Fixes#2668
When Kubernetes marks nodes as "Ready" before their Certificate Signing
Requests (CSRs) are approved, the buildx kubernetes driver can fail to
connect to builder pods with transient TLS errors like:
- "tls: internal error"
- "context deadline exceeded"
- "use of closed network connection"
- "i/o timeout"
This is particularly problematic on EKS clusters with ARM64 nodes under
heavy load, where multiple builders are being spawned simultaneously.
This commit adds retry logic with exponential backoff to the Dial()
function in the kubernetes driver. The implementation:
- Attempts up to 5 connection retries
- Uses exponential backoff starting at 500ms, capped at 10s
- Only retries on known transient connection errors
- Uses errors.Is/errors.As for proper error type checking
- Logs retry attempts using logrus for visibility
- Respects context cancellation
This allows buildx to gracefully handle the race condition where pods
are marked as Running before their TLS certificates are fully ready.
Signed-off-by: guimove <dasilva.guillaume@live.fr>
Directly convert to a int32 instead of later conversion so that
we can return an error if the value is out of range.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The ResolveDefaultContext function is only used internally by the CLI,
and has no known external users, except for this test in buildx. It was
exported in [cli@f820766] to allow (unit) testing, but did not document
that it was only exported for this purpose.
This patch rewrites the test to allow deprecating / removing the function
in the CLI.
[cli@f820766]: https://github.com/docker/cli/commit/f820766f6ac57188d96c9ca377f2b4627e90da28
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `#nosec` comment allows ignoring a specific rule; this prevents
potentially other "gosec" linting failulres from being silently ignored.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
In this mode buildkit can push directly so pushing manually
with docker would result in pushing image twice.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Because remote driver implements Info() by calling
Client() internally, two instances on Client are created
backed by separate TCP connection. This hack avoids it
and improves performance.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Update buildkit dependency to v0.14.0-rc1. Update the tracing
infrastructure to use the new detect API which updates how the delegated
exporter is configured.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
resolveNode methods can call with nil logger. Although
the results should already be cached now in resolver
this makes the protection more explicit.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Use a simplified local implementation that follow the same semantics,
so that we don't need k8s.io/apiserver as dependency.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Tonis Tiigi