# CKS exam host: the common exam host (images/node) plus what the CKS hosts carry - the scanners,
# a sandbox runtime, a service mesh client, and Kubernetes installed as real packages so that an
# upgrade is `apt-get install` and `kubeadm upgrade`, as on the day. Built by `./ksim build cks`.
ARG BASE
FROM ${BASE}
RUN apt-get update \
 && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
      python3-minimal bsdextrautils binutils xxd strace file bzip2 gnupg conntrack tcpdump lsof kmod vsftpd \
 && rm -rf /var/lib/apt/lists/* \
 # vsftpd is here to be found and removed in a task; it must not run on every host
 && (systemctl disable vsftpd >/dev/null 2>&1 || true) \
 && rm -f /etc/systemd/system/multi-user.target.wants/vsftpd.service

# --- Kubernetes as packages -------------------------------------------------------------------
# A kind node carries kubelet, kubeadm and kubectl as loose binaries. Installing the same version
# from pkgs.k8s.io puts them under dpkg, so a task can hold a node back on an older patch release
# and the candidate upgrades it the documented way. kind's own kubelet unit and drop-ins live in
# /etc/systemd and keep taking precedence over the package's.
ARG K8S_VERSION
ARG K8S_MINOR
RUN mkdir -p /etc/apt/keyrings \
 && curl -fsSL "https://pkgs.k8s.io/core:/stable:/${K8S_MINOR}/deb/Release.key" | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg \
 && echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/${K8S_MINOR}/deb/ /" > /etc/apt/sources.list.d/kubernetes.list \
 # kubeadm refuses to upgrade a node without the cpuset cgroup controller, which a rootless
 # container does not get. The packaged binary is diverted and a wrapper (rootfs/usr/bin/kubeadm)
 # passes --ignore-preflight-errors=SystemVerification to `kubeadm upgrade`, so the candidate
 # types the same commands as on a real node. The diversion survives package upgrades.
 && dpkg-divert --add --rename --divert /usr/bin/kubeadm.real /usr/bin/kubeadm \
 && apt-get update \
 && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends -o Dpkg::Options::=--force-confold \
      "kubelet=${K8S_VERSION}-*" "kubeadm=${K8S_VERSION}-*" "kubectl=${K8S_VERSION}-*" \
 && apt-mark hold kubelet kubeadm kubectl \
 && rm -rf /var/lib/apt/lists/* \
 && test -x /usr/bin/kubeadm.real

# --- CKS tools --------------------------------------------------------------------------------
ARG KUBE_BENCH=0.16.0
ARG TRIVY=0.75.0
ARG KUBESEC=2.15.0
ARG KUBE_LINTER=0.8.3
ARG BOM=0.8.0
ARG COSIGN=3.1.3
ARG ISTIO=1.31.1
ARG GVISOR=20261005
RUN cd /tmp && G=https://github.com \
 && curl -fsSL "$G/aquasecurity/kube-bench/releases/download/v${KUBE_BENCH}/kube-bench_${KUBE_BENCH}_linux_amd64.tar.gz" | tar -xz kube-bench cfg \
 && install -m755 kube-bench /usr/local/bin/ && mkdir -p /etc/kube-bench && rm -rf /etc/kube-bench/cfg && mv cfg /etc/kube-bench/cfg && rm -f kube-bench \
 && curl -fsSL "$G/aquasecurity/trivy/releases/download/v${TRIVY}/trivy_${TRIVY}_Linux-64bit.tar.gz" | tar -xz -C /usr/local/bin trivy \
 && curl -fsSL "$G/controlplaneio/kubesec/releases/download/v${KUBESEC}/kubesec_linux_amd64.tar.gz" | tar -xz -C /usr/local/bin kubesec \
 && curl -fsSL "$G/stackrox/kube-linter/releases/download/v${KUBE_LINTER}/kube-linter-linux.tar.gz" | tar -xz -C /usr/local/bin kube-linter \
 && curl -fsSL -o /usr/local/bin/bom "$G/kubernetes-sigs/bom/releases/download/v${BOM}/bom-amd64-linux" \
 && curl -fsSL -o /usr/local/bin/cosign "$G/sigstore/cosign/releases/download/v${COSIGN}/cosign-linux-amd64" \
 && curl -fsSL "$G/istio/istio/releases/download/${ISTIO}/istioctl-${ISTIO}-linux-amd64.tar.gz" | tar -xz -C /usr/local/bin istioctl \
 && curl -fsSL "https://storage.googleapis.com/gvisor/releases/release/${GVISOR}/x86_64/gvisor.tar.bz2" | tar -xj -C /usr/local/bin \
 && chmod 755 /usr/local/bin/* \
 && chown -R root:root /usr/local/bin /etc/kube-bench

COPY rootfs/ /
RUN chmod 755 /usr/bin/kubeadm \
 # gVisor as a second runtime handler ("runsc") beside runc; a RuntimeClass selects it
 && printf '\n[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc]\n  runtime_type = "io.containerd.runsc.v1"\n  [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc.options]\n    TypeUrl = "io.containerd.runsc.v1.options"\n    ConfigPath = "/etc/containerd/runsc.toml"\n' >> /etc/containerd/config.toml \
 # trivy reads /etc/trivy.yaml (the Docker Hub cache as a mirror, one cache directory for all
 # users), for logins and for sudo alike
 && install -d -m 1777 /var/lib/trivy \
 && echo 'TRIVY_CONFIG=/etc/trivy.yaml' >> /etc/environment \
 && echo 'export TRIVY_CONFIG=/etc/trivy.yaml' >> /etc/exam.bashrc