ContainerImage.Pinniped/Dockerfile

# Copyright 2020 the Pinniped contributors. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0

FROM golang:1.15.2 as build-env

WORKDIR /work
# Get dependencies first so they can be cached as a layer
COPY go.* ./
COPY generated/1.19/apis/go.* ./generated/1.19/apis/
COPY generated/1.19/client/go.* ./generated/1.19/client/
RUN go mod download

# Copy only the production source code to avoid cache misses when editing other files
COPY generated ./generated
COPY cmd ./cmd
COPY internal ./internal
COPY pkg ./pkg
COPY tools ./tools
COPY hack ./hack

# Build the executable binary (CGO_ENABLED=0 means static linking)
RUN mkdir out \
  && CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "$(hack/get-ldflags.sh)" -o out ./cmd/pinniped-server/... \
  && CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "$(hack/get-ldflags.sh)" -o out ./cmd/pinniped-supervisor/... \
  && CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o out ./cmd/local-user-authenticator/...

# Use a runtime image based on Debian slim
FROM debian:10.5-slim

# Copy the binaries from the build-env stage
COPY --from=build-env /work/out/pinniped-server /usr/local/bin/pinniped-server
COPY --from=build-env /work/out/pinniped-supervisor /usr/local/bin/pinniped-supervisor
COPY --from=build-env /work/out/local-user-authenticator /usr/local/bin/local-user-authenticator

# Document the port
EXPOSE 443

# Set the entrypoint
ENTRYPOINT ["/usr/local/bin/pinniped-server"]
Update copyright to reference Pinniped contributors Signed-off-by: Andrew Keesler <akeesler@vmware.com> 2020-09-16 14:05:51 +00:00			`# Copyright 2020 the Pinniped contributors. All Rights Reserved.`
First draft of moving API server TLS cert generation to controllers - Refactors the existing cert generation code into controllers which read and write a Secret containing the certs - Does not add any new functionality yet, e.g. no new handling for cert expiration, and no leader election to allow for multiple servers running simultaneously - This commit also doesn't add new tests for the cert generation code, but it should be more unit testable now as controllers 2020-08-09 17:04:05 +00:00			`# SPDX-License-Identifier: Apache-2.0`

