Merge pull request #30787 from jbeda/rsync

.gitignore

@@ -62,6 +62,9 @@ network_closure.sh
 
 .tags*
 
+# Version file for dockerized build
+.dockerized-kube-version-defs
+
 # Web UI
 /www/master/node_modules/
 /www/master/npm-debug.log

build/BUILD_IMAGE_VERSION

+3

build/build-image/Dockerfile

@@ -15,6 +15,8 @@
 # This file creates a standard build environment for building Kubernetes
 FROM gcr.io/google_containers/kube-cross:KUBE_BUILD_IMAGE_CROSS_TAG
 
+ADD localtime /etc/localtime
+
 # Mark this as a kube-build container
 RUN touch /kube-build-image
 
@@ -25,19 +27,13 @@ RUN chmod -R a+rwx /usr/local/go/pkg ${K8S_PATCHED_GOROOT}/pkg
 # of operations.
 ENV HOME /go/src/k8s.io/kubernetes
 WORKDIR ${HOME}
-# We have to mkdir the dirs we need, or else Docker will create them when we
-# mount volumes, and it will create them with root-only permissions.  The
-# explicit chmod of _output is required, but I can't really explain why.
-RUN mkdir -p ${HOME} ${HOME}/_output \
-    && chmod -R a+rwx ${HOME} ${HOME}/_output
-
-# Propagate the git tree version into the build image
-ADD kube-version-defs /kube-version-defs
-RUN chmod a+r /kube-version-defs
-ENV KUBE_GIT_VERSION_FILE /kube-version-defs
 
 # Make output from the dockerized build go someplace else
 ENV KUBE_OUTPUT_SUBPATH _output/dockerized
 
-# Upload Kubernetes source
-ADD kube-source.tar.gz /go/src/k8s.io/kubernetes/
+# Pick up version stuff here as we don't copy our .git over.
+ENV KUBE_GIT_VERSION_FILE ${HOME}/.dockerized-kube-version-defs
+
+ADD rsyncd.password /
+RUN chmod a+r /rsyncd.password
+ADD rsyncd.sh /

build/build-image/rsyncd.sh

+#!/bin/bash
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This script will set up and run rsyncd to allow data to move into and out of
+# our dockerized build system.  This is used for syncing sources and changes of
+# sources into the docker-build-container.  It is also used to transfer built binaries
+# and generated files back out.
+#
+# When run as root (rare) it'll preserve the file ids as sent from the client.
+# Usually it'll be run as non-dockerized UID/GID and end up translating all file
+# ownership to that.
+
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+# The directory that gets sync'd
+VOLUME=${HOME}
+
+# Assume that this is running in Docker on a bridge.  Allow connections from
+# anything on the local subnet.
+ALLOW=$(ip route | awk  '/^default via/ { reg = "^[0-9./]+ dev "$5 } ; $0 ~ reg { print $1 }')
+
+CONFDIR="/tmp/rsync.k8s"
+PIDFILE="${CONFDIR}/rsyncd.pid"
+CONFFILE="${CONFDIR}/rsyncd.conf"
+SECRETS="${CONFDIR}/rsyncd.secrets"
+
+mkdir -p "${CONFDIR}"
+
+if [[ -f "${PIDFILE}" ]]; then
+  PID=$(cat "${PIDFILE}")
+  echo "Cleaning up old PID file: ${PIDFILE}"
+  kill $PID &> /dev/null || true
+  rm "${PIDFILE}"
+fi
+
+PASSWORD=$(</rsyncd.password)
+
+cat <<EOF >"${SECRETS}"
+k8s:${PASSWORD}
+EOF
+chmod go= "${SECRETS}"
+
+USER_CONFIG=
+if [[ "$(id -u)" == "0" ]]; then
+  USER_CONFIG="  uid = 0"$'\n'"  gid = 0"
+fi
+
+cat <<EOF >"${CONFFILE}"
+pid file = ${PIDFILE}
+use chroot = no
+log file = /dev/stdout
+reverse lookup = no
+munge symlinks = no
+port = 8730
+[k8s]
+  numeric ids = true
+  $USER_CONFIG
+  hosts deny = *
+  hosts allow = ${ALLOW}
+  auth users = k8s
+  secrets file = ${SECRETS}
+  read only = false
+  path = ${VOLUME}
+  filter = - /.make/ - /.git/ - /_tmp/
+EOF
+
+exec /usr/bin/rsync --no-detach --daemon --config="${CONFFILE}" "$@"

build/copy-output.sh

@@ -14,10 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Copies any built binaries off the Docker machine.
-#
-# This is a no-op on Linux when the Docker daemon is local.  This is only
-# necessary on Mac OS X with boot2docker.
+# Copies any built binaries (and other generated files) out of the Docker build contianer.
 set -o errexit
 set -o nounset
 set -o pipefail

build/json-extractor.py

-#!/usr/bin/env python
-
-# Copyright 2014 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# This is a very simple utility that reads a JSON document from stdin, parses it
-# and returns the specified value.  The value is described using a simple dot
-# notation.  If any errors are encountered along the way, an error is output and
-# a failure value is returned.
-
-from __future__ import print_function
-
-import json
-import sys
-
-def PrintError(*err):
-  print(*err, file=sys.stderr)
-
-def main():
-  try:
-    obj = json.load(sys.stdin)
-  except Exception, e:
-    PrintError("Error loading JSON: {0}".format(str(e)))
-
-  if len(sys.argv) == 1:
-    # if we don't have a query string, return success
-    return 0
-  elif len(sys.argv) > 2:
-    PrintError("Usage: {0} <json query>".format(sys.args[0]))
-    return 1
-
-  query_list = sys.argv[1].split('.')
-  for q in query_list:
-    if isinstance(obj, dict):
-      if q not in obj:
-        PrintError("Couldn't find '{0}' in dict".format(q))
-        return 1
-      obj = obj[q]
-    elif isinstance(obj, list):
-      try:
-        index = int(q)
-      except:
-        PrintError("Can't use '{0}' to index into array".format(q))
-        return 1
-      if index >= len(obj):
-        PrintError("Index ({0}) is greater than length of list ({1})".format(q, len(obj)))
-        return 1
-      obj = obj[index]
-    else:
-      PrintError("Trying to query non-queryable object: {0}".format(q))
-      return 1
-
-  if isinstance(obj, str):
-    print(obj)
-  else:
-    print(json.dumps(obj, indent=2))
-
-if __name__ == "__main__":
-  sys.exit(main())

build/make-clean.sh

@@ -23,5 +23,4 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
 source "${KUBE_ROOT}/build/common.sh"
 
 kube::build::verify_prereqs
-kube::build::clean_output
-kube::build::clean_images
+kube::build::clean

build/push-federation-images.sh

@@ -23,6 +23,7 @@ set -o pipefail
 KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
 
 source "${KUBE_ROOT}/build/util.sh"
+source "${KUBE_ROOT}/build/lib/release.sh"
 
 source "${KUBE_ROOT}/federation/cluster/common.sh"
 

build/release.sh

@@ -16,8 +16,10 @@
 
 # Build a Kubernetes release.  This will build the binaries, create the Docker
 # images and other build artifacts.
-# For pushing these artifacts publicly on Google Cloud Storage, see the 
-# associated build/push-* scripts.
+#
+# For pushing these artifacts publicly to Google Cloud Storage or to a registry
+# please refer to the kubernetes/release repo at
+# https://github.com/kubernetes/release.
 
 set -o errexit
 set -o nounset
@@ -25,6 +27,7 @@ set -o pipefail
 
 KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
 source "${KUBE_ROOT}/build/common.sh"
+source "${KUBE_ROOT}/build/lib/release.sh"
 
 KUBE_RELEASE_RUN_TESTS=${KUBE_RELEASE_RUN_TESTS-y}
 

build/shell.sh

@@ -24,6 +24,7 @@ set -o pipefail
 
 KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
 source "${KUBE_ROOT}/build/common.sh"
+source "${KUBE_ROOT}/build/lib/release.sh"
 
 kube::build::verify_prereqs
 kube::build::build_image

cluster/mesos/docker/config-default.sh

@@ -56,7 +56,7 @@ MESOS_DOCKER_ADDON_TIMEOUT="${MESOS_DOCKER_ADDON_TIMEOUT:-180}"
 # ${MESOS_DOCKER_WORK_DIR}/log - storage of component logs (written on deploy failure)
 # ${MESOS_DOCKER_WORK_DIR}/auth - storage of SSL certs/keys/tokens
 # ${MESOS_DOCKER_WORK_DIR}/<component>/mesos - storage of mesos slave work (e.g. task logs)
-# If using docker-machine or boot2docker, should be under /Users (which is mounted from the host into the docker vm).
+# If using docker-machine or Docker for Mac, should be under /Users (which is mounted from the host into the docker vm).
 # If running in a container, $HOME should be resolved outside of the container.
 MESOS_DOCKER_WORK_DIR="${MESOS_DOCKER_WORK_DIR:-${HOME}/tmp/kubernetes}"
 

cluster/mesos/docker/util.sh

@@ -72,7 +72,7 @@ function cluster::mesos::docker::docker_compose_lazy_pull {
 }
 
 # Run kubernetes scripts inside docker.
-# This bypasses the need to set up network routing when running docker in a VM (e.g. boot2docker).
+# This bypasses the need to set up network routing when running docker in a VM (e.g. docker-machine).
 # Trap signals and kills the docker container for better signal handing
 function cluster::mesos::docker::run_in_docker_test {
   local entrypoint="$1"

cmd/libs/go2idl/go-to-protobuf/build-image/Dockerfile

-# Copyright 2016 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# This file creates a standard build environment for building Kubernetes
-FROM gcr.io/google_containers/kube-cross:KUBE_BUILD_IMAGE_CROSS_TAG
-
-# Mark this as a kube-build container
-RUN touch /kube-build-image
-
-WORKDIR /go/src/k8s.io/kubernetes
-
-# Install goimports tool
-RUN go get golang.org/x/tools/cmd/goimports

docs/design/clustering/Makefile

@@ -39,7 +39,3 @@ docker:
 docker-clean:
 	docker rmi clustering-seqdiag || true
 	docker images -q --filter "dangling=true" | xargs docker rmi
-
-.PHONY: fix-clock-skew
-fix-clock-skew:
-	boot2docker ssh sudo date -u -D "%Y%m%d%H%M.%S" --set "$(shell date -u +%Y%m%d%H%M.%S)"

docs/design/clustering/README.md

@@ -56,10 +56,6 @@ The first run will be slow but things should be fast after that.
 To clean up the docker containers that are created (and other cruft that is left
 around) you can run `make docker-clean`.
 
-If you are using boot2docker and get warnings about clock skew (or if things
-aren't building for some reason) then you can fix that up with
-`make fix-clock-skew`.
-
 ## Automatically rebuild on file changes
 
 If you have the fswatch utility installed, you can have it monitor the file

hack/jenkins/build.sh

@@ -31,7 +31,6 @@ set -o xtrace
 # space.
 export HOME=${WORKSPACE} # Nothing should want Jenkins $HOME
 export PATH=$PATH:/usr/local/go/bin
-export KUBE_SKIP_CONFIRMATIONS=y
 
 # Skip gcloud update checking
 export CLOUDSDK_COMPONENT_MANAGER_DISABLE_UPDATE_CHECK=true

hack/lib/golang.sh

@@ -144,12 +144,6 @@ readonly KUBE_TEST_SERVER_PLATFORMS=("${KUBE_SERVER_PLATFORMS[@]}")
 # Gigabytes desired for parallel platform builds. 11 is fairly
 # arbitrary, but is a reasonable splitting point for 2015
 # laptops-versus-not.
-#
-# If you are using boot2docker, the following seems to work (note
-# that 12000 rounds to 11G):
-#   boot2docker down
-#   VBoxManage modifyvm boot2docker-vm --memory 12000
-#   boot2docker up
 readonly KUBE_PARALLEL_BUILD_MEMORY=11
 
 readonly KUBE_ALL_TARGETS=(
@@ -553,7 +547,7 @@ kube::golang::build_binaries_for_platform() {
         "${testpkg}"
 
     mkdir -p "$(dirname ${outfile})"
-    go test -c \
+    go test -i -c \
       "${goflags[@]:+${goflags[@]}}" \
       -gcflags "${gogcflags}" \
       -ldflags "${goldflags}" \

hack/local-up-cluster.sh

@@ -18,7 +18,6 @@
 # local-up.sh, but this one launches the three separate binaries.
 # You may need to run this as root to allow kubelet to open docker's socket.
 DOCKER_OPTS=${DOCKER_OPTS:-""}
-DOCKER_NATIVE=${DOCKER_NATIVE:-""}
 DOCKER=(docker ${DOCKER_OPTS})
 DOCKERIZE_KUBELET=${DOCKERIZE_KUBELET:-""}
 ALLOW_PRIVILEGED=${ALLOW_PRIVILEGED:-""}

hack/update-bindata.sh

@@ -19,8 +19,7 @@ set -o pipefail
 set -o nounset
 
 if [[ -z "${KUBE_ROOT:-}" ]]; then
-	# Relative to test/e2e/generated/
-	KUBE_ROOT="../../../"
+	KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
 fi
 
 source "${KUBE_ROOT}/cluster/lib/logging.sh"
@@ -37,7 +36,7 @@ if ! which go-bindata &>/dev/null ; then
 fi
 
 BINDATA_OUTPUT="${KUBE_ROOT}/test/e2e/generated/bindata.go"
-go-bindata -nometadata -prefix "${KUBE_ROOT}" -o ${BINDATA_OUTPUT} -pkg generated \
+go-bindata -nometadata -prefix "${KUBE_ROOT}" -o "${BINDATA_OUTPUT}.tmp" -pkg generated \
 	-ignore .jpg -ignore .png -ignore .md \
 	"${KUBE_ROOT}/examples/..." \
 	"${KUBE_ROOT}/docs/user-guide/..." \
@@ -45,6 +44,16 @@ go-bindata -nometadata -prefix "${KUBE_ROOT}" -o ${BINDATA_OUTPUT} -pkg generate
 	"${KUBE_ROOT}/test/images/..." \
 	"${KUBE_ROOT}/test/fixtures/..."
 
-gofmt -s -w ${BINDATA_OUTPUT}
+gofmt -s -w "${BINDATA_OUTPUT}.tmp"
 
-V=2 kube::log::info "Generated bindata file : $(wc -l ${BINDATA_OUTPUT}) lines of lovely automated artifacts"
+# Here we compare and overwrite only if different to avoid updating the
+# timestamp and triggering a rebuild. The 'cat' redirect trick to preserve file
+# permissions of the target file.
+if ! cmp -s "${BINDATA_OUTPUT}.tmp" "${BINDATA_OUTPUT}" ; then
+	cat "${BINDATA_OUTPUT}.tmp" > "${BINDATA_OUTPUT}"
+	V=2 kube::log::info "Generated bindata file : ${BINDATA_OUTPUT} has $(wc -l ${BINDATA_OUTPUT}) lines of lovely automated artifacts"
+else
+	V=2 kube::log::info "No changes in generated bindata file: ${BINDATA_OUTPUT}"
+fi
+
+rm -f "${BINDATA_OUTPUT}.tmp"

hack/update-generated-protobuf.sh

@@ -19,36 +19,11 @@ set -o nounset
 set -o pipefail
 
 KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
-source "${KUBE_ROOT}/build/common.sh"
 
-kube::golang::setup_env
+# NOTE: All output from this script needs to be copied back to the calling
+# source tree.  This is managed in kube::build::copy_output in build/common.sh.
+# If the output set is changed update that function.
 
