Rebase container images from alpine to debian-base.

[yuwenma]

Updated containers:kube-dns, sidecar
Context:KEP: Rebase k8s images to distroless
Test:

1. make images can create the following images
   staging-k8s.gcr.io/k8s-dns-sidecar-amd64
   staging-k8s.gcr.io/k8s-dns-node-cache-amd64
   staging-k8s.gcr.io/k8s-dns-kube-dns-amd64
   staging-k8s.gcr.io/k8s-dns-dnsmasq-nanny-amd64
   staging-k8s.gcr.io/k8s-dns-dnsmasq-amd64

2. docker run -e <with required flags like service host/port> <Kube-DNS-IMAGE-ID>
   can successfully upstart a container.

[k8s-ci-robot]

Hi @yuwenma. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[yuwenma]

/assign bowei
/assign prameshj

[yuwenma]

/assign @rramkumar1

[rramkumar1]

/ok-to-test

[yuwenma]

Gentle ping. Can I get a review on this?

[yuwenma]

/unassign rramkumar1

/assign pavithrar
/assign zihongz

[k8s-ci-robot]

@yuwenma: GitHub didn't allow me to assign the following users: pavithrar, zihongz.

Note that only kubernetes members and repo collaborators can be assigned and that issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

In response to this:

/unassign rramkumar1

/assign pavithrar
/assign zihongz

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[yuwenma]

/assign @MrHohn
/assign @prameshj

[prameshj]

When switching to distroless, will we lose a shell on kube-dns containers?

[yuwenma]

When switching to distroless, will we lose a shell on kube-dns containers?

yes, we will.

[MrHohn]

Tried building the new images and bring up a cluster with @prameshj, it seems like the sidecar is having issue coming up:

  Warning  Failed     2m (x4 over 3m)  kubelet, e2e-test-zihongz-minion-group-rq2k  Error: failed to start container "sidecar": Error response from daemon: linux spec user: unable to find user nobody: no matching entries in passwd file

[yuwenma]

no matching entries in passwd file

@zihong, do you have any insights what this error may come from? I don't know what the nobody USER does, but it seems to be specified in the sidecar Dockerfile

[MrHohn]

@yuwenma I was under the impression that nobody was used just to make sure that container uses a user account that is in no privileged groups. Maybe that will not be a concern with distroless?

[prameshj]

no matching entries in passwd file

@zihong, do you have any insights what this error may come from? I don't know what the nobody USER does, but it seems to be specified in the sidecar Dockerfile

The image works fine if the user is removed from the sidecar Dockerfile.

[yuwenma]

According to the offline discussion, dns is currently rebased to kube custom debian-base instead of distroless for debugging convenience.

[prameshj]

@yuwenma would you mind modifying Dockerfile.node-cache line 15 with the same debian image as well? We need to pick up fixes to CVEs, i was trying to see if we can change all base images in this same PR.

[yuwenma]

@yuwenma would you mind modifying Dockerfile.node-cache line 15 with the same debian image as well? We need to pick up fixes to CVEs, i was trying to see if we can change all base images in this same PR.

Done 😃

[prameshj]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: prameshj, yuwenma

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [prameshj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment