aliyuncontainerservice / ackdistro Goto Github PK
View Code? Open in Web Editor NEWLicense: Apache License 2.0
License: Apache License 2.0
Hello!
I hope you are doing well!
We are a security research team. Our tool automatically detected a vulnerability in this repository. We want to disclose it responsibly. GitHub has a feature called Private vulnerability reporting, which enables security research to privately disclose a vulnerability. Unfortunately, it is not enabled for this repository.
Can you enable it, so that we can report it?
Thanks in advance!
PS: you can read about how to enable private vulnerability reporting here: https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository
Detail Log:
2023-08-11 11:25:47 [INFO] Start pre-flight...
2023-08-11 11:25:47 [INFO] Start parsing and validating trident config from /root/.sealer/Clusterfile
2023-08-11 11:25:47 [INFO] failed to get kube client, think it is first time installation
2023-08-11 11:25:47 [INFO] Start parsing site info...
2023-08-11 11:25:51 [INFO] Start validating cluster...
2023-08-11 11:25:51 [INFO] Start running cluster scope validators...
2023-08-11 11:25:51 [INFO] Start running cluster validator HostNameDuplicate...
2023-08-11 11:25:51 [INFO] Start running cluster validator TimeDiff...
2023-08-11 11:25:52 [INFO] Start running agent validators...
2023-08-11 11:26:14 [WARN] [Validator:OS on host:192.168.3.121] fails: kernel version 4.19.284-0419284-generic cannot be marshal, please contact us for help, but since --ignore-errors is configured, this failure has been ignored.
2023-08-11 11:26:14 [WARN] [Validator:OS on host:192.168.3.122] fails: kernel version 4.19.284-0419284-generic cannot be marshal, please contact us for help, but since --ignore-errors is configured, this failure has been ignored.
2023-08-11 11:26:14 [WARN] [Validator:OS on host:192.168.3.123] fails: kernel version 4.19.284-0419284-generic cannot be marshal, please contact us for help, but since --ignore-errors is configured, this failure has been ignored.
2023-08-11 11:26:14 [INFO] Starting dumping validate report anyway...
Trident version 1.14.3, Build: d1412075 go1.17.2, Build time: 2023-03-31-11-37-07, EnableLicense: false, Log file: /var/lib/sealer/data/my-cluster/rootfs/trident_log_2023-08-11T11-25-47+08-00
failed to validate cluster:
[Validator:SystemTools on host:192.168.3.121] fails: missing system tools: [setenforce] on this node, please install them first, please check your cluster and fix this error. Or, if you know what you are doing, you can run with flag [--env IgnoreErrors="OS||SystemTools"] to ignore it.
[Validator:SystemTools on host:192.168.3.122] fails: missing system tools: [setenforce] on this node, please install them first, please check your cluster and fix this error. Or, if you know what you are doing, you can run with flag [--env IgnoreErrors="OS||SystemTools"] to ignore it.
[Validator:SystemTools on host:192.168.3.123] fails: missing system tools: [setenforce] on this node, please install them first, please check your cluster and fix this error. Or, if you know what you are doing, you can run with flag [--env IgnoreErrors="OS||SystemTools"] to ignore it.
[Validator:TimeSyncService on host:192.168.3.121] fails: either chronyd and ntpd not set in this host, please check your cluster and fix this error. Or, if you know what you are doing, you can run with flag [--env IgnoreErrors="OS||TimeSyncService"] to ignore it.
[Validator:TimeSyncService on host:192.168.3.122] fails: either chronyd and ntpd not set in this host, please check your cluster and fix this error. Or, if you know what you are doing, you can run with flag [--env IgnoreErrors="OS||TimeSyncService"] to ignore it.
[Validator:TimeSyncService on host:192.168.3.123] fails: either chronyd and ntpd not set in this host, please check your cluster and fix this error. Or, if you know what you are doing, you can run with flag [--env IgnoreErrors="OS||TimeSyncService"] to ignore it.
[Validator:KernelFlags on host:192.168.3.121] fails:
invalid kernel flag: kernel/panic_on_oops, expected value: [1], actual value: 0
, please check your cluster and fix this error. Or, if you know what you are doing, you can run with flag [--env IgnoreErrors="OS||KernelFlags"] to ignore it.
[Validator:KernelFlags on host:192.168.3.122] fails:
invalid kernel flag: kernel/panic_on_oops, expected value: [1], actual value: 0
, please check your cluster and fix this error. Or, if you know what you are doing, you can run with flag [--env IgnoreErrors="|OS|KernelFlags"] to ignore it.
[Validator:KernelFlags on host:192.168.3.123] fails:
invalid kernel flag: kernel/panic_on_oops, expected value: [1], actual value: 0
, please check your cluster and fix this error. Or, if you know what you are doing, you can run with flag [--env IgnoreErrors="OS||KernelFlags"] to ignore it..
You can see entire survey report in /var/lib/sealer/data/my-cluster/rootfs/site-survey-report.yaml
cat /etc/os-release
):Ubuntu 18.04.6 LTSuname -a
):4.19.284-0419284-genericI isure install chronyd Or ntpd and check /var/lib/sealer/data/my-cluster/rootfs/site-survey-report.yaml
I don't know the location of the executed script,like ansible ,I know how it works。
Hope for help
Summarizing 6 Failures:
[Fail] [sig-apps] Daemon set [Serial] [It] should rollback without unnecessary restarts [Conformance]
/workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/apps/daemon_set.go:418
[Fail] [sig-scheduling] SchedulerPredicates [Serial] [It] validates resource limits of pods that are allowed to run [Conformance]
/workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/scheduling/predicates.go:325
[Fail] [sig-scheduling] SchedulerPreemption [Serial] [It] validates lower priority pod preemption by critical pod [Conformance]
/workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/vendor/github.com/onsi/ginkgo/internal/leafnodes/runner.go:113
[Fail] [sig-scheduling] SchedulerPredicates [Serial] [It] validates that there exists conflict between pods with same hostPort and protocol but one using 0.0.0.0 hostIP [Conformance]
/workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/scheduling/predicates.go:1123
[Fail] [sig-scheduling] SchedulerPreemption [Serial] [It] validates basic preemption works [Conformance]
/workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/vendor/github.com/onsi/ginkgo/internal/leafnodes/runner.go:113
[Fail] [sig-scheduling] SchedulerPredicates [Serial] [It] validates that NodeSelector is respected if not matching [Conformance]
/workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/scheduling/predicates.go:438
Ran 309 of 5667 Specs in 6177.341 seconds
FAIL! -- 303 Passed | 6 Failed | 0 Pending | 5358 Skipped
--- FAIL: TestE2E (6177.45s)
FAIL
Ginkgo ran 1 suite in 1h42m59.12647752s
Test Suite Failed
2022/07/01 07:40:54 Saving results at /tmp/sonobuoy/results
2022/07/01 07:40:54 running command: exit status 1
将ackdistro的k8s升级到1.22的使用手册
Type: feature request
ARM arch support
How to get the cluster configuration file in the master node
Pulling the image from sea.hub:5000
reports an error
http: server gave HTTP response to HTTPS client
You need to modify the /etc/docker/daemon.json
file, add { "insecure-registries":["sea.hub:5000"] }
configuration, then load the configuration and restart docker
systemctl daemon-reload
systemctl restart docker
Run the installation command again, the installation is complete
# kubectl get cs
Warning: v1 ComponentStatus is deprecated in v1.19+
NAME STATUS MESSAGE ERROR
etcd-2 Healthy ok
controller-manager Healthy ok
scheduler Healthy ok
etcd-0 Healthy ok
etcd-1 Healthy ok
Type: feature request
将ackdistro升级到1.22以后构建arm64镜像并测试
Type: feature request
Type: feature request
Could ACK-distro provide the roadmap details?
Will we support kubernetes 1.21 soon?
