Backport Docker-based etcd retirement to release/3.0

acl/packages.yaml

@@ -19,7 +19,6 @@
 packages:
   # --- Ported from Flatcar ------------------------------------------------
   - coreos-init         # Init scripts, systemd units, generators (autologin fix)
-  - sdnotify-proxy      # sd_notify proxy for containerized services
 
   # --- LISA testing dependencies ------------------------------------------
   - stress-ng           # Stress test tool

acl/tests/kola_enforcing.yaml

@@ -28,21 +28,6 @@ version: 1
 
 tests:
   - name: acl.basic
-  - name: acl.etcd-member.discovery
-    exceptions:
-      - platforms: [qemu]
-        architectures: [aarch64]
-        reason: 3-node etcd cluster on TCG-emulated arm64 races systemd's DefaultDeviceTimeoutSec for /dev/disk/by-label/OEM; tracked by the OEM fsck conditional dropin work
-      - platforms: [azure]
-        reason: Azure version depends on discovery.etcd.io, which is unmaintained.
-      - imageVariants: [acl-t]
-        reason: |
-          The test's etcd server runs in a docker container
-          (etcd-member.service via etcd-wrapper), and acl-t has no
-          docker daemon — the standalone `docker` sysext is not carried
-          and docker has no RPM replacement (same as docker.*) — so no
-          etcd server can start for the test to drive.
-
   - name: acl.internet
     exceptions:
       - platforms: [qemu]
@@ -144,27 +129,6 @@ tests:
         architectures: [aarch64]
         reason: Flakiness on TCG-emulated arm64, failures due to slow device enumeration.
 
-  - name: cl.etcd-member.etcdctlv3
-    exceptions:
-      - imageVariants: [acl-t]
-        reason: |
-          The test's etcd server runs in a docker container
-          (etcd-member.service via etcd-wrapper), and acl-t has no
-          docker daemon — the standalone `docker` sysext is not carried
-          and docker has no RPM replacement (same as docker.*) — so no
-          etcd server can start for the test to drive.
-  - name: cl.etcd-member.v2-backup-restore
-    exceptions:
-      - platforms: [azure]
-        reason: Azure version depends on discovery.etcd.io, which is unmaintained.
-      - imageVariants: [acl-t]
-        reason: |
-          The test's etcd server runs in a docker container
-          (etcd-member.service via etcd-wrapper), and acl-t has no
-          docker daemon — the standalone `docker` sysext is not carried
-          and docker has no RPM replacement (same as docker.*) — so no
-          etcd server can start for the test to drive.
-
   - name: cl.filesystem
     exceptions:
       - platforms: [azure]
@@ -361,115 +325,6 @@ tests:
           AKS). containerd-native (ctr) replacement tests are tracked as
           a follow-up.
 
