Fix: use same sandbox as upstream

.ci/README.md

@@ -14,7 +14,7 @@ include .ci/podman.mk
 
 Add subtree to your project:
 ```
-git subtree add --prefix .ci https://git.zero-downtime.net/ZeroDownTime/ci-tools-lib.git main --squash
+git subtree add --prefix .ci https://git.zero-downtime.net/ZeroDownTime/ci-tools-lib.git master --squash
 ```
 
 

Makefile

@@ -2,8 +2,6 @@ REGISTRY := public.ecr.aws/zero-downtime
 IMAGE := alpine-builder
 REGION := us-east-1
 
-# NEW_TAG = $(shell podman image inspect alpine:3.21 --format='{{ index .Annotations "org.opencontainers.image.version" }}')
-
 # Also tag builder images as latest major version
 EXTRA_TAGS = $(shell echo $(GIT_TAG) | awk -F '.' '{ print $$1 "." $$2 }')
 
@@ -24,7 +22,7 @@ aarch64-toolchain:
 		-v ${PWD}/aports:/home/alpine/aports \
 		-v ${HOME}/.gitconfig/:/home/alpine/.gitconfig:ro \
 		-v ${HOME}/.abuild/:/home/alpine/.abuild:ro \
-		$(REGISTRY)/$(IMAGE):v$(ALPINE_MAJOR) aarch64-toolchain
+		$(REGISTRY)/$(IMAGE):$(TAG) aarch64-toolchain
 
 packages:
 	mkdir -p packages/kubezero/aarch64 packages/kubezero/x86_64

kubezero/aws-iam-authenticator/APKBUILD

@@ -9,17 +9,7 @@ arch="x86_64 aarch64 armv7 x86"
 license="Apache-2.0"
 makedepends="go bash"
 options="!check chmod-clean net"
-source="$pkgname-$pkgver.tar.gz::https://github.com/kubernetes-sigs/$pkgname/archive/refs/tags/v$pkgver.tar.gz
+source="$pkgname-$pkgver.tar.gz::https://github.com/kubernetes-sigs/$pkgname/archive/refs/tags/v$pkgver.tar.gz"
-        aws-iam-authenticator.initd
-        aws-iam-authenticator.monit
-        config.yaml
-        "
-
-install="$pkgname-server.pre-install"
-subpackages="$pkgname-server"
-
-pkggroups="awsiam"
-pkgusers="awsiam"
 
 build() {
   make bin
@@ -29,19 +19,6 @@ package() {
 	install -Dm755 "$builddir/_output/bin/aws-iam-authenticator" "$pkgdir"/usr/bin/aws-iam-authenticator
 }
 
-server() {
-	install -d "$subpkgdir"/var/log/"$pkgname" -g awsiam -m 775
-	install -d "$subpkgdir"/etc/"$pkgname" -g awsiam -m 775
-
-  install "$srcdir"/config.yaml "$subpkgdir"/etc/$pkgname/config.yaml
-  install -Dm755 "$srcdir"/$pkgname.initd "$subpkgdir"/etc/init.d/$pkgname
-
-  install -Dm644 "$srcdir"/$pkgname.monit "$subpkgdir/etc/monit.d/$pkgname.conf"
-}
-
 sha512sums="
 276efbbf44228b7ef6fe45e80c19443b134664d940706f2634e7478c4e8a3d2499bd0cbe70e1b7916af47dbc66ca1b5419f4738ad1f94ef82fe88f3a06f27d65  aws-iam-authenticator-0.6.29.tar.gz
-a374448ffe7ac2079fef4a4d370b8d4b3aa10d371fff976e41a1107c17198d366f0e28f47f7313555503eaa44d358dff385f84a0000709aa6b75991a0c35f77b  aws-iam-authenticator.initd
-81454a32d898214c80fef1dda1630e6f6550180908e0b45980b25700478ee7fa4a8ef797cf0f1597fa98713b84f2ae9bd324d017e636ef965c26876147039745  aws-iam-authenticator.monit
-97fb2b255161837b1789c17dc7543644d24404ee9eeb95ace0d7c1d8ba12647cca78a8d86ff07dcb7a3eb833d9bc632b4f8511df8aedf484d61acc48929ce9be  config.yaml
 "

kubezero/aws-iam-authenticator/aws-iam-authenticator-server.pre-install

@@ -1,6 +0,0 @@
-#!/bin/sh
-
-addgroup -S awsiam 2>/dev/null
-adduser -S -D -H -h /dev/null -s /sbin/nologin -G awsiam -g awsiam awsiam 2>/dev/null
-
-exit 0

kubezero/aws-iam-authenticator/aws-iam-authenticator.initd

@@ -1,16 +0,0 @@
-#!/sbin/openrc-run
-
-name=aws-iam-authenticator
-command="/usr/bin/aws-iam-authenticator"
-command_background="true"
-command_user="awsiam:awsiam"
-pidfile="${pidfile:-/run/${RC_SVCNAME}.pid}"
-
-start_stop_daemon_args="--stderr /var/log/${RC_SVCNAME}/${RC_SVCNAME}.log \
-                        --stdout /var/log/${RC_SVCNAME}/${RC_SVCNAME}.log"
-
-command_args="server -l=json --config=/etc/aws-iam-authenticator/config.yaml"
-
-depend() {
-	need net
-}

kubezero/aws-iam-authenticator/aws-iam-authenticator.monit

@@ -1,10 +0,0 @@
-check process aws-iam-authenticator pidfile /run/aws-iam-authenticator.pid
-  start program = "/sbin/rc-service aws-iam-authenticator start"
-  stop program  = "/sbin/rc-service aws-iam-authenticator stop"
-  restart program = "/sbin/rc-service aws-iam-authenticator restart"
-  if failed
-    port 21363
-    protocol http
-    request "/healthz"
-    for 2 cycles
-  then restart

kubezero/aws-iam-authenticator/config.yaml

@@ -1 +0,0 @@
-clusterID: exampleCluster

kubezero/containerd/APKBUILD

@@ -4,15 +4,15 @@
 pkgname=containerd
 
 # NOTE: containerd's Makefile tries to get REVISION from git, but we're building from a tarball.
-_commit=207ad71
+_commit=bcc810d
-pkgver=2.0.0
+pkgver=1.7.25
 pkgrel=1337
 pkgdesc="An open and reliable container runtime"
 url="https://containerd.io/"
 arch="all"
 license="Apache-2.0"
 # we use crun
-#depends="runc"
+depends="crun"
 makedepends="btrfs-progs-dev go go-md2man libseccomp-dev log_proxy"
 subpackages="
 	$pkgname-ctr
@@ -108,6 +108,9 @@ package() {
 
 	install -d "$pkgdir"/etc/containerd/conf.d
 	install -Dm644 "$srcdir"/config.toml "$pkgdir"/etc/containerd/config.toml
+
+	# Provide runc as there seem to be various hardcoded runc refs unfortunately
+	cd $pkgdir/usr/bin && ln -s crun runc
 }
 
