feat: switch to alpine base image to reduce vulns

We have made the decision to publish the snyk-monitor with an Alpine base image, which has less packages and therefore less vulnerabilities.
We have recently been struck with a long case of high severity vulnerabilities in the UBI8 base image which had no fixes.

Some of our customers' pipelines break because we're publishing an image with high severity vulnerabilities. They therefore have to triage the vulns and also raise it with us to resolve.

This change affects the default Helm chart installation but overall should not have any performance impact or any problems with the product.

The Operator installation will NOT use Alpine - it will still use UBI8 because it is a requirement for running on Red Hat OpenShift and being a Certified product.

Author: ivanstanev

.circleci/config.yml

@@ -73,8 +73,8 @@ jobs:
             - run:
                 command: |
                     export IMAGE_TAG=$([[ "$CIRCLE_BRANCH" == "staging" ]] && echo "staging-candidate" || echo "discardable")
-                    OPERATOR_TAG="${IMAGE_TAG}-${CIRCLE_SHA1}"
-                    MONITOR_TAG="${IMAGE_TAG}-${CIRCLE_SHA1}"
+                    OPERATOR_TAG="${IMAGE_TAG}-ubi8-${CIRCLE_SHA1}"
+                    MONITOR_TAG="${IMAGE_TAG}-ubi8-${CIRCLE_SHA1}"
                     scripts/operator/create_operator_and_push.py "${OPERATOR_TAG}" "${MONITOR_TAG}" "${DOCKERHUB_USER}" "${DOCKERHUB_PASSWORD}"
                     echo "export OPERATOR_TAG=$OPERATOR_TAG" >> $BASH_ENV
                 name: Create Operator and push Operator image to DockerHub
@@ -86,16 +86,16 @@ jobs:
             - run:
                 command: |
                     export IMAGE_TAG=$([[ "$CIRCLE_BRANCH" == "staging" ]] && echo "staging-candidate" || echo "discardable")
-                    export SNYK_MONITOR_IMAGE_TAG="${IMAGE_TAG}-${CIRCLE_SHA1}"
-                    export SNYK_OPERATOR_VERSION="0.0.1-${CIRCLE_SHA1}"
+                    export SNYK_MONITOR_IMAGE_TAG="${IMAGE_TAG}-ubi8-${CIRCLE_SHA1}"
+                    export SNYK_OPERATOR_VERSION="0.0.1-ubi8-${CIRCLE_SHA1}"
                     export SNYK_OPERATOR_IMAGE_TAG="${SNYK_MONITOR_IMAGE_TAG}"
                     OPERATOR_PATH=$(scripts/operator/package_operator_bundle.py "${SNYK_OPERATOR_VERSION}" "${SNYK_OPERATOR_IMAGE_TAG}" "${SNYK_MONITOR_IMAGE_TAG}")
                     echo "export OPERATOR_PATH=$OPERATOR_PATH" >> $BASH_ENV
                 name: Package Operator Bundle
             - run:
                 command: |
                     export OPERATOR_DIR=$OPERATOR_PATH
-                    export PACKAGE_VERSION="0.0.1-${CIRCLE_SHA1}"
+                    export PACKAGE_VERSION="0.0.1-ubi8-${CIRCLE_SHA1}"
                     scripts/operator/create_operator_bundle_and_index_and_push.py "${OPERATOR_DIR}" "${PACKAGE_VERSION}" "${DOCKERHUB_USER}" "${DOCKERHUB_PASSWORD}"
                 name: Create Operator Bundle and Index and push to Docker Hub
             - run:
@@ -106,29 +106,40 @@ jobs:
         working_directory: ~/kubernetes-monitor
     build_image:
         machine:
-            image: ubuntu-2004:202111-01
+            image: ubuntu-2004:202111-02
         steps:
             - checkout
             - install_python_requests
             - run:
                 command: |
                     IMAGE_TAG=$([[ "$CIRCLE_BRANCH" == "staging" ]] && echo "staging-candidate" || echo "discardable")
                     IMAGE_NAME_CANDIDATE=snyk/kubernetes-monitor:${IMAGE_TAG}-${CIRCLE_SHA1}
+                    IMAGE_NAME_CANDIDATE_UBI8=snyk/kubernetes-monitor:${IMAGE_TAG}-ubi8-${CIRCLE_SHA1}
                     echo "export IMAGE_NAME_CANDIDATE=$IMAGE_NAME_CANDIDATE" >> $BASH_ENV
+                    echo "export IMAGE_NAME_CANDIDATE_UBI8=$IMAGE_NAME_CANDIDATE_UBI8" >> $BASH_ENV
                 name: Export environment variables
             - run:
                 command: |
                     docker login --username ${DOCKERHUB_USER} --password ${DOCKERHUB_PASSWORD}
                     ./scripts/docker/build-image.sh ${IMAGE_NAME_CANDIDATE}
+                    ./scripts/docker/build-image-ubi8.sh ${IMAGE_NAME_CANDIDATE_UBI8}
                 name: Build image
             - snyk/scan:
+                additional-arguments: --project-name=alpine
                 docker-image-name: ${IMAGE_NAME_CANDIDATE}
                 monitor-on-build: false
                 severity-threshold: high
                 target-file: Dockerfile
+            - snyk/scan:
+                additional-arguments: --project-name=ubi8
+                docker-image-name: ${IMAGE_NAME_CANDIDATE_UBI8}
+                monitor-on-build: false
+                severity-threshold: high
+                target-file: Dockerfile.ubi8
             - run:
                 command: |
                     docker push ${IMAGE_NAME_CANDIDATE}
+                    docker push ${IMAGE_NAME_CANDIDATE_UBI8}
                 name: Push image
             - run:
                 command: |
@@ -330,7 +341,8 @@ jobs:
                 name: Create temporary directory for logs
             - run:
                 command: |
-                    export OPERATOR_VERSION="0.0.1-${CIRCLE_SHA1}"
+                    export OPERATOR_VERSION="0.0.1-ubi8-${CIRCLE_SHA1}"
+                    export IMAGE_TAG_UBI_SUFFIX="-ubi8"
                     export KUBERNETES_MONITOR_IMAGE_NAME_AND_TAG=$(./scripts/circleci-jobs/setup-integration-tests.py)
                     .circleci/do-exclusively --branch staging --job ${CIRCLE_JOB} npm run test:integration:kindolm:operator
                 name: Operator integration tests on vanilla Kubernetes
@@ -387,7 +399,7 @@ jobs:
     openshift3_integration_tests:
         machine:
             docker_layer_caching: true
-            image: ubuntu-2004:202111-01
+            image: ubuntu-2004:202111-02
         steps:
             - checkout
             - setup_node16
@@ -397,6 +409,7 @@ jobs:
                 name: Create temporary directory for logs
             - run:
                 command: |
+                    export IMAGE_TAG_UBI_SUFFIX="-ubi8"
                     export KUBERNETES_MONITOR_IMAGE_NAME_AND_TAG=$(./scripts/circleci-jobs/setup-integration-tests.py)
                     npm run test:integration:openshift3:yaml
                 name: Integration tests OpenShift 3
@@ -410,7 +423,7 @@ jobs:
     openshift4_integration_tests:
         machine:
             docker_layer_caching: true
-            image: ubuntu-2004:202111-01
+            image: ubuntu-2004:202111-02
         steps:
             - checkout
             - setup_node16
@@ -420,7 +433,8 @@ jobs:
                 name: create temp dir for logs
             - run:
                 command: |
-                    export OPERATOR_VERSION="0.0.1-${CIRCLE_SHA1}"
