Set linkopts "-w" instead of "-w -s" when building go binaries

[inteon]

What this PR does / why we need it:
In #4169, the "-w" and "-s" flags were introduced when building go binaries.
These options remove both the DWARF tables and the symbol tables from the binary. However, removing the symbols table from the binaries causes some issues #4169 (comment).
@SgtCoDFish noticed that the binary size reduction is mostly thanks to removing the DWARF tables.
Results for the kubectl plugin:

• no flags: 74M
• "-w": 62M
• "-w", "-s": 49M

This PR removes the "-s" flag and only keeps the "-w" flag for building go binaries.

Release note:

reduce binary sizes by adding "-w" as ldflag

[jetstack-bot]

Hi @inteon. Thanks for your PR.

I'm waiting for a jetstack or cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[coderanger]

I'm confused, if the user having issues is already modifying cert-manager to link against some CGo stuff, why can't they patch their build config as well?

[SgtCoDFish]

that was an easy review 😂

[jetstack-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: inteon, SgtCoDFish

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [SgtCoDFish]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[irbekrm]

/ok-to-test

[SgtCoDFish]

I'm confused, if the user having issues is already modifying cert-manager to link against some CGo stuff, why can't they patch their build config as well?

For context: the issue that Irbe was talking about is related to using the boringcrypto branch of Go, which uses a different crypto library so that cert-manager might be used in environments which require FIPS compliance.

It's not really changing cert-manager itself - just building in a different environment.

The issue arises afterwards, when we use https://pkg.go.dev/rsc.io/goversion to verify that we're using the FIPS-compliant crypto libs. That tool requires the symbol table to be intact to be able to detect the crypto libraries used, and there are definitely reasons that people might want to make those checks on the cert-manager binaries [1].

There's maybe a case to be made that for the cert-manager kubectl plugin specifically, we could use both -s -w - but the simplest thing to do today is to build everything with -w for now, and maybe revisit in the future.

I guess at the core of it, -w seems like an entirely uncontroversial default for all binaries currently, whereas we have a case where -s breaks things. So, we use -w for now, and then can look at -s on a case-by-case basis.

[1] Since FIPS is bit rubbish, it might be reasonable for a user to want to verify that their cert-manager install was not built with boringcrypto - which is hard to do without the symbol table 😄

[irbekrm]

Agree with Ashley that it may still be useful for folks to be able to inspect the binaries.
I guess we can get back to this if there's a strong argument for it?
We are still aiming to remove Bazel from cert-manager at which point this part of the codebase will go away anyway and it should be easier to create a custom build config that isn't too different from how the standard images are built.

/lgtm

[irbekrm]

/kind cleanup