Revamp Calico images and enable RISC-V builds#233
Revamp Calico images and enable RISC-V builds#233twz123 wants to merge 3 commits intok0sproject:mainfrom
Conversation
twz123
commented
Feb 1, 2026
twz123
commented
- Use Alpine 3.23.3 and Go 1.25.6
- Build Calico BIRD from sources
- Update the iptables-wrapper
- Manage GOCACHE via build caches
- Strip flannel and CNI plugin executables
* v3.29.7-0 -> v3.29.7-1 Signed-off-by: Tom Wieczorek <twieczorek@mirantis.com>
* Use Alpine 3.23.3 and Go 1.25.6 * Build Calico BIRD from sources * Update the iptables-wrapper * Manage GOCACHE via build caches * Strip flannel and CNI plugin executables Signed-off-by: Tom Wieczorek <twieczorek@mirantis.com>
Signed-off-by: Tom Wieczorek <twieczorek@mirantis.com>
| + # NOTE(k0s): iptables-nft will fail under QEMU with the below error | ||
| + # message, hence use iptables-legacy for the version check | ||
| + if ! version=$("${sbin}/iptables-nft" --version 2>&1); then | ||
| + if [ "$version" != "iptables: Failed to initialize nft: Protocol not supported" ]; then |
There was a problem hiding this comment.
I think you are missing some kernel options in your QEMU riscv64 kernel. I hade the same problem with my own kernel on real hardware. iptables-nft need some kernel options enabled.
I added some CONFIG_NFT_* options in my .config and did a rebuild of the kernel. No idea with one a needed, but i added all this options after 3 rebuilds and still missing some options:
CONFIG_NETFILTER_SKIP_EGRESS
CONFIG_NETFILTER_FAMILY_ARP
CONFIG_NETFILTER_NETLINK_HOOK
CONFIG_NETFILTER_CONNCOUNT
CONFIG_NETFILTER_SYNPROXY
CONFIG_NF_TABLES_INET
CONFIG_NF_TABLES_NETDEV
CONFIG_NFT_NUMGEN
CONFIG_NFT_CT
CONFIG_NFT_FLOW_OFFLOAD
CONFIG_NFT_CONNLIMIT
CONFIG_NFT_LOG
CONFIG_NFT_LIMIT
CONFIG_NFT_MASQ
CONFIG_NFT_REDIR
CONFIG_NFT_NAT
CONFIG_NFT_TUNNEL
CONFIG_NFT_QUOTA
CONFIG_NFT_REJECT
CONFIG_NFT_REJECT_INET
CONFIG_NFT_COMPAT
CONFIG_NFT_HASH
CONFIG_NFT_FIB
CONFIG_NFT_FIB_INET
CONFIG_NFT_XFRM
CONFIG_NFT_SOCKET
CONFIG_NFT_OSF
CONFIG_NFT_TPROXY
CONFIG_NFT_SYNPROXY
CONFIG_NF_DUP_NETDEV
CONFIG_NFT_DUP_NETDEV
CONFIG_NFT_FWD_NETDEV
CONFIG_NFT_FIB_NETDEV
CONFIG_NFT_REJECT_NETDEV
CONFIG_NF_FLOW_TABLE_INET
CONFIG_NF_FLOW_TABLE
CONFIG_NF_FLOW_TABLE_PROCFS
CONFIG_NETFILTER_XT_TARGET_CT
CONFIG_NF_SOCKET_IPV4
CONFIG_NF_TPROXY_IPV4
CONFIG_NF_TABLES_IPV4
CONFIG_NFT_REJECT_IPV4
CONFIG_NFT_DUP_IPV4
CONFIG_NFT_FIB_IPV4
CONFIG_NF_TABLES_ARP
CONFIG_NF_DUP_IPV4
CONFIG_NFT_COMPAT_ARP
CONFIG_IP_NF_ARP_MANGLE
CONFIG_NF_SOCKET_IPV6
CONFIG_NF_TPROXY_IPV6
CONFIG_NF_TABLES_IPV6
CONFIG_NFT_REJECT_IPV6
CONFIG_NFT_DUP_IPV6
CONFIG_NFT_FIB_IPV6
CONFIG_NF_DUP_IPV6
CONFIG_IP6_NF_TARGET_NPT
CONFIG_NF_TABLES_BRIDGE
CONFIG_NFT_BRIDGE_META
CONFIG_NFT_BRIDGE_REJECT
CONFIG_IFB
3 participants
