conjurdemos / kubernetes-conjur-demo

Demo application for Conjur Kubernetes integration
11 stars 14 forks source link

CNJR-0000: Use alpine instead of Ruby base image #154

Closed szh closed 2 months ago

szh commented 2 months ago

There doesn't seem to be any real reason we're using the Ruby base image for the summon test app. Summon is written in Go, and besides we're installing the compiled version. The Ruby image is large and has therefore has a large attack surface and many packages with vulnerabilities. Switching to a slimmer base image such as Alpine reduces attack surface and vulnerabilities.

While testing this, I discovered that Jenkins tests on OpenShift were failing due to the google/cloud-sdk base image used in tests no longer having the correct glibc version needed by the OpenShift CLI. I decided to switch from the (very large) google/cloud-sdk image to a plain ubuntu image and download the Google Cloud CLI as described in https://cloud.google.com/sdk/docs/install#deb