ContainerImage.Pinniped/internal/controller
Matt Moyer 58bbffded4
Switch to a slimmer distroless base image.
At a high level, it switches us to a distroless base container image, but that also includes several related bits:

- Add a writable /tmp but make the rest of our filesystems read-only at runtime.

- Condense our main server binaries into a single pinniped-server binary. This saves a bunch of space in
  the image due to duplicated library code. The correct behavior is dispatched based on `os.Args[0]`, and
  the `pinniped-server` binary is symlinked to `pinniped-concierge` and `pinniped-supervisor`.

- Strip debug symbols from our binaries. These aren't really useful in a distroless image anyway and all the
  normal stuff you'd expect to work, such as stack traces, still does.

- Add a separate `pinniped-concierge-kube-cert-agent` binary with "sleep" and "print" functionality instead of
  using builtin /bin/sleep and /bin/cat for the kube-cert-agent. This is split from the main server binary
  because the loading/init time of the main server binary was too large for the tiny resource footprint we
  established in our kube-cert-agent PodSpec. Using a separate binary eliminates this issue and the extra
  binary adds only around 1.5MiB of image size.

- Switch the kube-cert-agent code to use a JSON `{"tls.crt": "<b64 cert>", "tls.key": "<b64 key>"}` format.
  This is more robust to unexpected input formatting than the old code, which simply concatenated the files
  with some extra newlines and split on whitespace.

- Update integration tests that made now-invalid assumptions about the `pinniped-server` image.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-08-09 15:05:13 -04:00
..
apicerts certs_expirer: be specific about what secret to delete 2021-07-28 09:56:05 -04:00
authenticator impersonator: add support for service account token authentication 2021-04-29 17:30:35 -04:00
conditionsutil Split package upstreamwatchers into four packages 2021-05-12 14:00:39 -07:00
impersonatorconfig Add ClusterIP service to impersonator-config-controller informer. 2021-07-28 11:57:18 -05:00
issuerconfig When merging CredentialIssuer updates, don't overwrite LastUpdated. 2021-05-27 17:09:12 -05:00
kubecertagent Switch to a slimmer distroless base image. 2021-08-09 15:05:13 -04:00
supervisorconfig Merge branch 'main' into oidc-upstream-watcher-supports-proxy 2021-07-09 07:24:52 -07:00
supervisorstorage Merge branch 'main' into initial_ldap 2021-05-11 11:09:37 -07:00
controller_test.go Clean this test up a trivial amount using require.Implementsf(). 2020-12-17 08:38:16 -06:00
utils.go Upstream Watcher Controller Syncs less often by adjusting its filters 2020-12-18 15:41:18 -08:00