cleanup(vpa): remove go vendoring

[davidspek]

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

This PR removes the vendor directories for the VPA. Vendoring the dependencies into the repo not only increases the size, but also makes reviewing PRs that include dependency changes more difficult. Sometimes to the point of breaking the GitHub UI like in #7551 and likely this PR. The relevant Dockerfiles have been updated to function without the vendor directory and maximize layer caching. Along with that, the final image was change to gcr.io/distroless/static:nonroot so the containers don't run as root used by default.

Which issue(s) this PR fixes:

Fixes #7570

Special notes for your reviewer:

The hack/update-codegen.sh script will need to be modified. However, doing so with the current version and this change is quite difficult. So I would like to postpone this to the PR that updates the k8s dependencies.

Does this PR introduce a user-facing change?

NONE

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[k8s-ci-robot]

Hi @davidspek. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[adrianmoisey]

/ok-to-test

[davidspek]

/assign raywainman

[adrianmoisey]

/lgtm

e2e tests still pass locally 👍

[raywainman]

Could we replace all these copy statements with just one?

COPY . .

Similar to https://github.com/GoogleContainerTools/distroless?tab=readme-ov-file#examples-with-docker?

[davidspek]

The reason for these separate copy statements is to maximize layer caching. First copying the go.mod and go.sum and then downloading the dependencies before before copying any application code allows the layer containing all the dependencies to be cached during a container build. This can make a big difference for build times, especially when doing development. For this same reason the Go code is being explicitly copied into the container instead of a more global copy so that changes to other files (or the addition of new ones) that aren't part of the codebase don't trigger a new image build. Technically this could also be done with a .dockerignore file, but then any new files or directories would need to be added there, and in my opinion having it copied in the Dockerfile explicitly also helps for clarity. This is also the standard way Dockerfiles are created for projects using kubebuilder and I believe can be seen as best practice.

[adrianmoisey]

What about:

COPY go.mod go.sum .

And later:

COPY common pkg .

[davidspek]

That should also work, although technically a little less good for layer caching.

[adrianmoisey]

Since both operations are a copy, I don't think there will be a noticeable different to the user if one those layers had to be re executed

[davidspek]

@raywainman What's your view on this? I'd like to get this sorted so it can be merged and we can move forward with the dependency upgrade PR.

[raywainman]

Layer caching seems like a reasonable reason to do this. LGTM.

[adrianmoisey]

I'm going to /lgtm
I don't have strong opinions about the Dockerfile COPY

[raywainman]

/lgtm

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: davidspek, raywainman

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• vertical-pod-autoscaler/OWNERS [raywainman]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment