Update build system from master

.drone.yml

@@ -9,8 +9,13 @@ platform:
 steps:
 - name: build
   image: rancher/dapper:v0.4.2
+  secrets: [ gcloud_auth ]
+  environment:
+    GCLOUD_AUTH:
+      from_secret: gcloud_auth
   commands:
   - dapper ci
+  - echo "${DRONE_TAG}-amd64" | sed -e 's/+/-/g' >.tags
   volumes:
   - name: docker
     path: /var/run/docker.sock
@@ -43,7 +48,6 @@ steps:
     password:
       from_secret: docker_password
     repo: "rancher/k3s"
-    tag: "${DRONE_TAG}-amd64"
     username:
       from_secret: docker_username
   when:
@@ -55,14 +59,14 @@ steps:
     event:
     - tag
 
-- name: sonobuoy-e2e-tests
+- name: test
   image: rancher/dapper:v0.4.2
   secrets: [ gcloud_auth ]
   environment:
     GCLOUD_AUTH:
       from_secret: gcloud_auth
   commands:
-  - dapper -f Dockerfile.sonobuoy.dapper
+  - dapper -f Dockerfile.test.dapper
   volumes:
   - name: docker
     path: /var/run/docker.sock
@@ -100,8 +104,13 @@ platform:
 steps:
 - name: build
   image: rancher/dapper:v0.4.2
+  secrets: [ gcloud_auth ]
+  environment:
+    GCLOUD_AUTH:
+      from_secret: gcloud_auth
   commands:
   - dapper ci
+  - echo "${DRONE_TAG}-arm64" | sed -e 's/+/-/g' >.tags
   volumes:
   - name: docker
     path: /var/run/docker.sock
@@ -134,7 +143,6 @@ steps:
     password:
       from_secret: docker_password
     repo: "rancher/k3s"
-    tag: "${DRONE_TAG}-arm64"
     username:
       from_secret: docker_username
   when:
@@ -146,14 +154,14 @@ steps:
     event:
     - tag
 
-- name: sonobuoy-e2e-tests
+- name: test
   image: rancher/dapper:v0.4.2
   secrets: [ gcloud_auth ]
   environment:
     GCLOUD_AUTH:
       from_secret: gcloud_auth
   commands:
-  - dapper -f Dockerfile.sonobuoy.dapper
+  - dapper -f Dockerfile.test.dapper
   volumes:
   - name: docker
     path: /var/run/docker.sock
@@ -174,8 +182,13 @@ platform:
 steps:
 - name: build
   image: rancher/dapper:v0.4.2
+  secrets: [ gcloud_auth ]
+  environment:
+    GCLOUD_AUTH:
+      from_secret: gcloud_auth
   commands:
   - dapper ci
+  - echo "${DRONE_TAG}-arm" | sed -e 's/+/-/g' >.tags
   volumes:
   - name: docker
     path: /var/run/docker.sock
@@ -208,7 +221,6 @@ steps:
     password:
       from_secret: docker_password
     repo: "rancher/k3s"
-    tag: "${DRONE_TAG}-arm"
     username:
       from_secret: docker_username
   when:
@@ -220,14 +232,14 @@ steps:
     event:
     - tag
 
-- name: sonobuoy-e2e-tests
+- name: test
   image: rancher/dapper:v0.4.2
   secrets: [ gcloud_auth ]
   environment:
     GCLOUD_AUTH:
       from_secret: gcloud_auth
   commands:
-  - dapper -f Dockerfile.sonobuoy.dapper
+  - dapper -f Dockerfile.test.dapper
   volumes:
   - name: docker
     path: /var/run/docker.sock
@@ -247,18 +259,20 @@ platform:
 
 steps:
 - name: manifest
-  image: plugins/manifest:1.0.2
-  settings:
-    username:
+  image: plugins/docker
+  environment:
+    DOCKER_USERNAME:
       from_secret: docker_username
-    password:
+    DOCKER_PASSWORD:
       from_secret: docker_password
-    platforms:
-      - linux/amd64
-      - linux/arm64
-      - linux/arm
-    target: "rancher/k3s:${DRONE_TAG}"
-    template: "rancher/k3s:${DRONE_TAG}-ARCH"
+  settings:
+    dry_run: true
+    dockerfile: Dockerfile.manifest
+    repo: "rancher/k3s-manifest"
+    build_args_from_env:
+    - DOCKER_USERNAME
+    - DOCKER_PASSWORD
+    - DRONE_TAG
   when:
     instance:
     - drone-publish.rancher.io

Dockerfile.dapper

-FROM golang:1.13.4-alpine3.10
+FROM golang:1.13.6-alpine3.10
 
 RUN apk -U --no-cache add bash git gcc musl-dev docker vim less file curl wget ca-certificates jq linux-headers zlib-dev tar zip squashfs-tools npm coreutils \
-    python3 py3-pip python3-dev openssl-dev libffi-dev libseccomp libseccomp-dev make libuv-static
+    python2 python3 py3-pip python3-dev openssl-dev libffi-dev libseccomp libseccomp-dev make libuv-static
 RUN pip3 install 'tox==3.6.0'
 RUN apk -U --no-cache --repository http://dl-3.alpinelinux.org/alpine/edge/main/ add sqlite-dev sqlite-static
 RUN mkdir -p /go/src/golang.org/x && \
@@ -26,7 +26,7 @@ RUN if [ "$DQLITE" = true ]; then \
 
 ENV GO111MODULE off
 ENV DAPPER_RUN_ARGS --privileged -v k3s-cache:/go/src/github.com/rancher/k3s/.cache
-ENV DAPPER_ENV REPO TAG DRONE_TAG IMAGE_NAME SKIP_VALIDATE
+ENV DAPPER_ENV REPO TAG DRONE_TAG IMAGE_NAME SKIP_VALIDATE GCLOUD_AUTH
 ENV DAPPER_SOURCE /go/src/github.com/rancher/k3s/
 ENV DAPPER_OUTPUT ./bin ./dist ./build/out
 ENV DAPPER_DOCKER_SOCKET true

Dockerfile.manifest

+FROM golang:1.13.6-alpine3.10
+
+COPY --from=plugins/manifest:1.2.3 /bin/* /bin/
+
+ARG DOCKER_USERNAME
+ENV DOCKER_USERNAME $DOCKER_USERNAME
+
+ARG DOCKER_PASSWORD
+ENV DOCKER_PASSWORD $DOCKER_PASSWORD
+
+ARG DRONE_TAG
+ENV DRONE_TAG $DRONE_TAG
+
+COPY ./scripts/manifest /bin/
+
+RUN manifest

Dockerfile.sonobuoy.dapper → Dockerfile.test.dapper

-FROM golang:1.13.4-alpine3.10
+FROM golang:1.13.6-alpine3.10
 
-RUN apk -U --no-cache add bash git gcc musl-dev docker curl jq coreutils python2
-RUN SONOBUOY_VER=v0.16.2 && \
-    SONOBUOY_PKG=github.com/vmware-tanzu/sonobuoy && \
-    go get -d ${SONOBUOY_PKG} && \
-    cd /go/src/${SONOBUOY_PKG} && \
-    git checkout -b current ${SONOBUOY_VER} && \
-    go build -o /usr/local/bin/sonobuoy
-RUN rm -rf /go/src /go/pkg
+RUN apk -U --no-cache add bash git gcc musl-dev docker curl jq coreutils python2 openssl
 
 ARG DAPPER_HOST_ARCH
 ENV ARCH $DAPPER_HOST_ARCH
 
+RUN if [ "${ARCH}" == "amd64" ] || [ "${ARCH}" == "arm64" ]; then \
+        VERSION=0.17.1 OS=linux && \
+        curl -sL "https://github.com/vmware-tanzu/sonobuoy/releases/download/v${VERSION}/sonobuoy_${VERSION}_${OS}_${ARCH}.tar.gz" | \
+        tar -xzf - -C /usr/local/bin; \
+    fi
+
 RUN curl -sL https://storage.googleapis.com/kubernetes-release/release/$( \
             curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt \
         )/bin/linux/${ARCH}/kubectl -o /usr/local/bin/kubectl && \
     chmod a+x /usr/local/bin/kubectl
 
+ENV TEST_CLEANUP true
+
 ENV DAPPER_RUN_ARGS --privileged --network host
-ENV DAPPER_ENV REPO TAG DRONE_TAG IMAGE_NAME GCLOUD_AUTH
+ENV DAPPER_ENV REPO TAG DRONE_TAG DRONE_BUILD_EVENT IMAGE_NAME GCLOUD_AUTH
 ENV DAPPER_SOURCE /go/src/github.com/rancher/k3s/
 ENV DAPPER_OUTPUT ./dist
 ENV DAPPER_DOCKER_SOCKET true
@@ -26,4 +27,4 @@ ENV HOME ${DAPPER_SOURCE}
 WORKDIR ${DAPPER_SOURCE}
 
 ENTRYPOINT ["./scripts/entry.sh"]
-CMD ["sonobuoy-e2e-tests"]
+CMD ["test"]

scripts/airgap/image-list.txt

 docker.io/coredns/coredns:1.6.3
-docker.io/library/traefik:1.7.14
-docker.io/rancher/klipper-helm:v0.1.5
+docker.io/library/traefik:1.7.19
+docker.io/rancher/klipper-helm:v0.2.3
 docker.io/rancher/klipper-lb:v0.1.2
 docker.io/rancher/local-path-provisioner:v0.0.11
 docker.io/rancher/metrics-server:v0.3.6
-k8s.gcr.io/pause:3.1
+docker.io/rancher/pause:3.1

scripts/build

@@ -10,13 +10,37 @@ PKG_CONTAINERD="github.com/containerd/containerd"
 PKG_RANCHER_CONTAINERD="github.com/rancher/containerd"
 PKG_CRICTL="github.com/kubernetes-sigs/cri-tools"
 
+buildDate=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
+
 VENDOR_PREFIX="${PKG}/vendor/"
 VERSIONFLAGS="
     -X ${PKG}/pkg/version.Version=${VERSION}
     -X ${PKG}/pkg/version.GitCommit=${COMMIT:0:8}
+
+    -X ${VENDOR_PREFIX}k8s.io/client-go/pkg/version.gitVersion=${VERSION}
+    -X ${VENDOR_PREFIX}k8s.io/client-go/pkg/version.gitCommit=${COMMIT}
+    -X ${VENDOR_PREFIX}k8s.io/client-go/pkg/version.gitTreeState=${TREE_STATE}
+    -X ${VENDOR_PREFIX}k8s.io/client-go/pkg/version.buildDate=${buildDate}
+
+    -X ${VENDOR_PREFIX}k8s.io/component-base/version.gitVersion=${VERSION}
+    -X ${VENDOR_PREFIX}k8s.io/component-base/version.gitCommit=${COMMIT}
+    -X ${VENDOR_PREFIX}k8s.io/component-base/version.gitTreeState=${TREE_STATE}
+    -X ${VENDOR_PREFIX}k8s.io/component-base/version.buildDate=${buildDate}
+
+    -X ${VENDOR_PREFIX}k8s.io/kubectl/pkg/version.gitVersion=${VERSION}
+    -X ${VENDOR_PREFIX}k8s.io/kubectl/pkg/version.gitCommit=${COMMIT}
+    -X ${VENDOR_PREFIX}k8s.io/kubectl/pkg/version.gitTreeState=${TREE_STATE}
+    -X ${VENDOR_PREFIX}k8s.io/kubectl/pkg/version.buildDate=${buildDate}
+
+    -X ${VENDOR_PREFIX}k8s.io/kubernetes/pkg/version.gitVersion=${VERSION}
+    -X ${VENDOR_PREFIX}k8s.io/kubernetes/pkg/version.gitCommit=${COMMIT}
+    -X ${VENDOR_PREFIX}k8s.io/kubernetes/pkg/version.gitTreeState=${TREE_STATE}
+    -X ${VENDOR_PREFIX}k8s.io/kubernetes/pkg/version.buildDate=${buildDate}
+
     -X ${VENDOR_PREFIX}${PKG_CONTAINERD}/version.Version=${VERSION_CONTAINERD}
     -X ${VENDOR_PREFIX}${PKG_CONTAINERD}/version.Package=${PKG_RANCHER_CONTAINERD}
-    -X ${VENDOR_PREFIX}${PKG_CRICTL}/pkg/version.Version=${VERSION_CRICTL}"
+    -X ${VENDOR_PREFIX}${PKG_CRICTL}/pkg/version.Version=${VERSION_CRICTL}
+"
 LDFLAGS="
     -w -s"
 STATIC="

scripts/build-upload

+#!/bin/bash
+
+[ -n "$GCLOUD_AUTH" ] || {
+  exit 0
+}
+[ -x "$1" ] || {
+  echo "First argument should be an executable" >&2
+  exit 1
+}
+[ -n "$2" ] || {
+  echo "Second argument should be a commit hash" >&2
+  exit 1
+}
+
+umask 077
+
+TMPDIR=$(mktemp -d)
+cleanup() {
+  exit_code=$?
+  trap - EXIT INT
+  rm -rf ${TMPDIR}
+  exit ${exit_code}
+}
+trap cleanup EXIT INT
+
+GCLOUD_JSON=${TMPDIR}/.gcloud.json
+[ -z "${GCLOUD_AUTH}" ] || echo "${GCLOUD_AUTH}" >${GCLOUD_JSON}
+[ -s "${GCLOUD_JSON}" ] || {
+  echo "gcloud auth not defined" >&2
+  exit 1
+}
+
+BOTO_CONF=${TMPDIR}/.boto
+[ -s "${BOTO_CONF}" ] || cat >${BOTO_CONF} <<END
+[Credentials]
+gs_service_key_file = ${GCLOUD_JSON}
+[Boto]
+https_validate_certificates = True
+[GSUtil]
+content_language = en
+default_api_version = 2
+default_project_id = rancher-dev
+END
+
+BUILD_NAME=$(basename $1)-$2
+(cd $(dirname $1) && sha256sum $(basename $1)) >${TMPDIR}/${BUILD_NAME}.sha256sum
+cp $1 ${TMPDIR}/${BUILD_NAME}
+
+[ -d "${TMPDIR}/gsutil" ] || curl -sfL https://storage.googleapis.com/pub/gsutil.tar.gz | tar xz -C ${TMPDIR}
+
+HOME=${TMPDIR}
+PATH=${PATH}:${HOME}/gsutil
+
+gsutil cp ${TMPDIR}/${BUILD_NAME}* gs://k3s-ci-builds || exit 1
+
+echo "Build uploaded" >&2
+echo "https://storage.googleapis.com/k3s-ci-builds/${BUILD_NAME}"

scripts/log-upload

@@ -40,7 +40,7 @@ END
 HOME=${TMPDIR}
 PATH=$PATH:${HOME}/gsutil
 
-LOG_TGZ=k3s-log-$(uname -s | tr '[:upper:]' '[:lower:]' )-$(go env GOARCH)-$(git rev-parse --short HEAD)-$(date +%s)-$(basename $1).tgz
+LOG_TGZ=k3s-log-$(date +%s)-$(go env GOARCH)-$(git rev-parse --short HEAD)-$(basename $1).tgz
 
 tar -cz -f ${TMPDIR}/${LOG_TGZ} -C $(dirname $1) $(basename $1)
 gsutil cp ${TMPDIR}/${LOG_TGZ} gs://k3s-ci-logs || exit 1

scripts/manifest

+#!/bin/sh
+
+if [ -z "${DRONE_TAG}" ]; then
+  echo "DRONE_TAG not defined" >&2
+  exit 1
+fi
+
+set -e -x
+
+export REPO="rancher/k3s"
+export DRONE_TAG=$(echo "${DRONE_TAG}" | sed -e 's/+/-/g')
+export PLUGIN_TARGET="${REPO}:${DRONE_TAG}"
+export PLUGIN_TEMPLATE="${REPO}:${DRONE_TAG}-ARCH"
+export PLUGIN_PLATFORMS="linux/amd64,linux/arm64,linux/arm"
+
+drone-manifest

scripts/package-cli

@@ -60,3 +60,5 @@ if [ "$DQLITE" = "true" ]; then
     DQLITE_TAGS="dqlite"
 fi
 CGO_ENABLED=0 go build -tags "$DQLITE_TAGS" -ldflags "$LDFLAGS $STATIC" -o ${CMD_NAME} ./cmd/k3s/main.go
+
+./scripts/build-upload ${CMD_NAME} ${COMMIT}

scripts/package-image

@@ -5,7 +5,7 @@ cd $(dirname $0)/..
 
