Repository: kubernetes-sigs/gcp-compute-persistent-disk-csi-driver
Pull request #985 (2022-05-12 01:19:16)

Add Makefile target that validates the Dockerfile images contain the correct shared library dependencies
**What type of PR is this?**
/kind test

**What this PR does / why we need it**: This uses ldd on the target architecture (amd64/arm64) to validate if all direct and indirect dependencies of a program. The underlying logic leverages ldd to find dependencies that are "not found". This is helpful to catch in presubmit issues where all the runtime libs were not included. See #974 as an example of this.

**Does this PR introduce a user-facing change?**:
```release-note
NONE
```


pwschuurman: /assign @saikat-royc 
k8s-ci-robot: Hi @pwschuurman. Thanks for your PR.

I'm waiting for a [kubernetes-sigs](https://github.com/orgs/kubernetes-sigs/people) member to verify that this patch is reasonable to test. If it is, they should reply with `/ok-to-test` on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should [join the org](https://git.k8s.io/community/community-membership.md#member) to skip this step.

Once the patch is verified, the new status will be reflected by the `ok-to-test` label.

I understand the commands that are listed [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fgcp-compute-persistent-disk-csi-driver).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>

k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver/pull/985#" title="Author self-approved">pwschuurman</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please ask for approval from **saikat-royc** after the PR has been reviewed.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fgcp-compute-persistent-disk-csi-driver).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver/blob/master/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["saikat-royc"]} -->

Patch:
diff --git a/Dockerfile b/Dockerfile
index a6dbfb68..6c39bfa4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -40,7 +40,7 @@ ENV LIB_DIR_PREFIX x86_64
 FROM distroless-base AS distroless-arm64
 ENV LIB_DIR_PREFIX aarch64
 
-FROM distroless-$TARGETARCH
+FROM distroless-$TARGETARCH as output-image
 
 # Copy necessary dependencies into distroless base.
 COPY --from=builder /go/src/sigs.k8s.io/gcp-compute-persistent-disk-csi-driver/bin/gce-pd-csi-driver /gce-pd-csi-driver
@@ -98,4 +98,16 @@ COPY --from=debian /usr/lib/${LIB_DIR_PREFIX}-linux-gnu/libacl.so.1 \
 # Copy NVME support required script and rules into distroless base.
 COPY deploy/kubernetes/udev/google_nvme_id /lib/udev_containerized/google_nvme_id
 
+# Build stage used for validation of the output-image
+# See validate-container-linux-* targets in Makefile
+FROM output-image as validation-image
+
+COPY --from=debian /usr/bin/ldd /usr/bin/find /usr/bin/xargs /usr/bin/
+COPY --from=builder /go/src/sigs.k8s.io/gcp-compute-persistent-disk-csi-driver/hack/print-missing-deps.sh /print-missing-deps.sh
+SHELL ["/bin/bash", "-c"]
+RUN /print-missing-deps.sh
+
+# Final build stage, create the real Docker image with ENTRYPOINT
+FROM output-image
+
 ENTRYPOINT ["/gce-pd-csi-driver"]
diff --git a/Makefile b/Makefile
index 62dcb23b..daf1cd32 100644
--- a/Makefile
+++ b/Makefile
@@ -79,6 +79,22 @@ build-and-push-multi-arch-debug: build-and-push-container-linux-debug build-and-
 
 push-container: build-container
 
+# Used by hack/verify-docker-deps.sh, not used for building artifacts
+validate-container-linux-amd64: init-buildx
+	$(DOCKER) buildx build --platform=linux/amd64 \
+		-t validation_linux_amd64 \
+		--target validation-image \
+		--build-arg BUILDPLATFORM=linux \
+		--build-arg STAGINGVERSION=$(STAGINGVERSION) .
+
+# Used by hack/verify-docker-deps.sh, not used for building artifacts
+validate-container-linux-arm64: init-buildx
+	$(DOCKER) buildx build --platform=linux/arm64 \
+		-t validation_linux_arm64 \
+		--target validation-image \
+		--build-arg BUILDPLATFORM=linux \
+		--build-arg STAGINGVERSION=$(STAGINGVERSION) .
+
 build-and-push-container-linux-amd64: require-GCE_PD_CSI_STAGING_IMAGE init-buildx
 	$(DOCKER) buildx build --platform=linux/amd64 \
 		-t $(STAGINGIMAGE):$(STAGINGVERSION)_linux_amd64 \
diff --git a/hack/print-missing-deps.sh b/hack/print-missing-deps.sh
new file mode 100755
index 00000000..9c170835
--- /dev/null
+++ b/hack/print-missing-deps.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+# Copyright 2022 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+echo "Verifying Docker Executables have appropriate dependencies"
+
+printMissingDep() {
+  if /usr/bin/ldd "$@" | grep "not found"; then
+    echo "!!! Missing deps for $@ !!!"
+    exit 1
+  fi
+}
+
+export -f printMissingDep
+
+/usr/bin/find / -type f -executable -print | /usr/bin/xargs -I {} /bin/bash -c 'printMissingDep "{}"'
diff --git a/hack/verify-docker-deps.sh b/hack/verify-docker-deps.sh
new file mode 100755
index 00000000..0324df3e
--- /dev/null
+++ b/hack/verify-docker-deps.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+# Copyright 2018 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+echo "Verifying Docker Image Dependencies"
+
+PKG_ROOT=$(git rev-parse --show-toplevel)
+
+make -C "${PKG_ROOT}" validate-container-linux-amd64 validate-container-linux-arm64
diff --git a/manifest_osversion.sh b/manifest_osversion.sh
index 5c6c0cc4..82293d52 100755
--- a/manifest_osversion.sh
+++ b/manifest_osversion.sh
@@ -1,7 +1,5 @@
 #!/bin/bash
 
-set -o xtrace
-
 # The following is a workaround for issue https://github.com/moby/moby/issues/41417
 # to manually inserver os.version information into docker manifest file
 # TODO: once docker manifest annotation for os.versions is availabler for the installed docker here,
@@ -35,7 +33,4 @@ for ((i=0;i<${#imagetags[@]};++i)); do
   sed -i -r "s/(\"os\"\:\"windows\")/\0,\"os.version\":$full_version/" \
   "${HOME}/.docker/manifests/${manifest_folder}/${image_folder}"
 
-  # manifest after transformations
-  cat "${HOME}/.docker/manifests/${manifest_folder}/${image_folder}"
 done
-


Test patch:
diff --git a/test/k8s-integration/main.go b/test/k8s-integration/main.go
index 47742631..1d27a58a 100644
--- a/test/k8s-integration/main.go
+++ b/test/k8s-integration/main.go
@@ -586,7 +586,7 @@ func generateGKETestSkip(testParams *testParameters) string {
 
 	// Cloning test fixes were introduced after 1.23.
 	if curVer.lessThan(mustParseVersion("1.24.0")) {
-		skipString = skipString + "|pvc.data.source"
+		skipString = skipString + "|\\[Feature:VolumeSnapshotDataSource\\]|pvc.data.source"
 	}
 
 	// "volumeMode should not mount / map unused volumes in a pod" tests a