Make our container image "distroless" #15
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| ```release-note:enhancement | ||
| Container image is now "distroless" for better security | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -32,11 +32,12 @@ var ( | |
| logLevel string | ||
| logJSON bool | ||
|
|
||
| nodeName string | ||
| nodeID string | ||
| serviceID string | ||
| serviceIDPath string | ||
| namespace string | ||
| partition string | ||
|
|
||
| credentialType string | ||
| token string | ||
|
|
@@ -93,6 +94,7 @@ func init() { | |
| flag.StringVar(&nodeName, "service-node-name", "", "The name of the Consul node to which the proxy service instance is registered.") | ||
| flag.StringVar(&nodeID, "service-node-id", "", "The ID of the Consul node to which the proxy service instance is registered.") | ||
| flag.StringVar(&serviceID, "proxy-service-id", "", "The proxy service instance's ID.") | ||
| flag.StringVar(&serviceIDPath, "proxy-service-id-path", "", "The path to a file containing the proxy service instance's ID.") | ||
| flag.StringVar(&namespace, "service-namespace", "", "The Consul Enterprise namespace in which the proxy service instance is registered.") | ||
| flag.StringVar(&partition, "service-partition", "", "The Consul Enterprise partition in which the proxy service instance is registered.") | ||
|
|
||
|
|
@@ -155,6 +157,7 @@ func main() { | |
| return | ||
| } | ||
|
|
||
| readServiceIDFromFile() | ||
| validateFlags() | ||
|
|
||
| consuldpCfg := &consuldp.Config{ | ||
|
|
@@ -249,3 +252,19 @@ func main() { | |
| log.Fatal(err) | ||
| } | ||
| } | ||
|
|
||
| // readServiceIDFromFile reads the service ID from the file specified by the | ||
| // -proxy-service-id-path flag. | ||
| // | ||
| // We do this here, rather than in the consuldp package's config handling, | ||
| // because this option only really makes sense as a CLI flag (and we handle | ||
| // all flag parsing here). | ||
|
Comment on lines
+260
to
+261
There was a problem hiding this comment. I don't think it'd make sense to add this to the config file, what do you think? |
||
| func readServiceIDFromFile() { | ||
| if serviceID == "" && serviceIDPath != "" { | ||
| id, err := os.ReadFile(serviceIDPath) | ||
| if err != nil { | ||
| log.Fatalf("failed to read given -proxy-service-id-path: %v", err) | ||
| } | ||
| serviceID = string(id) | ||
| } | ||
| } | ||
|
Comment on lines
+256
to
+270
There was a problem hiding this comment. Hey @ishustava @thisisnotashwin 👋🏻 Do you have an explanation of why consul-k8s needs this, rather than putting the service ID directly in the CLI flags, that I could put here? There was a problem hiding this comment. In K8s, we often have a different container responsible for getting the service ID to begin with. Information across containers can only be shared via files on a shared volume. It makes it significantly easier to ready what is going on if we are dealing with filepath. Putting the service ID directly to the CLI would require reading the contents of that file anyway. |
||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I tried to use the (smaller)
static-debian11image, but unfortunately, Envoy dynamically links system libraries so this is not possible.