"
echo "-$pkgrel-$_flavor" > "$_builddir"/localversion-alpine
local actions="listnewconfig oldconfig"
if ! [ -f "$_builddir"/.config ]; then
cp "$srcdir"/$_config "$_builddir"/.config
actions="olddefconfig"
fi
env | grep ^CONFIG_ >> "$_builddir"/.config || true
make -j1 -C "$builddir" \
O="$_builddir" \
ARCH="$(_kernelarch $_arch)" \
$actions savedefconfig
cp "$_builddir"/defconfig "$startdir"/$_config
done
}
set_kbuild_timestamp() {
# KBUILD_BUILD_TIMESTAMP needs to be parsable by busybox date
export KBUILD_BUILD_TIMESTAMP="$(date '+%Y-%m-%d %H:%M:%S' -u${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH})"
}
build() {
unset LDFLAGS
# for some reason these sometimes leak into the kernel build,
# -Werror=format-security breaks some stuff
unset CFLAGS CPPFLAGS CXXFLAGS
set_kbuild_timestamp
for i in $_flavors; do
_prepareconfig "$i" "$CARCH"
done
for i in $_flavors; do
msg "Building $i kernel"
cd "$srcdir"/build-$i.$CARCH
# set org in cert for modules signing
# https://www.kernel.org/doc/html/v6.1/admin-guide/module-signing.html#generating-signing-keys
mkdir -p certs
sed -e 's/#O = Unspecified company/O = alpinelinux.org/' \
"$builddir"/certs/default_x509.genkey \
> certs/x509.genkey
make ARCH="$(_kernelarch $CARCH)" \
CC="${CC:-gcc}" \
AWK="${AWK:-mawk}" \
KBUILD_BUILD_VERSION="$((pkgrel + 1 ))-Alpine"
done
}
_package() {
local _buildflavor="$1" _outdir="$2"
set_kbuild_timestamp
cd "$srcdir"/build-$_buildflavor.$CARCH
local _abi_release="$(make -s kernelrelease)"
# modules_install seems to regenerate a defect Modules.symvers on s390x. Work
# around it by backing it up and restore it after modules_install
cp Module.symvers Module.symvers.backup
mkdir -p "$_outdir"/boot "$_outdir"/lib/modules
local _install
case "$CARCH" in
arm*|aarch64|riscv*) _install="zinstall dtbs_install";;
*) _install=install;;
esac
make modules_install $_install \
ARCH="$(_kernelarch $CARCH)" \
INSTALL_MOD_PATH="$_outdir" \
INSTALL_MOD_STRIP=1 \
INSTALL_PATH="$_outdir"/boot \
INSTALL_DTBS_PATH="$_outdir/boot/dtbs-$_buildflavor"
cp Module.symvers.backup Module.symvers
rm -f "$_outdir"/lib/modules/"$_abi_release"/build \
"$_outdir"/lib/modules/"$_abi_release"/source
rm -rf "$_outdir"/lib/firmware
install -D -m644 include/config/kernel.release \
"$_outdir"/usr/share/kernel/$_buildflavor/kernel.release
case "$CARCH" in
loongarch64)
mv "$_outdir"/boot/vmlinuz-$_abi_release \
"$_outdir"/boot/vmlinuz-$_buildflavor
mv "$_outdir"/boot/config-$_abi_release \
"$_outdir"/boot/config-$_buildflavor
mv "$_outdir"/boot/System.map-$_abi_release \
"$_outdir"/boot/System.map-$_buildflavor
;;
esac
}
# main flavor installs in $pkgdir
package() {
depends="$depends linux-firmware-any"
_package "$_flavor" "$pkgdir"
# copy files for linux-lts-doc sub package
mkdir -p "$pkgdir"/usr/share/doc
cp -r "$builddir"/Documentation \
"$pkgdir"/usr/share/doc/linux-doc-"$pkgver"/
# remove files that aren't part of the documentation itself
for nondoc in \
.gitignore conf.py docutils.conf \
dontdiff Kconfig Makefile
do
rm "$pkgdir"/usr/share/doc/linux-doc-"$pkgver"/"$nondoc"
done
# create /usr/share/doc/linux-doc symlink
cd "$pkgdir"/usr/share/doc; ln -s linux-doc-"$pkgver" linux-doc
}
# subflavors install in $subpkgdir
virt() {
_package virt "$subpkgdir"
}
_dev() {
local _flavor=$(echo $subpkgname | sed -E 's/(^linux-|-dev$)//g')
local _builddir="$srcdir"/build-$_flavor.$CARCH
local _abi_release="$(make -C "$_builddir" -s kernelrelease)"
# copy the only the parts that we really need for build 3rd party
# kernel modules and install those as /usr/src/linux-headers,
# simlar to what ubuntu does
#
# this way you dont need to install the 300-400 kernel sources to
# build a tiny kernel module
#
pkgdesc="Headers and script for third party modules for $_flavor kernel"
depends="$_depends_dev"
local dir="$subpkgdir"/usr/src/linux-headers-"$_abi_release"
set_kbuild_timestamp
# first we import config, run prepare to set up for building
# external modules, and create the scripts
mkdir -p "$dir"
cp -a "$_builddir"/.config "$_builddir"/localversion-alpine \
"$dir"/
install -D -t "$dir"/certs "$_builddir"/certs/signing_key.x509 || :
make -C "$builddir" \
O="$dir" \
ARCH="$(_kernelarch $CARCH)" \
AWK="${AWK:-mawk}" \
prepare modules_prepare scripts
# remove the stuff that points to real sources. we want 3rd party
# modules to believe this is the sources
rm "$dir"/Makefile "$dir"/source
# copy the needed stuff from real sources
#
# this is taken from ubuntu kernel build script
# http://kernel.ubuntu.com/git/ubuntu/ubuntu-zesty.git/tree/debian/rules.d/3-binary-indep.mk
cd "$builddir"
find . -path './include/*' -prune \
-o -path './scripts/*' -prune -o -type f \
\( -name 'Makefile*' -o -name 'Kconfig*' -o -name 'Kbuild*' -o \
-name '*.sh' -o -name '*.pl' -o -name '*.lds' -o -name 'Platform' \) \
-print | cpio -pdm "$dir"
cp -a scripts include "$dir"
find "arch/$_karch" -name include -type d -print | while IFS='' read -r folder; do
find "$folder" -type f
done | sort -u | cpio -pdm "$dir"
install -Dm644 "$srcdir"/build-$_flavor.$CARCH/Module.symvers \
"$dir"/Module.symvers
# remove unneeded things
msg "Removing documentation..."
rm -r "$dir"/Documentation
find "$dir" -type f -name '*.o' -printf 'Removing %P\n' -delete
local _karch="$(_kernelarch $CARCH | sed 's/x86_64/x86/')"
msg "Removing unneeded arch headers..."
for i in "$dir"/arch/*; do
if [ "${i##*/}" != "$_karch" ]; then
echo " ${i##*/}"
rm -r "$i"
fi
done
mkdir -p "$subpkgdir"/lib/modules/"$_abi_release"
ln -sf /usr/src/linux-headers-"$_abi_release" \
"$subpkgdir"/lib/modules/"$_abi_release"/build
}
sha512sums="
458b2c34d46206f9b4ccbac54cc57aeca1eaecaf831bc441e59701bac6eadffc17f6ce24af6eadd0454964e843186539ac0d63295ad2cc32d112b60360c39a35 linux-6.6.tar.xz
58bf9e84fb01f811f0cada7f7953d111908f0b0650648d6a3522061fe08c9fe284c9315515ae386189253e37d0c92419f78048d6568e2e426654b1e61010685f 0001-powerpc-boot-wrapper-Add-z-notext-flag-for-ppc64le.patch
763dcb40f698d43b0bb856f44493973e840b66efe62a8fd41a08b6e3fa38cf903e059d107be3735ab2f38a0f27bdb0262798e5e530a1905f96195cd8bcf62fdf 0002-x86-Compress-vmlinux-with-zstd-19-instead-of-22.patch
75f232b6becee7d36d360ffaf2aaa837d13518f9ec620ca159bcb2a0e98eb18a77631406a9b44244ea0164a7ed59fad583823909681e9b894a012f9d13365b69 0003-kexec-add-kexec_load_disabled-boot-option.patch
2956050bb332411d00a285e9656618f2e34b631492bbc19bef54d83a6e91b8531f4e18830b9313cfe52fbf8a8ca6fb76cf55b3ddd146ca3b977046cf2fd10cad 0004-objtool-respect-AWK-setting.patch
4b16f15b47b5e5835b926126e39723f519290469517875cfb2d2b857a93ad1344f0d1ba4b255289e20f4da9c867647526b344f752981cee0a48c51577badac3f 0005-powerpc-config-defang-gcc-check-for-stack-protector-.patch
a7085f581773cd492d8ed76638abe0d81924107778c3eb87ea495fba9aff69b2f28cb01d0ca6101bd849641ccc8294c238486043f492dc44ee26d7111a6b76cc 1337-nftables-ipv6.patch
a8286ac0cbff0736ab7d5503a19034b11d69d1faa84316bef69087102a009c27b9f54daf9d55d55112e8eef4f239d1dd3a34fe1b55c1aa078ca638a85e0ded1b lts.aarch64.config
2fd7ce3f044f72718b51c7db81bb0f720630a8a4164b97036bfe1a0816efc6903ca83f580543ea4bdca6031d912af9138c44f90722ceff8d5e928412ad23a609 lts.armv7.config
b2534172f8eeb14edb5855c59e806ce07fdfbc1a5a4fe206dd037f17aa21b894d927c1cdcf7c87bb364efd491bb226e3ee21e7f46d26a1afc05f9385260985eb lts.x86.config
eff52f6533953312290456124f11e3532dbcbc389a46556c638c7a2d77a0ced2d6316e159c2f0d9bc026fd1a06520f70dd9b1c748fd618e825f4da2cfdf42cad lts.x86_64.config
243eb831ef4cf7ae8c18e80433447ddfc437b3eda51c8a584e1d0006b214aac77b1801e66860e6cdcbba04b7c9a15c66cd602811cdf30cb7edf0f43778fb1922 lts.ppc64le.config
60327486c2668ee24041f86a22d3856dcac3c9e358f4e16a16f6d302d79095ca5a08c4011141050eafe06ba2d1c3eccd142b79ffa469338e213ae2156e29aa44 lts.s390x.config
4697069b98b81243a18d97ed668a00c08504b55255e4d4392a0f1e63403b6d72036d440b4e54c63c8932ca243164729486e1cea229bd8baf5201fb969f838450 lts.loongarch64.config
b79a6cf6578c49b582931e0f38564e69714bfa2b03c7615301e4cdf0ba9617bf42e01952f4a8a99d82c68733c0aed8b45b4e72ba0a175ce75dc8a14f12fe0f83 virt.aarch64.config
fdd8ff5bac36fc6421c3e71af89346c9a84fedfebc49e61353185561c9737bd59f9692fb09af553eaee5dd104e6f170e9cb460c0a54ee429cffe9a7b150b0379 virt.armv7.config
4dab1bb85d5eaf95ee85beae150c888140583feb1f5bbaec1cf17e2ff73d604590b5aee4edb51caec2ae28adbcf451e88cf3d39bff01887e28ae05c2e104535e virt.ppc64le.config
2110f9a8b62af734f67e1024b598645433786bceec2517ca529bd705ebabb3265395ea1e4416260b69778f4c8a5e90db10877d7136841a06c41ffff3279cfb8f virt.x86.config
c9f51f49e82f14f1ce5420c9c7deca77b2b54b3c2ff1d2ad377b57a028689c614c573f7d413c960c62a6d0c0463fbd17c1ae8d25c7c70c09217946f2c7c4ef11 virt.x86_64.config
9feecb9b368461c27c93cdc852d30caaa53fedb6f7c8cf066feb5ec35a87b016250b7573d17b1cdb992df80a840b5bc80d4aa84a00b631ac4bfaa8b64bc23cda patch-6.6.58.xz
"

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

View File

@ -1,888 +0,0 @@
# CONFIG_LOCALVERSION_AUTO is not set
CONFIG_SYSVIPC=y
CONFIG_POSIX_MQUEUE=y
CONFIG_NO_HZ=y
CONFIG_HIGH_RES_TIMERS=y
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_JIT=y
CONFIG_PREEMPT=y
CONFIG_BSD_PROCESS_ACCT=y
CONFIG_BSD_PROCESS_ACCT_V3=y
CONFIG_TASKSTATS=y
CONFIG_TASK_DELAY_ACCT=y
CONFIG_TASK_XACCT=y
CONFIG_TASK_IO_ACCOUNTING=y
CONFIG_LOG_BUF_SHIFT=18
CONFIG_NUMA_BALANCING=y
CONFIG_MEMCG=y
CONFIG_BLK_CGROUP=y
CONFIG_CFS_BANDWIDTH=y
CONFIG_RT_GROUP_SCHED=y
CONFIG_CGROUP_PIDS=y
CONFIG_CGROUP_FREEZER=y
CONFIG_CGROUP_HUGETLB=y
CONFIG_CPUSETS=y
CONFIG_CGROUP_DEVICE=y
CONFIG_CGROUP_CPUACCT=y
CONFIG_CGROUP_PERF=y
CONFIG_CGROUP_BPF=y
CONFIG_NAMESPACES=y
CONFIG_USER_NS=y
CONFIG_CHECKPOINT_RESTORE=y
CONFIG_SCHED_AUTOGROUP=y
CONFIG_RELAY=y
CONFIG_BLK_DEV_INITRD=y
CONFIG_EXPERT=y
CONFIG_KALLSYMS_ALL=y
CONFIG_PERF_EVENTS=y
CONFIG_KEXEC=y
CONFIG_CRASH_DUMP=y
CONFIG_NUMA=y
CONFIG_RANDOMIZE_BASE=y
CONFIG_HIBERNATION=y
CONFIG_ACPI_SPCR_TABLE=y
CONFIG_ACPI_TAD=y
CONFIG_ACPI_DOCK=y
CONFIG_ACPI_IPMI=m
CONFIG_ACPI_PCI_SLOT=y
CONFIG_ACPI_HOTPLUG_MEMORY=y
CONFIG_JUMP_LABEL=y
CONFIG_MODULES=y
CONFIG_MODULE_FORCE_LOAD=y
CONFIG_MODULE_UNLOAD=y
CONFIG_MODULE_FORCE_UNLOAD=y
CONFIG_MODVERSIONS=y
CONFIG_BLK_DEV_THROTTLING=y
CONFIG_PARTITION_ADVANCED=y
CONFIG_BSD_DISKLABEL=y
CONFIG_UNIXWARE_DISKLABEL=y
CONFIG_IOSCHED_BFQ=y
CONFIG_BINFMT_MISC=m
CONFIG_ZSWAP=y
CONFIG_ZSWAP_COMPRESSOR_DEFAULT_ZSTD=y
CONFIG_Z3FOLD=y
# CONFIG_COMPAT_BRK is not set
CONFIG_MEMORY_HOTPLUG=y
CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=y
CONFIG_MEMORY_HOTREMOVE=y
CONFIG_KSM=y
CONFIG_TRANSPARENT_HUGEPAGE=y
CONFIG_USERFAULTFD=y
CONFIG_NET=y
CONFIG_PACKET=y
CONFIG_TLS=m
CONFIG_TLS_DEVICE=y
CONFIG_XFRM_USER=y
CONFIG_NET_KEY=y
CONFIG_XDP_SOCKETS=y
CONFIG_IP_MULTICAST=y
CONFIG_IP_ADVANCED_ROUTER=y
CONFIG_IP_MULTIPLE_TABLES=y
CONFIG_IP_ROUTE_MULTIPATH=y
CONFIG_IP_ROUTE_VERBOSE=y
CONFIG_IP_PNP=y
CONFIG_IP_PNP_DHCP=y
CONFIG_IP_PNP_BOOTP=y
CONFIG_IP_PNP_RARP=y
CONFIG_NET_IPIP=m
CONFIG_NET_IPGRE_DEMUX=m
CONFIG_NET_IPGRE=m
CONFIG_NET_IPGRE_BROADCAST=y
CONFIG_IP_MROUTE=y
CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
CONFIG_IP_PIMSM_V1=y
CONFIG_IP_PIMSM_V2=y
CONFIG_INET_ESP=m
CONFIG_INET_UDP_DIAG=y
CONFIG_TCP_CONG_ADVANCED=y
CONFIG_TCP_CONG_BBR=m
CONFIG_IPV6_ROUTER_PREF=y
CONFIG_IPV6_ROUTE_INFO=y
CONFIG_INET6_ESP=m
CONFIG_IPV6_MROUTE=y
CONFIG_NETWORK_PHY_TIMESTAMPING=y
CONFIG_NETFILTER=y
CONFIG_BRIDGE_NETFILTER=m
CONFIG_NETFILTER_NETLINK_LOG=m
CONFIG_NF_CONNTRACK=m
CONFIG_NF_CONNTRACK_AMANDA=m
CONFIG_NF_CONNTRACK_FTP=m
CONFIG_NF_CONNTRACK_NETBIOS_NS=m
CONFIG_NF_CONNTRACK_SNMP=m
CONFIG_NF_CONNTRACK_PPTP=m
CONFIG_NF_CONNTRACK_TFTP=m
CONFIG_NF_CT_NETLINK=m
CONFIG_NF_TABLES=m
CONFIG_NFT_NUMGEN=m
CONFIG_NFT_CT=m
CONFIG_NFT_CONNLIMIT=m
CONFIG_NFT_LOG=m
CONFIG_NFT_LIMIT=m
CONFIG_NFT_MASQ=m
CONFIG_NFT_REDIR=m
CONFIG_NFT_NAT=m
CONFIG_NFT_TUNNEL=m
CONFIG_NFT_QUEUE=m
CONFIG_NFT_QUOTA=m
CONFIG_NFT_REJECT=m
CONFIG_NFT_COMPAT=m
CONFIG_NFT_HASH=m
CONFIG_NFT_XFRM=m
CONFIG_NFT_SOCKET=m
CONFIG_NFT_OSF=m
CONFIG_NFT_TPROXY=m
CONFIG_NFT_SYNPROXY=m
CONFIG_NETFILTER_XT_SET=m
CONFIG_NETFILTER_XT_TARGET_AUDIT=m
CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
CONFIG_NETFILTER_XT_TARGET_CT=m
CONFIG_NETFILTER_XT_TARGET_DSCP=m
CONFIG_NETFILTER_XT_TARGET_HMARK=m
CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
CONFIG_NETFILTER_XT_TARGET_LED=m
CONFIG_NETFILTER_XT_TARGET_LOG=m
CONFIG_NETFILTER_XT_TARGET_MARK=m
CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
CONFIG_NETFILTER_XT_TARGET_TRACE=m
CONFIG_NETFILTER_XT_TARGET_SECMARK=m
CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
CONFIG_NETFILTER_XT_MATCH_BPF=m
CONFIG_NETFILTER_XT_MATCH_CGROUP=m
CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
CONFIG_NETFILTER_XT_MATCH_COMMENT=m
CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
CONFIG_NETFILTER_XT_MATCH_CPU=m
CONFIG_NETFILTER_XT_MATCH_DCCP=m
CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_IPCOMP=m
CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
CONFIG_NETFILTER_XT_MATCH_IPVS=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
CONFIG_NETFILTER_XT_MATCH_LIMIT=m
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
CONFIG_NETFILTER_XT_MATCH_NFACCT=m
CONFIG_NETFILTER_XT_MATCH_OSF=m
CONFIG_NETFILTER_XT_MATCH_OWNER=m
CONFIG_NETFILTER_XT_MATCH_POLICY=m
CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
CONFIG_NETFILTER_XT_MATCH_QUOTA=m
CONFIG_NETFILTER_XT_MATCH_RATEEST=m
CONFIG_NETFILTER_XT_MATCH_REALM=m
CONFIG_NETFILTER_XT_MATCH_SOCKET=m
CONFIG_NETFILTER_XT_MATCH_STATE=m
CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
CONFIG_NETFILTER_XT_MATCH_STRING=m
CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
CONFIG_NETFILTER_XT_MATCH_TIME=m
CONFIG_NETFILTER_XT_MATCH_U32=m
CONFIG_IP_SET=m
CONFIG_IP_VS=m
CONFIG_IP_VS_IPV6=y
CONFIG_IP_VS_PROTO_TCP=y
CONFIG_IP_VS_PROTO_UDP=y
CONFIG_IP_VS_PROTO_ESP=y
CONFIG_IP_VS_PROTO_AH=y
CONFIG_IP_VS_PROTO_SCTP=y
CONFIG_IP_VS_RR=m
CONFIG_IP_VS_WRR=m
CONFIG_IP_VS_NFCT=y
CONFIG_NF_TABLES_IPV4=y
CONFIG_NFT_DUP_IPV4=m
CONFIG_NFT_FIB_IPV4=m
CONFIG_NF_TABLES_ARP=y
CONFIG_IP_NF_IPTABLES=m
CONFIG_IP_NF_MATCH_AH=m
CONFIG_IP_NF_MATCH_ECN=m
CONFIG_IP_NF_MATCH_RPFILTER=m
CONFIG_IP_NF_MATCH_TTL=m
CONFIG_IP_NF_FILTER=m
CONFIG_IP_NF_TARGET_REJECT=m
CONFIG_IP_NF_TARGET_SYNPROXY=m
CONFIG_IP_NF_NAT=m
CONFIG_IP_NF_TARGET_MASQUERADE=m
CONFIG_IP_NF_TARGET_NETMAP=m
CONFIG_IP_NF_TARGET_REDIRECT=m
CONFIG_IP_NF_MANGLE=m
CONFIG_IP_NF_TARGET_ECN=m
CONFIG_IP_NF_TARGET_TTL=m
CONFIG_IP_NF_RAW=m
CONFIG_IP_NF_SECURITY=m
CONFIG_IP_NF_ARPTABLES=m
CONFIG_IP_NF_ARPFILTER=m
CONFIG_IP_NF_ARP_MANGLE=m
CONFIG_NF_TABLES_IPV6=y
CONFIG_NFT_DUP_IPV6=m
CONFIG_NFT_FIB_IPV6=m
CONFIG_IP6_NF_IPTABLES=y
CONFIG_IP6_NF_MATCH_AH=m
CONFIG_IP6_NF_MATCH_EUI64=m
CONFIG_IP6_NF_MATCH_FRAG=m
CONFIG_IP6_NF_MATCH_OPTS=m
CONFIG_IP6_NF_MATCH_IPV6HEADER=m
CONFIG_IP6_NF_MATCH_MH=m
CONFIG_IP6_NF_MATCH_RPFILTER=m
CONFIG_IP6_NF_MATCH_RT=m
CONFIG_IP6_NF_MATCH_SRH=m