[CKS] script to generate cks images with cilium as default CNI by ewerton-silva00 · Pull Request #12619 · apache/cloudstack

ewerton-silva00 · 2026-02-09T21:40:25Z

…a default CNI

Description

This PR fixes #9304.

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

The script in question generates CloudStack Kubernetes Service (CKS) images using Cilium as the default CNI.

Additionally, the other components are up-to-date.

You can also use ready-made images from my repository.. See: https://download.suanuvem.io/cks/

…a default CNI

boring-cyborg · 2026-02-09T21:40:28Z

Congratulations on your first Pull Request and welcome to the Apache CloudStack community! If you have any issues or are unsure about any anything please check our Contribution Guide (https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md)
Here are some useful points:

In case of a new feature add useful documentation (raise doc PR at https://github.com/apache/cloudstack-documentation)
Be patient and persistent. It might take some time to get a review or get the final approval from the committers.
Pay attention to the quality of your code, ensure tests are passing and your PR doesn't have conflicts.
Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Issues, Mailing list and Slack.
Be sure to read the CloudStack Coding Conventions.
Apache CloudStack is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: [email protected] (https://cloudstack.apache.org/mailing-lists.html)
Slack: https://apachecloudstack.slack.com/

sureshanaparti · 2026-02-10T04:59:32Z

@blueorangutan package

blueorangutan · 2026-02-10T05:00:04Z

@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

codecov · 2026-02-10T05:07:56Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 17.94%. Comparing base (d3e1976) to head (9362ba8).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #12619      +/-   ##
============================================
+ Coverage     17.90%   17.94%   +0.04%     
- Complexity    16094    16165      +71     
============================================
  Files          5938     5939       +1     
  Lines        532864   533015     +151     
  Branches      65192    65218      +26     
============================================
+ Hits          95392    95649     +257     
+ Misses       426793   426638     -155     
- Partials      10679    10728      +49

Flag	Coverage Δ
uitests	`3.67% <ø> (-0.01%)`	⬇️
unittests	`19.05% <ø> (+0.04%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

blueorangutan · 2026-02-10T05:41:55Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✖️ debian ✔️ suse15. SL-JID 16769

Copilot

Pull request overview

Adds a new utility script to generate CloudStack Kubernetes Service (CKS) “binaries ISO” images that bundle Kubernetes components plus manifests/images needed to run with Cilium as the default CNI, addressing the requested Cilium support in #9304.

Changes:

Introduces create-kubernetes-binaries-iso-with-cilium.sh to build an ISO with Kubernetes binaries, CNI/crictl, addons/manifests, and pre-pulled container images.
Generates the Cilium manifest via Helm with a set of default Cilium configuration values.
Updates image collection/pulling logic to include images referenced by generated Cilium and Dashboard manifests.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

scripts/util/create-kubernetes-binaries-iso-with-cilium.sh

Copilot · 2026-02-10T07:46:10Z

scripts/util/create-kubernetes-binaries-iso-with-cilium.sh

+      sudo $PKG_MGR --assumeyes remove docker-common docker container-selinux docker-selinux docker-engine
+      sudo $PKG_MGR --assumeyes install lvm2 device-mapper device-mapper-persistent-data device-mapper-event device-mapper-libs device-mapper-event-libs
+      sudo $PKG_MGR --assumeyes install http://mirror.centos.org/centos/7/extras/x86_64/Packages/container-selinux-2.107-3.el7.noarch.rpm
+      sudo $PKG_MGR --assumeyes install containerd.io
+    elif [ -f /etc/debian_version ] || command -v apt-get > /dev/null 2>&1; then


RedHat install path downloads a container-selinux RPM from a CentOS 7 x86_64 URL. This will fail (and possibly install an incompatible package) on aarch64/arm64, even though the script advertises arm support. Consider selecting the correct arch/repo or using distro-provided packages/repos instead of a hard-coded x86_64 RPM URL.

scripts/util/create-kubernetes-binaries-iso-with-cilium.sh

shwstppr

@ewerton-silva00 can you please check comments from Copilot and look into failing pre-commit GHA?

ewerton-silva00 · 2026-02-12T17:08:44Z

@shwstppr, yes.

I am reviewing the points reported by Copilot.

I will make the necessary adjustments, test, and submit the changes.

* etcd download: use arch variable instead of hard-coded amd64 Replace hard-coded linux-amd64 in etcd tarball download URL and output filename with linux- to support both amd64 and arm64 architectures. * container-selinux: install from distro repos instead of CentOS 7 mirror Remove hard-coded CentOS 7 x86_64 RPM URL for container-selinux and install directly from the system's configured repositories, which handles architecture and version automatically. * build_name: fix dead-code fallback default Check whether parameter is empty before constructing build_name, so the fallback default setup--.iso is actually reachable. * CNI download: fail on HTTP errors for both URL attempts Use curl -f on both primary and legacy CNI download URLs and exit with a clear error if neither succeeds, instead of only checking for 404 on the first attempt. * temp directory: use mktemp and trap for cleanup Replace fixed /tmp/iso with mktemp -d to avoid collisions between concurrent runs, and register a trap EXIT to ensure cleanup on failure or early exit.

ewerton-silva00 · 2026-02-16T18:16:36Z

@shwstppr and @DaanHoogland, could you please review this Pull Request again?

DaanHoogland · 2026-02-17T08:00:00Z

scripts/util/create-kubernetes-binaries-iso-with-cilium.sh

+echo "Downloading etcd ${ETCD_VERSION}..."
+curl -sS -L "https://github.com/etcd-io/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-${ARCH}.tar.gz" -o "${etcd_dir}/etcd-linux-${ARCH}.tar.gz"
+
+mkisofs -o "${output_dir}/${build_name}" -J -R -l "${iso_dir}"


Suggested change

mkisofs -o "${output_dir}/${build_name}" -J -R -l "${iso_dir}"

mkisofs -o "${output_dir}/${build_name}" -J -R -l "${iso_dir}"

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 6 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-17T08:10:19Z

scripts/util/create-kubernetes-binaries-iso-with-cilium.sh

+if [[ $(echo "${2} $VAL" | awk '{print ($1 < $2)}') == 1 ]]; then
+  curl -sSL "https://raw.githubusercontent.com/kubernetes/kubernetes/${RELEASE}/build/debs/kubelet.service" | sed "s:/usr/bin:/opt/bin:g" > "${kubelet_service_file}"
+else
+  curl -sSL "https://raw.githubusercontent.com/shapeblue/cloudstack-nonoss/main/cks/kubelet.service" | sed "s:/usr/bin:/opt/bin:g" > "${kubelet_service_file}"
+fi


The curl | sed > file pipelines can silently succeed even if curl fails (because the pipeline exit status is from sed unless pipefail is set). With set -e alone, this can leave empty/partial kubelet.service (and similarly 10-kubeadm.conf) in the ISO without failing the script. Consider enabling set -o pipefail and/or avoiding pipelines by downloading to a temp file and transforming it after a successful curl --fail.

Copilot · 2026-02-17T08:10:19Z

scripts/util/create-kubernetes-binaries-iso-with-cilium.sh

+if [[ $(echo "${2} $VAL" | awk '{print ($1 < $2)}') == 1 ]]; then
+  curl -sSL "https://raw.githubusercontent.com/kubernetes/kubernetes/${RELEASE}/build/debs/kubelet.service" | sed "s:/usr/bin:/opt/bin:g" > "${kubelet_service_file}"


The Kubernetes version comparison echo "${2} $VAL" | awk '{print ($1 < $2)}' is not a reliable semver comparison (e.g., 1.9.0 is treated as 1.9 and compares as greater than 1.18.0). This can select the wrong source for kubelet.service/10-kubeadm.conf. Use a version-aware compare (e.g., sort -V, dpkg --compare-versions, or parsing major/minor/patch) instead of numeric awk.

Copilot · 2026-02-17T08:10:19Z

scripts/util/create-kubernetes-binaries-iso-with-cilium.sh

+  exit 1
+fi
+
+helm repo add cilium https://helm.cilium.io/ > /dev/null 2>&1 || true


helm repo add ... || true suppresses failures (e.g., network/DNS issues), which can turn an actionable error into a later, less-clear failure during helm template. It’s better to either let helm repo add fail normally or only ignore the specific “already exists” case (e.g., by checking helm repo list).

Suggested change

helm repo add cilium https://helm.cilium.io/ > /dev/null 2>&1 || true

# Add the Cilium Helm repository only if it is not already configured

if ! helm repo list 2>/dev/null | awk 'NR>1 {print $1}' | grep -qx "cilium"; then

helm repo add cilium https://helm.cilium.io/ > /dev/null 2>&1

fi

Copilot · 2026-02-17T08:10:19Z

scripts/util/create-kubernetes-binaries-iso-with-cilium.sh

+curl -sS -L "https://github.com/etcd-io/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-${ARCH}.tar.gz" -o "${etcd_dir}/etcd-linux-${ARCH}.tar.gz"
+


This curl -sS -L download won’t fail the script on HTTP errors (e.g., 404/500) because --fail isn’t used; the ISO could be generated with an HTML error page instead of the etcd tarball. Add --fail/--fail-with-body (and optionally validate the archive) so the script reliably stops on download problems.

Suggested change

curl -sS -L "https://github.com/etcd-io/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-${ARCH}.tar.gz" -o "${etcd_dir}/etcd-linux-${ARCH}.tar.gz"

curl -sS -L --fail "https://github.com/etcd-io/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-${ARCH}.tar.gz" -o "${etcd_dir}/etcd-linux-${ARCH}.tar.gz"

# Validate that the downloaded etcd archive is a valid tar.gz

if ! tar -tzf "${etcd_dir}/etcd-linux-${ARCH}.tar.gz" > /dev/null; then

echo "ERROR: Downloaded etcd archive is invalid or corrupted."

exit 1

fi

Copilot · 2026-02-17T08:10:20Z

scripts/util/create-kubernetes-binaries-iso-with-cilium.sh

+  ARCH="arm64"
+  ARCH_SUFFIX="aarch64"
+else
+  echo "ERROR: ARCH must be 'x86_64' or 'aarch64'."


The ARCH validation error message is inconsistent with the accepted values. The script accepts amd64/arm64 as aliases, but the error only mentions x86_64/aarch64, which can confuse users troubleshooting invalid input. Update the message (and/or the usage text) to reflect all accepted values.

Suggested change

echo "ERROR: ARCH must be 'x86_64' or 'aarch64'."

echo "ERROR: ARCH must be one of: x86_64, amd64, aarch64, or arm64."

Copilot · 2026-02-17T08:10:20Z

scripts/util/create-kubernetes-binaries-iso-with-cilium.sh

+if [[ $(echo "${2} $VAL" | awk '{print ($1 < $2)}') == 1 ]]; then
+  curl -sSL "https://raw.githubusercontent.com/kubernetes/kubernetes/${RELEASE}/build/debs/kubelet.service" | sed "s:/usr/bin:/opt/bin:g" > "${kubelet_service_file}"
+else
+  curl -sSL "https://raw.githubusercontent.com/shapeblue/cloudstack-nonoss/main/cks/kubelet.service" | sed "s:/usr/bin:/opt/bin:g" > "${kubelet_service_file}"
+fi
+
+echo "Downloading 10-kubeadm.conf ${RELEASE}..."
+kubeadm_conf_file="${working_dir}/10-kubeadm.conf"
+touch "${kubeadm_conf_file}"
+if [[ $(echo "${2} $VAL" | awk '{print ($1 < $2)}') == 1 ]]; then
+  curl -sSL "https://raw.githubusercontent.com/kubernetes/kubernetes/${RELEASE}/build/debs/10-kubeadm.conf" | sed "s:/usr/bin:/opt/bin:g" > "${kubeadm_conf_file}"
+else
+  curl -sSL "https://raw.githubusercontent.com/shapeblue/cloudstack-nonoss/main/cks/10-kubeadm.conf" | sed "s:/usr/bin:/opt/bin:g" > "${kubeadm_conf_file}"
+fi


