fix compile options

Signed-off-by: WangFengTu <wangfengtu@huawei.com>
(cherry picked from commit d7216b0794d64f8c3f7d5a88523a2431b6713ee7)

0002-fix-compile-options.patch

@@ -0,0 +1,42 @@
+From 64a21ff088bc4271f596cd1e622d50293eb9566a Mon Sep 17 00:00:00 2001
+From: WangFengTu <wangfengtu@huawei.com>
+Date: Mon, 22 Mar 2021 14:31:00 +0800
+Subject: [PATCH] fix compile options
+
+Signed-off-by: WangFengTu <wangfengtu@huawei.com>
+---
+ hack/lib/golang.sh | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/hack/lib/golang.sh b/hack/lib/golang.sh
+index bef1d837..6d467a8e 100755
+--- a/hack/lib/golang.sh
++++ b/hack/lib/golang.sh
+@@ -701,6 +701,7 @@ kube::golang::build_binaries_for_platform() {
+       -installsuffix static
+       ${goflags:+"${goflags[@]}"}
+       -gcflags "${gogcflags:-}"
++      -buildmode=pie
+       -asmflags "${goasmflags:-}"
+       -ldflags "${goldflags:-}"
+       -tags "${gotags:-}"
+@@ -712,6 +713,7 @@ kube::golang::build_binaries_for_platform() {
+     build_args=(
+       ${goflags:+"${goflags[@]}"}
+       -gcflags "${gogcflags:-}"
++      -buildmode=pie
+       -asmflags "${goasmflags:-}"
+       -ldflags "${goldflags:-}"
+       -tags "${gotags:-}"
+@@ -787,7 +789,7 @@ kube::golang::build_binaries() {
+     # Disable SC2153 for this, as it will throw a warning that the local
+     # variable goldflags will exist, and it suggest changing it to this.
+     # shellcheck disable=SC2153
+-    goldflags="${GOLDFLAGS=-s -w -buildid=} $(kube::version::ldflags)"
++    goldflags="${GOLDFLAGS=-s -w -buildid=} $(kube::version::ldflags) -linkmode=external"
+     goasmflags="-trimpath=${KUBE_ROOT}"
+     gogcflags="${GOGCFLAGS:-} -trimpath=${KUBE_ROOT}"
+ 
+-- 
+2.25.1
+

kubernetes.spec

@@ -3,7 +3,7 @@
 
 Name:         kubernetes
 Version:      1.20.2
-Release:      3
+Release:      4
 Summary:      Container cluster management
 License:      ASL 2.0
 URL:          https://k8s.io/kubernetes
@@ -25,6 +25,7 @@ Source14:     kubeadm.conf
 Source15:     kubernetes.conf
 
 Patch6000: 0001-kubelet-support-exec-websocket-protocol.patch
+Patch6001: 0002-fix-compile-options.patch
 
 %description
 Container cluster management.
@@ -95,6 +96,8 @@ export KUBE_GIT_TREE_STATE="clean"
 export KUBE_GIT_COMMIT=%{commit}
 export KUBE_GIT_VERSION=v{version}
 export KUBE_EXTRA_GOPATH=$(pwd)/Godeps/_workspace
+export CGO_CFLAGS="-fstack-protector-strong -fPIE -D_FORTIFY_SOURCE=2 -O2"
+export CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack -pie"
 
 make WHAT="cmd/kube-proxy"
 make WHAT="cmd/kube-apiserver"
@@ -254,6 +257,9 @@ getent passwd kube >/dev/null || useradd -r -g kube -d / -s /sbin/nologin \
 %systemd_postun kubelet kube-proxy
 
 %changelog
+* The Mar 23 2021 wangfengtu <wangfengtu@huawei.com> - 1.20.2-4
+- Fix compile options
+
 * The Feb 09 2021 lixiang <lixiang172@huawei.com> - 1.20.2-3
 - Remove go-md2man build require since it's no longer provided