-  - name: kubeadm.v1.32.4.calico.base
-    exceptions:
-      - platforms: [qemu]
-        architectures: [aarch64]
-        reason: kubectl wait timeouts on emulated arm64 QEMU
-      - imageVariants: [acl-t]
-        reason: |
-          The kubeadm cluster provisions an etcd node that runs etcd in
-          a docker container (etcd-member.service via etcd-wrapper);
-          acl-t has no docker daemon — the standalone `docker` sysext is
-          not carried and docker has no RPM replacement (same as
-          docker.*) — so the control plane cannot bootstrap.
-  - name: kubeadm.v1.32.4.cilium.base
-    exceptions:
-      - platforms: [qemu]
-        architectures: [aarch64]
-        reason: kubectl wait timeouts on emulated arm64 QEMU
-      - imageVariants: [acl-t]
-        reason: |
-          The kubeadm cluster provisions an etcd node that runs etcd in
-          a docker container (etcd-member.service via etcd-wrapper);
-          acl-t has no docker daemon — the standalone `docker` sysext is
-          not carried and docker has no RPM replacement (same as
-          docker.*) — so the control plane cannot bootstrap.
-  - name: kubeadm.v1.32.4.flannel.base
-    exceptions:
-      - platforms: [qemu]
-        architectures: [aarch64]
-        reason: kubectl wait timeouts on emulated arm64 QEMU
-      - imageVariants: [acl-t]
-        reason: |
-          The kubeadm cluster provisions an etcd node that runs etcd in
-          a docker container (etcd-member.service via etcd-wrapper);
-          acl-t has no docker daemon — the standalone `docker` sysext is
-          not carried and docker has no RPM replacement (same as
-          docker.*) — so the control plane cannot bootstrap.
-  - name: kubeadm.v1.33.0.calico.base
-    exceptions:
-      - platforms: [qemu]
-        architectures: [aarch64]
-        reason: kubectl wait timeouts on emulated arm64 QEMU
-      - imageVariants: [acl-t]
-        reason: |
-          The kubeadm cluster provisions an etcd node that runs etcd in
-          a docker container (etcd-member.service via etcd-wrapper);
-          acl-t has no docker daemon — the standalone `docker` sysext is
-          not carried and docker has no RPM replacement (same as
-          docker.*) — so the control plane cannot bootstrap.
-  - name: kubeadm.v1.33.0.cilium.base
-    exceptions:
-      - platforms: [qemu]
-        architectures: [aarch64]
-        reason: kubectl wait timeouts on emulated arm64 QEMU
-      - imageVariants: [acl-t]
-        reason: |
-          The kubeadm cluster provisions an etcd node that runs etcd in
-          a docker container (etcd-member.service via etcd-wrapper);
-          acl-t has no docker daemon — the standalone `docker` sysext is
-          not carried and docker has no RPM replacement (same as
-          docker.*) — so the control plane cannot bootstrap.
-  - name: kubeadm.v1.33.0.flannel.base
-    exceptions:
-      - platforms: [qemu]
-        architectures: [aarch64]
-        reason: kubectl wait timeouts on emulated arm64 QEMU
-      - imageVariants: [acl-t]
-        reason: |
-          The kubeadm cluster provisions an etcd node that runs etcd in
-          a docker container (etcd-member.service via etcd-wrapper);
-          acl-t has no docker daemon — the standalone `docker` sysext is
-          not carried and docker has no RPM replacement (same as
-          docker.*) — so the control plane cannot bootstrap.
-  - name: kubeadm.v1.34.1.calico.base
-    exceptions:
-      - platforms: [qemu]
-        architectures: [aarch64]
-        reason: kubectl wait timeouts on emulated arm64 QEMU
-      - imageVariants: [acl-t]
-        reason: |
-          The kubeadm cluster provisions an etcd node that runs etcd in
-          a docker container (etcd-member.service via etcd-wrapper);
-          acl-t has no docker daemon — the standalone `docker` sysext is
-          not carried and docker has no RPM replacement (same as
-          docker.*) — so the control plane cannot bootstrap.
-  - name: kubeadm.v1.34.1.cilium.base
-    exceptions:
-      - platforms: [qemu]
-        architectures: [aarch64]
-        reason: kubectl wait timeouts on emulated arm64 QEMU
-      - imageVariants: [acl-t]
-        reason: |
-          The kubeadm cluster provisions an etcd node that runs etcd in
-          a docker container (etcd-member.service via etcd-wrapper);
-          acl-t has no docker daemon — the standalone `docker` sysext is
-          not carried and docker has no RPM replacement (same as
-          docker.*) — so the control plane cannot bootstrap.
-  - name: kubeadm.v1.34.1.flannel.base
-    exceptions:
-      - platforms: [qemu]
-        architectures: [aarch64]
-        reason: kubectl wait timeouts on emulated arm64 QEMU
-      - imageVariants: [acl-t]
-        reason: |
-          The kubeadm cluster provisions an etcd node that runs etcd in
-          a docker container (etcd-member.service via etcd-wrapper);
-          acl-t has no docker daemon — the standalone `docker` sysext is
-          not carried and docker has no RPM replacement (same as
-          docker.*) — so the control plane cannot bootstrap.
-
   - name: linux.nfs.v3
     exceptions:
       - platforms: [azure]

build_library/rpm/build_image_util.sh

@@ -1036,61 +1036,6 @@ EOF
     sudo chmod 0644 "${root_fs_dir}/etc/systemd/system/ldconfig.service"
 }
 
