debian-iptables: Build buster-v1.6.0 image

[wespanther]

What type of PR is this?

/kind feature

What this PR does / why we need it:

A new debian-iptables image based on k8s.gcr.io/build-image/debian-base:buster-v1.6.0. This fixes a handful of CVEs, such as some in openssl.

Which issue(s) this PR fixes:

None

Special notes for your reviewer:

None

Does this PR introduce a user-facing change?

debian-iptables: Build buster-v1.6.0 image

[k8s-ci-robot]

Hi @wespanther. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[saschagrunert]

/ok-to-test

[wespanther]

/retest

[wespanther]

/test pull-release-image-debian-iptables

[wespanther]

pull-release-image-debian-iptables is only failing on s390x:

docker buildx build \
	--pull \
	--load \
	--platform linux/s390x \
	-t gcr.io/k8s-staging-releng-test/debian-iptables-s390x:buster-v1.6.0 \
	-t gcr.io/k8s-staging-releng-test/debian-iptables-s390x:v20210406-v0.8.0-9-gf364dbfc-buster \
	-t gcr.io/k8s-staging-releng-test/debian-iptables-s390x:latest-buster \
	--build-arg=IPTABLES_VERSION=1.8.5 \
	--build-arg=BASEIMAGE=k8s.gcr.io/build-image/debian-base-s390x:buster-v1.5.0 \
	buster

fails with:

...
#6 28.63 dpkg: error processing archive /tmp/apt-dpkg-install-fIpBPP/9-ebtables_2.0.11-4~bpo10+1_s390x.deb (--unpack):
#6 28.63  rm command for cleanup subprocess returned error exit status 1
#6 28.65 Errors were encountered while processing:
#6 28.65  /tmp/apt-dpkg-install-fIpBPP/1-libip6tc2_1.8.5-3~bpo10+1_s390x.deb
#6 28.65  /tmp/apt-dpkg-install-fIpBPP/2-libxtables12_1.8.5-3~bpo10+1_s390x.deb
#6 28.65  /tmp/apt-dpkg-install-fIpBPP/3-netbase_6.1~bpo10+1_all.deb
#6 28.65  /tmp/apt-dpkg-install-fIpBPP/4-libmnl0_1.0.4-2_s390x.deb
#6 28.65  /tmp/apt-dpkg-install-fIpBPP/5-libnfnetlink0_1.0.1-3+b1_s390x.deb
#6 28.65  /tmp/apt-dpkg-install-fIpBPP/6-libnetfilter-conntrack3_1.0.7-1_s390x.deb
#6 28.65  /tmp/apt-dpkg-install-fIpBPP/7-libnftnl11_1.1.7-1~bpo10+1_s390x.deb
#6 28.65  /tmp/apt-dpkg-install-fIpBPP/8-iptables_1.8.5-3~bpo10+1_s390x.deb
#6 28.65  /tmp/apt-dpkg-install-fIpBPP/9-ebtables_2.0.11-4~bpo10+1_s390x.deb
#6 28.73 E: Sub-process /usr/bin/dpkg returned an error code (1)
#6 ERROR: executor failed running [/dev/.buildkit_qemu_emulator /bin/sh -c echo deb http://deb.debian.org/debian buster-backports main >> /etc/apt/sources.list     && apt-get update     && apt-get -t buster-backports -y --no-install-recommends install         iptables=${IPTABLES_VERSION}*         ebtables]: exit code: 100```

[wespanther]

Looks like it's failing on the apt-get install portion of

RUN echo deb http://deb.debian.org/debian buster-backports main >> /etc/apt/sources.list \
    && apt-get update \
    && apt-get -t buster-backports -y --no-install-recommends install \
        iptables=${IPTABLES_VERSION}* \
        ebtables

It seems to be trying to use "/usr/sbin/rm"

#6 28.04 Preparing to unpack .../0-libip4tc2_1.8.5-3~bpo10+1_s390x.deb ...
#6 28.06 Unpacking libip4tc2:s390x (1.8.5-3~bpo10+1) ...
#6 28.40 Error while loading /usr/sbin/rm: No such file or directory
#6 28.40 dpkg: error while cleaning up:
#6 28.40  rm command for cleanup subprocess returned error exit status 1
#6 28.42 Error while loading /usr/sbin/rm: No such file or directory

[wespanther]

I'm able to build it locally, which is kind of odd.

[wespanther]

/retest

[vinayakankugoyal]

Add RUN ln -s /bin/rm /usr/sbin/rm before you install the packages we had to do this for the setcap image too. See https://github.com/kubernetes/release/blob/master/images/build/setcap/Dockerfile

[wespanther]

Going to try to symlink from /bin/rm, although I'm not sure why dpkg is trying to use /usr/sbin/rm.

[vinayakankugoyal]

My recommendation would be to run these in the same command as each of these is a new layer.

Suggested change

	RUN ln -s /bin/rm /usr/sbin/rm
	RUN echo deb http://deb.debian.org/debian buster-backports main >> /etc/apt/sources.list \
	&& apt-get update \
	&& apt-get -t buster-backports -y --no-install-recommends install \
	RUN ln -s /bin/rm /usr/sbin/rm \
	&& echo deb http://deb.debian.org/debian buster-backports main >> /etc/apt/sources.list \
	&& apt-get update \
	&& apt-get -t buster-backports -y --no-install-recommends install \

[wespanther]

Good call, changed

[k8s-ci-robot]

@vinayakankugoyal: changing LGTM is restricted to collaborators

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[justaugustus]

/hold for #1991 and debian-base promotion

[justaugustus]

Rebased on #1991 and split the ln change into a separate commit.
/hold cancel
/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justaugustus, saschagrunert, wespanther

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [justaugustus,saschagrunert]
• images/build/debian-iptables/OWNERS [justaugustus,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment