ondat / trousseau

Store and access your secrets the Kubernetes native way with any external KMS.
https://trousseau.io
Apache License 2.0
177 stars 11 forks source link

[RFE] create a non-distroless container for advanced debug #39

Closed romdalf closed 2 years ago

romdalf commented 2 years ago

Is it linked to a user story? (use the "#" to tag the user story)

38

What do we want to build? Current code base built on a Ubuntu container for debugging

Why do we want to build it? Current package is built on distroless container base image which doesn't content any tooling for live debugging (like shell approach)

How do we want to design it?

Is it linked to a user story? No

What do we want to build? A non production-grade container image for debugging purposes only


romdalf commented 2 years ago

I build two images using ubi-minimal:latest and ubuntu:20.04 (LTS) and pushed them within Ondat Package registry: https://github.com/orgs/ondat/packages These are currently not published and need to be tested.

One remark - At the current stage, if the health check (KMS connectivity check) is not successful, the process is terminated. This leads to a rescheduling of a fresh Pod from a k8s perspective per the DaemonSet requirements. Therefore, this debug container should have a code change to void the termination of kubernetes-kms-vault to rather move towards infinite retry providing debbuging time. At the current stage, if the health check (KMS connectivity check) is not successful, the process is terminated. This leads to a rescheduling of a fresh Pod from a k8s perspective per the DaemonSet requirements.