Set buildmode to pie and drop pie and debuginfo patches for kubernetes

[bnrjee]

Issue number:
#1102

Description of changes:
Removed the patches 0002-do-not-omit-debug-info.patch and 0003-enable-PIE-for-platform-binaries.patch and exported GOLDFLAGS as "-buildmode=pie" in the spec files of the different kubernetes versions. Also renumbered the bottlerocket patches that were created for kubernetes.

Testing done:
1>Built bottlerocket successfully.
2>Verified using checksec that the kubelet binaries are all still built as PIE.
3>Made sure that this goldflag along with the SOURCE_DATE_EPOCH flag can build reproducible binaries for upstream kubernetes.
4>Created an AMI and ran busybox pod with it.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[bcressey]

Can you verify using checksec that the kubelet binaries are all still built as PIE?

You can extract the RPMs in build/rpm and check the binaries using a command like this:

rpm2cpio bottlerocket-x86_64-kubelet-1.15-*.x86_64.rpm | cpio -idmv
checksec -f x86_64-bottlerocket-linux-gnu/sys-root/usr/bin/kubelet
rm -r x86_64-bottlerocket-linux-gnu

(This needs to be integrated as check during package builds, but hasn't been automated yet.)

[bnrjee]

Can you verify using checksec that the kubelet binaries are all still built as PIE?

It says PIE enabled for all 3 versions of kubernetes. Please find the output below.

[ec2-user@ip-172-31-13-77 test]$ ls
bottlerocket-x86_64-kubelet-1.15-1.15.12-1.x86_64.rpm  checksec.sh  x86_64-bottlerocket-linux-gnu
[ec2-user@ip-172-31-13-77 test]$ sh checksec.sh --file x86_64-bottlerocket-linux-gnu/sys-root/usr/bin/kubelet
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FILE
Full RELRO      Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   x86_64-bottlerocket-linux-gnu/sys-root/usr/bin/kubelet

[ec2-user@ip-172-31-13-77 test]$ ls
bottlerocket-x86_64-kubelet-1.16-1.16.13-1.x86_64.rpm  checksec.sh  x86_64-bottlerocket-linux-gnu
[ec2-user@ip-172-31-13-77 test]$ sh checksec.sh --file x86_64-bottlerocket-linux-gnu/sys-root/usr/bin/kubelet
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FILE
Full RELRO      Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   x86_64-bottlerocket-linux-gnu/sys-root/usr/bin/kubelet

[ec2-user@ip-172-31-13-77 test]$ ls
bottlerocket-x86_64-kubelet-1.17-1.17.9-1.x86_64.rpm  checksec.sh  x86_64-bottlerocket-linux-gnu
[ec2-user@ip-172-31-13-77 test]$ sh checksec.sh --file x86_64-bottlerocket-linux-gnu/sys-root/usr/bin/kubelet
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FILE
Full RELRO      Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   x86_64-bottlerocket-linux-gnu/sys-root/usr/bin/kubelet

[bcressey]

Can you update the title, description, and testing done? LGTM otherwise.