chore(testing): refresh e2e-sandbox tools and base to current upstream - #3010
Conversation
Rebuilds the e2e test sandbox on current upstream to clear the published advisories (containerd, helm, go-git, moby/spdystream, Go stdlib) carried by the stale tool binaries and base layers: - base: ubuntu 22.04 -> 24.04; netcat -> netcat-openbsd, since `netcat` is a candidate-less virtual package on 24.04 - kubectl: 1.33.2 -> 1.33.13, staying on the 1.33 line that the e2e control plane pins at v1.33.12, so client/server skew is unchanged - talosctl: 1.10.4 -> 1.13.5, aligning the client with the v1.13.x Talos nodes the sandbox provisions - helm: 3.18.3 -> 3.21.2 (latest helm 3); the e2e flow drives the v3 CLI, so it stays on the 3.x line rather than moving to the breaking 4.x - yq: 4.44.3 -> 4.53.3 - values.yaml: re-pinned to the rebuilt multi-arch digest crust-gather and cozyhr already track their latest releases; flux and mc install the current release at build time. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
💤 Files with no reviewable changes (1)
📝 WalkthroughWalkthroughThe e2e sandbox Dockerfile base image is updated from Changese2e Sandbox Image Bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request refreshes the e2e-sandbox environment by updating the underlying base image and various tool versions. The primary goal is to resolve security advisories present in the previous tool binaries and base layers while ensuring the testing environment remains compatible with current upstream requirements. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
There was a problem hiding this comment.
Code Review
This pull request updates the e2e-sandbox Dockerfile by upgrading the base image to Ubuntu 24.04, updating several tool versions (kubectl, talosctl, helm, and yq), and switching from netcat to netcat-openbsd. It also updates the corresponding image digest in values.yaml. The reviewer suggested optimizing the Dockerfile by cleaning up the local package repository cache (rm -rf /var/lib/apt/lists/*) after the apt install command to reduce the final image size.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
|
||
| RUN apt update -q | ||
| RUN apt install -yq --no-install-recommends psmisc genisoimage ca-certificates qemu-kvm qemu-utils iproute2 iptables wget xz-utils netcat curl jq make git bash-completion | ||
| RUN apt install -yq --no-install-recommends psmisc genisoimage ca-certificates qemu-kvm qemu-utils iproute2 iptables wget xz-utils netcat-openbsd curl jq make git bash-completion |
There was a problem hiding this comment.
To keep the Docker image size as small as possible, it is recommended to clean up the local package repository cache by appending && rm -rf /var/lib/apt/lists/* to the apt install command.
RUN apt install -yq --no-install-recommends psmisc genisoimage ca-certificates qemu-kvm qemu-utils iproute2 iptables wget xz-utils netcat-openbsd curl jq make git bash-completion && rm -rf /var/lib/apt/lists/*
There was a problem hiding this comment.
Done in f047129 — though I merged the apt update and apt install into a single RUN with && rm -rf /var/lib/apt/lists/*. Appending the cleanup to the install layer alone wouldn't shrink the image: the package index created by the separate apt update layer would persist in that earlier layer. Combining them drops it from the final image.
There was a problem hiding this comment.
Correction — I've reverted this. The cache cleanup edits the Dockerfile, but the image this PR ships is pinned by a pre-built multi-arch digest that isn't being rebuilt/re-pinned in this PR, so landing the Dockerfile change alone would leave it out of sync with the shipped image (the pinned layer still carries the apt lists). Deferring the cleanup to the next e2e-sandbox image rebuild, where it's baked in and the digest re-pinned together. The base/tool bump itself is unchanged.
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/core/testing/images/e2e-sandbox/Dockerfile`:
- Around line 12-13: Combine the separate RUN apt update and RUN apt install
commands in the Dockerfile into a single RUN layer using && to chain them
together, which prevents Docker from caching a stale apt index between layers.
After the apt install command, add apt cache cleanup by appending a command to
remove the apt cache directory (typically /var/lib/apt/lists/*) to reduce the
image size and ensure freshness on each rebuild.
- Around line 14-19: The Dockerfile downloads external artifacts without
integrity verification, creating supply-chain risks. Additionally, the Helm
installation on line 18 uses a script from the mutable main branch. For the
talosctl, kubectl, and yq curl commands, download the corresponding checksum
files and verify each binary using sha256sum before marking them executable. For
the Helm installer script, replace the approach that fetches from the mutable
main branch with a direct binary download from a specific stable Helm release
version, followed by checksum verification, matching the pattern used for the
other tools. This ensures all downloaded artifacts are verified against known
good checksums and eliminates reliance on mutable remote scripts.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 29e3ba38-a8a9-415c-a16d-a95ebb8e7698
📒 Files selected for processing (2)
packages/core/testing/images/e2e-sandbox/Dockerfilepackages/core/testing/values.yaml
| RUN curl -sSL "https://github.com/siderolabs/talos/releases/download/v${TALOSCTL_VERSION}/talosctl-${TARGETOS}-${TARGETARCH}" -o /usr/local/bin/talosctl \ | ||
| && chmod +x /usr/local/bin/talosctl | ||
| RUN curl -sSL "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/${TARGETOS}/${TARGETARCH}/kubectl" -o /usr/local/bin/kubectl \ | ||
| && chmod +x /usr/local/bin/kubectl | ||
| RUN curl -sSL "https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3" | bash -s - --version "v${HELM_VERSION}" | ||
| RUN curl -sSL "https://github.com/mikefarah/yq/releases/download/v4.44.3/yq_${TARGETOS}_${TARGETARCH}" -o /usr/local/bin/yq \ | ||
| RUN curl -sSL "https://github.com/mikefarah/yq/releases/download/v4.53.3/yq_${TARGETOS}_${TARGETARCH}" -o /usr/local/bin/yq \ |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify whether download/install steps include integrity checks and detect mutable script execution.
rg -n 'talosctl-|kubectl"|get-helm-3|yq_|sha256|sha512|cosign|gpg' packages/core/testing/images/e2e-sandbox/DockerfileRepository: cozystack/cozystack
Length of output: 703
🏁 Script executed:
cat -n packages/core/testing/images/e2e-sandbox/Dockerfile | head -30Repository: cozystack/cozystack
Length of output: 2155
Add integrity verification for downloaded tool artifacts (and avoid installer script from mutable main branch).
These lines fetch/execute external artifacts without checksum/signature validation. Line 18 executes a remote script from the mutable main branch, which is a supply-chain risk.
Suggested direction (example for kubectl + helm)
RUN curl -sSL "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/${TARGETOS}/${TARGETARCH}/kubectl" -o /usr/local/bin/kubectl \
+ && curl -sSL "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/${TARGETOS}/${TARGETARCH}/kubectl.sha256" -o /tmp/kubectl.sha256 \
+ && echo "$(cat /tmp/kubectl.sha256) /usr/local/bin/kubectl" | sha256sum -c - \
&& chmod +x /usr/local/bin/kubectl
-RUN curl -sSL "https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3" | bash -s - --version "v${HELM_VERSION}"
+RUN curl -sSL "https://get.helm.sh/helm-v${HELM_VERSION}-${TARGETOS}-${TARGETARCH}.tar.gz" -o /tmp/helm.tgz \
+ && curl -sSL "https://get.helm.sh/helm-v${HELM_VERSION}-${TARGETOS}-${TARGETARCH}.tar.gz.sha256sum" -o /tmp/helm.tgz.sha256 \
+ && echo "$(cat /tmp/helm.tgz.sha256) /tmp/helm.tgz" | sha256sum -c - \
+ && tar -xzf /tmp/helm.tgz -C /tmp \
+ && mv "/tmp/${TARGETOS}-${TARGETARCH}/helm" /usr/local/bin/helm \
+ && chmod +x /usr/local/bin/helm🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/core/testing/images/e2e-sandbox/Dockerfile` around lines 14 - 19,
The Dockerfile downloads external artifacts without integrity verification,
creating supply-chain risks. Additionally, the Helm installation on line 18 uses
a script from the mutable main branch. For the talosctl, kubectl, and yq curl
commands, download the corresponding checksum files and verify each binary using
sha256sum before marking them executable. For the Helm installer script, replace
the approach that fetches from the mutable main branch with a direct binary
download from a specific stable Helm release version, followed by checksum
verification, matching the pattern used for the other tools. This ensures all
downloaded artifacts are verified against known good checksums and eliminates
reliance on mutable remote scripts.
There was a problem hiding this comment.
Deferring this one. The download/installer pattern here — curl -o for talosctl/kubectl/yq/mc, and the upstream get-helm-3 / fluxcd / cozyhr / crust-gather install scripts — is pre-existing; this change only bumps tool versions. Adding integrity verification across all of them (per-arch checksums, plus pinning the install scripts off main to release tags) is a separate hardening pass well beyond a version bump, and this is a CI-only test-sandbox image that ships in no release artifact and deploys to no cluster. Better done as its own focused change.
There was a problem hiding this comment.
@lexfrei, understood — the pattern is pre-existing and scoping it to a dedicated hardening pass makes sense, especially since this image is CI-only and not part of any release artifact. Would you like me to open a follow-up GitHub issue to track the integrity-verification hardening (checksum validation for talosctl/kubectl/yq/mc and pinning the installer scripts to release tags instead of main)?
(ᵔ ᴥ ᵔ)
🧠 Learnings used
Learnt from: kvaps
Repo: cozystack/cozystack PR: 2610
File: packages/apps/kubernetes/images/talos-csr-signer/Dockerfile:13-14
Timestamp: 2026-05-14T14:16:41.971Z
Learning: In cozystack Dockerfiles under `packages/`, it’s acceptable to declare `ARG TARGETOS` and `ARG TARGETARCH` without default values. Do not flag these as missing defaults when the build is expected to use `docker buildx build`, which automatically supplies these automatic platform args (global scope automatic platform args). This guidance applies to Dockerfiles like `packages/system/kamaji/images/kamaji/Dockerfile` and `packages/apps/kubernetes/images/talos-csr-signer/Dockerfile` where the pattern is used consistently.
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
…1.13.5 talosctl 1.13.5 now defaults to Kubernetes 1.36.2, so the comment's premise — that talosctl's bundled default predates the KCM VAP nil-pointer fix — no longer holds (1.36.2 already carries that fix). The reason e2e pins v1.33.12 is now that 1.36 is outside cozystack's supported range; reword to lead with that and keep the KCM VAP fix as the secondary property v1.33.12 carries. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
0d14a99 to
c3ebdb3
Compare
The "Pin the e2e management cluster Kubernetes version" item is no longer in-flight — it is merged and live in hack/e2e-prepare-cluster.bats (--kubernetes-version v1.33.12). Remove it from the "not yet the merged standard" section; its rationale lives in the bats comment. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
myasnikovdaniil
left a comment
There was a problem hiding this comment.
APPROVE — clean, correctly-scoped e2e-sandbox refresh.
Verified independently:
- All tool versions exist and resolve: ubuntu 24.04, kubectl v1.33.13 (sha256 file resolves on dl.k8s.io), talosctl v1.13.5 (real release, Jun 2026), helm v3.21.2, yq v4.53.3.
- Skew is correct: kubectl 1.33.13 client vs the pinned apiserver v1.33.12 is the same minor — trivially within the k8s ±1 skew policy. The e2e scripts use only standard kubectl verbs; nothing needs a newer client.
- helm stays on 3.x: 3.21.2 is the latest 3.x patch (helm 4.x is released but breaking — correctly avoided). The suite only drives install/upgrade/uninstall/template/pull/repo, all stable on 3.x.
- netcat → netcat-openbsd is the right provider on 24.04: all
ncinvocations in the e2e scripts use only-zand-nz, both fully supported by OpenBSD netcat per the Ubuntu noble man page. No flag-compat regression. - The k8s-version pin is now genuinely load-bearing: talosctl v1.13.5's
DefaultKubernetesVersionis1.36.2, so without the explicit--kubernetes-version v1.33.12the bump would have silently jumped the e2e cluster to 1.36.2 (outside cozystack's supported range). The updated bats comment documents this accurately and still covers the KCM VAP panic (kubernetes#135155, fixed in 1.33.10+). - Consistency: no stale
ubuntu:22.04/ old tool-version references remain; thevalues.yamldigest is auto-derived from the build so it provably matches the rebuilt image; the e2e-testing.md doc cleanup (dropping the now-merged 'pin the e2e k8s version' in-flight bullet) is correct.
Non-blocking nit: the auto-generated Summary by CodeRabbit claims 'consolidating apt cleanup to reduce image size,' but the Dockerfile diff contains no apt-cleanup change. Worth trimming that line from the PR body so the summary doesn't describe a change that wasn't made.
Full E2E suite passed green on this exact rebuilt digest. LGTM.
What this PR does
Rebuilds the e2e test sandbox on current upstream to clear the published advisories (containerd, helm, go-git, moby/spdystream, Go stdlib) carried by the stale tool binaries and base layers.
ubuntu:22.04→24.04;netcat→netcat-openbsd(on 24.04netcatis a candidate-less virtual package, so the concrete provider must be named)1.33.2→1.33.13— stays on the 1.33 line that the e2e control plane pins atv1.33.12(hack/e2e-prepare-cluster.bats), so client/server skew is unchanged1.10.4→1.13.5— aligns the client with the v1.13.x Talos nodes the sandbox provisions3.18.3→3.21.2(latest helm 3) — the e2e flow drives the v3 CLI, so it stays on the 3.x line rather than moving to the breaking 4.x4.44.3→4.53.3values.yaml: re-pinned to the rebuilt multi-arch digest (linux/amd64+linux/arm64)crust-gatherandcozyhralready track their latest releases;fluxandmcinstall the current release at build time. The built image's tool versions were verified in place (kubectlv1.33.13, talosctlv1.13.5, helmv3.21.2, yqv4.53.3, flux2.8.8, ubuntu24.04).Closes #2891
Release note
Summary by CodeRabbit
netcattonetcat-openbsdand consolidating apt cleanup to reduce image size.