feat: Switch to wolfi-base image

.github/workflows/tests.yml

@@ -105,9 +105,9 @@ jobs:
           docker build -t test-image --platform=${{ matrix.docker_platform }} --build-arg=ARCH_ORG=${{ matrix.arch_org }} .
       - name: Test if git works inside container
         run: |
-          # test if the git binary is still working, which keep breaking due to wolfi-base updates being missed
-          # If you see this failing, it's time to upgrade the base image in Dockerfile...
-          docker run --platform=${{ matrix.docker_platform }} --rm -i --entrypoint=/bin/sh test-image -c "cd && git clone https://github.com/kluctl/kluctl.git"
+          # test if Jinja2 rendering is still working. It might break if the glic version from wolfi-base is not
+          # recent enough to support the embedded Python distribution.
+          docker run --platform=${{ matrix.docker_platform }} --rm -i --entrypoint=/bin/sh test-image -c "/usr/bin/template-controller -test-jinja2"
 
   tests:
     runs-on: ubuntu-22.04

.goreleaser.yaml

@@ -27,8 +27,6 @@ dockers:
     goarch: amd64
     build_flag_templates:
       - "--pull"
-      - "--build-arg=ARCH=linux-amd64"
-      - "--build-arg=ARCH_ORG=amd64"
       - "--label=org.opencontainers.image.created={{ .Date }}"
       - "--label=org.opencontainers.image.name={{ .ProjectName }}"
       - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
@@ -42,8 +40,6 @@ dockers:
     goarch: arm64
     build_flag_templates:
       - "--pull"
-      - "--build-arg=ARCH=linux-arm64"
-      - "--build-arg=ARCH_ORG=arm64v8"
       - "--label=org.opencontainers.image.created={{ .Date }}"
       - "--label=org.opencontainers.image.name={{ .ProjectName }}"
       - "--label=org.opencontainers.image.revision={{ .FullCommit }}"

Dockerfile

@@ -1,12 +1,17 @@
-ARG ARCH_ORG
+# We must use a glibc based distro due to embedded python not supporting musl libc for aarch64 (only amd64+musl is supported)
+# see https://github.com/indygreg/python-build-standalone/issues/87
+# use `docker buildx imagetools inspect cgr.dev/chainguard/wolfi-base:latest` to find latest sha256 of multiarch image
+ARG WOLFI_DIGEST=sha256:5cc4736f5a03e9ba618760e5b21c1f1bc0ce275fc6ba86589c8dd26374c2647b
+FROM --platform=$TARGETPLATFORM cgr.dev/chainguard/wolfi-base@$WOLFI_DIGEST
 
-# We must use a glibc based distro due to embedded python not supporting musl libc for aarch64
-FROM $ARCH_ORG/debian:bullseye-slim
+# See https://docs.docker.com/engine/reference/builder/#automatic-platform-args-in-the-global-scope
+ARG TARGETPLATFORM
 
-# We meed git for kustomize to support overlays from git
-RUN apt update && apt install git -y && rm -rf /var/lib/apt/lists/*
+RUN apk update && apk add tzdata
+
+ENV KLUCTL_CACHE_DIR=/tmp/kluctl-cache
 
 COPY bin/template-controller /usr/bin/
 USER 65532:65532
 
-ENTRYPOINT ["/manager"]
+ENTRYPOINT ["/usr/bin/template-controller"]

go.mod

@@ -7,8 +7,8 @@ require (
 	github.com/gobwas/glob v0.2.3
 	github.com/google/go-github/v47 v47.1.0
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/kluctl/go-jinja2 v0.0.0-20240619083358-c137395943eb
-	github.com/kluctl/kluctl/lib v0.0.0-20240708111940-7d9465ba9662
+	github.com/kluctl/go-jinja2 v0.0.0-20240708212116-03ee7eefba4f
+	github.com/kluctl/kluctl/lib v0.0.0-20240708210331-4b60c060bd56
 	github.com/ohler55/ojg v1.22.1
 	github.com/onsi/ginkgo/v2 v2.19.0
 	github.com/onsi/gomega v1.33.1

go.sum

@@ -127,10 +127,10 @@ github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kluctl/go-embed-python v0.0.0-3.12.3-20240415-1 h1:IX2O3LJUL0AjYsROGZ4aNENTEb3c/Ll/0b9Yb/8P61Q=
 github.com/kluctl/go-embed-python v0.0.0-3.12.3-20240415-1/go.mod h1:9kqX8IjRCNh4ppXxlKGtLN+QFuvsdSsNGKsTLgdSNRw=
-github.com/kluctl/go-jinja2 v0.0.0-20240619083358-c137395943eb h1:ibPMOncAbKZqREllxULOLtC+7i4vfCK7hZvZbuER0iM=
-github.com/kluctl/go-jinja2 v0.0.0-20240619083358-c137395943eb/go.mod h1:O6CJS5+wwnQE4OorQi/fV3eGFye5ian11tjHIYLJzIY=
-github.com/kluctl/kluctl/lib v0.0.0-20240708111940-7d9465ba9662 h1:JygTDCOld/sCf819F6n6h+9OcO3xeqAV7qd2g6O+Rz0=
-github.com/kluctl/kluctl/lib v0.0.0-20240708111940-7d9465ba9662/go.mod h1:ClZJ+/4RWjK+4tcs4KGKW66P82PW7eitWf604c++z8I=
+github.com/kluctl/go-jinja2 v0.0.0-20240708212116-03ee7eefba4f h1:DXcOryOSs9LG2xd7LlllWOL8fPA8i4OTXJzHOPtz6hA=
+github.com/kluctl/go-jinja2 v0.0.0-20240708212116-03ee7eefba4f/go.mod h1:O6CJS5+wwnQE4OorQi/fV3eGFye5ian11tjHIYLJzIY=
+github.com/kluctl/kluctl/lib v0.0.0-20240708210331-4b60c060bd56 h1:7/0N0ubA5I+JOWBKB+qGUe4tU6e9wSJ8RHK1Apir3uI=
+github.com/kluctl/kluctl/lib v0.0.0-20240708210331-4b60c060bd56/go.mod h1:ClZJ+/4RWjK+4tcs4KGKW66P82PW7eitWf604c++z8I=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=

main.go

@@ -18,6 +18,7 @@ package main
 
 import (
 	"flag"
+	"fmt"
 	"github.com/kluctl/template-controller/controllers"
 	"github.com/kluctl/template-controller/controllers/comments"
 	"os"
@@ -55,11 +56,13 @@ func init() {
 }
 
 func main() {
+	var testJinja2 bool
 	var metricsAddr string
 	var enableLeaderElection bool
 	var probeAddr string
 	var watchAllNamespaces bool
 	var concurrent int
+	flag.BoolVar(&testJinja2, "test-jinja2", false, "Perform a simple Jinja2 rendering test and exit.")
 	flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
 	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
 	flag.BoolVar(&enableLeaderElection, "leader-elect", false,
@@ -74,6 +77,21 @@ func main() {
 	opts.BindFlags(flag.CommandLine)
 	flag.Parse()
 
+	if testJinja2 {
+		j2, err := controllers.NewJinja2()
+		if err != nil {
+			_, _ = fmt.Fprintf(os.Stderr, "failed to create jinja2 renderer: %s", err.Error())
+			os.Exit(1)
+		}
+		defer j2.Close()
+		_, err = j2.RenderString(`{{ "ok" }}`)
+		if err != nil {
+			_, _ = fmt.Fprintf(os.Stderr, "failed render test string: %s", err.Error())
+			os.Exit(1)
+		}
+		return
+	}
+
 	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
 
 	watchNamespace := ""