Introduce `tbot-distroless` image #38259

strideynet · 2024-02-15T15:00:18Z

Paired with https://github.com/gravitational/teleport.e/pull/3465

changelog: tbot-distroless image is now published. This contains just the tbot binary and therefore has a smaller image size.

Successful build: https://drone.platform.teleport.sh/gravitational/teleport/34023
Image: public.ecr.aws/gravitational/tbot-distroless:16.0.0-dev.noah.tbr.1

Working docker run:

docker run public.ecr.aws/gravitational/tbot-distroless:16.0.0-dev.noah.tbr.1                                                                   
Unable to find image 'public.ecr.aws/gravitational/tbot-distroless:16.0.0-dev.noah.tbr.1' locally
16.0.0-dev.noah.tbr.1: Pulling from gravitational/tbot-distroless
8398841c8311: Pull complete 
2b776ada0341: Pull complete 
2a977872b36c: Pull complete 
fcb6f6d2c998: Pull complete 
e8c73c638ae9: Pull complete 
1e3d9b7d1452: Pull complete 
4aa0ea1413d3: Pull complete 
2fa82a9c76b2: Pull complete 
672354a91bfa: Pull complete 
acd581f1e199: Pull complete 
972a9f56458f: Pull complete 
810b5cc4682a: Pull complete 
45c2519a3853: Pull complete 
2b9c28259b9a: Pull complete 
0d7c3f6d6dc4: Pull complete 
Digest: sha256:1d2d377a93cbff0c66953670c19eef2e793d3c630f361758fec802fe0565078a
Status: Downloaded newer image for public.ecr.aws/gravitational/tbot-distroless:16.0.0-dev.noah.tbr.1
Usage: tbot [<flags>] <command> [<args> ...]

Teleport Machine ID

Machine ID issues and renews short-lived certificates so your machines can
access Teleport protected resources in the same way your engineers do!

Find out more at https://goteleport.com/docs/machine-id/introduction/

Flags:
  -d, --[no-]debug  Verbose logging to stdout.
  -c, --config      Path to a configuration file.
      --[no-]fips   Runs tbot in FIPS compliance mode. This requires the FIPS
                    binary is in use.

Commands:
  help         Show help.
  version      Print the version of your tbot binary.
  start        Starts the renewal bot, writing certificates to the data dir at a set interval.
  init         Initialize a certificate destination directory for writes from a separate bot user.
  configure    Creates a config file based on flags provided, and writes it to stdout or a file (-c <path>).
  migrate      Migrates a config file from an older version to the newest version. Outputs to stdout by default.
  db           Execute database commands through tsh.
  proxy        Start a local TLS proxy via tsh to connect to Teleport in single-port mode.

Try 'tbot help [command]' to get help for a given command.

strideynet · 2024-02-15T18:58:58Z

I'll rebase out the "Release" commit once this is all approved ;)

marcoandredinis

This looks good to me, but I would rather have someone from Tooling review this as well

build.assets/charts/Dockerfile-tbot-distroless

examples/chart/teleport-cluster/tests/__snapshot__/auth_deployment_test.yaml.snap

camscale

How quickly do you need to get this in? I'd very much prefer to avoid adding to Drone right now, as I am currently moving everything off it. It's a slow and painful process but I hope to have it complete by the end of the week. If you can hold off a little, I'll work with you to get this into the GHA build/publish workflows instead.

build.assets/charts/Dockerfile-tbot-distroless

dronegen/promote.go

dronegen/tag.go

strideynet · 2024-02-19T12:03:55Z

How quickly do you need to get this in? I'd very much prefer to avoid adding to Drone right now, as I am currently moving everything off it. It's a slow and painful process but I hope to have it complete by the end of the week. If you can hold off a little, I'll work with you to get this into the GHA build/publish workflows instead.

More than happy to hold off - especially if it means this can go straight into GHA instead of drone. I'll regroup with you next week on this - thank you Cam.

strideynet · 2024-02-26T22:24:06Z

Successful build in the pure GHA environment: https://github.com/gravitational/teleport.e/actions/runs/8055743348

Successful publish in a pure GHA environment: https://github.com/gravitational/teleport.e/actions/runs/8056429084

➜  teleport git:(strideynet/tbot-docker-image-remastered) ✗ docker run public.ecr.aws/gravitational/tbot-distroless:16.0.0-dev.noah.tbr.5
Unable to find image 'public.ecr.aws/gravitational/tbot-distroless:16.0.0-dev.noah.tbr.5' locally
16.0.0-dev.noah.tbr.5: Pulling from gravitational/tbot-distroless
8398841c8311: Already exists 
2b776ada0341: Already exists 
2a977872b36c: Already exists 
fcb6f6d2c998: Already exists 
e8c73c638ae9: Already exists 
1e3d9b7d1452: Already exists 
4aa0ea1413d3: Already exists 
2fa82a9c76b2: Already exists 
672354a91bfa: Already exists 
acd581f1e199: Already exists 
972a9f56458f: Already exists 
810b5cc4682a: Already exists 
45c2519a3853: Already exists 
2b9c28259b9a: Already exists 
ed49bf97d7a7: Pull complete 
Digest: sha256:9914a8a4d82ac4dbfa131dcf421f2bf10c46736d5b8f2483c0c2a196feb8bbef
Status: Downloaded newer image for public.ecr.aws/gravitational/tbot-distroless:16.0.0-dev.noah.tbr.5
Usage: tbot [<flags>] <command> [<args> ...]

Teleport Machine ID

Machine ID issues and renews short-lived certificates so your machines can
access Teleport protected resources in the same way your engineers do!

Find out more at https://goteleport.com/docs/machine-id/introduction/

Flags:
  -d, --[no-]debug  Verbose logging to stdout.
  -c, --config      Path to a configuration file.
      --[no-]fips   Runs tbot in FIPS compliance mode. This requires the FIPS
                    binary is in use.

Commands:
  help         Show help.
  version      Print the version of your tbot binary.
  start        Starts the renewal bot, writing certificates to the data dir at a set interval.
  init         Initialize a certificate destination directory for writes from a separate bot user.
  configure    Creates a config file based on flags provided, and writes it to stdout or a file (-c <path>).
  migrate      Migrates a config file from an older version to the newest version. Outputs to stdout by default.
  db           Execute database commands through tsh.
  proxy        Start a local TLS proxy via tsh to connect to Teleport in single-port mode.

Try 'tbot help [command]' to get help for a given command.

strideynet · 2024-02-26T22:34:31Z

Running v16.0.0-dev.noah.tbr.6 build to test b326428

strideynet · 2024-02-26T22:34:49Z

Once I've got approval on both sides, I'll drop the release commits from this branch.

camscale

This has still got drone stuff in it that should be dropped. All this PR needs is the Dockerfile-tbot-distroless file.

To keep the version stuff from a dev tag build getting on the PR, what I often do is create a test branch on top of the PR branch (strideynet/test/tbot-docker-image-remastered in this case) and run make update-version; make update-tag on that. The test branch does not even need to be pushed, since the tag is pushed. Then I throw away the branch when I'm done.

I don't like to approve PRs that have the version changes in it in case some accidentally gets merged - I think it's cleaner and easier to leave it off the PR.

build.assets/charts/Dockerfile-tbot-distroless

strideynet · 2024-02-27T09:50:58Z

Running https://github.com/gravitational/teleport.e/actions/runs/8062741799 to validate deb extraction changes and changes on e to use version action.

Failed due to incorrect config

Fixed config and rerunning https://github.com/gravitational/teleport.e/actions/runs/8064136416

strideynet · 2024-02-27T16:25:01Z

➜  teleport git:(strideynet/migrate-remote-cluster-rpcs-to-grpc) ✗ docker run public.ecr.aws/gravitational/tbot-distroless:16.0.0-dev.noah.tbr.8
Unable to find image 'public.ecr.aws/gravitational/tbot-distroless:16.0.0-dev.noah.tbr.8' locally
16.0.0-dev.noah.tbr.8: Pulling from gravitational/tbot-distroless
8398841c8311: Pull complete 
2b776ada0341: Pull complete 
2a977872b36c: Pull complete 
fcb6f6d2c998: Pull complete 
e8c73c638ae9: Pull complete 
1e3d9b7d1452: Pull complete 
4aa0ea1413d3: Pull complete 
2fa82a9c76b2: Pull complete 
672354a91bfa: Pull complete 
acd581f1e199: Pull complete 
972a9f56458f: Pull complete 
810b5cc4682a: Pull complete 
45c2519a3853: Pull complete 
2b9c28259b9a: Pull complete 
0be80286843c: Pull complete 
Digest: sha256:15008c9ada589182e39aea6914dc53d0bc409ab46cb8e0eea5b9b284b9b2f32b
Status: Downloaded newer image for public.ecr.aws/gravitational/tbot-distroless:16.0.0-dev.noah.tbr.8
Usage: tbot [<flags>] <command> [<args> ...]

Teleport Machine ID

Machine ID issues and renews short-lived certificates so your machines can
access Teleport protected resources in the same way your engineers do!

Find out more at https://goteleport.com/docs/machine-id/introduction/

Flags:
  -d, --[no-]debug  Verbose logging to stdout.
  -c, --config      Path to a configuration file.
      --[no-]fips   Runs tbot in FIPS compliance mode. This requires the FIPS
                    binary is in use.

Commands:
  help         Show help.
  version      Print the version of your tbot binary.
  start        Starts the renewal bot, writing certificates to the data dir at a set interval.
  init         Initialize a certificate destination directory for writes from a separate bot user.
  configure    Creates a config file based on flags provided, and writes it to stdout or a file (-c <path>).
  migrate      Migrates a config file from an older version to the newest version. Outputs to stdout by default.
  db           Execute database commands through tsh.
  proxy        Start a local TLS proxy via tsh to connect to Teleport in single-port mode.