 openrc() {
@@ -127,8 +130,8 @@ stress() {
 }
 
 sha512sums="
-b1a89c4c53db2c69757bc40d90d585e2662ab4fffb28acb904f9710b281a9f22273ecdbab49250b229bf95b29cf1a33a352afb81967db7580ae209a83c5fb2ea  containerd-2.0.0.tar.gz
+83477f9ed1d5d0653f5a4829d1ac6299cdd8958ca5534de1b22d7b5858d0118e97c9d3ce4c5d58e5b06393be007007f7bf4ac511e1903d1fe407579fa96ab36d  containerd-1.7.25.tar.gz
 75a882a95167578bb4f289822256e770ecf2f74d7a50181e622c15e847383120d3622100e5e5629b94b58e2082f990de1cc3daa2f69b0ee48827072c1e9dde0e  containerd.confd
 8315a8d58b4ba7e19ebed2cd82c7b5eaab45da630f9818a9e6cc8f3c8e88f159432474299798f79e6e465e843c91c0f50df04030083c8913c385ea1d73e81e6a  containerd.initd
-a10a1e1b5deea30c156a786592bfc54597bcf2d45c4e6447182b72a7d0a5e2eb058698a8830dbace95e71176aa3070d123bcf75c4c4a36d814182c5d24fe9d71  config.toml
+dfb92fffeac35310956da6c6ad5f8c43eba3a5355ecbfabeec0f9c7445a08e309312b56b6855a17a471fd6012cc099d6abb39dc8bd26279112d0fe936624023d  config.toml
 "

kubezero/containerd/config.toml

@@ -1,6 +1,8 @@
-version = 3
+version = 2
 
 imports = ["/etc/containerd/conf.d/*.toml"]
 
-[plugins.'io.containerd.cri.v1.runtime'.cni]
+[plugins]
-  bin_dir = '/usr/libexec/cni'
+  [plugins."io.containerd.grpc.v1.cri"]
+    [plugins."io.containerd.grpc.v1.cri".cni]
+      bin_dir = "/usr/libexec/cni"

kubezero/kubernetes/APKBUILD

@@ -5,7 +5,7 @@
 # Contributor: Dave <dj.2dixx@gmail.com>
 # Maintainer: Stefan Reimer <stefan@zero-downtime.net>
 pkgname=kubernetes
-pkgver=1.31.6
+pkgver=1.31.5
 pkgrel=0
 pkgdesc="Container Cluster Manager"
 url="https://kubernetes.io/"
@@ -146,7 +146,7 @@ zshcomp() {
 }
 
 sha512sums="
-cc27eedde442c185d9b08bbe25b1d7f189d93d0519b4d02ab47a711dc6345ac3c942cc82ede4026bd20fdabef71f8615df63d06ebd550c60acba6a595c4574b7  kubernetes-1.31.6.tar.gz
+6c773d706cb45bf0d8cb18cbd718ab2053fd4d17ae4db35b9159b258b55dbef71d0f6fd6e6057d8b5e027bdfc9ffb7a0a4d2bc63d8f092c48f5b44f3cc73ff96  kubernetes-1.31.5.tar.gz
 5427c2e653504cfd5b0bcaf195d4734ee40947ddfebc9f155cd96dddccfc27692c29d94af4ac99f1018925b52995c593b584c5d7a82df2f185ebce1a9e463c40  make-e2e_node-run-over-distro-bins.patch
 94d07edfe7ca52b12e85dd9e29f4c9edcd144abc8d120fb71e2a0507f064afd4bac5dde30da7673a35bdd842b79a4770a03a1f3946bfae361c01dd4dc4903c64  make-test-cmd-run-over-hyperkube-based-kubectl.patch
 e690daff2adb1013c92124f32e71f8ed9a18c611ae6ae5fcb5ce9674768dbf9d911a05d7e4028488cda886e63b82e8ac0606d14389a05844c1b5538a33dd09d1  kube-apiserver.initd

