Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: change image to scratch #16

Merged
merged 3 commits into from
Jul 14, 2023
Merged

feat: change image to scratch #16

merged 3 commits into from
Jul 14, 2023

Conversation

vishal-chdhry
Copy link
Contributor

Updating the base to alpine 3.18 reduces the size of image from 583.97MB to 79.2MB

Size comparision between amazon linux image and alpine image

Image verification is working as intended on main.

$ kubectl apply -f configs/samples/kyverno-policy.yaml
clusterpolicy.kyverno.io/check-images configured
$ kubectl -n test-notation run test --image=844333597536.dkr.ecr.us-west-2.amazonaws.com/kyverno-demo:v1 --dry-run=server
pod/test created (server dry run)
$ kubectl -n test-notation run test --image=844333597536.dkr.ecr.us-west-2.amazonaws.com/kyverno-demo:v1-unsigned --dry-run=server
Error from server: admission webhook "validate.kyverno.svc-fail" denied the request: 

resource Pod/test-notation/test was blocked due to the following policies 

check-images:
  call-aws-signer-extension: 'failed to check deny conditions: failed to substitute
    variables in condition key: failed to resolve result.verified at path : JMESPath
    query failed: Unknown key "result" in path'

Signed-off-by: Vishal Choudhary <[email protected]>
@vishal-chdhry
Copy link
Contributor Author

vishal-chdhry commented Jul 12, 2023

Even if I use scratch and build the plugin without debug information, (this build didn’t work for some reason although pod was created)

RUN GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="-w -s" -o kyverno-notation-aws .

I could not get the size below 51.63 MB
Screenshot 2023-07-13 at 03 03 14

  1. Scratch Image and no debug information - 51.63 MB (Not working…) (Added SSL CA certificates and now it works!)
  2. Alpine Image and no debug information - 58.96 MB
  3. Alpine Image with debug information - 69.92 MB
  4. Alpine Image with debug information and tree - 79.2 MB
Screenshot 2023-07-13 at 03 05 59

Is there anything else that I can try?

@vishal-chdhry vishal-chdhry changed the title feat: change image to alpine 3.18 feat: change image to scratch Jul 12, 2023
@realshuting realshuting merged commit 5e4a3b6 into main Jul 14, 2023
2 checks passed
@realshuting realshuting deleted the alpine branch August 9, 2023 05:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants