Disable cgo for all Antrea binaries #5988

antoninbas · 2024-02-14T23:13:21Z

Instead of selectively disabling cgo for some binaries (e.g., release
assets), we now unconditionally disable cgo for all binaries, even those
that only run inside the container image for which they were built
(e.g., antrea-controller). After some analysis, there seems to be no
downside in doing this. We also get some benefits such as reduced build
time for the default make command.

Fixes #5724

antoninbas · 2024-02-14T23:14:11Z

We can revert some commits which had to be introduced to fix the UBI build specifically because cgo was enabled

Instead of selectively disabling cgo for some binaries (e.g., release assets), we now unconditionally disable cgo for all binaries, even those that only run inside the container image for which they were built (e.g., antrea-controller). After some analysis, there seems to be no downside in doing this. We also get some benefits such as reduced build time for the default make command. Fixes antrea-io#5724 Signed-off-by: Antonin Bas <[email protected]>

This reverts commit 2f8441b. Signed-off-by: Antonin Bas <[email protected]>

This reverts commit 2afab06. Signed-off-by: Antonin Bas <[email protected]>

heanlan

disabling cgo for Flow-Aggregator looks good to me

luolanzone

LGTM overall, one question.

luolanzone · 2024-02-18T02:03:40Z

build/images/Dockerfile.build.ubi

@@ -12,30 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-ARG BUILD_TAG
-FROM registry.access.redhat.com/ubi8 as antrea-build


I am wondering why this ubi8 is no longer needed?

@xliuxu FYI, this change will conflict with your PR #5737

Thanks for the FYI. I can rebase the PR later.
BTW I think this change is to revert #5723

@luolanzone I think it's because it no longer relies on glibc shipped with ubi8.

That's correct. This change just reverts an earlier commit that I had to be introduced because of a glibc mismatch (I preserved the individual "revert" commits in the history for this PR, so you can take a look). Now that we disable cgo, the Antrea binaries no longer have a dependency on libc, and if there is a mismatch in version between the libc included in the golang Docker image and the libc included in the ubi Docker image, it doesn't matter anymore. Therefore we can revert to the golang Docker image, to avoid having to install Go manually.

wenyingd

Can we also disable cgo PHONY "bin" in Makefile ? I am asking this because we have another issue #5967 for VM agent case, which may build antrea-agent for VM scenario inside a Docker container runtime using Ubuntu 22.04, but run it on a VM on a different Linux OS version (e.g. ubuntu 18.04), then agent may fail because of the missing libraries.

wenyingd · 2024-02-18T02:36:16Z

Makefile

 	  -coverprofile=.coverage/coverage-unit.txt -covermode=atomic \
 	  antrea.io/antrea/cmd/... antrea.io/antrea/pkg/... antrea.io/antrea/multicluster/cmd/... antrea.io/antrea/multicluster/controllers/...

 .PHONY: .windows-test-unit
 .windows-test-unit: .coverage
 	@echo
 	@echo "==> Running unit tests <=="
-	$(GO) test -race -coverpkg=antrea.io/antrea/cmd/...,antrea.io/antrea/pkg/... \
+	CGO_ENABLED=1 $(GO) test -race -coverpkg=antrea.io/antrea/cmd/...,antrea.io/antrea/pkg/... \


I used to see build errors with enabling cgo on Windows, does this change work?

The job succeeded: https://github.com/antrea-io/antrea/actions/runs/7908780513/job/21588621924?pr=5988

Cgo is required to run the race detector:

On macOS, the race detector has been rewritten not to use cgo: race-detector-enabled programs can be built and run without Xcode. On Linux and other Unix systems, and on Windows, a host C toolchain is required to use the race detector.

This is the only place where we enable it. By default, cgo is now disabled for every build operation.

wenyingd · 2024-02-18T07:13:04Z

/test-vm-e2e

tnqn

LGTM

tnqn · 2024-02-20T08:52:04Z

Makefile

 	  -coverprofile=.coverage/coverage-unit.txt -covermode=atomic \
 	  antrea.io/antrea/cmd/... antrea.io/antrea/pkg/... antrea.io/antrea/multicluster/cmd/... antrea.io/antrea/multicluster/controllers/...

 .PHONY: .windows-test-unit
 .windows-test-unit: .coverage
 	@echo
 	@echo "==> Running unit tests <=="
-	$(GO) test -race -coverpkg=antrea.io/antrea/cmd/...,antrea.io/antrea/pkg/... \
+	CGO_ENABLED=1 $(GO) test -race -coverpkg=antrea.io/antrea/cmd/...,antrea.io/antrea/pkg/... \


The job succeeded: https://github.com/antrea-io/antrea/actions/runs/7908780513/job/21588621924?pr=5988

tnqn · 2024-02-20T08:58:38Z

build/images/Dockerfile.build.ubi

@@ -12,30 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-ARG BUILD_TAG
-FROM registry.access.redhat.com/ubi8 as antrea-build


@luolanzone I think it's because it no longer relies on glibc shipped with ubi8.

antoninbas · 2024-02-21T00:56:50Z

Can we also disable cgo PHONY "bin" in Makefile ? I am asking this because we have another issue #5967 for VM agent case, which may build antrea-agent for VM scenario inside a Docker container runtime using Ubuntu 22.04, but run it on a VM on a different Linux OS version (e.g. ubuntu 18.04), then agent may fail because of the missing libraries.

Cgo is disabled for everything now (except when enabling the race detector for unit tests).
The only places where cgo is enabled will be where you see an explicit CGO_ENABLED=1.

antoninbas · 2024-02-21T00:59:10Z

/test-vm-e2e

antoninbas · 2024-02-21T00:59:15Z

/test-all

antoninbas · 2024-02-21T01:49:30Z

One test case is currently failing for test-vm-e2e. This is unrelated to this PR and is being addressed separately in #6008

antoninbas · 2024-02-21T04:49:36Z

@wenyingd does this need to be backported to older releases?

wenyingd · 2024-03-20T05:48:40Z

@wenyingd does this need to be backported to older releases?

Sorry for missing the ask, yes, we need to back port the change. cc @luolanzone

* Disable cgo for all Antrea binaries Instead of selectively disabling cgo for some binaries (e.g., release assets), we now unconditionally disable cgo for all binaries, even those that only run inside the container image for which they were built (e.g., antrea-controller). After some analysis, there seems to be no downside in doing this. We also get some benefits such as reduced build time for the default make command. Fixes antrea-io#5724 * Revert "Add git to antrea-build image for UBI build (antrea-io#5727)" This reverts commit 2f8441b. * Revert "Fix antrea-ubi image build (antrea-io#5723)" This reverts commit 2afab06. --------- Signed-off-by: Antonin Bas <[email protected]>

luolanzone · 2024-03-20T06:28:27Z

I have backported this to v1.15, I suppose v1.14 is also needed? @antoninbas @wenyingd
Do we need to back port to v1.13? I think we still need to do a patch release for v1.13 this time.

wenyingd · 2024-03-20T08:29:15Z

I suppose v1.14 is also needed? @antoninbas @wenyingd Do we need to back port to v1.13? I think we still need to do a patch release for v1.13 this time.

Focusing on VM Agent case, it is supposed to be required after we bump up the base Ubuntu to 22.04 in the antrea images. So we shall back port the change to all the versions which are still in the maintenance cycle.

