Skip to content

fix: Restore a buildable, digest-pinned base image #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
johnxie wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix: Restore a buildable, digest-pinned base image #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,19 @@
FROM bitnami/kubectl:1.24.12
# Digest-pinned on purpose. This action runs on taskade/taskcade's production
# deploy path (production.yml: "Create AWS credentials secret" and "Register
# Temporal taskade Namespace"), so the base image must be immutable - a floating
# tag lets a third party change what runs with our kubeconfig and AWS creds.
#
# Do NOT move this to bitnami/kubectl. The 1.24.12 attempt broke twice over:
# 1. `bitnami/kubectl:1.24.12` 404s. Bitnami retired their free Docker Hub
# catalog; the image only survives at `bitnamilegacy/kubectl:1.24.12`.
# 2. Even resolved to bitnamilegacy, the build still fails at the RUN below
# with `curl: command not found` - the bitnami base ships no curl.
# Both were reproduced with `docker build` before this revert.
#
# Upgrading kubectl past the 1.23.15 in this image is a real want, but it needs
# a base that has curl (or a different way to fetch aws-iam-authenticator) and
# a version chosen against the live EKS control plane. Track it separately.
FROM gcr.io/cloud-builders/kubectl@sha256:2be508c9ef153be3d3d2e986acd430821d99c1bcbdccda2e426222338f034762

LABEL version="1.0.0"
LABEL name="kubectl"
Expand Down