 . ./scripts/version.sh
 
-TAG=${TAG:-${VERSION}${SUFFIX}}
+TAG=${TAG:-${VERSION_TAG}${SUFFIX}}
 REPO=${REPO:-rancher}
 IMAGE_NAME=${IMAGE_NAME:-k3s}
 

scripts/test

+#!/bin/bash
+set -e -x
+cd $(dirname $0)/..
+
+. ./scripts/test-helpers
+
+artifacts=$(pwd)/dist/artifacts
+mkdir -p $artifacts
+
+# ---
+
+. ./scripts/test-run-basics
+
+# ---
+
+E2E_OUTPUT=$artifacts test-run-sonobuoy
+
+# ---
+
+if [ "$DRONE_BUILD_EVENT" = 'tag' ]; then
+  printf "\033[33mSkipping remaining tests on tag.\033[m\n"
+  exit 0
+fi
+
+if [ "$ARCH" != 'amd64' ]; then
+  printf "\033[33mSkipping remaining tests, images not available for $ARCH.\033[m\n"
+  exit 0
+fi
+
+# ---
+
+test-run-sonobuoy mysql
+test-run-sonobuoy postgres
+# test-run-sonobuoy dqlite
\ No newline at end of file

scripts/test-certs-openssl.cnf

+# db OpenSSL configuration file.
+SAN = "IP:127.0.0.1, IP:172.17.0.1, DNS:host.docker.internal"
+dir = .
+
+[ ca ]
+default_ca = db_ca
+
+[ db_ca ]
+certs            = $dir/certs
+certificate      = $dir/certs/ca.crt
+crl              = $dir/crl.pem
+crl_dir          = $dir/crl
+crlnumber        = $dir/crlnumber
+database         = $dir/index.txt
+email_in_dn      = no
+new_certs_dir    = $dir/newcerts
+private_key      = $dir/private/ca.key
+serial           = $dir/serial
+RANDFILE         = $dir/private/.rand
+name_opt         = ca_default
+cert_opt         = ca_default
+default_days     = 3650
+default_crl_days = 30
+default_md       = sha512
+preserve         = no
+policy           = policy_db
+
+[ policy_db ]
+organizationName = optional
+commonName       = supplied
+
+[ req ]
+default_bits       = 1024
+default_keyfile    = privkey.pem
+distinguished_name = req_distinguished_name
+attributes         = req_attributes
+x509_extensions    = v3_ca
+string_mask        = utf8only
+req_extensions     = db_client
+
+[ req_distinguished_name ]
+countryName                = Country Name (2 letter code)
+countryName_default        = US
+countryName_min            = 2
+countryName_max            = 2
+commonName                 = Common Name (FQDN)
+0.organizationName         = Organization Name (eg, company)
+0.organizationName_default = db-ca
+
+[ req_attributes ]
+
+[ v3_ca ]
+basicConstraints       = CA:true
+keyUsage               = keyCertSign,cRLSign
+subjectKeyIdentifier   = hash
+
+[ db_client ]
+basicConstraints       = CA:FALSE
+extendedKeyUsage       = clientAuth
+keyUsage               = digitalSignature, keyEncipherment
+
+[ db_peer ]
+basicConstraints       = CA:FALSE
+extendedKeyUsage       = clientAuth, serverAuth
+keyUsage               = digitalSignature, keyEncipherment
+subjectAltName         = ${ENV::SAN}
+
+[ db_server ]
+basicConstraints       = CA:FALSE
+extendedKeyUsage       = clientAuth, serverAuth
+keyUsage               = digitalSignature, keyEncipherment
+subjectAltName         = ${ENV::SAN}
\ No newline at end of file

scripts/test-run-basics

+#!/bin/bash
+
+export NUM_SERVERS=1
+export NUM_AGENTS=1
+export SERVER_ARGS='--no-deploy=traefik,coredns,local-storage,metrics-server'
+
+start-test() {
+    docker exec $(cat $TEST_DIR/servers/1/metadata/name) check-config || true
+    verify-valid-versions $(cat $TEST_DIR/servers/1/metadata/name)
+}
+export -f start-test
+
+# --- create a basic cluster and check for valid versions
+LABEL=BASICS run-test

scripts/test-runner

+#!/bin/bash
+set -x -e
+cd $(dirname $0)/..
+
+# ---
+
+for include in $TEST_INCLUDES; do
+  . $include
+done
+
+test-setup
+provision-cluster
+start-test $@

