feat: use nonroot distroless as base image for ingress-pipy (#189)

* feat: use distroless base-debian11 as base image for ingress-pipy Signed-off-by: Lin Yang <reaver@flomesh.io> * fix: change owner of pipy Signed-off-by: Lin Yang <reaver@flomesh.io> * fix: use shell directive Signed-off-by: Lin Yang <reaver@flomesh.io> * fix: chown Signed-off-by: Lin Yang <reaver@flomesh.io> * feat: build pipy binary Signed-off-by: Lin Yang <reaver@flomesh.io> * feat: build pipy nonroot image manually Signed-off-by: Lin Yang <reaver@flomesh.io> * fix: add workflow name Signed-off-by: Lin Yang <reaver@flomesh.io> * feat: build ingress-pipy nonroot Signed-off-by: Lin Yang <reaver@flomesh.io> * fix: builder name Signed-off-by: Lin Yang <reaver@flomesh.io> Signed-off-by: Lin Yang <reaver@flomesh.io>
flomesh-io · Jan 1, 2023 · 0ab51c4 · 0ab51c4
1 parent 0fafbd0
commit 0ab51c4
Show file tree

Hide file tree

Showing 9 changed files with 201 additions and 118 deletions.
diff --git a/.github/workflows/build-pipy.yml b/.github/workflows/build-pipy.yml
@@ -0,0 +1,47 @@
+name: build-pipy-nonroot-image
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'pipy release tag'
+        required: true
+        type: string
+
+jobs:
+  build:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2.1.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2.2.1
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v2.1.0
+        with:
+          username: ${{ secrets.FLOMESH_DOCKERHUB_USERNAME }}
+          password: ${{ secrets.FLOMESH_DOCKERHUB_PASSWORD }}
+
+      - name: Docker meta
+        id: docker_meta
+        uses: crazy-max/ghaction-docker-meta@v4.1.1
+        with:
+          images: flomesh/pipy
+          tags: |
+            type=raw,${{ inputs.tags }}-nonroot
+
+      - name: Build and Push
+        uses: docker/build-push-action@v3.2.0
+        with:
+          context: .
+          file: ./dockerfiles/pipy/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
+          build-args: |
+            DISTROLESS_TAG=nonroot
+            PIPY_VERSION=${{ inputs.tags }}
+          
diff --git a/VERSION b/VERSION
@@ -1,4 +1,4 @@
-APP_VERSION=0.2.0-alpha.17
-HELM_CHART_VERSION=0.2.0-alpha.17
-K8S_VERSION=1.24.3
-ENVTEST_K8S_VERSION=1.24
+APP_VERSION=0.2.0-alpha.18
+HELM_CHART_VERSION=0.2.0-alpha.18
+K8S_VERSION=1.25.5
+ENVTEST_K8S_VERSION=1.25
diff --git a/charts/fsm/Chart.yaml b/charts/fsm/Chart.yaml
@@ -18,13 +18,13 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.0-alpha.17
+version: 0.2.0-alpha.18
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.2.0-alpha.17"
+appVersion: "0.2.0-alpha.18"
 
 keywords:
   - kubernetes

diff --git a/charts/namespaced-ingress/Chart.yaml b/charts/namespaced-ingress/Chart.yaml
@@ -16,13 +16,13 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.0-alpha.17
+version: 0.2.0-alpha.18
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.2.0-alpha.17"
+appVersion: "0.2.0-alpha.18"
 
 dependencies:
   - name: tpls

diff --git a/deploy/fsm-dev.yaml b/deploy/fsm-dev.yaml
@@ -14,8 +14,8 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm
   namespace: flomesh
 ---
@@ -25,8 +25,8 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-leader-election-role
   namespace: flomesh
 rules:
@@ -58,8 +58,8 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-mesh-config-role
   namespace: flomesh
 rules:
@@ -79,8 +79,8 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-role
 rules:
 - apiGroups:
@@ -293,8 +293,8 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-leader-election-rolebinding
   namespace: flomesh
 roleRef:
@@ -312,8 +312,8 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -1443,8 +1443,8 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-crds-resources
   namespace: flomesh
 ---
@@ -1468,8 +1468,8 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-manager-config
   namespace: flomesh
 ---
@@ -1500,8 +1500,8 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-manifests-config
   namespace: flomesh
 ---
@@ -1514,7 +1514,7 @@ data:
       "images": {
         "repository": "flomesh",
         "pipyImage": "pipy:0.70.0-46",
-        "proxyInitImage": "fsm-proxy-init:0.2.0-alpha.17-dev",
+        "proxyInitImage": "fsm-proxy-init:0.2.0-alpha.18-dev",
         "klipperLbImage": "mirrored-klipper-lb:v0.3.5"
       },
 
@@ -1572,8 +1572,8 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-mesh-config
   namespace: flomesh
 ---
@@ -1586,8 +1586,8 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-repo-init-scripts
   namespace: flomesh
 ---
@@ -1599,8 +1599,8 @@ metadata:
     app.kubernetes.io/instance: fsm-ingress-pipy
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-ingress-pipy-controller
   namespace: flomesh
 spec:
@@ -1624,8 +1624,8 @@ metadata:
     app.kubernetes.io/instance: fsm-manager
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-manager
   namespace: flomesh
 spec:
@@ -1647,8 +1647,8 @@ metadata:
     app.kubernetes.io/instance: fsm-repo
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-repo-service
   namespace: flomesh
 spec:
@@ -1670,8 +1670,8 @@ metadata:
     app.kubernetes.io/instance: fsm-manager
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-webhook-service
   namespace: flomesh
 spec:
@@ -1693,8 +1693,8 @@ metadata:
     app.kubernetes.io/instance: fsm-ingress-pipy
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-ingress-pipy
   namespace: flomesh
 spec:
@@ -1717,9 +1717,9 @@ spec:
         app.kubernetes.io/instance: fsm-ingress-pipy
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: fsm
-        app.kubernetes.io/version: 0.2.0-alpha.17-dev
+        app.kubernetes.io/version: 0.2.0-alpha.18-dev
         flomesh.io/app: fsm-ingress-pipy
-        helm.sh/chart: fsm-0.2.0-alpha.17
+        helm.sh/chart: fsm-0.2.0-alpha.18
         ingress.flomesh.io/namespaced: "false"
     spec:
       affinity:
@@ -1761,7 +1761,7 @@ spec:
               fieldPath: metadata.namespace
         - name: FSM_NAMESPACE
           value: flomesh
-        image: flomesh/fsm-ingress-pipy:0.2.0-alpha.17-dev
+        image: flomesh/fsm-ingress-pipy:0.2.0-alpha.18-dev
         imagePullPolicy: Always
         livenessProbe:
           initialDelaySeconds: 5
@@ -1821,8 +1821,8 @@ metadata:
     app.kubernetes.io/instance: fsm-manager
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-manager
   namespace: flomesh
 spec:
@@ -1839,9 +1839,9 @@ spec:
         app.kubernetes.io/instance: fsm-manager
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: fsm
-        app.kubernetes.io/version: 0.2.0-alpha.17-dev
+        app.kubernetes.io/version: 0.2.0-alpha.18-dev
         flomesh.io/app: fsm-manager
-        helm.sh/chart: fsm-0.2.0-alpha.17
+        helm.sh/chart: fsm-0.2.0-alpha.18
     spec:
       affinity:
         nodeAffinity:
@@ -1885,7 +1885,7 @@ spec:
               fieldPath: metadata.namespace
         - name: FSM_NAMESPACE
           value: flomesh
-        image: flomesh/fsm-manager:0.2.0-alpha.17-dev
+        image: flomesh/fsm-manager:0.2.0-alpha.18-dev
         imagePullPolicy: Always
         livenessProbe:
           httpGet:
@@ -1993,8 +1993,8 @@ metadata:
     app.kubernetes.io/instance: fsm-repo
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: fsm-repo
   namespace: flomesh
 spec:
@@ -2011,9 +2011,9 @@ spec:
         app.kubernetes.io/instance: fsm-repo
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: fsm
-        app.kubernetes.io/version: 0.2.0-alpha.17-dev
+        app.kubernetes.io/version: 0.2.0-alpha.18-dev
         flomesh.io/app: fsm-repo
-        helm.sh/chart: fsm-0.2.0-alpha.17
+        helm.sh/chart: fsm-0.2.0-alpha.18
     spec:
       affinity:
         nodeAffinity:
@@ -2101,8 +2101,8 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: pipy-repo
   namespace: flomesh
 spec:
@@ -2127,8 +2127,8 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: pipy
 spec:
   controller: flomesh.io/ingress-pipy
@@ -2140,8 +2140,8 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: flomesh-mutating-webhook-configuration
 webhooks: []
 ---
@@ -2152,7 +2152,7 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: fsm
-    app.kubernetes.io/version: 0.2.0-alpha.17-dev
-    helm.sh/chart: fsm-0.2.0-alpha.17
+    app.kubernetes.io/version: 0.2.0-alpha.18-dev
+    helm.sh/chart: fsm-0.2.0-alpha.18
   name: flomesh-validating-webhook-configuration
 webhooks: []