feat: Remove kubectl binary from container and apply CRDs with client-go

Due too multiple CVEs in the kubectl binary we remove the dependency to it.
To be able to update our CRDs we introduce a custom Go binary that uses client-go
to apply our CRDs and also from our dependencies, like NFD and SRIOV.

Additionally we remove the scale-down Helm hook as it is no longer needed.

Signed-off-by: Tobias Giese <[email protected]>

Dockerfile

@@ -15,17 +15,14 @@
 # Ensure the final image uses the correct platform
 ARG ARCH
 
+# Build flags
+ARG LDFLAGS
+ARG GCFLAGS
+
 # Build the manager binary
-FROM golang:1.23@sha256:540d3442f4758da82e787d03930bf6468cf6f8613474135e8946259b9e531ea0 AS builder
+FROM golang:1.23@sha256:540d3442f4758da82e787d03930bf6468cf6f8613474135e8946259b9e531ea0 AS manager-builder
 
 WORKDIR /workspace
-# Add kubectl tool
-# Using the $ARCH in the name of the binary here ensures we don't get any cross-arch caching after this binary is downloaded.
-ARG ARCH
-# kubectl latest version can be retrieved by curl -L -s https://dl.k8s.io/release/stable.txt
-ARG KUBECTL_VERSION=v1.31.1
-RUN curl -L "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${ARCH}/kubectl" -o kubectl-${ARCH} && \
-    chmod +x ./kubectl-${ARCH}
 
 # Copy the Go Modules manifests
 COPY go.mod go.mod
@@ -38,30 +35,48 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 # Copy the go source
 COPY ./ ./
 
+# Build
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} go build -ldflags="${LDFLAGS}" -gcflags="${GCFLAGS}" -o manager main.go
+
+# Build the apply-crds binary
+FROM golang:1.23@sha256:540d3442f4758da82e787d03930bf6468cf6f8613474135e8946259b9e531ea0 AS apply-crds-builder
+
+WORKDIR /workspace
+
+# Copy the Go Modules manifests
+COPY hack/tools/apply-crds/go.mod go.mod
+COPY hack/tools/apply-crds/go.sum go.sum
+# cache deps before building and copying source so that we don't need to re-download as much
+# and so that source changes don't invalidate our downloaded layer
+RUN --mount=type=cache,target=/go/pkg/mod \
+    go mod download -x
+
+# Copy the go source
+COPY hack/tools/apply-crds/ ./
+COPY deployment/network-operator/ ./network-operator-chart/
+
 # copy CRDs from helm charts
 RUN mkdir crds && \
-    cp -r deployment/network-operator/crds /workspace/crds/network-operator/ && \
-    cp -r deployment/network-operator/charts/sriov-network-operator/crds /workspace/crds/sriov-network-operator/ && \
-    cp -r deployment/network-operator/charts/node-feature-discovery/crds /workspace/crds/node-feature-discovery/
+    cp -r network-operator-chart/crds /workspace/crds/network-operator/ && \
+    cp -r network-operator-chart/charts/sriov-network-operator/crds /workspace/crds/sriov-network-operator/ && \
+    cp -r network-operator-chart/charts/node-feature-discovery/crds /workspace/crds/node-feature-discovery/
 
 # Build
-ARG LDFLAGS
-ARG GCFLAGS
 RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
-    CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} go build -ldflags="${LDFLAGS}" -gcflags="${GCFLAGS}" -o manager main.go
+    CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} go build -ldflags="${LDFLAGS}" -gcflags="${GCFLAGS}" -o apply-crds main.go
 
 FROM --platform=linux/${ARCH} registry.access.redhat.com/ubi8-micro:8.10
 
-ARG ARCH
-
 WORKDIR /
-COPY --from=builder /workspace/manager .
-COPY --from=builder /workspace/kubectl-${ARCH} /usr/local/bin/kubectl
-COPY --from=builder /workspace/crds /crds
+COPY --from=manager-builder /workspace/manager .
+COPY --from=apply-crds-builder /workspace/apply-crds .
+COPY --from=apply-crds-builder /workspace/crds /crds
 
 # Default Certificates are missing in micro-ubi. These are need to fetch DOCA drivers image tags
-COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
+COPY --from=manager-builder /etc/ssl/certs/ca-certificates.crt /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
 COPY /webhook-schemas /webhook-schemas
 COPY manifests/ manifests/
 USER 65532:65532

deployment/network-operator/templates/upgrade-crd-hook.yaml

@@ -84,12 +84,12 @@ spec:
             - /bin/sh
             - -c
             - >
-              kubectl apply -f /crds/network-operator;
+              /apply-crds --crds-dir=/crds/network-operator;
         {{- if .Values.sriovNetworkOperator.enabled }}
-              kubectl apply -f /crds/sriov-network-operator;
+              /apply-crds --crds-dir=/crds/sriov-network-operator;
         {{- end }}
         {{- if .Values.nfd.enabled }}
-              kubectl apply -f /crds/node-feature-discovery;
+              /apply-crds --crds-dir=/crds/node-feature-discovery;
         {{- end }}
       restartPolicy: OnFailure
 {{- end }}

hack/tools/apply-crds/go.mod

@@ -0,0 +1,52 @@
+module github.com/mellanox/network-operator/hack/tools/adopt-crds
+
+go 1.23.2
+
+require (
+	k8s.io/apiextensions-apiserver v0.31.2
+	k8s.io/apimachinery v0.31.2
+	k8s.io/client-go v0.31.2
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.22.4 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/imdario/mergo v0.3.6 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/onsi/gomega v1.33.1 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	golang.org/x/net v0.26.0 // indirect
+	golang.org/x/oauth2 v0.21.0 // indirect
+	golang.org/x/sys v0.21.0 // indirect
+	golang.org/x/term v0.21.0 // indirect
+	golang.org/x/text v0.16.0 // indirect
+	golang.org/x/time v0.3.0 // indirect
+	google.golang.org/protobuf v1.34.2 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/api v0.31.2 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
+	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
+)