Because we are now disabling cgo when building all Antrea binaries, there is no need to install Go manually when building the UBI images. It was required before because of incompatibility between the glibc versions in the golang image and the ubi8 base image. We can now use the standard golang image to compile the Antrea binaries (without cgo, there is no dependency on glibc), then copy these binaries to the ubi8 image. PR antrea-io#5988, which disabled cgo, removed the unnecessary code from Dockerfile.build.ubi, but not from the other Dockerfiles (Dockerfile.build.agent.ubi and Dockerfile.build.controller.ubi). Signed-off-by: Antonin Bas <[email protected]>

* Disable cgo for all Antrea binaries Instead of selectively disabling cgo for some binaries (e.g., release assets), we now unconditionally disable cgo for all binaries, even those that only run inside the container image for which they were built (e.g., antrea-controller). After some analysis, there seems to be no downside in doing this. We also get some benefits such as reduced build time for the default make command. Fixes #5724 * Revert "Add git to antrea-build image for UBI build (#5727)" This reverts commit 2f8441b. * Revert "Fix antrea-ubi image build (#5723)" This reverts commit 2afab06. --------- Signed-off-by: Antonin Bas <[email protected]>

Because we are now disabling cgo when building all Antrea binaries, there is no need to install Go manually when building the UBI images. It was required before because of incompatibility between the glibc versions in the golang image and the ubi8 base image. We can now use the standard golang image to compile the Antrea binaries (without cgo, there is no dependency on glibc), then copy these binaries to the ubi8 image. PR #5988, which disabled cgo, removed the unnecessary code from Dockerfile.build.ubi, but not from the other Dockerfiles (Dockerfile.build.agent.ubi and Dockerfile.build.controller.ubi). Signed-off-by: Antonin Bas <[email protected]>

* Disable cgo for all Antrea binaries Instead of selectively disabling cgo for some binaries (e.g., release assets), we now unconditionally disable cgo for all binaries, even those that only run inside the container image for which they were built (e.g., antrea-controller). After some analysis, there seems to be no downside in doing this. We also get some benefits such as reduced build time for the default make command. Fixes antrea-io#5724 * Revert "Add git to antrea-build image for UBI build (antrea-io#5727)" This reverts commit 2f8441b. * Revert "Fix antrea-ubi image build (antrea-io#5723)" This reverts commit 2afab06. --------- Signed-off-by: Antonin Bas <[email protected]>

* Disable cgo for all Antrea binaries Instead of selectively disabling cgo for some binaries (e.g., release assets), we now unconditionally disable cgo for all binaries, even those that only run inside the container image for which they were built (e.g., antrea-controller). After some analysis, there seems to be no downside in doing this. We also get some benefits such as reduced build time for the default make command. Fixes #5724 * Revert "Add git to antrea-build image for UBI build (#5727)" This reverts commit 2f8441b. * Revert "Fix antrea-ubi image build (#5723)" This reverts commit 2afab06. --------- Signed-off-by: Antonin Bas <[email protected]>

* Disable cgo for all Antrea binaries Instead of selectively disabling cgo for some binaries (e.g., release assets), we now unconditionally disable cgo for all binaries, even those that only run inside the container image for which they were built (e.g., antrea-controller). After some analysis, there seems to be no downside in doing this. We also get some benefits such as reduced build time for the default make command. Fixes antrea-io#5724 * Revert "Add git to antrea-build image for UBI build (antrea-io#5727)" This reverts commit 2f8441b. * Revert "Fix antrea-ubi image build (antrea-io#5723)" This reverts commit 2afab06. --------- Signed-off-by: Antonin Bas <[email protected]>

* Disable cgo for all Antrea binaries Instead of selectively disabling cgo for some binaries (e.g., release assets), we now unconditionally disable cgo for all binaries, even those that only run inside the container image for which they were built (e.g., antrea-controller). After some analysis, there seems to be no downside in doing this. We also get some benefits such as reduced build time for the default make command. Fixes #5724 * Revert "Add git to antrea-build image for UBI build (#5727)" This reverts commit 2f8441b. * Revert "Fix antrea-ubi image build (#5723)" This reverts commit 2afab06. --------- Signed-off-by: Antonin Bas <[email protected]>

antoninbas added 3 commits February 14, 2024 15:33

Revert "Add git to antrea-build image for UBI build (antrea-io#5727)"

8178fb2

This reverts commit 2f8441b. Signed-off-by: Antonin Bas <[email protected]>

Revert "Fix antrea-ubi image build (antrea-io#5723)"

81b2320

This reverts commit 2afab06. Signed-off-by: Antonin Bas <[email protected]>

antoninbas force-pushed the disable-cgo-for-all-antrea-binaries branch from c03439d to 81b2320 Compare February 14, 2024 23:34

antoninbas requested review from wenyingd, tnqn, heanlan and luolanzone February 15, 2024 01:33

heanlan approved these changes Feb 15, 2024

View reviewed changes

luolanzone approved these changes Feb 18, 2024

View reviewed changes

wenyingd reviewed Feb 18, 2024

View reviewed changes

wenyingd mentioned this pull request Feb 18, 2024

[VM Agent] Build antrea binaries with static link #5970

Closed

tnqn approved these changes Feb 20, 2024

View reviewed changes

tnqn mentioned this pull request Feb 20, 2024

test-vm-e2e doesn't work in CI pipeline #5967

Closed

antoninbas merged commit 9fee7d2 into antrea-io:main Feb 21, 2024
49 of 54 checks passed

antoninbas deleted the disable-cgo-for-all-antrea-binaries branch February 21, 2024 04:48

antoninbas added the action/release-note Indicates a PR that should be included in release notes. label Feb 21, 2024

luolanzone mentioned this pull request Mar 20, 2024

Automated cherry pick of #5988: Disable cgo for all Antrea binaries (#5988) #6126

Merged

antoninbas mentioned this pull request Mar 20, 2024

Remove unnecessary code from UBI Dockerfiles #6128

Merged

luolanzone mentioned this pull request Mar 22, 2024

Automated cherry pick of #5988: Disable cgo for all Antrea binaries (#5988) #6008: Fix TestVMAgent (#6008) #6135

Merged

luolanzone mentioned this pull request Mar 26, 2024

Automated cherry pick of #5988: Disable cgo for all Antrea binaries (#5988) #6146

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Disable cgo for all Antrea binaries #5988

Disable cgo for all Antrea binaries #5988

antoninbas commented Feb 14, 2024

antoninbas commented Feb 14, 2024

heanlan left a comment

luolanzone left a comment

luolanzone Feb 18, 2024

xliuxu Feb 18, 2024

tnqn Feb 20, 2024

antoninbas Feb 21, 2024

wenyingd left a comment •

edited

Loading

wenyingd Feb 18, 2024

tnqn Feb 20, 2024

antoninbas Feb 21, 2024

wenyingd commented Feb 18, 2024

tnqn left a comment

tnqn Feb 20, 2024

tnqn Feb 20, 2024

antoninbas commented Feb 21, 2024

antoninbas commented Feb 21, 2024

antoninbas commented Feb 21, 2024

antoninbas commented Feb 21, 2024

antoninbas commented Feb 21, 2024

wenyingd commented Mar 20, 2024

luolanzone commented Mar 20, 2024

wenyingd commented Mar 20, 2024

Disable cgo for all Antrea binaries #5988

Disable cgo for all Antrea binaries #5988

Conversation

antoninbas commented Feb 14, 2024

antoninbas commented Feb 14, 2024

heanlan left a comment

Choose a reason for hiding this comment

luolanzone left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wenyingd left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wenyingd commented Feb 18, 2024

tnqn left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

antoninbas commented Feb 21, 2024

antoninbas commented Feb 21, 2024

antoninbas commented Feb 21, 2024

antoninbas commented Feb 21, 2024

antoninbas commented Feb 21, 2024

wenyingd commented Mar 20, 2024

luolanzone commented Mar 20, 2024

wenyingd commented Mar 20, 2024

wenyingd left a comment •

edited

Loading