# Exam host: a kind node (kubeadm, kubelet, containerd, static-pod control plane) on Ubuntu 24.04,
# as the exam's hosts are, that you reach with `ssh <host>` as `candidate`, carrying the tools the
# real exam hosts have. Built once per Kubernetes minor by `./ksim build`; every question gets its
# own cluster from this image.
ARG BASE
ARG ETCD_IMAGE
FROM ${ETCD_IMAGE} AS etcd
FROM ${BASE} AS kind

# kind's node image is Debian: kind's images/base/Dockerfile (v0.33.0) on debian:trixie-slim, plus
# Kubernetes. This is the same node on Ubuntu. kind's packages and systemd trimming are done here;
# what does not depend on the distribution is copied from kind's image: its scripts and units,
# containerd, runc, crictl, the CNI plugins and the preloaded images. Kubernetes itself comes from
# pkgs.k8s.io below, as on a node installed with kubeadm - and with it the kubernetes-cni package,
# whose plugins (the same release) take the place of kind's.
FROM docker.io/library/ubuntu:24.04
# Ubuntu's container image is minimized: no man pages, and `man` a stub. The exam hosts have them
# ("man and man pages for further documentation"), so they come back the way `unminimize` does it;
# docs and translations stay out. Its user `ubuntu` holds uid 1000, which is the candidate's.
RUN printf 'path-exclude=/usr/share/doc/*\npath-include=/usr/share/doc/*/copyright\npath-exclude=/usr/share/locale/*/LC_MESSAGES/*.mo\n' \
      > /etc/dpkg/dpkg.cfg.d/excludes \
 && rm -f /usr/bin/man && dpkg-divert --quiet --remove --rename /usr/bin/man \
 && userdel -r ubuntu \
 && apt-get update \
 && dpkg -S /usr/share/man/ | sed 's|, |\n|g;s|: [^:]*$||' | DEBIAN_FRONTEND=noninteractive xargs apt-get install --reinstall -y -qq \
 && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
      systemd \
      conntrack iptables nftables iproute2 ethtool util-linux mount kmod \
      libseccomp2 pigz fuse-overlayfs \
      nfs-common open-iscsi \
      e2fsprogs \
      bash ca-certificates curl jq procps \
      man-db manpages \
 && rm -rf /var/lib/apt/lists/*
COPY --from=kind /kind/ /kind/
COPY --from=kind /LICENSES/ /LICENSES/
COPY --from=kind /usr/local/bin/ /usr/local/bin/
COPY --from=kind /usr/local/sbin/runc /usr/local/sbin/
COPY --from=kind /opt/cni/ /opt/cni/
COPY --from=kind /etc/containerd/ /etc/containerd/
COPY --from=kind /etc/crictl.yaml /etc/
COPY --from=kind /etc/default/kubelet /etc/default/
COPY --from=kind /etc/sysctl.d/10-network-magic.conf /etc/sysctl.d/10-network-security.conf /etc/sysctl.d/
COPY --from=kind /etc/systemd/system/containerd.service /etc/systemd/system/containerd-fuse-overlayfs.service \
     /etc/systemd/system/kubelet.service /etc/systemd/system/kubelet.slice /etc/systemd/system/undo-mount-hacks.service \
     /etc/systemd/system/
COPY --from=kind /etc/systemd/system/kubelet.service.d/ /etc/systemd/system/kubelet.service.d/
COPY --from=kind /var/lib/containerd/ /var/lib/containerd/
RUN find /lib/systemd/system/sysinit.target.wants/ -name "systemd-tmpfiles-setup.service" -delete \
 && rm -f /lib/systemd/system/multi-user.target.wants/* \
 && rm -f /etc/systemd/system/*.wants/* \
 && rm -f /lib/systemd/system/local-fs.target.wants/* \
 && rm -f /lib/systemd/system/sockets.target.wants/*udev* \
 && rm -f /lib/systemd/system/sockets.target.wants/*initctl* \
 && rm -f /lib/systemd/system/basic.target.wants/* \
 && echo "ReadKMsg=no" >> /etc/systemd/journald.conf \
 && ln -sf /usr/lib/systemd/systemd /sbin/init \
 && systemctl enable kubelet.service containerd.service undo-mount-hacks.service \
 && systemctl mask systemd-binfmt.service \
 && mkdir -p /etc/kubernetes/manifests
ENV container=docker
STOPSIGNAL SIGRTMIN+3
ENTRYPOINT ["/usr/local/bin/entrypoint", "/sbin/init"]