-# ── etcd: remove native server, keep etcdctl, prepare for Docker wrapper ─────
-_configure_etcd_rpm() {
-    local root_fs_dir="$1"
-
-    # Remove etcd server and etcdutl binaries - we only need etcdctl from the etcd RPM.
-    # The etcd server runs inside a Docker container via etcd-wrapper, not natively.
-    if [[ -f "${root_fs_dir}/usr/bin/etcd" ]]; then
-        info "RPM mode: Removing /usr/bin/etcd (etcd server runs in Docker via etcd-wrapper)"
-        sudo rm -f "${root_fs_dir}/usr/bin/etcd"
-    fi
-    if [[ -f "${root_fs_dir}/usr/bin/etcdutl" ]]; then
-        info "RPM mode: Removing /usr/bin/etcdutl (not needed)"
-        sudo rm -f "${root_fs_dir}/usr/bin/etcdutl"
-    fi
-    # Also remove the native etcd.service - etcd-member.service (Docker-based) is used instead
-    if [[ -f "${root_fs_dir}/usr/lib/systemd/system/etcd.service" ]]; then
-        info "RPM mode: Removing native etcd.service (using etcd-member.service instead)"
-        sudo rm -f "${root_fs_dir}/usr/lib/systemd/system/etcd.service"
-    fi
-    # Remove the etcd preset file (refers to the native etcd.service we just removed)
-    sudo rm -f "${root_fs_dir}/usr/lib/systemd/system-preset/50-etcd.preset"
-    # Remove etcd config file (native etcd.service config, not used with etcd-wrapper)
-    sudo rm -f "${root_fs_dir}/etc/etcd/etcd-default-conf.yml"
-
-    # sysusers.d config to create the etcd user/group (needed by etcd-wrapper).
-    # The etcd RPM doesn't create this user, but etcd-wrapper needs it for:
-    #   - chown etcd:etcd on the data directory
-    #   - id -u/-g to map the user into the Docker container
-    # This MUST be in the rootfs (not the sysext) so systemd-sysusers creates
-    # the user before the docker sysext is mounted.
-    cat <<'SYSUSERS_EOF' | sudo tee "${root_fs_dir}/usr/lib/sysusers.d/etcd.conf" > /dev/null
-u etcd - "etcd user" /var/lib/etcd
-SYSUSERS_EOF
-
-    # CLC transpiler generates ExecStart=/usr/lib/coreos/etcd-wrapper
-    # Create compat symlink so /usr/lib/coreos -> flatcar resolves
-    sudo ln -sfT flatcar "${root_fs_dir}/usr/lib/coreos"
-
-    # etcd-member.service and etcd-wrapper.conf MUST be in the rootfs (not the
-    # sysext) because Ignition runs before sysext merge. If the unit file only
-    # exists in the sysext, Ignition cannot read its [Install] WantedBy= section
-    # to create the multi-user.target.wants symlink, so the service never starts.
-    local etcd_wrapper_src="${SCRIPT_ROOT}/sdk_container/src/third_party/coreos-overlay/app-admin/etcd-wrapper/files"
-    local etcd_version="3.5.16"
-    if [[ ! -d "${etcd_wrapper_src}" ]]; then
-        die "etcd-wrapper source not found at ${etcd_wrapper_src}"
-    fi
-    # etcd-member.service (substitute image tag)
-    sed "s|@ETCD_IMAGE_TAG@|v${etcd_version}|g" \
-        "${etcd_wrapper_src}/etcd-member.service" \
-        | sudo tee "${root_fs_dir}/usr/lib/systemd/system/etcd-member.service" > /dev/null
-    # etcd-wrapper.conf -> /usr/lib/tmpfiles.d/ (creates /var/lib/etcd 0700 etcd:etcd)
-    sudo cp "${etcd_wrapper_src}/etcd-wrapper.conf" "${root_fs_dir}/usr/lib/tmpfiles.d/etcd-wrapper.conf"
-}
-
 # CIS Level 1 hardening
 # Addresses CIS Azure Container Linux 4 Level 1 failures without affecting
 # network connectivity or core system operation. All settings are safe for
@@ -1368,7 +1313,6 @@ finish_image_post_tmpfiles_rpm() {
     _configure_disk_autogrow_rpm "${root_fs_dir}"
     _remove_unused_systemd_components_rpm "${root_fs_dir}"
     _configure_pcrlock_rpm "${root_fs_dir}"
-    _configure_etcd_rpm "${root_fs_dir}"
     _configure_kdump_rpm "${root_fs_dir}"
     _configure_misc_rpm "${root_fs_dir}"
     _configure_cis_hardening_rpm "${root_fs_dir}"

build_library/rpm/package_catalog.yaml

@@ -98,9 +98,7 @@ packages:
   sys-block/open-iscsi: iscsi-initiator-utils
 
   # Container runtime
-  app-containers/docker:
-    - moby-engine
-    - sdnotify-proxy
+  app-containers/docker: moby-engine
   app-emulation/docker: moby-engine  # Alternative package name
   app-containers/docker-cli: docker-cli
   app-containers/docker-buildx: docker-buildx
@@ -578,9 +576,7 @@ packages:
   app-misc/c_rehash: SKIP
   app-misc/pax-utils: SKIP
   dev-cpp/glog: SKIP
-  # TODO: we should create a new client package for etcdctl instead of using
-  # the full package
-  dev-db/etcdctl: etcd
+  dev-db/etcdctl: SKIP  # No etcd server or client needed in RPM mode
   dev-libs/jose: SKIP  # not used, skipping to not bring "jose" from extended
   dev-libs/libbsd: SKIP
   dev-libs/libverto: SKIP
@@ -710,4 +706,3 @@ packages:
   sys-libs/nss-usrfiles: SKIP
   sys-libs/tevent: SKIP
   sys-power/acpid: SKIP
-

build_library/sysext_mangle_docker-flatcar

@@ -28,8 +28,3 @@ cp -vdR --preserve=mode,timestamps "${files_dir}/"* "${rootfs}"
 
 mkdir -p "${rootfs}/usr/lib/systemd/system/sockets.target.d"
 { echo "[Unit]"; echo "Upholds=docker.socket"; } > "${rootfs}/usr/lib/systemd/system/sockets.target.d/10-docker-socket.conf"
-
-# RPM-specific mangle (etcd-wrapper, etc.)
-if [[ "${PACKAGE_SOURCE_MODE}" == "RPM" ]]; then
-  "$(dirname "$0")/rpm/sysext_mangle_docker-flatcar.sh" "${rootfs}"
-fi