Type: feature request
containerd --version
containerd.sh: line 13: containerd: command not found
++ utils_get_distribution
++ lsb_dist=
++ '[' -r /etc/os-release ']'
+++ . /etc/os-release
++++ NAME='Alibaba Cloud Linux'
++++ VERSION='3 (Soaring Falcon)'
++++ ID=alinux
++++ ID_LIKE='rhel fedora centos anolis'
++++ VERSION_ID=3
++++ PLATFORM_ID=platform:al8
++++ PRETTY_NAME='Alibaba Cloud Linux 3 (Soaring Falcon)'
++++ ANSI_COLOR='0;31'
++++ HOME_URL=https://www.aliyun.com/
+++ echo alinux
++ lsb_dist=alinux
++ echo alinux
lsb_dist=alinux
++ echo alinux
++ tr '[:upper:]' '[:lower:]'
lsb_dist=alinux
echo 'current system is alinux'
current system is alinux
case "${lsb_dist}" in
utils_error 'unknown system to use /etc/systemd/system/containerd.service'
containerd.sh: line 51: utils_error: command not found
cat /etc/os-release
): Alibaba Cloud Linux 3 (Soaring Falcon)uname -a
): Linux iZbp1efisqbwapk8hs5w8cZ 5.10.134-12.al8.x86_64 #1 SMP Tue Sep 6 14:59:57 CST 2022 x86_64 x86_64 x86_64 GNU/Linux在两个环境同时部署,
环境1:
环境2:
测试利用到ginkgo去调用sealer run test module --->正在调研中
触发条件:
issue触发:获取到触发命令带tag
自动化构建--->sh /root/ackdistro/build/build.sh $tag
等待构建完成以后会自动回复 auto-build success
delete cluster after default test
e2e: e2e test
noe2e: no e2e test
hold: save cluster
Basic test
/test imageName calico/hybridnet noe2e
Basic test and save cluster
/test imageName calico/hybridnet noe2e hold
Basic test + e2e
/test imageName calico/hybridnet e2e
Basic test + e2e and save cluster
/test imageName calico/hybridnet e2e hold
level=warning msg="Error getting v2 registry: Get https://sea.hub:5000/v2/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)"
Do you support upgrading versions of K8s and sckdistro?
Type: bug report
cat /etc/os-release
):uname -a
):sealer run -f ClusterFile
failed, could not find disk that exists
Type: bug report
Trident version 1.14.3, Build: d1412075 go1.17.2, Build time: 2023-03-31-11-38-17, EnableLicense: false, Log file: /var/lib/sealer/data/my-cluster/rootfs/trident_log_2023-04-07T11-53-58+08-00
failed to validate cluster:
[Validator:InstanceResource on host:172.25.132.244] fails: [FATAL] failed to find device /dev/nvme1n1, which is assigned as StorageDevice;device /dev/nvme1n1, which is assigned as StorageDevice, need 150 GB, but only has 0.00 GB. You can 'lsblk' on host 172.25.132.244 to choose an right disk, and this error can't be ignored, please check your cluster.
[Validator:InstanceResource on host:172.25.132.246] fails: [FATAL] failed to find device /dev/nvme1n1, which is assigned as StorageDevice;device /dev/nvme1n1, which is assigned as StorageDevice, need 150 GB, but only has 0.00 GB. You can 'lsblk' on host 172.25.132.246 to choose an right disk, and this error can't be ignored, please check your cluster.
[Validator:InstanceResource on host:172.25.132.245] fails: [FATAL] failed to find device /dev/nvme1n1, which is assigned as StorageDevice;device /dev/nvme1n1, which is assigned as StorageDevice, need 150 GB, but only has 0.00 GB. You can 'lsblk' on host 172.25.132.245 to choose an right disk, and this error can't be ignored, please check your cluster..