Try 'tbot help [command]' to get help for a given command.

Successful build, publish and run based on the last commit!

camscale

Looks really good now. I'm pleased with how simple it's ended up.

public-teleport-github-review-bot · 2024-02-28T09:28:35Z

@strideynet See the table below for backport results.

Branch	Result
branch/v13	Create PR
branch/v14	Create PR
branch/v15	Create PR

strideynet marked this pull request as ready for review February 15, 2024 18:59

github-actions bot added helm size/md labels Feb 15, 2024

github-actions bot requested review from marcoandredinis and tigrato February 15, 2024 18:59

marcoandredinis reviewed Feb 16, 2024

View reviewed changes

build.assets/charts/Dockerfile-tbot-distroless Outdated Show resolved Hide resolved

marcoandredinis approved these changes Feb 16, 2024

View reviewed changes

tigrato reviewed Feb 16, 2024

View reviewed changes

examples/chart/teleport-cluster/tests/__snapshot__/auth_deployment_test.yaml.snap Outdated Show resolved Hide resolved

camscale reviewed Feb 19, 2024

View reviewed changes

build.assets/charts/Dockerfile-tbot-distroless Outdated Show resolved Hide resolved

dronegen/promote.go Outdated Show resolved Hide resolved

dronegen/tag.go Outdated Show resolved Hide resolved

strideynet force-pushed the strideynet/tbot-docker-image-remastered branch from 2a812ee to fd5c68d Compare February 26, 2024 17:32

strideynet added backport/branch/v13 backport/branch/v14 backport/branch/v15 labels Feb 26, 2024

strideynet requested a review from camscale February 26, 2024 22:34

camscale reviewed Feb 27, 2024

View reviewed changes

build.assets/charts/Dockerfile-tbot-distroless Outdated Show resolved Hide resolved

build.assets/charts/Dockerfile-tbot-distroless Outdated Show resolved Hide resolved

strideynet added 2 commits February 27, 2024 09:23

Add dockerfile for tbot-distroless

4d1d5b4

use --mount rather than copy

0326745

strideynet force-pushed the strideynet/tbot-docker-image-remastered branch from fa2a8f3 to 0326745 Compare February 27, 2024 09:23

simplify deb extraction

a22999e

strideynet requested a review from camscale February 27, 2024 16:25

camscale approved these changes Feb 28, 2024

View reviewed changes

tigrato approved these changes Feb 28, 2024

View reviewed changes

strideynet added this pull request to the merge queue Feb 28, 2024

github-merge-queue bot removed this pull request from the merge queue due to failed status checks Feb 28, 2024

strideynet added this pull request to the merge queue Feb 28, 2024

Merged via the queue into master with commit 3d8d39f Feb 28, 2024
34 checks passed

strideynet deleted the strideynet/tbot-docker-image-remastered branch February 28, 2024 09:26

This was referenced Feb 28, 2024

[v15] Introduce tbot-distroless image #38718

Merged

[v14] Introduce tbot-distroless image #38719

Merged

[v13] Introduce tbot-distroless image #38720

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Introduce `tbot-distroless` image #38259

Introduce `tbot-distroless` image #38259

strideynet commented Feb 15, 2024 •

edited

Loading

strideynet commented Feb 15, 2024

marcoandredinis left a comment

camscale left a comment

strideynet commented Feb 19, 2024

strideynet commented Feb 26, 2024 •

edited

Loading

strideynet commented Feb 26, 2024

strideynet commented Feb 26, 2024

camscale left a comment

strideynet commented Feb 27, 2024 •

edited

Loading

strideynet commented Feb 27, 2024

camscale left a comment

public-teleport-github-review-bot bot commented Feb 28, 2024

Introduce tbot-distroless image #38259

Introduce tbot-distroless image #38259

Conversation

strideynet commented Feb 15, 2024 • edited Loading

strideynet commented Feb 15, 2024

marcoandredinis left a comment

Choose a reason for hiding this comment

camscale left a comment

Choose a reason for hiding this comment

strideynet commented Feb 19, 2024

strideynet commented Feb 26, 2024 • edited Loading

strideynet commented Feb 26, 2024

strideynet commented Feb 26, 2024

camscale left a comment

Choose a reason for hiding this comment

strideynet commented Feb 27, 2024 • edited Loading

strideynet commented Feb 27, 2024

camscale left a comment

Choose a reason for hiding this comment

public-teleport-github-review-bot bot commented Feb 28, 2024

Introduce `tbot-distroless` image #38259

Introduce `tbot-distroless` image #38259

strideynet commented Feb 15, 2024 •

edited

Loading

strideynet commented Feb 26, 2024 •

edited

Loading

strideynet commented Feb 27, 2024 •

edited

Loading