Bump golang from 1.15.1 to 1.15.2 Bumps golang from 1.15.1 to 1.15.2. Signed-off-by: dependabot[bot] <support@github.com> 2020-09-16 14:59:35 +00:00			`FROM golang:1.15.2 as build-env`
Update dockerfile to use netrc Signed-off-by: Monis Khan <mok@vmware.com> 2020-07-17 03:52:53 +00:00
Add Dockerfile 2020-07-06 23:54:04 +00:00			`WORKDIR /work`
			`# Get dependencies first so they can be cached as a layer`
Switch to Debian base images. Signed-off-by: Matt Moyer <moyerm@vmware.com> 2020-08-12 20:57:27 +00:00			`COPY go.* ./`
Convert code to use the new generated packages. Signed-off-by: Matt Moyer <moyerm@vmware.com> 2020-08-24 19:30:45 +00:00			`COPY generated/1.19/apis/go.* ./generated/1.19/apis/`
			`COPY generated/1.19/client/go.* ./generated/1.19/client/`
Add Dockerfile 2020-07-06 23:54:04 +00:00			`RUN go mod download`
Switch to Debian base images. Signed-off-by: Matt Moyer <moyerm@vmware.com> 2020-08-12 20:57:27 +00:00
Initial aggregated API server (#15) Add initial aggregated API server (squashed from a bunch of commits). Signed-off-by: Andrew Keesler <akeesler@vmware.com> Signed-off-by: Aram Price <pricear@vmware.com> Signed-off-by: Ryan Richard <richardry@vmware.com> 2020-07-23 15:05:21 +00:00			`# Copy only the production source code to avoid cache misses when editing other files`
Convert code to use the new generated packages. Signed-off-by: Matt Moyer <moyerm@vmware.com> 2020-08-24 19:30:45 +00:00			`COPY generated ./generated`
Initial aggregated API server (#15) Add initial aggregated API server (squashed from a bunch of commits). Signed-off-by: Andrew Keesler <akeesler@vmware.com> Signed-off-by: Aram Price <pricear@vmware.com> Signed-off-by: Ryan Richard <richardry@vmware.com> 2020-07-23 15:05:21 +00:00			`COPY cmd ./cmd`
			`COPY internal ./internal`
			`COPY pkg ./pkg`
			`COPY tools ./tools`
			`COPY hack ./hack`
Switch to Debian base images. Signed-off-by: Matt Moyer <moyerm@vmware.com> 2020-08-12 20:57:27 +00:00
Build with CGO_ENABLED=0 in Dockerfile - Not strictly necessary at the moment because both our build layer and our run layer are based on alpine, but static linking our binary will help us later when we want to base our run image on something closer to scratch 2020-08-06 00:43:24 +00:00			`# Build the executable binary (CGO_ENABLED=0 means static linking)`
Create a deployment for `test-webhook` - For now, build the test-webhook binary in the same container image as the pinniped-server binary, to make it easier to distribute - Also fix lots of bugs from the first draft of the test-webhook's `/authenticate` implementation from the previous commit - Add a detailed README for the new deploy-test-webhook directory 2020-09-10 02:06:39 +00:00			`RUN mkdir out \`
			`&& CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "$(hack/get-ldflags.sh)" -o out ./cmd/pinniped-server/... \`
Implement very rough skeleton of the start of a supervisor server - This is just stab at a starting place because it felt easier to put something down on paper than to keep staring at a blank page 2020-10-06 00:28:19 +00:00			`&& CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "$(hack/get-ldflags.sh)" -o out ./cmd/pinniped-supervisor/... \`
Rename `test-webhook` to `local-user-authenticator` Signed-off-by: Andrew Keesler <akeesler@vmware.com> 2020-09-10 22:20:02 +00:00			`&& CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o out ./cmd/local-user-authenticator/...`
Add Dockerfile 2020-07-06 23:54:04 +00:00
Switch to Debian base images. Signed-off-by: Matt Moyer <moyerm@vmware.com> 2020-08-12 20:57:27 +00:00			`# Use a runtime image based on Debian slim`
Revert "Pin images to exact hashes (Dependabot can handle this, it seems)." 2020-08-14 15:52:29 +00:00			`FROM debian:10.5-slim`
Switch to Debian base images. Signed-off-by: Matt Moyer <moyerm@vmware.com> 2020-08-12 20:57:27 +00:00
Create a deployment for `test-webhook` - For now, build the test-webhook binary in the same container image as the pinniped-server binary, to make it easier to distribute - Also fix lots of bugs from the first draft of the test-webhook's `/authenticate` implementation from the previous commit - Add a detailed README for the new deploy-test-webhook directory 2020-09-10 02:06:39 +00:00			`# Copy the binaries from the build-env stage`
Rename project 2020-08-20 17:54:15 +00:00			`COPY --from=build-env /work/out/pinniped-server /usr/local/bin/pinniped-server`
Implement very rough skeleton of the start of a supervisor server - This is just stab at a starting place because it felt easier to put something down on paper than to keep staring at a blank page 2020-10-06 00:28:19 +00:00			`COPY --from=build-env /work/out/pinniped-supervisor /usr/local/bin/pinniped-supervisor`
Rename `test-webhook` to `local-user-authenticator` Signed-off-by: Andrew Keesler <akeesler@vmware.com> 2020-09-10 22:20:02 +00:00			`COPY --from=build-env /work/out/local-user-authenticator /usr/local/bin/local-user-authenticator`
Switch to Debian base images. Signed-off-by: Matt Moyer <moyerm@vmware.com> 2020-08-12 20:57:27 +00:00
Add Dockerfile 2020-07-06 23:54:04 +00:00			`# Document the port`
Initial aggregated API server (#15) Add initial aggregated API server (squashed from a bunch of commits). Signed-off-by: Andrew Keesler <akeesler@vmware.com> Signed-off-by: Aram Price <pricear@vmware.com> Signed-off-by: Ryan Richard <richardry@vmware.com> 2020-07-23 15:05:21 +00:00			`EXPOSE 443`
Switch to Debian base images. Signed-off-by: Matt Moyer <moyerm@vmware.com> 2020-08-12 20:57:27 +00:00
			`# Set the entrypoint`
Rename project 2020-08-20 17:54:15 +00:00			`ENTRYPOINT ["/usr/local/bin/pinniped-server"]`