scripts/test-setup-sonobuoy

+#!/bin/bash
+
+export NUM_SERVERS=1
+export NUM_AGENTS=1
+export SERVER_ARGS='--no-deploy=traefik'
+export WAIT_SERVICES='coredns local-path-provisioner metrics-server'
+
+export sonobuoyParallelArgs=(--e2e-focus='\[Conformance\]' --e2e-skip='\[Serial\]' --e2e-parallel=y)
+export sonobuoySerialArgs=(--e2e-focus='\[Serial\].*\[Conformance\]')
+
+start-test() {
+  sonobuoy-test $@
+}
+export -f start-test

scripts/test-setup-sonobuoy-dqlite

+#!/bin/bash
+
+. ./scripts/test-setup-sonobuoy
+
+export NUM_SERVERS=2
+export NUM_AGENTS=0
+
+export SERVER_1_ARGS=--cluster-init
+
+# ---
+
+server-post-hook() {
+  if [ $1 -eq 1 ]; then
+    local url=$(cat $TEST_DIR/servers/1/metadata/url)
+    export SERVER_ARGS="--server $url"
+  fi
+}
+export -f server-post-hook

scripts/test-setup-sonobuoy-mysql

+#!/bin/bash
+
+. ./scripts/test-setup-sonobuoy
+
+# ---
+
+cluster-pre-hook() {
+  # gen-certs
+
+  mkdir -p $TEST_DIR/db/$LABEL_SUFFIX/metadata
+  local testID=$(basename $TEST_DIR)
+  local name=$(echo $LABEL_SUFFIX-$testID | tee $TEST_DIR/db/$LABEL_SUFFIX/metadata/name)
+  local port=$(timeout --foreground 5s bash -c get-port | tee $TEST_DIR/db/$LABEL_SUFFIX/metadata/port)
+  local secret=$(echo "${RANDOM}${RANDOM}${RANDOM}" | tee $TEST_DIR/db/$LABEL_SUFFIX/metadata/secret)
+
+  docker run --name $name \
+    --privileged \
+    -p 0.0.0.0:$port:3306 \
+    -v $TEST_DIR/db-ca/:/db-ca \
+    -e MYSQL_ROOT_PASSWORD=$secret \
+    -e MYSQL_ROOT_HOST=% \
+    -d mysql:latest \
+    >/dev/null
+      #  --require-secure-transport=ON \
+      #  --ssl-ca /db-ca/certs/ca.crt \
+      #  --ssl-cert /db-ca/certs/db.crt \
+      #  --ssl-key /db-ca/private/db.key \
+
+  local ip=$(docker inspect --format '{{ .NetworkSettings.IPAddress }}' $name | tee $TEST_DIR/db/$LABEL_SUFFIX/metadata/ip)
+  # local host=host.docker.internal
+  local host=172.17.0.1
+
+  DB_CONNECTION_TEST="
+    docker run
+      -v $TEST_DIR/db-ca/:/db-ca
+      --rm mysql
+      mysql
+        -h$host
+        -P$port
+        -uroot
+        -p$secret
+        -e status" \
+    timeout --foreground 1m bash -c "wait-for-db-connection"
+        # --ssl-ca /db-ca/certs/ca.crt
+        # --ssl-cert /db-ca/certs/client.crt
+        # --ssl-key /db-ca/private/client.key
+
+  echo "Started $LABEL_SUFFIX db @ $host"
+  export SERVER_ARGS="${SERVER_ARGS}
+    --datastore-endpoint=mysql://root:$secret@tcp($host:$port)/testdb
+  "
+    # --datastore-cafile /db-ca/certs/ca.crt
+    # --datastore-certfile /db-ca/certs/client.crt
+    # --datastore-keyfile /db-ca/private/client.key
+}
+export -f cluster-pre-hook