kubezero/kubezero/APKBUILD

@@ -1,7 +1,7 @@
 # Contributor: Stefan Reimer <stefan@zero-downtime.net>
 # Maintainer: Stefan Reimer <stefan@zero-downtime.net>
 pkgname=kubezero
-pkgver=1.31.6
+pkgver=1.31.5
 _containerd=1.7.25-r1337
 _ecr=1.31.4
 _iam=0.6.29
@@ -94,6 +94,6 @@ ecb33fc3a0ffc378723624858002f9f5e180e851b55b98ab6611ecc6a73d4719bc7de240f87683fc
 fce1013f7b1bfa8ee526de62e642a37fda3168889723e873d3fb69e257f4caa1423b5a14b9343b12a87f3b6f93c7d3861b854efda67ef2d6a42a5ca8cf3d1593  evictLocalNode.sh
 92499ec9a8b3634c42b16c01d27f1c1bb650bcc074a2c8d9d16cfe2ea08942948989c6aae79bd2df562ff17df11bbc329e0971f15c4e64f944457825dee7aa79  credential-provider.yaml
 8b81eb0fb66e6a739965db6af6a31c443e8f612c06146bd51107372abd833b527423299ee11b27e011f46cfbee11415234b3fa0dea695dbbb06711e0ad58f08d  kubelet.monit
-2814ac38da801582b4865f79edd775eb14e35ea3789038881cec7f7ae585bbe9edd8cd30b9525c4324bf7b594123f00b6b34b2508434db220ba08f368581fdcc  containerd.conf
+dda96910382f65c69672a60c789f0e0f9883f8a018a07fde2f16ad27e62af900a74d55d5892029346dafbe81c58bca8396a3f6691c75434a9977fcc61ea452b9  containerd.conf
 b112ffd86f095aec47bf75179659af20720792c453d6cc9d11db26446aa2f3c237fe59b793dd8ef3ee93f6fd4230ff8abadfdada76e6452779b982a71eb37cb9  crictl.yaml
 "

kubezero/kubezero/containerd.conf

@@ -1,28 +1,36 @@
-version = 3
+version = 2
 
 oom_score = -999
 
-[plugins.'io.containerd.cri.v1.images'.pinned_images]
+[plugins]
-  sandbox = 'registry.k8s.io/pause:3.10'
+  [plugins."io.containerd.grpc.v1.cri"]
+    enable_cdi = true
+    sandbox_image = "registry.k8s.io/pause:3.10"
+    tolerate_missing_hugetlb_controller = false
 
-[plugins.'io.containerd.cri.v1.images'.registry]
+    [plugins."io.containerd.grpc.v1.cri".cni]
-  config_path = '/etc/containerd/certs.d'
+      bin_dir = "/usr/libexec/cni"
 
-[plugins.'io.containerd.monitor.v1.cgroups']
+    [plugins."io.containerd.grpc.v1.cri".containerd]
-  no_prometheus = true
+      default_runtime_name = "crun"
 
-[plugins.'io.containerd.cri.v1.runtime']
+      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
-  tolerate_missing_hugetlb_controller = false
-  [plugins.'io.containerd.cri.v1.runtime'.containerd]
-    default_runtime_name = 'crun'
 
-    [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes]
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.crun]
-      [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.crun]
+          runtime_type = "io.containerd.runc.v2"
-        runtime_type = 'io.containerd.runc.v2'
+          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.crun.options]
-        [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.crun.options]
+            BinaryName = "/usr/bin/crun"
-          BinaryName = '/usr/bin/crun'
 
-      [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.nvidia]
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.nvidia]
-        runtime_type = 'io.containerd.runc.v2'
+          runtime_type = "io.containerd.runc.v2"
-        [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.nvidia.options]
+          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.nvidia.options]
-          BinaryName = '/usr/bin/nvidia-container-runtime'
+            BinaryName = "/usr/bin/nvidia-container-runtime"
+
+    [plugins."io.containerd.grpc.v1.cri".registry]
+      config_path = "/etc/containerd/certs.d"
+
+  [plugins."io.containerd.runtime.v1.linux"]
+    runtime = "crun"
+
+  [plugins."io.containerd.monitor.v1.cgroups"]
+    no_prometheus = true

kubezero/multus-cni/APKBUILD

@@ -11,6 +11,9 @@ makedepends="go bash"
 options="!check chmod-clean net"
 source="$pkgname-$pkgver.tar.gz::https://github.com/k8snetworkplumbingwg/$pkgname/archive/refs/tags/v$pkgver.tar.gz"
 
+export CGO_ENABLED=0
+export GO111MODULE=on
+
 build() {
   DEST_DIR="bin"