You can see entire survey report in /var/lib/sealer/data/my-cluster/rootfs/site-survey-report.yaml
should recognize /dev/nvme1n1 disk
sealer run -f ClusterFile
my clusterFile
kind: Cluster
metadata:
name: my-cluster # must be my-cluster
spec:
image: ack-agility-registry.cn-shanghai.cr.aliyuncs.com/ecp_builder/ackdistro:v1-22-15-ack-10
containerRuntime:
type: docker # which container runtime, support containerd/docker, default is docker
registry:
#externalRegistry: # external registry configuration
# domain: ack-agility-registry.cn-shanghai.cr.aliyuncs.com # if use lite mode image, externalRegistry must be set as this
localRegistry: # local registry configuration
domain: sea.hub # domain for local registry, default is sea.hub
port: 5000 # port for local registry, default is 5000
env:
#- EtcdDevice="" # EtcdDevice is device for etcd, default is "", which will use system disk
- StorageDevice=/dev/nvme1n1 # StorageDevice is device for kubelet and container daemon, default is "", which will use system disk
- YodaDevice=/dev/nvme1n1 # YodaDevice is device for open-local, if not specified, open local can't provision pv
- DockerRunDiskSize=120 # unit is GiB, capacity for /var/lib/docker, default is 100
- KubeletRunDiskSize=30 # unit is GiB, capacity for /var/lib/kubelet, default is 100
# - Addons=paralb,kube-prometheus-crds,ack-node-problem-detector
- Network=calico # support hybridnet/calico, default is hybridnet
- DNSDomain=cluster.local # default is cluster.local
- ServiceNodePortRange=30000-32767 # default is 30000-32767
- EnableLocalDNSCache=false # enable local dns cache component, default is false
- RemoveMasterTaint=false # remove master taint or not, default is false
- IgnoreErrors=InstanceResource # ignore errors for preflight
# - TrustedRegistry=your.registry.url # Registry Domain to be trusted by container runtime
mydisks
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
nvme0n1 259:0 0 40G 0 disk
├─nvme0n1p1 259:2 0 191M 0 part /boot/efi
└─nvme0n1p2 259:3 0 39.8G 0 part /
nvme2n1 259:4 0 20G 0 disk
nvme1n1 259:1 0 200G 0 disk
└─nvme1n1p1 259:5 0 200G 0 part
cat /etc/os-release
): CentOS 7uname -a
): 4.18.0-348.20.1.el7.aarch64Type: feature request
Type: bug report
kubectl top node
would fail with
"error: metrics not available yet"
kubectl top node
returns the node resource usage normally
kubectl top node
cat /etc/os-release
):uname -a
):[root@iZm5ebh5r61znlcl60iqumZ ~]# kubectl get node
NAME STATUS ROLES AGE VERSION
izm5ebh5r61znlcl60iqumz Ready control-plane,master 32d v1.20.4-aliyun.1
[root@iZm5ebh5r61znlcl60iqumZ ~]# cat /etc/redhat-release
CentOS Linux release 7.8.2003 (Core)
[root@iZm5ebh5r61znlcl60iqumZ ~]# sealer version
{"gitVersion":"v0.5.2","gitCommit":"858ece9","buildDate":"2021-12-13 03:22:26","goVersion":"go1.14.15","compiler":"gc","platform":"linux/amd64"}
[root@iZm5ebh5r61znlcl60iqumZ ~]# uname -a
Linux iZm5ebh5r61znlcl60iqumZ 3.10.0-1127.19.1.el7.x86_64 #1 SMP Tue Aug 25 17:23:54 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
Type: feature request
hi, @Stevent-fei @VinceCui ,
so fast when i use this repo to build ackd sealer image.
while i run build cmd: bash build.sh v1.22.15-aliyun.1 v1.1 true
, every time I re-run, this script will re-download the corresponding oss file.
Can we optimize this to make build more faster ?
Summarizing 2 Failures:
[Fail] [sig-apps] Daemon set [Serial] [It] should rollback without unnecessary restarts [Conformance]
/workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/apps/daemon_set.go:431
[Fail] [sig-auth] ServiceAccounts [It] ServiceAccountIssuerDiscovery should support OIDC discovery of service account issuer [Conformance]
/workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/auth/service_accounts.go:789
Ran 346 of 6432 Specs in 5737.033 seconds
FAIL! -- 344 Passed | 2 Failed | 0 Pending | 6086 Skipped
--- FAIL: TestE2E (5739.15s)
FAIL
Ginkgo ran 1 suite in 1h35m39.279950085s
Test Suite Failed
2022/06/30 04:25:44 Saving results at /tmp/sonobuoy/results
2022/06/30 04:25:44 running command: exit status 1
namespace="sonobuoy" pod="sonobuoy-e2e-job-dd069f1531904f7c" container="sonobuoy-worker"
time="2022-06-30T04:25:45Z" level=info msg="Detected done file, transmitting result file" resultFile=/tmp/sonobuoy/results/e2e.tar.gz
namespace="sonobuoy" pod="sonobuoy" container="kube-sonobuoy"
time="2022-06-30T04:25:45Z" level=info msg="received request" client_cert="[e2e]" method=PUT plugin_name=e2e url=/api/v1/results/global/e2e
time="2022-06-30T04:25:45Z" level=info msg="Last update to annotations on exit"
time="2022-06-30T04:25:45Z" level=info msg="Shutting down aggregation server"
time="2022-06-30T04:25:45Z" level=info msg="Resources is not set explicitly implying query all resources, but skipping secrets for safety. Specify the value explicitly in Resources to gather this data."
time="2022-06-30T04:25:45Z" level=info msg="Collecting Node Configuration and Health..."
time="2022-06-30T04:25:45Z" level=info msg="Creating host results for izj6c0ccak9v1pxg9muizpz under /tmp/sonobuoy/b335dbc0-151d-42d6-a824-61803851b8c0/hosts/izj6c0ccak9v1pxg9muizpz\n"
time="2022-06-30T04:25:45Z" level=info msg="Running cluster queries"
W0630 04:25:45.810700 1 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+
W0630 04:25:46.033333 1 warnings.go:70] v1 ComponentStatus is deprecated in v1.19+
time="2022-06-30T04:25:46Z" level=info msg="Running ns query (kube-system)"
time="2022-06-30T04:25:46Z" level=info msg="Namespace acs-system Matched=false"
time="2022-06-30T04:25:46Z" level=info msg="Namespace default Matched=false"
time="2022-06-30T04:25:46Z" level=info msg="Namespace disruption-9089 Matched=false"
time="2022-06-30T04:25:46Z" level=info msg="Namespace kube-node-lease Matched=false"
time="2022-06-30T04:25:46Z" level=info msg="Namespace kube-public Matched=false"
time="2022-06-30T04:25:46Z" level=info msg="Namespace kube-system Matched=true"
time="2022-06-30T04:25:46Z" level=info msg="Namespace resourcequota-3125 Matched=false"
time="2022-06-30T04:25:46Z" level=info msg="Namespace sonobuoy Matched=true"
time="2022-06-30T04:25:46Z" level=info msg="Collecting Pod Logs by namespace (kube-system)"
time="2022-06-30T04:25:48Z" level=info msg="Collecting Pod Logs by namespace (sonobuoy)"
time="2022-06-30T04:25:48Z" level=info msg="Collecting Pod Logs by FieldSelectors []"
time="2022-06-30T04:25:48Z" level=info msg="Log lines after this point will not appear in the downloaded tarball."
time="2022-06-30T04:25:49Z" level=info msg="Results available at /tmp/sonobuoy/202206300249_sonobuoy_b335dbc0-151d-42d6-a824-61803851b8c0.tar.gz"
time="2022-06-30T04:25:49Z" level=info msg="no-exit was specified, sonobuoy is now blocking"
We update a new version of paralb to support dual-stack. Meaning that, the LoadBalancer services in k8s could have dual-stack vips as external-ips supplied by Paralb.
Type: bug report
after helm install open-local charts, open-local-agent pod STATUS is CrashLoopBackOff.
open-local-agent should start successful
1.sealer -f ./ClusterFile
2. helm install open-local open-local-chart
cat /etc/os-release
): CentOS 7uname -a
): 4.18.0-348.20.1.el7.aarch64after some digging , it might be conflicted with yoda-agent, port 1736 already used by yoda-agent.
I found that currently ACK-distro has no version policy there, such as ack-distro 0.1.0 or 1.0.0, or conclude a detailed set of feature.
I think if ack-distro has a detailed plan fo version policy, it could provide more confidence when users are judging whether to adopt it.
Hi,
I submitted a security bug on security.alibaba.com related to this GitHub repository but I haven't heard anything back from them. navigating the security.alibaba.com website is also very tough as it always error's out.
I see that you have disabled the aliyun/Alibaba cloud credentials. Can you please help me in communicating with the security team?
I would like to add lb, logging, monitoring and other 3rd part components, and then build my own container stack based on ackdistro. Could you please add a new user doc or a new section about how to extend ackdistro?
Hello!
I hope you are doing well!
We are a security research team. Our tool automatically detected a vulnerability in this repository. We want to disclose it responsibly. GitHub has a feature called Private vulnerability reporting, which enables security research to privately disclose a vulnerability. Unfortunately, it is not enabled for this repository.
Can you enable it, so that we can report it?
Thanks in advance!
PS: you can read about how to enable private vulnerability reporting here: https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository
Type: bug report
sealer delete -a , but those containerd files is not deleted .
cat /etc/os-release
):uname -a
):Type: feature request
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.