Rebase core master image from debian to distroless

[yuwenma]

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespaces from that line:

/kind api-change
/kind bug

/kind cleanup

/kind design
/kind documentation
/kind failing-test
/kind feature
/kind flake

What this PR does / why we need it:

This PR is part of the effort on rebasing kubernetes images to distroless/static. See this KEP for details.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

[k8s-ci-robot]

Hi @yuwenma. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: yuwenma
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: zmerlynn

If they are not already assigned, you can assign the PR to them by writing /assign @zmerlynn in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• build/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[yuwenma]

/ok-to-test

[justaugustus]

/remove-lifecycle stale

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[k8s-ci-robot]

@yuwenma: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[justaugustus]

/remove-lifecycle rotten
/lifecycle frozen

[justaugustus]

@yuwenma @liggitt -- What's the current status on this?
cc: @DirectXMan12 (ref: kubernetes/klog#70)

[dims]

/hold

I don't see any evidence that distroless images support architectures other than amd64 (Please correct me if i am wrong!!!)

cc @tallclair

[BenTheElder]

oof yeah, inspecting the images in cloud console shows only amd64 manifests (sampled a few).
GoogleContainerTools/distroless#406

[dims]

@BenTheElder someone ported to arm arch as well https://github.com/discolix/discolix but that's it other arches don't work either

cc @tallclair

[dims]

Looks like i missed a nuance, even if the manifest says amd64 like Ben observed, looks like the key here is :static
GoogleContainerTools/distroless#346

[BenTheElder]

We still have to be careful to make sure the release images have the right architecture metadata.

…

On Mon, Apr 27, 2020, 07:15 Davanum Srinivas ***@***.***> wrote: Looks like i missed a nuance, even if the manifest says amd64 like Ben observed, looks like the key here is :static GoogleContainerTools/distroless#346 <GoogleContainerTools/distroless#346> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#75306 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAHADK4PEWUUEP62N673MPLROWHRDANCNFSM4G5QFVNA> .

[dims]

/hold cancel

Right @BenTheElder

[dekkagaijin]

Seems like distroless:static should be trivially multi-arch-friendly, though that obviously doesn't extend to :base and others with bundled libs and runtimes. I'll follow up to see how difficult it would be to push a manifest list to gcr.io/distroless/static:latest

[BenTheElder]

Even with no binary base: #87325

…

On Mon, Apr 27, 2020, 16:46 Jake Sanders ***@***.***> wrote: Seems like distroless:static should be trivially multi-arch-friendly, though that obviously doesn't extend to :base and others with bundled libs and runtimes. I'll follow up to see how difficult it would be to push a manifest list to gcr.io/distroless/static:latest — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#75306 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAHADK54DWLRNLAQQR6JX4LROYKMTANCNFSM4G5QFVNA> .

[dekkagaijin]

@BenTheElder right, it'd require a manifest list to be pushed to the base image repo. amd64 is the default, otherwise.

[spiffxp]

needs rebase

[dims]

Note that before we merge this PR - Revert "Revert "Revert "[Re-Apply][Distroless] Convert the GCE manifests for master containers.""" - needs to be Reverted again!

[dims]

/close

Thanks a ton @yuwenma we are continuing this work in #90674

[k8s-ci-robot]

@dims: Closed this PR.

In response to this:

/close

Thanks a ton @yuwenma we are continuing this work in #90674

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.