hardcode kustomize download to bypass github api rate limits#1171
hardcode kustomize download to bypass github api rate limits#1171trdoyle81 wants to merge 1 commit into
Conversation
Signed-off-by: Triona Doyle <tekton@example.com>
openshift-ci
Bot
added
the
kind/failing-test
📝 WalkthroughSummary by CodeRabbitRelease Notes
WalkthroughThe Dockerfile adds a parameterized ChangesKustomize Installation Versioning
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@openshift-ci/build-root/Dockerfile`:
- Line 18: The Dockerfile currently downloads and installs kustomize using the
RUN curl ... | tar -xz pipeline with KUSTOMIZE_VERSION but performs no integrity
check; update the Dockerfile to fetch the corresponding release checksum or
signature for kustomize (using KUSTOMIZE_VERSION), verify the downloaded archive
before extracting (e.g., compare sha256/sha512 against the release checksum or
verify a GPG signature), and only copy the binary to /usr/local/bin if the
verification succeeds; reference the existing KUSTOMIZE_VERSION variable and the
kustomize_${KUSTOMIZE_VERSION}_linux_amd64.tar.gz artifact when implementing the
checksum/sig retrieval and verification step.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 8d9e56c1-8ad1-4b23-adc2-2ac0b82e005b
📒 Files selected for processing (1)
openshift-ci/build-root/Dockerfile
| # Install Kustomize | ||
| RUN wget https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh && \ | ||
| bash install_kustomize.sh /usr/local/bin && rm install_kustomize.sh | ||
| RUN curl -sSL https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2F${KUSTOMIZE_VERSION}/kustomize_${KUSTOMIZE_VERSION}_linux_amd64.tar.gz | tar -xz -C /usr/local/bin |
There was a problem hiding this comment.
Add integrity verification for the downloaded Kustomize binary
Line 18 installs an executable without checksum/signature validation. That creates a supply-chain risk in the CI image build path.
Suggested hardening change
ARG KUSTOMIZE_VERSION=v5.8.1
+ARG KUSTOMIZE_SHA256=<official_sha256_for_linux_amd64>
# Install Kustomize
-RUN curl -sSL https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2F${KUSTOMIZE_VERSION}/kustomize_${KUSTOMIZE_VERSION}_linux_amd64.tar.gz | tar -xz -C /usr/local/bin
+RUN curl -fsSLo /tmp/kustomize.tar.gz "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2F${KUSTOMIZE_VERSION}/kustomize_${KUSTOMIZE_VERSION}_linux_amd64.tar.gz" && \
+ echo "${KUSTOMIZE_SHA256} /tmp/kustomize.tar.gz" | sha256sum -c - && \
+ tar -xzf /tmp/kustomize.tar.gz -C /usr/local/bin && \
+ chmod +x /usr/local/bin/kustomize && \
+ rm -f /tmp/kustomize.tar.gz🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@openshift-ci/build-root/Dockerfile` at line 18, The Dockerfile currently
downloads and installs kustomize using the RUN curl ... | tar -xz pipeline with
KUSTOMIZE_VERSION but performs no integrity check; update the Dockerfile to
fetch the corresponding release checksum or signature for kustomize (using
KUSTOMIZE_VERSION), verify the downloaded archive before extracting (e.g.,
compare sha256/sha512 against the release checksum or verify a GPG signature),
and only copy the binary to /usr/local/bin if the verification succeeds;
reference the existing KUSTOMIZE_VERSION variable and the
kustomize_${KUSTOMIZE_VERSION}_linux_amd64.tar.gz artifact when implementing the
checksum/sig retrieval and verification step.
Source: Coding guidelines
|
@trdoyle81: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
What type of PR is this?
/kind failing-test
What does this PR do / why we need it:
Fixes flaky OpenShift CI
imagesjob failures.The
install_kustomize.shscript in the CI Dockerfile queries the GitHub API, which frequently gets blocked by rate limits (403 API Rate Limit Exceeded) due to shared CI IPs. This causes a silent download failure and crashes the build during thetarextraction. This PR replaces the script with a directcurl | tardownload of Kustomizev5.8.1. This bypasses the GitHub API completely and makes the CI build deterministic.Have you updated the necessary documentation?
Which issue(s) this PR fixes:
Fixes #
Test acceptance criteria:
How to test changes / Special notes to the reviewer:
podman build -t ci-test .