Use sync.OnceValue to initialize the kubeclient scheme, codec factory,
and parameter codec as a single lazy-loaded bundle.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Replace the full generated clientset and global Kubernetes scheme
with a small local REST client layer and minimal scheme registration.
This keeps the existing kubeconfig/auth and remote exec behavior while
significantly reducing the linked and vendored Kubernetes dependency set.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Fixes#2668
When Kubernetes marks nodes as "Ready" before their Certificate Signing
Requests (CSRs) are approved, the buildx kubernetes driver can fail to
connect to builder pods with transient TLS errors like:
- "tls: internal error"
- "context deadline exceeded"
- "use of closed network connection"
- "i/o timeout"
This is particularly problematic on EKS clusters with ARM64 nodes under
heavy load, where multiple builders are being spawned simultaneously.
This commit adds retry logic with exponential backoff to the Dial()
function in the kubernetes driver. The implementation:
- Attempts up to 5 connection retries
- Uses exponential backoff starting at 500ms, capped at 10s
- Only retries on known transient connection errors
- Uses errors.Is/errors.As for proper error type checking
- Logs retry attempts using logrus for visibility
- Respects context cancellation
This allows buildx to gracefully handle the race condition where pods
are marked as Running before their TLS certificates are fully ready.
Signed-off-by: guimove <dasilva.guillaume@live.fr>
Directly convert to a int32 instead of later conversion so that
we can return an error if the value is out of range.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The ResolveDefaultContext function is only used internally by the CLI,
and has no known external users, except for this test in buildx. It was
exported in [cli@f820766] to allow (unit) testing, but did not document
that it was only exported for this purpose.
This patch rewrites the test to allow deprecating / removing the function
in the CLI.
[cli@f820766]: https://github.com/docker/cli/commit/f820766f6ac57188d96c9ca377f2b4627e90da28
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `#nosec` comment allows ignoring a specific rule; this prevents
potentially other "gosec" linting failulres from being silently ignored.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
In this mode buildkit can push directly so pushing manually
with docker would result in pushing image twice.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Use a simplified local implementation that follow the same semantics,
so that we don't need k8s.io/apiserver as dependency.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This refactors the driver handle to initialize the tracer delegate
inside of the driver handle instead of the individual plugins.
This provides more uniformity to how the tracer delegate is created by
allowing the driver handle to pass additional client options to the
drivers when they create the client. It also avoids creating the tracer
delegate client multiple times because the driver handle will only
initialize the client once. This prevents some drivers, like the remote
driver, from accidentally registering multiple clients as tracer
delegates.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
This allows the buildx CLI to act a proxy to the configured instance.
It allows external code to use buildx itself as a driver for connecting
to buildkitd instances.
Instance and node selection should follow the same semantics as as
`buildx build`, including taking into account the `BUILDX_BUILDER` env
var and the `--builder` global flag.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Adds a new HostGatewayIP entry in the Driver interface so we can
move Features and HostGatewayIP handling with cache to the very
specific driver (docker).
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
Replace rules are not inherited by consumers of buildx as a module, and as
such would default to use the v0.26.2 version. Removing the replace rules
also removes various (indirect) dependencies (although brings in some new
packages from k8s itself).
The "azure" and "gcp" authentication packages in k8s.io/go-client are now
no longer functional, so removing those imports.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Tonis Tiigi