Consolidate Images

[ibuildthecloud]

Right now acorn has four images

acorn
buildkit
registry
klipper-lb

We should consolidate everything to one image so that airgapping acorn is simple.

[meldafrawi]

Validation: PASS
Version: v0.0.0-dev+05ee1411

Use the following Acornfile:

routers: myroute: {
    routes: {
        "/auth": "auth:80"
        "/api": {
            pathType: "exact"
            targetServiceName: "api"
            targetPort: 80
        }
    }
}

containers: auth: {
    image: "nginx:latest"
    ports: "80/http"
}

containers: api: {
    image: "nginx:stable"
    ports: "80/http"
}

then: acorn run -i .

check the following k8s objects using acorn image with different commands (klipper, nginx, api-server, controller, buildkit, containerd-config-path)

[meldafrawi]

kubectl get pods -n acorn-system acorn-api-867bc8f7c4-2xflw -o jsonpath='{.spec.containers[0]}' | jq
{
"args": [
"api-server"
],
"env": [
{
"name": "ACORN_IMAGE",
"value": "ghcr.io/acorn-io/acorn:main"
}
],
"image": "ghcr.io/acorn-io/acorn:main",
"imagePullPolicy": "Always",
"name": "acorn-api",
"ports": [
{
"containerPort": 7443,
"protocol": "TCP"
}
],
"resources": {},
"securityContext": {
"runAsUser": 1000
},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"volumeMounts": [
{
"mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
"name": "kube-api-access-n4bk7",
"readOnly": true
}
]
}

[meldafrawi]

kubectl get pods -n acorn-system acorn-controller-5f76cd7d55-zc5sr -o jsonpath='{.spec}'  | jq
{
  "containers": [
    {
      "args": [
        "controller"
      ],
      "env": [
        {
          "name": "ACORN_IMAGE",
          "value": "ghcr.io/acorn-io/acorn:main"
        }
      ],
      "image": "ghcr.io/acorn-io/acorn:main",
      "imagePullPolicy": "Always",
      "name": "acorn-controller",
      "resources": {},
      "securityContext": {
        "runAsUser": 1000
      },
      "terminationMessagePath": "/dev/termination-log",
      "terminationMessagePolicy": "File",
      "volumeMounts": [
        {
          "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
          "name": "kube-api-access-b6p5w",
          "readOnly": true
        }
      ]
    }
  ],
  "dnsPolicy": "ClusterFirst",
  "enableServiceLinks": true,
  "nodeName": "nil",
  "preemptionPolicy": "PreemptLowerPriority",
  "priority": 0,
  "restartPolicy": "Always",
  "schedulerName": "default-scheduler",
  "securityContext": {},
  "serviceAccount": "acorn-system",
  "serviceAccountName": "acorn-system",
  "terminationGracePeriodSeconds": 30,
  "tolerations": [
    {
      "effect": "NoExecute",
      "key": "node.kubernetes.io/not-ready",
      "operator": "Exists",
      "tolerationSeconds": 300
    },
    {
      "effect": "NoExecute",
      "key": "node.kubernetes.io/unreachable",
      "operator": "Exists",
      "tolerationSeconds": 300
    }
  ],
  "volumes": [
    {
      "name": "kube-api-access-b6p5w",
      "projected": {
        "defaultMode": 420,
        "sources": [
          {
            "serviceAccountToken": {
              "expirationSeconds": 3607,
              "path": "token"
            }
          },
          {
            "configMap": {
              "items": [
                {
                  "key": "ca.crt",
                  "path": "ca.crt"
                }
              ],
              "name": "kube-root-ca.crt"
            }
          },
          {
            "downwardAPI": {
              "items": [
                {
                  "fieldRef": {
                    "apiVersion": "v1",
                    "fieldPath": "metadata.namespace"
                  },
                  "path": "namespace"
                }
              ]
            }
          }
        ]
      }
    }
  ]
}

[meldafrawi]

 kubectl get deployments.apps -n acorn-system divine-shadow-acorn-divine-shadow-e07f144b-cd3  -o jsonpath='{.spec}'  | jq
{
  "progressDeadlineSeconds": 600,
  "replicas": 1,
  "revisionHistoryLimit": 10,
  "selector": {
    "matchLabels": {
      "acorn.io/app-name": "divine-shadow",
      "acorn.io/app-namespace": "acorn",
      "acorn.io/managed": "true",
      "acorn.io/service-name": "divine-shadow"
    }
  },
  "strategy": {
    "rollingUpdate": {
      "maxSurge": "25%",
      "maxUnavailable": "25%"
    },
    "type": "RollingUpdate"
  },
  "template": {
    "metadata": {
      "creationTimestamp": null,
      "labels": {
        "acorn.io/app-name": "divine-shadow",
        "acorn.io/app-namespace": "acorn",
        "acorn.io/managed": "true",
        "acorn.io/service-name": "divine-shadow"
      }
    },
    "spec": {
      "automountServiceAccountToken": false,
      "containers": [
        {
          "command": [
            "/usr/local/bin/klipper-lb"
          ],
          "env": [
            {
              "name": "SRC_PORT",
              "value": "80"
            },
            {
              "name": "DEST_PROTO",
              "value": "tcp"
            },
            {
              "name": "DEST_PORT",
              "value": "80"
            },
            {
              "name": "DEST_IPS",
              "value": "10.43.249.153 10.43.249.153"
            }
          ],
          "image": "ghcr.io/acorn-io/acorn:main",
          "imagePullPolicy": "IfNotPresent",
          "name": "port-80",
          "ports": [
            {
              "containerPort": 80,
              "protocol": "TCP"
            }
          ],
          "resources": {},
          "securityContext": {
            "capabilities": {
              "add": [
                "NET_ADMIN"
              ]
            }
          },
          "terminationMessagePath": "/dev/termination-log",
          "terminationMessagePolicy": "File"
        }
      ],
      "dnsPolicy": "ClusterFirst",
      "enableServiceLinks": false,
      "restartPolicy": "Always",
      "schedulerName": "default-scheduler",
      "securityContext": {},
      "terminationGracePeriodSeconds": 30
    }
  }
}

[meldafrawi]

kubectl get pods -n divine-shadow-e07f144b-cd3  myroute-776c48d45d-q9mlt -o jsonpath='{.spec}'  | jq
{
  "containers": [
    {
      "args": [
        "nginx",
        "-g",
        "daemon off;"
      ],
      "command": [
        "/docker-entrypoint.sh"
      ],
      "image": "ghcr.io/acorn-io/acorn:main",
      "imagePullPolicy": "IfNotPresent",
      "name": "nginx",
      "ports": [
        {
          "containerPort": 8080,
          "name": "http",
          "protocol": "TCP"
        }
      ],
      "readinessProbe": {
        "failureThreshold": 3,
        "periodSeconds": 10,
        "successThreshold": 1,
        "tcpSocket": {
          "port": 8080
        },
        "timeoutSeconds": 1
      },
      "resources": {},
      "terminationMessagePath": "/dev/termination-log",
      "terminationMessagePolicy": "File",
      "volumeMounts": [
        {
          "mountPath": "/etc/nginx/conf.d/nginx.conf",
          "name": "conf",
          "readOnly": true,
          "subPath": "config"
        },
        {
          "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
          "name": "kube-api-access-fpz5l",
          "readOnly": true
        }
      ]
    }
  ],
  "dnsPolicy": "ClusterFirst",
  "enableServiceLinks": false,
  "nodeName": "nil",
  "preemptionPolicy": "PreemptLowerPriority",
  "priority": 0,
  "restartPolicy": "Always",
  "schedulerName": "default-scheduler",
  "securityContext": {},
  "serviceAccount": "acorn",
  "serviceAccountName": "acorn",
  "terminationGracePeriodSeconds": 5,
  "tolerations": [
    {
      "effect": "NoExecute",
      "key": "node.kubernetes.io/not-ready",
      "operator": "Exists",
      "tolerationSeconds": 300
    },
    {
      "effect": "NoExecute",
      "key": "node.kubernetes.io/unreachable",
      "operator": "Exists",
      "tolerationSeconds": 300
    }
  ],
  "volumes": [
    {
      "configMap": {
        "defaultMode": 420,
        "name": "myroute-3a34c871"
      },
      "name": "conf"
    },
    {
      "name": "kube-api-access-fpz5l",
      "projected": {
        "defaultMode": 420,
        "sources": [
          {
            "serviceAccountToken": {
              "expirationSeconds": 3607,
              "path": "token"
            }
          },
          {
            "configMap": {
              "items": [
                {
                  "key": "ca.crt",
                  "path": "ca.crt"
                }
              ],
              "name": "kube-root-ca.crt"
            }
          },
          {
            "downwardAPI": {
              "items": [
                {
                  "fieldRef": {
                    "apiVersion": "v1",
                    "fieldPath": "metadata.namespace"
                  },
                  "path": "namespace"
                }
              ]
            }
          }
        ]
      }
    }
  ]
}

[meldafrawi]

kubectl exec -it  -n divine-shadow-e07f144b-cd3 myroute-776c48d45d-q9mlt -- cat /etc/nginx/conf.d/nginx.conf


server {
listen 8080;
location = /auth {
  proxy_pass http://auth:80;
}
location /auth/ {
  proxy_pass http://auth:80;
}
location = /api {
  proxy_pass http://api:80;
}
}