These curl calls fetch kubelet.service and 10-kubeadm.conf directly from the shapeblue GitHub repository main branch at ISO build time and embed them as systemd unit/config files that will later be executed with root privileges. Because they are pinned only to a mutable branch and no checksum or signature verification is performed, a compromise of that repository (or its branch) would silently inject arbitrary code into all clusters built with this script. To reduce supply-chain risk, vendor these files into this repository or pin them to immutable commits/tags and validate their integrity before packaging them into the ISO.

chore(cks): include new script to generate cks images with cilium as …

7fbad05

…a default CNI

DaanHoogland requested a review from Copilot February 10, 2026 07:38

Copilot started reviewing on behalf of DaanHoogland February 10, 2026 07:39 View session

kiranchavala self-assigned this Feb 10, 2026

Copilot AI reviewed Feb 10, 2026

View reviewed changes

shwstppr reviewed Feb 11, 2026

View reviewed changes

DaanHoogland changed the title ~~chore(cks): include new script to generate cks images with cilium as …~~ [CKS] script to generate cks images with cilium as default CNI Feb 13, 2026

DaanHoogland reviewed Feb 17, 2026

View reviewed changes

DaanHoogland requested a review from Copilot February 17, 2026 08:02

Copilot started reviewing on behalf of DaanHoogland February 17, 2026 08:02 View session

Copilot AI reviewed Feb 17, 2026

View reviewed changes

	mkisofs -o "${output_dir}/${build_name}" -J -R -l "${iso_dir}"
	mkisofs -o "${output_dir}/${build_name}" -J -R -l "${iso_dir}"

		if [[ $(echo "${2} $VAL" \| awk '{print ($1 < $2)}') == 1 ]]; then
		curl -sSL "https://raw.githubusercontent.com/kubernetes/kubernetes/${RELEASE}/build/debs/kubelet.service" \| sed "s:/usr/bin:/opt/bin:g" > "${kubelet_service_file}"

		curl -sS -L "https://github.com/etcd-io/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-${ARCH}.tar.gz" -o "${etcd_dir}/etcd-linux-${ARCH}.tar.gz"

-curl -sS -L "https://github.com/etcd-io/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-${ARCH}.tar.gz" -o "${etcd_dir}/etcd-linux-${ARCH}.tar.gz"
+curl -sS -L --fail "https://github.com/etcd-io/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-${ARCH}.tar.gz" -o "${etcd_dir}/etcd-linux-${ARCH}.tar.gz"
+# Validate that the downloaded etcd archive is a valid tar.gz
+if ! tar -tzf "${etcd_dir}/etcd-linux-${ARCH}.tar.gz" > /dev/null; then
+    echo "ERROR: Downloaded etcd archive is invalid or corrupted."
+    exit 1
+fi

	echo "ERROR: ARCH must be 'x86_64' or 'aarch64'."
	echo "ERROR: ARCH must be one of: x86_64, amd64, aarch64, or arm64."

Conversation

ewerton-silva00 commented Feb 9, 2026

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

Uh oh!

boring-cyborg bot commented Feb 9, 2026

Uh oh!

sureshanaparti commented Feb 10, 2026

Uh oh!

blueorangutan commented Feb 10, 2026

Uh oh!

codecov bot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

blueorangutan commented Feb 10, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

shwstppr left a comment

Choose a reason for hiding this comment

Uh oh!

ewerton-silva00 commented Feb 12, 2026

Uh oh!

ewerton-silva00 commented Feb 16, 2026

Uh oh!

DaanHoogland Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

codecov bot commented Feb 10, 2026 •

edited

Loading

DaanHoogland Feb 17, 2026 •

edited

Loading