-function prereqs() {
-  kube::log::status "Verifying Prerequisites...."
-  kube::build::ensure_docker_in_path || return 1
-  if kube::build::is_osx; then
-      kube::build::docker_available_on_osx || return 1
-  fi
-  kube::build::ensure_docker_daemon_connectivity || return 1
-
-  KUBE_ROOT_HASH=$(kube::build::short_hash "${HOSTNAME:-}:${REPO_DIR:-${KUBE_ROOT}}")
-  KUBE_BUILD_IMAGE_TAG="build-${KUBE_ROOT_HASH}"
-  KUBE_BUILD_IMAGE="${KUBE_BUILD_IMAGE_REPO}:${KUBE_BUILD_IMAGE_TAG}"
-  KUBE_BUILD_CONTAINER_NAME="kube-build-${KUBE_ROOT_HASH}"
-  KUBE_BUILD_DATA_CONTAINER_NAME="kube-build-data-${KUBE_ROOT_HASH}"
-  DOCKER_MOUNT_ARGS=(
-    --volume "${REPO_DIR:-${KUBE_ROOT}}:/go/src/${KUBE_GO_PACKAGE}"
-    --volume /etc/localtime:/etc/localtime:ro
-    --volumes-from "${KUBE_BUILD_DATA_CONTAINER_NAME}"
-  )
-  LOCAL_OUTPUT_BUILD_CONTEXT="${LOCAL_OUTPUT_IMAGE_STAGING}/${KUBE_BUILD_IMAGE}"
-}
-
-prereqs
-mkdir -p "${LOCAL_OUTPUT_BUILD_CONTEXT}"
-cp "${KUBE_ROOT}/cmd/libs/go2idl/go-to-protobuf/build-image/Dockerfile" "${LOCAL_OUTPUT_BUILD_CONTEXT}/Dockerfile"
-kube::build::update_dockerfile
-kube::build::docker_build "${KUBE_BUILD_IMAGE}" "${LOCAL_OUTPUT_BUILD_CONTEXT}" 'false'
-kube::build::run_build_command hack/update-generated-protobuf-dockerized.sh "$@"
+"${KUBE_ROOT}/build/run.sh" hack/update-generated-protobuf-dockerized.sh "$@"
 
 # ex: ts=2 sw=2 et filetype=sh

hack/update-generated-runtime.sh

@@ -19,35 +19,11 @@ set -o nounset
 set -o pipefail
 
 KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
-source "${KUBE_ROOT}/build/common.sh"
 
-kube::golang::setup_env
+# NOTE: All output from this script needs to be copied back to the calling
+# source tree.  This is managed in kube::build::copy_output in build/common.sh.
+# If the output set is changed update that function.
 
