Remove netstat from cilium-bugtool and replace with ss tool

[soumynathan]

This PR removes the 'netstat -a' command from cilium-bugtool
configuration and substitutes 'ss -a' command instead. Also
adds the 'ss' tool to the Docker.builder

Fixes: #11648
Signed-off-by: Swaminathan Vasudevan svasudevan@suse.com

[maintainer-s-little-helper]

Please set the appropriate release note label.

[borkmann]

The builder image relies on the cilium-runtime image. The latter already have some of the tooling from iproute2.

What needs to be done instead is: changing https://github.com/cilium/packaging/blob/master/Dockerfile.iproute2 to copy ss tool into the scratch iproute2 image there. And once this is done the cilium-builder image needs to COPY --from=quay.io/cilium/cilium-iproute2:xxxx-xx-xx /bin/ss /bin/ to its own image.

[borkmann]

But one more clarification, does the bugtool rely on Dockerfile.builder which is why we need it in here as a dependency? (I was not aware of that.)

[soumynathan]

Thanks for the clarification. I was try to fix this.

[joestringer]

@soumynathan why does it need to be in the builder image at all?

[soumynathan]

@soumynathan why does it need to be in the builder image at all?

Sorry, my bad, I should not have added it here.

[soumynathan]

The builder image relies on the cilium-runtime image. The latter already have some of the tooling from iproute2.

What needs to be done instead is: changing https://github.com/cilium/packaging/blob/master/Dockerfile.iproute2 to copy ss tool into the scratch iproute2 image there. And once this is done the cilium-builder image needs to COPY --from=quay.io/cilium/cilium-iproute2:xxxx-xx-xx /bin/ss /bin/ to its own image.

So we need to touch/modify the 'cilium/packaging' repo along with the 'cilium/bugtool'.

[soumynathan]

The builder image relies on the cilium-runtime image. The latter already have some of the tooling from iproute2.

What needs to be done instead is: changing https://github.com/cilium/packaging/blob/master/Dockerfile.iproute2 to copy ss tool into the scratch iproute2 image there. And once this is done the cilium-builder image needs to COPY --from=quay.io/cilium/cilium-iproute2:xxxx-xx-xx /bin/ss /bin/ to its own image.

Ok, I have pushed in a PR to add the 'ss' to the cilium-iproute2 image.
cilium/image-tools#15
Once it merges, then we can edit the

cilium/contrib/packaging/docker/Dockerfile.runtime

Line 55 in a9af784

COPY --from=quay.io/cilium/cilium-iproute2:2020-05-20 /bin/tc /bin/ip /bin/

to include the 'ss'.

[soumynathan]

Now since the PR 'cilium/image-tools#15' merged, do we need to wait for the latest 'cilium-iproute2: xxxx-xx-xx' build to happen. The latest I see is the 2020-05-20.

[joestringer]

The new container build would have occurred automatically here:

https://github.com/cilium/image-tools/runs/712053055?check_suite_focus=true

There's been some changes to the way these images are generated/tagged recently so I'm not sure whether the date-based tags will show up or if we just need to adjust the main Cilium runtime image to consume these SHA tags from the repo directly.

@errordeveloper are the main Cilium dockerfiles consuming these images yet? If not, it may make sense for @soumynathan to put this work on the backburner until that work is done and then revisit this PR.

[coveralls]

Coverage decreased (-0.002%) to 36.869% when pulling fc220b6 on soumynathan:cilium-bugtool-replace-netstat into 1439b27 on cilium:master.

[borkmann]

lgtm, thanks!