From 8c55034e06298c9311f2f529cf5bf34e1ef2da3a Mon Sep 17 00:00:00 2001 From: drivebyer Date: Mon, 13 Jul 2026 17:38:02 +0800 Subject: [PATCH 1/3] chore: pin mysql-operator source refs to the v0.8.0 tag --- images/mgr-operator/Dockerfile | 6 +++--- images/mysql-operator-sidecar-5.7/Dockerfile | 10 +++++++--- images/mysql-operator-sidecar-8.0/Dockerfile | 10 +++++++--- images/mysql-operator-sidecar-8.0/Dockerfile.base | 10 +++++++--- images/mysql-operator-sidecar-8.4/Dockerfile | 6 +++--- 5 files changed, 27 insertions(+), 15 deletions(-) diff --git a/images/mgr-operator/Dockerfile b/images/mgr-operator/Dockerfile index d084d6b..ea32cbb 100644 --- a/images/mgr-operator/Dockerfile +++ b/images/mgr-operator/Dockerfile @@ -3,13 +3,13 @@ ARG BASE_IMAGE_REPOSITORY=ghcr.io/ksmartdata/community-operator FROM alpine:3.22.2 AS downloader ARG MGR_OPERATOR_REF=package -ARG MYSQL_OPERATOR_EXTRA_IMAGE_REF=extra_image +ARG MYSQL_OPERATOR_EXTRA_IMAGE_REF=v0.8.0 WORKDIR /tmp RUN wget -q "https://github.com/ksmartdata/mgr-operator/archive/${MGR_OPERATOR_REF}.zip" -O mgr-operator.zip && \ unzip -q mgr-operator.zip && \ mv mgr-operator-* mgr-operator-src && \ - wget -q "https://github.com/ksmartdata/mysql-operator/archive/${MYSQL_OPERATOR_EXTRA_IMAGE_REF}.zip" -O extra_image.zip && \ - unzip -q extra_image.zip && \ + wget -q "https://github.com/ksmartdata/mysql-operator/archive/${MYSQL_OPERATOR_EXTRA_IMAGE_REF}.zip" -O mysql-operator.zip && \ + unzip -q mysql-operator.zip && \ mv mysql-operator-* mysql-operator-src FROM golang:1.24.13-alpine AS builder diff --git a/images/mysql-operator-sidecar-5.7/Dockerfile b/images/mysql-operator-sidecar-5.7/Dockerfile index 7008556..c16dd6c 100644 --- a/images/mysql-operator-sidecar-5.7/Dockerfile +++ b/images/mysql-operator-sidecar-5.7/Dockerfile @@ -8,11 +8,15 @@ RUN apt update -y && \ ENV GOPROXY=https://goproxy.cn ENV GOPATH=/build +# pinned mysql-operator ref (tag or commit - repo policy forbids pulling +# from branch heads); bump via build-args when cutting a new release +ARG OPERATOR_REF=v0.8.0 + # build mysql-operator-sidecar WORKDIR /build -RUN wget -O extra_image.zip https://github.com/ksmartdata/mysql-operator/archive/refs/heads/extra_image.zip -RUN unzip extra_image.zip -WORKDIR /build/mysql-operator-extra_image +RUN wget -O src.zip https://github.com/ksmartdata/mysql-operator/archive/${OPERATOR_REF}.zip +RUN unzip src.zip && mv mysql-operator-* mysql-operator-src +WORKDIR /build/mysql-operator-src RUN go mod tidy RUN CGO_ENABLED=0 go build -o /mysql-operator-sidecar cmd/mysql-operator-sidecar/main.go diff --git a/images/mysql-operator-sidecar-8.0/Dockerfile b/images/mysql-operator-sidecar-8.0/Dockerfile index e678a1b..df56c2d 100644 --- a/images/mysql-operator-sidecar-8.0/Dockerfile +++ b/images/mysql-operator-sidecar-8.0/Dockerfile @@ -8,11 +8,15 @@ RUN apt install -y wget gcc unzip ENV GOPROXY=https://goproxy.cn ENV GOPATH=/build +# pinned mysql-operator ref (tag or commit - repo policy forbids pulling +# from branch heads); bump via build-args when cutting a new release +ARG OPERATOR_REF=v0.8.0 + # build mysql-operator-sidecar WORKDIR /build -RUN wget -O arm64.zip https://github.com/ksmartdata/mysql-operator/archive/refs/heads/extra_image.zip -RUN unzip arm64.zip -WORKDIR /build/mysql-operator-extra_image +RUN wget -O src.zip https://github.com/ksmartdata/mysql-operator/archive/${OPERATOR_REF}.zip +RUN unzip src.zip && mv mysql-operator-* mysql-operator-src +WORKDIR /build/mysql-operator-src RUN go mod tidy RUN CGO_ENABLED=0 go build -o /mysql-operator-sidecar cmd/mysql-operator-sidecar/main.go diff --git a/images/mysql-operator-sidecar-8.0/Dockerfile.base b/images/mysql-operator-sidecar-8.0/Dockerfile.base index 982d2bb..9be5dbf 100644 --- a/images/mysql-operator-sidecar-8.0/Dockerfile.base +++ b/images/mysql-operator-sidecar-8.0/Dockerfile.base @@ -14,10 +14,14 @@ RUN apt install -y wget gcc unzip ENV GOPROXY=https://goproxy.cn ENV GOPATH=/build +# pinned mysql-operator ref (tag or commit - repo policy forbids pulling +# from branch heads); bump via build-args when cutting a new release +ARG OPERATOR_REF=v0.8.0 + WORKDIR /build -RUN wget -O extra_image.zip https://github.com/ksmartdata/mysql-operator/archive/refs/heads/extra_image.zip -RUN unzip extra_image.zip -WORKDIR /build/mysql-operator-extra_image +RUN wget -O src.zip https://github.com/ksmartdata/mysql-operator/archive/${OPERATOR_REF}.zip +RUN unzip src.zip && mv mysql-operator-* mysql-operator-src +WORKDIR /build/mysql-operator-src RUN go mod tidy RUN CGO_ENABLED=0 go build -o /mysql-operator-sidecar cmd/mysql-operator-sidecar/main.go diff --git a/images/mysql-operator-sidecar-8.4/Dockerfile b/images/mysql-operator-sidecar-8.4/Dockerfile index 2421983..c362cfe 100644 --- a/images/mysql-operator-sidecar-8.4/Dockerfile +++ b/images/mysql-operator-sidecar-8.4/Dockerfile @@ -16,8 +16,8 @@ FROM --platform=$TARGETPLATFORM golang:1.26-bookworm AS builder # Release convention: tag the mysql-operator repo first (e.g. v0.8.0), then # dispatch the build with build-args OPERATOR_REF= so the sidecar # binary is pinned to an exact commit (git clone --branch accepts tags). -# The default only exists for ad-hoc builds and floats with the branch head. -ARG OPERATOR_REF=extra_image +# The default is pinned to the latest release tag; bump it per release. +ARG OPERATOR_REF=v0.8.0 # git is bundled with the golang image (wget/unzip are not) RUN git clone --depth 1 --branch ${OPERATOR_REF} \ @@ -62,7 +62,7 @@ RUN curl -fsSL https://rclone.org/install.sh | bash \ # re-declared so the builder-stage ARG is visible here; records which # mysql-operator ref the embedded sidecar binary was built from -ARG OPERATOR_REF=extra_image +ARG OPERATOR_REF=v0.8.0 LABEL io.ksmartdata.operator-ref=${OPERATOR_REF} COPY --from=builder /mysql-operator-sidecar /usr/local/bin/mysql-operator-sidecar From 0930a3cea96fba888cb3a37dcfe90e8b92dd2380 Mon Sep 17 00:00:00 2001 From: drivebyer Date: Mon, 13 Jul 2026 18:04:06 +0800 Subject: [PATCH 2/3] fix: bump sidecar builder Go to 1.26 to clear the trivy stdlib CVE gate --- images/mysql-operator-sidecar-5.7/Dockerfile | 4 +++- images/mysql-operator-sidecar-8.0/Dockerfile | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/images/mysql-operator-sidecar-5.7/Dockerfile b/images/mysql-operator-sidecar-5.7/Dockerfile index c16dd6c..c1ef3c5 100644 --- a/images/mysql-operator-sidecar-5.7/Dockerfile +++ b/images/mysql-operator-sidecar-5.7/Dockerfile @@ -1,4 +1,6 @@ -FROM --platform=$TARGETPLATFORM golang:1.21.11 as builder +# keep the Go version current: the stdlib compiled into the sidecar binary +# is what the trivy CRITICAL gate scans (see the 8.4 image) +FROM --platform=$TARGETPLATFORM golang:1.26-bookworm as builder USER root diff --git a/images/mysql-operator-sidecar-8.0/Dockerfile b/images/mysql-operator-sidecar-8.0/Dockerfile index df56c2d..e48e286 100644 --- a/images/mysql-operator-sidecar-8.0/Dockerfile +++ b/images/mysql-operator-sidecar-8.0/Dockerfile @@ -1,4 +1,6 @@ -FROM --platform=$TARGETPLATFORM golang:1.21.11 as builder +# keep the Go version current: the stdlib compiled into the sidecar binary +# is what the trivy CRITICAL gate scans (see the 8.4 image) +FROM --platform=$TARGETPLATFORM golang:1.26-bookworm as builder USER root From 40f6f8fbfbdb1ecd67cfa1388a2c3b8423725795 Mon Sep 17 00:00:00 2001 From: drivebyer Date: Tue, 14 Jul 2026 10:22:15 +0800 Subject: [PATCH 3/3] fix: drop the stale Go toolchain shipped in the sidecar-8.0 base image --- images/mysql-operator-sidecar-8.0/Dockerfile | 3 +++ 1 file changed, 3 insertions(+) diff --git a/images/mysql-operator-sidecar-8.0/Dockerfile b/images/mysql-operator-sidecar-8.0/Dockerfile index e48e286..30b0360 100644 --- a/images/mysql-operator-sidecar-8.0/Dockerfile +++ b/images/mysql-operator-sidecar-8.0/Dockerfile @@ -27,6 +27,9 @@ RUN curl https://rclone.org/install.sh | bash FROM --platform=$TARGETPLATFORM ghcr.io/ksmartdata/mysql-operator-sidecar-8.0:v0.7.4 USER root +# the v0.7.4 base ships a full Go toolchain at /usr/local/go; a runtime +# image needs no compiler and trivy gates on its stale stdlib CVEs +RUN rm -rf /usr/local/go COPY --from=builder /mysql-operator-sidecar /usr/local/bin/ COPY --from=builder /usr/bin/rclone /usr/local/bin/ RUN chmod +x /usr/local/bin/mysql-operator-sidecar