Merge proxy_init image with proxyv2 image

[howardjohn]

Part of #17518

Benefits:

• 1 less image to worry about
• Only pull a single image. This means the pull will be finished during
  the init, rather than during pod startup. This means Envoy can get ready
  quicker and have less chance of the application starting up before it
  and failing requests

Please provide a description for what this PR is for.

And to help us figure out who should review this PR, please
put an X in all the areas that this PR affects.

[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

[howardjohn]

/retest

[rlenglet]

This is great!

[howardjohn]

Thanks!! I meant to do that and completely forgot. See lack of tests issue #17199

…

On Fri, Oct 4, 2019 at 4:22 PM Romain Lenglet ***@***.***> wrote: ***@***.**** requested changes on this pull request. This is great! ------------------------------ In tools/istio-docker.mk <#17615 (comment)>: > @@ -127,6 +119,7 @@ docker.proxyv2: pilot/docker/envoy_pilot.yaml.tmpl docker.proxyv2: pilot/docker/envoy_policy.yaml.tmpl docker.proxyv2: tools/packaging/common/istio-iptables.sh docker.proxyv2: pilot/docker/envoy_telemetry.yaml.tmpl +docker.proxyv2: $(ISTIO_DOCKER)/istio-iptables How about proxy_debug and proxytproxy? You modified the command line in the injection template, so those images will now break. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#17615?email_source=notifications&email_token=AAEYGXLOPNQFD36GWR7SG73QM7F33A5CNFSM4I5RWBN2YY3PNVWWK3TUL52HS4DFWFIHK3DMKJSXC5LFON2FEZLWNFSXPKTDN5WW2ZLOORPWSZGOCG7WFIY#pullrequestreview-297755299>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAEYGXLC3XK5O4IIMK35733QM7F33ANCNFSM4I5RWBNQ> .

[howardjohn]

@rlenglet github UI is acting weird, everything should be good now. They all need the bash iptables but only proxyv2 needs the golang version

[rlenglet]

They all need the bash iptables but only proxyv2 needs the golang version

Yes, you should be good now.

[howardjohn]

/retest

[howardjohn]

@istio/wg-environments-maintainers please take a look

[costinm]

Please change back the name - no need to make docker image inconsistent with .deb ( the .sh at the end).

I'm worried about the .so replacement - but let's see how it goes. It's a problem for distroless in general.

[costinm]

" That means the Dockerfile ENTRYPOINT command, when defined, must be specified in vector form, to avoid the container runtime prefixing with a shell." 
"ENTRYPOINT ["myapp"]"

[costinm]

So it seems the official way to add .deb packages is our friend Bazel...
https://github.com/bazelbuild/rules_docker#container_image-1

I really hope the base distroless image for Istio proxy will be generated from a different repo ( tools,etc) so we don't add a bazel dep if we have to..). Maybe even do it in the proxy repo, so that proxy builds also generate a distroless-base image where we can just add the agent ? For now it's probably ok to go with your hack of blindly copying all .so files...

[howardjohn]

Talked with @costinm , will use istio-iptables (no .sh) everywhere, and make sure all usages for VMs are updated for this. For now will keep the distroless hack since it is existing, but opened an issue to track improvement

[kyessenov]

I think it makes for the proxy repo to produce all repo artifacts (deb packages and docker images).
For that to happen, agent and iptables need to be decoupled from istio/istio and integrated into proxy build system.

[howardjohn]

/retest

failures seem infrastructural

[howardjohn]

/retest

discussed offline

[howardjohn]

/retest

[howardjohn]

failed to export image: failed to create image: failed to get layer sha256:226f3eff3002042707a9f31eb68b8255ac9c23ccf4591aba9931c10c822226eb: layer does not exist?? not sure how this could happen.. docker on the node may be broken

/retest

[howardjohn]

/test pilot-multicluster-e2e_istio

[howardjohn]

/retest

[howardjohn]

/retest

[howardjohn]

/retest

[istio-testing]

@howardjohn: The following test failed, say /retest to rerun them all:

Test name	Commit	Details	Rerun command
racetest_istio	2a3a034	link	/test racetest_istio

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[howardjohn]

/retest