-function prereqs() {
-  kube::log::status "Verifying Prerequisites...."
-  kube::build::ensure_docker_in_path || return 1
-  if kube::build::is_osx; then
-      kube::build::docker_available_on_osx || return 1
-  fi
-  kube::build::ensure_docker_daemon_connectivity || return 1
-
-  KUBE_ROOT_HASH=$(kube::build::short_hash "${HOSTNAME:-}:${REPO_DIR:-${KUBE_ROOT}}/go-to-protobuf")
-  KUBE_BUILD_IMAGE_TAG="build-${KUBE_ROOT_HASH}"
-  KUBE_BUILD_IMAGE="${KUBE_BUILD_IMAGE_REPO}:${KUBE_BUILD_IMAGE_TAG}"
-  KUBE_BUILD_CONTAINER_NAME="kube-build-${KUBE_ROOT_HASH}"
-  KUBE_BUILD_DATA_CONTAINER_NAME="kube-build-data-${KUBE_ROOT_HASH}"
-  DOCKER_MOUNT_ARGS=(
-    --volume "${REPO_DIR:-${KUBE_ROOT}}:/go/src/${KUBE_GO_PACKAGE}"
-    --volume /etc/localtime:/etc/localtime:ro
-    --volumes-from "${KUBE_BUILD_DATA_CONTAINER_NAME}"
-  )
-  LOCAL_OUTPUT_BUILD_CONTEXT="${LOCAL_OUTPUT_IMAGE_STAGING}/${KUBE_BUILD_IMAGE}"
-}
-
-prereqs
-mkdir -p "${LOCAL_OUTPUT_BUILD_CONTEXT}"
-cp "${KUBE_ROOT}/cmd/libs/go2idl/go-to-protobuf/build-image/Dockerfile" "${LOCAL_OUTPUT_BUILD_CONTEXT}/Dockerfile"
-kube::build::update_dockerfile
-kube::build::docker_build "${KUBE_BUILD_IMAGE}" "${LOCAL_OUTPUT_BUILD_CONTEXT}" 'false'
-kube::build::run_build_command hack/update-generated-runtime-dockerized.sh "$@"
+${KUBE_ROOT}/build/run.sh hack/update-generated-runtime-dockerized.sh "$@"
 
+# ex: ts=2 sw=2 et filetype=sh

hack/verify-generated-protobuf.sh

@@ -34,8 +34,8 @@ trap "cleanup" EXIT SIGINT
 
 cleanup
 for APIROOT in ${APIROOTS}; do
-  mkdir -p "${_tmp}/${APIROOT%/*}"
-  cp -a "${KUBE_ROOT}/${APIROOT}" "${_tmp}/${APIROOT}"
+  mkdir -p "${_tmp}/${APIROOT}"
+  cp -a -T "${KUBE_ROOT}/${APIROOT}" "${_tmp}/${APIROOT}"
 done
 
 "${KUBE_ROOT}/hack/update-generated-protobuf.sh"
@@ -44,7 +44,7 @@ for APIROOT in ${APIROOTS}; do
   echo "diffing ${APIROOT} against freshly generated protobuf"
   ret=0
   diff -Naupr -I 'Auto generated by' -x 'zz_generated.*' "${KUBE_ROOT}/${APIROOT}" "${TMP_APIROOT}" || ret=$?
-  cp -a "${TMP_APIROOT}" "${KUBE_ROOT}/${APIROOT%/*}"
+  cp -a -T "${TMP_APIROOT}" "${KUBE_ROOT}/${APIROOT}"
   if [[ $ret -eq 0 ]]; then
     echo "${APIROOT} up to date."
   else

hack/verify-generated-swagger-docs.sh

@@ -42,15 +42,21 @@ DIFFROOT="${KUBE_ROOT}/pkg"
 TMP_DIFFROOT="${KUBE_ROOT}/_tmp/pkg"
 _tmp="${KUBE_ROOT}/_tmp"
 
+cleanup() {
+  rm -rf "${_tmp}"
+}
+trap "cleanup" EXIT SIGINT
+
+cleanup
+
 mkdir -p "${_tmp}"
-trap "rm -rf ${_tmp}" EXIT SIGINT
-cp -a "${DIFFROOT}" "${TMP_DIFFROOT}"
+cp -a -T "${DIFFROOT}" "${TMP_DIFFROOT}"
 
 "${KUBE_ROOT}/hack/update-generated-swagger-docs.sh"
 echo "diffing ${DIFFROOT} against freshly generated swagger type documentation"
 ret=0
 diff -Naupr -I 'Auto generated by' "${DIFFROOT}" "${TMP_DIFFROOT}" || ret=$?
-cp -a "${TMP_DIFFROOT}" "${KUBE_ROOT}/"
+cp -a -T "${TMP_DIFFROOT}" "${DIFFROOT}"
 if [[ $ret -eq 0 ]]
 then
   echo "${DIFFROOT} up to date."