New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use debian-base instead of busybox as base image for server images #70245

Merged
merged 1 commit into from Oct 29, 2018

Conversation

@ixdy
Member

ixdy commented Oct 25, 2018

What type of PR is this?
/kind cleanup

What this PR does / why we need it: standardizes on debian-base for the server images instead of busybox, per #40248 (comment).

Using debian-base also ensures we use a consistent libc (glibc instead of musl libc), allows better security scanning on gcr.io, avoids weird compatibility bugs like #69195, and may even use marginally less space on nodes, since debian-iptables is based on it and is already included on all nodes for kube-proxy.

Does this PR introduce a user-facing change?:

Use debian-base instead of busybox as base image for server images

/assign @BenTheElder @cblecker @dims
cc @tallclair @AishSundar @simony-gke @listx
/sig release

@k8s-ci-robot

This comment has been minimized.

Contributor

k8s-ci-robot commented Oct 25, 2018

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ixdy

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tallclair

This comment has been minimized.

Member

tallclair commented Oct 25, 2018

xref: #70102 or #69333

I'm hoping that once we resolve either of those, we can just rebase these on scratch (doesn't address #69195 though)

@ixdy

This comment has been minimized.

Member

ixdy commented Oct 25, 2018

doesn't address #69195 though

We could probably use scratch-with-/etc/nsswitch.conf like we do for busybox now, though it might need an /etc/hosts too...

@ixdy

This comment has been minimized.

Member

ixdy commented Oct 25, 2018

bazel flake bazelbuild/bazel#6136
/retest

@cblecker

/lgtm
/hold

Holding for any further review, but I'm supportive of standardizing on debian-base as opposed to busybox.

kube-controller-manager,"k8s.gcr.io/debian-base-${arch}:${debian_base_version}"
kube-scheduler,"k8s.gcr.io/debian-base-${arch}:${debian_base_version}"
kube-proxy,"k8s.gcr.io/debian-iptables-${arch}:${debian_iptables_version}"
)

This comment has been minimized.

@BenTheElder

BenTheElder Oct 25, 2018

Member

this alone is wonderful, thanks :-)

# ensure /etc/nsswitch.conf exists so go's resolver respects /etc/hosts
container_image(
name = "busybox-with-nsswitch",
base = "@official_busybox//image",

This comment has been minimized.

@BenTheElder

BenTheElder Oct 25, 2018

Member

are we using this image elsewhere? otherwise we can also remove from WORKSPACE

This comment has been minimized.

@ixdy

ixdy Oct 25, 2018

Member

cluster/images/kubemark/BUILD uses it. I was planning to switch it to debian-base and then remove it here in a follow-up PR; I wanted to keep this one focused on the server images.

This comment has been minimized.

@BenTheElder

BenTheElder Oct 25, 2018

Member

SGTM 👍

@BenTheElder

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm label Oct 25, 2018

@BenTheElder

This comment has been minimized.

Member

BenTheElder commented Oct 25, 2018

We could probably use scratch-with-/etc/nsswitch.conf like we do for busybox now, though it might need an /etc/hosts too...

/etc/hosts is populated by Kubernetes. Adding /etc/nsswitch.conf should be fine

@BenTheElder

This comment has been minimized.

Member

BenTheElder commented Oct 25, 2018

re-iterating from @cblecker since it seemed to not stick...
/hold

@tallclair

This comment has been minimized.

Member

tallclair commented Oct 25, 2018

xref: #70249

@ixdy

This comment has been minimized.

Member

ixdy commented Oct 29, 2018

any objections from anyone?

@dims

This comment has been minimized.

Member

dims commented Oct 29, 2018

No objections. 🚢 it !

@BenTheElder

This comment has been minimized.

Member

BenTheElder commented Oct 29, 2018

:shipit:
/hold cancel

@k8s-ci-robot k8s-ci-robot merged commit f698f0f into kubernetes:master Oct 29, 2018

18 checks passed

cla/linuxfoundation ixdy authorized
Details
pull-kubernetes-bazel-build Job succeeded.
Details
pull-kubernetes-bazel-test Job succeeded.
Details
pull-kubernetes-cross Job succeeded.
Details
pull-kubernetes-e2e-gce Job succeeded.
Details
pull-kubernetes-e2e-gce-100-performance Job succeeded.
Details
pull-kubernetes-e2e-gce-device-plugin-gpu Job succeeded.
Details
pull-kubernetes-e2e-gke Skipped
pull-kubernetes-e2e-kops-aws Job succeeded.
Details
pull-kubernetes-e2e-kubeadm-gce Skipped
pull-kubernetes-integration Job succeeded.
Details
pull-kubernetes-kubemark-e2e-gce-big Job succeeded.
Details
pull-kubernetes-local-e2e Skipped
pull-kubernetes-local-e2e-containerized Skipped
pull-kubernetes-node-e2e Job succeeded.
Details
pull-kubernetes-typecheck Job succeeded.
Details
pull-kubernetes-verify Job succeeded.
Details
tide In merge pool.
Details
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment