Use SPIRE scratch images in favor of alpine images

[rturner3]

SPIRE is planning to stop pushing the alpine-based release images to GCR. SPIRE has published scratch images that contain only the SPIRE release binary since v1.1.0 to GHCR as ghcr.io/spiffe/<image>.

Update references to alpine images in GCR to scratch images in GHCR. Update places where a version < 1.1.0 is used to reference the latest version of SPIRE, as the scratch images are only published to GHCR as of v1.1.0.

[lumjjb]

lgtm! Thanks for opening this up @rturner3 !

[mrsabath]

Thank you @rturner3 This is great! We'll take it from here! 👍

[rturner3]

Thank you @rturner3 This is great! We'll take it from here! 👍

Thanks @mrsabath! I noticed in the failing CI job that the Dockerfiles are trying to install curl in the spire-server container. From what I see there are a few options, depending on the requirements:

• Remove the step of the Dockerfiles that installs curl
• Use a builder image like alpine in the Dockerfile, install curl in the builder image, then copy the curl binary into the Tornjak images
• Build from a different base image like alpine and copy the SPIRE binaries into the Tornjak image

If the fix is straightforward, I'm happy to contribute it in this PR since it doesn't look like this is safe to merge as is.

[mrsabath]

Thank you @rturner3 for reaching out. We fixed it by separating the Tornjak images from Spire (see #100) This is the most elegant way. We can still keep them both in a single pod, but as separate containers (e.g. a sidecar). This new Tornjak image is based on alpine, to address the lacking shell in scratch.

[rturner3]

Hi @mrsabath @lumjjb are there any other changes you need me to make in order to get this to a state where it can be merged? We are hoping to stop publishing the SPIRE alpine-based images starting in 1.6.0.

[mrsabath]

We are retiring the deployment model when Tornjak is together with SPIRE in the same container, in lieu of separate containers that can be deployed in the same pod. Tornjak requires alpine base in order to run shell commands. This change requires a new documentation that is still referencing the old images. See issue #111