# Exam host: a kind node (kubeadm, kubelet, containerd, static-pod control plane) on Ubuntu 24.04, # as the exam's hosts are, that you reach with `ssh ` as `candidate`, carrying the tools the # real exam hosts have. Built once per Kubernetes minor by `./ksim build`; every question gets its # own cluster from this image. ARG BASE ARG ETCD_IMAGE FROM ${ETCD_IMAGE} AS etcd FROM ${BASE} AS kind # kind's node image is Debian: kind's images/base/Dockerfile (v0.33.0) on debian:trixie-slim, plus # Kubernetes. This is the same node on Ubuntu. kind's packages and systemd trimming are done here; # what does not depend on the distribution is copied from kind's image: its scripts and units, # containerd, runc, crictl, the CNI plugins and the preloaded images. Kubernetes itself comes from # pkgs.k8s.io below, as on a node installed with kubeadm - and with it the kubernetes-cni package, # whose plugins (the same release) take the place of kind's. FROM docker.io/library/ubuntu:24.04 # Ubuntu's container image is minimized: no man pages, and `man` a stub. The exam hosts have them # ("man and man pages for further documentation"), so they come back the way `unminimize` does it; # docs and translations stay out. Its user `ubuntu` holds uid 1000, which is the candidate's. RUN printf 'path-exclude=/usr/share/doc/*\npath-include=/usr/share/doc/*/copyright\npath-exclude=/usr/share/locale/*/LC_MESSAGES/*.mo\n' \ > /etc/dpkg/dpkg.cfg.d/excludes \ && rm -f /usr/bin/man && dpkg-divert --quiet --remove --rename /usr/bin/man \ && userdel -r ubuntu \ && apt-get update \ && dpkg -S /usr/share/man/ | sed 's|, |\n|g;s|: [^:]*$||' | DEBIAN_FRONTEND=noninteractive xargs apt-get install --reinstall -y -qq \ && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ systemd \ conntrack iptables nftables iproute2 ethtool util-linux mount kmod \ libseccomp2 pigz fuse-overlayfs \ nfs-common open-iscsi \ e2fsprogs \ bash ca-certificates curl jq procps \ man-db manpages \ && rm -rf /var/lib/apt/lists/* COPY --from=kind /kind/ /kind/ COPY --from=kind /LICENSES/ /LICENSES/ COPY --from=kind /usr/local/bin/ /usr/local/bin/ COPY --from=kind /usr/local/sbin/runc /usr/local/sbin/ COPY --from=kind /opt/cni/ /opt/cni/ COPY --from=kind /etc/containerd/ /etc/containerd/ COPY --from=kind /etc/crictl.yaml /etc/ COPY --from=kind /etc/default/kubelet /etc/default/ COPY --from=kind /etc/sysctl.d/10-network-magic.conf /etc/sysctl.d/10-network-security.conf /etc/sysctl.d/ COPY --from=kind /etc/systemd/system/containerd.service /etc/systemd/system/containerd-fuse-overlayfs.service \ /etc/systemd/system/kubelet.service /etc/systemd/system/kubelet.slice /etc/systemd/system/undo-mount-hacks.service \ /etc/systemd/system/ COPY --from=kind /etc/systemd/system/kubelet.service.d/ /etc/systemd/system/kubelet.service.d/ COPY --from=kind /var/lib/containerd/ /var/lib/containerd/ RUN find /lib/systemd/system/sysinit.target.wants/ -name "systemd-tmpfiles-setup.service" -delete \ && rm -f /lib/systemd/system/multi-user.target.wants/* \ && rm -f /etc/systemd/system/*.wants/* \ && rm -f /lib/systemd/system/local-fs.target.wants/* \ && rm -f /lib/systemd/system/sockets.target.wants/*udev* \ && rm -f /lib/systemd/system/sockets.target.wants/*initctl* \ && rm -f /lib/systemd/system/basic.target.wants/* \ && echo "ReadKMsg=no" >> /etc/systemd/journald.conf \ && ln -sf /usr/lib/systemd/systemd /sbin/init \ && systemctl enable kubelet.service containerd.service undo-mount-hacks.service \ && systemctl mask systemd-binfmt.service \ && mkdir -p /etc/kubernetes/manifests ENV container=docker STOPSIGNAL SIGRTMIN+3 ENTRYPOINT ["/usr/local/bin/entrypoint", "/sbin/init"] # etcdctl/etcdutl at exactly the version of the cluster's etcd (the etcd image itself is distroless) COPY --from=etcd /usr/local/bin/etcdctl /usr/local/bin/etcdutl /usr/local/bin/ RUN apt-get update \ && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ openssh-server dbus sudo vim nano less jq tmux bash-completion curl wget ca-certificates gnupg \ iputils-ping dnsutils netcat-openbsd psmisc tree openssl git bsdextrautils xxd \ podman netavark aardvark-dns \ && rm -rf /var/lib/apt/lists/* \ # A podman package may ship a CNI config. The kubelet would take it for the cluster's pod network # until kindnet has written its own, and the first Pods would land on podman's bridge. && rm -f /etc/cni/net.d/87-podman-bridge.conflist \ && touch /etc/containers/nodocker # --- Kubernetes as packages ------------------------------------------------------------------- # kubelet, kubeadm and kubectl of the cluster's version from pkgs.k8s.io, held, with the repository # of their minor - as on an exam node. An upgrade is then `apt-get install` and `kubeadm upgrade`, # as on the day, and a task can hold a node back on an older release. kind's kubelet unit and # drop-ins live in /etc/systemd and keep taking precedence over the package's. ARG K8S_VERSION ARG K8S_MINOR RUN mkdir -p /etc/apt/keyrings \ && curl -fsSL "https://pkgs.k8s.io/core:/stable:/${K8S_MINOR}/deb/Release.key" | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg \ && echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/${K8S_MINOR}/deb/ /" > /etc/apt/sources.list.d/kubernetes.list \ # kubeadm refuses to upgrade a node without the cpuset cgroup controller, which a rootless # container does not get. The packaged binary is diverted and a wrapper (rootfs/usr/bin/kubeadm) # passes --ignore-preflight-errors=SystemVerification to `kubeadm upgrade`, so the candidate # types the same commands as on a real node. The diversion survives package upgrades. && dpkg-divert --add --rename --divert /usr/bin/kubeadm.real /usr/bin/kubeadm \ && apt-get update \ && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends -o Dpkg::Options::=--force-confold \ "kubelet=${K8S_VERSION}-*" "kubeadm=${K8S_VERSION}-*" "kubectl=${K8S_VERSION}-*" \ && apt-mark hold kubelet kubeadm kubectl \ && rm -rf /var/lib/apt/lists/* \ && test -x /usr/bin/kubeadm.real ARG HELM_VERSION RUN arch="$(dpkg --print-architecture)" \ && curl -fsSL "https://get.helm.sh/helm-${HELM_VERSION}-linux-${arch}.tar.gz" \ | tar -xz -C /usr/local/bin --strip-components=1 "linux-${arch}/helm" \ && curl -fsSL -o /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/latest/download/yq_linux_${arch}" \ && chmod +x /usr/local/bin/yq COPY rootfs/ / # uid 1000, passwordless sudo: the exam gives you `candidate` and expects `sudo -i` for node work RUN chmod 755 /usr/bin/kubeadm \ && useradd -m -s /bin/bash -u 1000 candidate \ && echo 'candidate ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/candidate && chmod 440 /etc/sudoers.d/candidate \ && cp /etc/skel/.vimrc /root/.vimrc \ && echo '. /etc/exam.bashrc' >> /etc/bash.bashrc \ # sshd as a service of its own: Ubuntu 24.04 would start it from ssh.socket on the first # connection, and a host that is up should be listening && (systemctl disable ssh.socket 2>/dev/null || true) && systemctl enable ssh.service \ # registry mirrors are read from /etc/containerd/certs.d (see docker.io/hosts.toml there) && printf '\n[plugins."io.containerd.grpc.v1.cri".registry]\n config_path = "/etc/containerd/certs.d"\n' >> /etc/containerd/config.toml \ # Installing dbus stamps the image with a D-Bus machine id, and systemd-machine-id-setup (run by # kind's entrypoint on every boot) copies that into /etc/machine-id instead of making a new one: # every node would share one machine id, derive the same eth0 MAC from it, and be unreachable from # its neighbours. Point it at /etc/machine-id, as a stock Ubuntu does, so each node gets its own. && rm -f /var/lib/dbus/machine-id && ln -s /etc/machine-id /var/lib/dbus/machine-id