# etcdctl/etcdutl at exactly the version of the cluster's etcd (the etcd image itself is distroless)
COPY --from=etcd /usr/local/bin/etcdctl /usr/local/bin/etcdutl /usr/local/bin/
RUN apt-get update \
 && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
      openssh-server dbus sudo vim nano less jq tmux bash-completion curl wget ca-certificates gnupg \
      iputils-ping dnsutils netcat-openbsd psmisc tree openssl git bsdextrautils xxd \
      podman netavark aardvark-dns \
 && rm -rf /var/lib/apt/lists/* \
 # A podman package may ship a CNI config. The kubelet would take it for the cluster's pod network
 # until kindnet has written its own, and the first Pods would land on podman's bridge.
 && rm -f /etc/cni/net.d/87-podman-bridge.conflist \
 && touch /etc/containers/nodocker

# --- Kubernetes as packages -------------------------------------------------------------------
# kubelet, kubeadm and kubectl of the cluster's version from pkgs.k8s.io, held, with the repository
# of their minor - as on an exam node. An upgrade is then `apt-get install` and `kubeadm upgrade`,
# as on the day, and a task can hold a node back on an older release. kind's kubelet unit and
# drop-ins live in /etc/systemd and keep taking precedence over the package's.
ARG K8S_VERSION
ARG K8S_MINOR
RUN mkdir -p /etc/apt/keyrings \
 && curl -fsSL "https://pkgs.k8s.io/core:/stable:/${K8S_MINOR}/deb/Release.key" | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg \
 && echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/${K8S_MINOR}/deb/ /" > /etc/apt/sources.list.d/kubernetes.list \
 # kubeadm refuses to upgrade a node without the cpuset cgroup controller, which a rootless
 # container does not get. The packaged binary is diverted and a wrapper (rootfs/usr/bin/kubeadm)
 # passes --ignore-preflight-errors=SystemVerification to `kubeadm upgrade`, so the candidate
 # types the same commands as on a real node. The diversion survives package upgrades.
 && dpkg-divert --add --rename --divert /usr/bin/kubeadm.real /usr/bin/kubeadm \
 && apt-get update \
 && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends -o Dpkg::Options::=--force-confold \
      "kubelet=${K8S_VERSION}-*" "kubeadm=${K8S_VERSION}-*" "kubectl=${K8S_VERSION}-*" \
 && apt-mark hold kubelet kubeadm kubectl \
 && rm -rf /var/lib/apt/lists/* \
 && test -x /usr/bin/kubeadm.real
ARG HELM_VERSION
RUN arch="$(dpkg --print-architecture)" \
 && curl -fsSL "https://get.helm.sh/helm-${HELM_VERSION}-linux-${arch}.tar.gz" \
      | tar -xz -C /usr/local/bin --strip-components=1 "linux-${arch}/helm" \
 && curl -fsSL -o /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/latest/download/yq_linux_${arch}" \
 && chmod +x /usr/local/bin/yq
COPY rootfs/ /
# uid 1000, passwordless sudo: the exam gives you `candidate` and expects `sudo -i` for node work
RUN chmod 755 /usr/bin/kubeadm \
 && useradd -m -s /bin/bash -u 1000 candidate \
 && echo 'candidate ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/candidate && chmod 440 /etc/sudoers.d/candidate \
 && cp /etc/skel/.vimrc /root/.vimrc \
 && echo '. /etc/exam.bashrc' >> /etc/bash.bashrc \
 # sshd as a service of its own: Ubuntu 24.04 would start it from ssh.socket on the first
 # connection, and a host that is up should be listening
 && (systemctl disable ssh.socket 2>/dev/null || true) && systemctl enable ssh.service \
 # registry mirrors are read from /etc/containerd/certs.d (see docker.io/hosts.toml there)
 && printf '\n[plugins."io.containerd.grpc.v1.cri".registry]\n  config_path = "/etc/containerd/certs.d"\n' >> /etc/containerd/config.toml \
 # Installing dbus stamps the image with a D-Bus machine id, and systemd-machine-id-setup (run by
 # kind's entrypoint on every boot) copies that into /etc/machine-id instead of making a new one:
 # every node would share one machine id, derive the same eth0 MAC from it, and be unreachable from
 # its neighbours. Point it at /etc/machine-id, as a stock Ubuntu does, so each node gets its own.
 && rm -f /var/lib/dbus/machine-id && ln -s /etc/machine-id /var/lib/dbus/machine-id