scripts/test-setup-sonobuoy-postgres

+#!/bin/bash
+
+. ./scripts/test-setup-sonobuoy
+
+# ---
+
+cluster-pre-hook() {
+  # gen-certs
+
+  mkdir -p $TEST_DIR/db/$LABEL_SUFFIX/metadata
+  local testID=$(basename $TEST_DIR)
+  local name=$(echo $LABEL_SUFFIX-$testID | tee $TEST_DIR/db/$LABEL_SUFFIX/metadata/name)
+  local port=$(timeout --foreground 5s bash -c get-port | tee $TEST_DIR/db/$LABEL_SUFFIX/metadata/port)
+  local secret=$(echo "${RANDOM}${RANDOM}${RANDOM}" | tee $TEST_DIR/db/$LABEL_SUFFIX/metadata/secret)
+
+  docker run --name $name \
+    --privileged \
+    -p 0.0.0.0:$port:5432 \
+    -v $TEST_DIR/db-ca/:/db-ca \
+    -e POSTGRES_USER=root \
+    -e POSTGRES_PASSWORD=$secret \
+    -d postgres:latest \
+    >/dev/null
+      # -c ssl=on \
+      # -c ssl_ca_file=/db-ca/certs/ca.crt \
+      # -c ssl_cert_file=/db-ca/certs/db.crt \
+      # -c ssl_key_file=/db-ca/private/db.key \
+
+  local ip=$(docker inspect --format '{{ .NetworkSettings.IPAddress }}' $name | tee $TEST_DIR/db/$LABEL_SUFFIX/metadata/ip)
+  # local host=host.docker.internal
+  local host=172.17.0.1
+
+  DB_CONNECTION_TEST="
+    docker run
+      -v $TEST_DIR/db-ca/:/db-ca
+      -e PGPASSWORD=$secret
+      --rm postgres
+      psql
+        -h $host
+        -p $port
+        -U root
+        -c \conninfo" \
+    timeout --foreground 1m bash -c "wait-for-db-connection"
+        # --set sslrootcert=/db-ca/certs/ca.crt
+        # --set sslcert=/db-ca/certs/client.crt
+        # --set sslkey=/db-ca/private/client.key
+
+  echo "Started $LABEL_SUFFIX db @ $host"
+  export SERVER_ARGS="${SERVER_ARGS}
+    --datastore-endpoint=postgres://root:$secret@$host:$port/testdb?sslmode=disable
+  "
+    # --datastore-cafile /db-ca/certs/ca.crt
+    # --datastore-certfile /db-ca/certs/client.crt
+    # --datastore-keyfile /db-ca/private/client.key
+}
+export -f cluster-pre-hook

scripts/version.sh

 #!/bin/bash
 
+TREE_STATE=clean
 if [ -n "$(git status --porcelain --untracked-files=no)" ]; then
     DIRTY="-dirty"
+    TREE_STATE=dirty
 fi
 
-COMMIT=$(git rev-parse --short HEAD)
-GIT_TAG=${DRONE_TAG:-$(git tag -l --contains HEAD | head -n 1)}
-
-if [[ -z "$DIRTY" && -n "$GIT_TAG" ]]; then
-    VERSION=$GIT_TAG
-else
-    VERSION="${COMMIT}${DIRTY}"
+COMMIT=$(git log -n3 --pretty=format:"%H %ae" | grep -v ' drone@localhost$' | cut -f1 -d\  | head -1)
+if [ -z "${COMMIT}" ]; then
+  COMMIT=$(git rev-parse HEAD)
 fi
 
+GIT_TAG=${DRONE_TAG:-$(git tag -l --contains HEAD | head -n 1)}
+
 ARCH=$(go env GOARCH)
 SUFFIX="-${ARCH}"
 
 VERSION_CONTAINERD=$(grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}')
-VERSION_CRICTL=$(grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}')
-
 if [ -z "$VERSION_CONTAINERD" ]; then
     VERSION_CONTAINERD="v0.0.0"
 fi
 
+VERSION_CRICTL=$(grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}')
 if [ -z "$VERSION_CRICTL" ]; then
     VERSION_CRICTL="v0.0.0"
 fi
 
+VERSION_K8S=$(grep k8s.io/kubernetes go.mod | head -n1 | awk '{print $4}' | sed -e 's/[-+].*//')
+if [ -z "$VERSION_K8S" ]; then
+    VERSION_K8S="v0.0.0"
+fi
+
 VERSION_CNIPLUGINS="v0.7.6-k3s1"
+
+if [[ -n "$GIT_TAG" ]]; then
+    if [[ ! "$GIT_TAG" =~ ^"$VERSION_K8S"[+-] ]]; then
+        echo "Tagged version '$GIT_TAG' does not match expected version '$VERSION_K8S[+-]*'" >&2
+        exit 1
+    fi
+    VERSION=$GIT_TAG
+else
+    VERSION="$VERSION_K8S+${COMMIT:0:8}$DIRTY"
+fi
+VERSION_TAG="$(sed -e 's/+/-/g' <<< "$VERSION")"