+                    export OPERATOR_VERSION="0.0.1-ubi8-${CIRCLE_SHA1}"
+                    export IMAGE_TAG_UBI_SUFFIX="-ubi8"
                     export KUBERNETES_MONITOR_IMAGE_NAME_AND_TAG=$(./scripts/circleci-jobs/setup-integration-tests.py)
                     .circleci/do-exclusively --branch staging --job ${CIRCLE_JOB} npm run test:integration:openshift4:operator
                 name: Integration tests OpenShift 4
@@ -673,25 +687,40 @@ jobs:
                     LATEST_TAG=${LATEST_TAG_WITH_V:1}
                     IMAGE_NAME_APPROVED=snyk/kubernetes-monitor:${LATEST_TAG}-approved
                     IMAGE_NAME_PUBLISHED=snyk/kubernetes-monitor:${LATEST_TAG}
+                    IMAGE_NAME_APPROVED_UBI8=snyk/kubernetes-monitor:${LATEST_TAG}-ubi8-approved
+                    IMAGE_NAME_PUBLISHED_UBI8=snyk/kubernetes-monitor:${LATEST_TAG}-ubi8
                     echo "export LATEST_TAG=${LATEST_TAG}" >> $BASH_ENV
                     echo "export IMAGE_NAME_APPROVED=${IMAGE_NAME_APPROVED}" >> $BASH_ENV
                     echo "export IMAGE_NAME_PUBLISHED=${IMAGE_NAME_PUBLISHED}" >> $BASH_ENV
+                    echo "export IMAGE_NAME_APPROVED_UBI8=${IMAGE_NAME_APPROVED_UBI8}" >> $BASH_ENV
+                    echo "export IMAGE_NAME_PUBLISHED_UBI8=${IMAGE_NAME_PUBLISHED_UBI8}" >> $BASH_ENV
                 name: Export environment variables
             - snyk/scan:
                 monitor-on-build: true
                 severity-threshold: high
             - snyk/scan:
+                additional-arguments: --project-name=alpine
                 docker-image-name: ${IMAGE_NAME_APPROVED}
                 monitor-on-build: true
                 severity-threshold: high
                 target-file: Dockerfile
+            - snyk/scan:
+                additional-arguments: --project-name=ubi8
+                docker-image-name: ${IMAGE_NAME_APPROVED_UBI8}
+                monitor-on-build: true
+                severity-threshold: high
+                target-file: Dockerfile.ubi8
             - run:
                 command: |
                     docker login --username ${DOCKERHUB_USER} --password ${DOCKERHUB_PASSWORD} &&
                     docker pull ${IMAGE_NAME_APPROVED} &&
                     docker tag ${IMAGE_NAME_APPROVED} ${IMAGE_NAME_PUBLISHED} &&
                     docker push ${IMAGE_NAME_PUBLISHED} &&
+                    docker pull ${IMAGE_NAME_APPROVED_UBI8} &&
+                    docker tag ${IMAGE_NAME_APPROVED_UBI8} ${IMAGE_NAME_PUBLISHED_UBI8} &&
+                    docker push ${IMAGE_NAME_PUBLISHED_UBI8} &&
                     ./scripts/slack/notify_push.py ${IMAGE_NAME_PUBLISHED} &&
+                    ./scripts/slack/notify_push.py ${IMAGE_NAME_PUBLISHED_UBI8} &&
                     ./scripts/publish-gh-pages.sh ${LATEST_TAG}
                 name: Publish
             - run:
@@ -705,7 +734,7 @@ jobs:
             - run:
                 command: |
                     export OPERATOR_TAG="${LATEST_TAG}"
-                    export MONITOR_TAG="${LATEST_TAG}"
+                    export MONITOR_TAG="${LATEST_TAG}-ubi8"
                     python3 scripts/operator/create_operator_and_push.py "${OPERATOR_TAG}" "${MONITOR_TAG}" "${DOCKERHUB_USER}" "${DOCKERHUB_PASSWORD}"
                     echo "export OPERATOR_TAG=${OPERATOR_TAG}" >> $BASH_ENV
                 name: Create Operator and push Operator image to DockerHub

.circleci/config/jobs/@jobs.yml

@@ -1,86 +1,3 @@
-build_image:
-  machine:
-    image: ubuntu-2004:202111-01
-  working_directory: ~/kubernetes-monitor
-  steps:
-    - checkout
-    - install_python_requests
-    - run:
-        name: Export environment variables
-        command: |
-          IMAGE_TAG=$([[ "$CIRCLE_BRANCH" == "staging" ]] && echo "staging-candidate" || echo "discardable")
-          IMAGE_NAME_CANDIDATE=snyk/kubernetes-monitor:${IMAGE_TAG}-${CIRCLE_SHA1}
-          echo "export IMAGE_NAME_CANDIDATE=$IMAGE_NAME_CANDIDATE" >> $BASH_ENV
-    - run:
-        name: Build image
-        command: |
-          docker login --username ${DOCKERHUB_USER} --password ${DOCKERHUB_PASSWORD}
-          ./scripts/docker/build-image.sh ${IMAGE_NAME_CANDIDATE}
-    - snyk/scan:
-        docker-image-name: ${IMAGE_NAME_CANDIDATE}
-        severity-threshold: high
-        target-file: Dockerfile
-        monitor-on-build: false
-    - run:
-        name: Push image
-        command: |
-          docker push ${IMAGE_NAME_CANDIDATE}
-    - run:
-        name: Notify Slack on failure
-        command: |
-          ./scripts/slack/notify_failure_on_branch.py "${CIRCLE_BRANCH}" "${CIRCLE_JOB}" "${CIRCLE_BUILD_URL}" "${CIRCLE_PULL_REQUEST}" "${SLACK_WEBHOOK}"
-        when: on_fail
-
-build_and_upload_operator:
-  docker:
-    - image: cimg/python:3.10
-      auth:
-        username: $DOCKERHUB_USER
-        password: $DOCKERHUB_PASSWORD
-  working_directory: ~/kubernetes-monitor
-  steps:
-    - checkout
-    - setup_remote_docker
-    - install_python_requests
-    - run:
-        name: Download Operator SDK and Operator Package Manager
-        command: |
-          scripts/operator/download_operator_sdk.py
-          scripts/operator/download_operator_package_manager.py
-    - run:
-        name: Create Operator and push Operator image to DockerHub
-        command: |
-          export IMAGE_TAG=$([[ "$CIRCLE_BRANCH" == "staging" ]] && echo "staging-candidate" || echo "discardable")
-          OPERATOR_TAG="${IMAGE_TAG}-${CIRCLE_SHA1}"
-          MONITOR_TAG="${IMAGE_TAG}-${CIRCLE_SHA1}"
-          scripts/operator/create_operator_and_push.py "${OPERATOR_TAG}" "${MONITOR_TAG}" "${DOCKERHUB_USER}" "${DOCKERHUB_PASSWORD}"
-          echo "export OPERATOR_TAG=$OPERATOR_TAG" >> $BASH_ENV
-    - snyk/scan:
-        docker-image-name: snyk/kubernetes-operator:${OPERATOR_TAG}
-        severity-threshold: high
-        target-file: snyk-operator/build/Dockerfile
-        monitor-on-build: false
-    - run:
-        name: Package Operator Bundle
-        command: |
-          export IMAGE_TAG=$([[ "$CIRCLE_BRANCH" == "staging" ]] && echo "staging-candidate" || echo "discardable")
-          export SNYK_MONITOR_IMAGE_TAG="${IMAGE_TAG}-${CIRCLE_SHA1}"
-          export SNYK_OPERATOR_VERSION="0.0.1-${CIRCLE_SHA1}"
-          export SNYK_OPERATOR_IMAGE_TAG="${SNYK_MONITOR_IMAGE_TAG}"
-          OPERATOR_PATH=$(scripts/operator/package_operator_bundle.py "${SNYK_OPERATOR_VERSION}" "${SNYK_OPERATOR_IMAGE_TAG}" "${SNYK_MONITOR_IMAGE_TAG}")
-          echo "export OPERATOR_PATH=$OPERATOR_PATH" >> $BASH_ENV
-    - run:
-        name: Create Operator Bundle and Index and push to Docker Hub
-        command: |
-          export OPERATOR_DIR=$OPERATOR_PATH
-          export PACKAGE_VERSION="0.0.1-${CIRCLE_SHA1}"
-          scripts/operator/create_operator_bundle_and_index_and_push.py "${OPERATOR_DIR}" "${PACKAGE_VERSION}" "${DOCKERHUB_USER}" "${DOCKERHUB_PASSWORD}"
-    - run:
-        name: Notify Slack on failure
-        command: |
-          ./scripts/slack/notify_failure_on_branch.py "${CIRCLE_BRANCH}" "${CIRCLE_JOB}" "${CIRCLE_BUILD_URL}" "${CIRCLE_PULL_REQUEST}" "${SLACK_WEBHOOK}"
-        when: on_fail
-
 lint:
   machine:
     docker_layer_caching: true
@@ -301,56 +218,6 @@ aks_integration_tests:
     - store_artifacts:
         path: /tmp/logs/test/integration/aks
 
-openshift3_integration_tests:
-  machine:
-    image: ubuntu-2004:202111-01
-    docker_layer_caching: true
-  working_directory: ~/kubernetes-monitor
-  steps:
-    - checkout
-    - setup_node16
-    - install_python_requests
-    - run:
-        name: Create temporary directory for logs
-        command: mkdir -p /tmp/logs/test/integration/openshift3
-    - run:
-        name: Integration tests OpenShift 3
-        command: |
-          export KUBERNETES_MONITOR_IMAGE_NAME_AND_TAG=$(./scripts/circleci-jobs/setup-integration-tests.py)
-          npm run test:integration:openshift3:yaml
-    - run:
-        name: Notify Slack on failure
-        command: ./scripts/slack/notify_failure.py "${CIRCLE_BRANCH}" "${CIRCLE_JOB}" "${CIRCLE_BUILD_URL}" "${CIRCLE_PULL_REQUEST}" "${SLACK_WEBHOOK}"
-        when: on_fail
-    - store_artifacts:
-        path: /tmp/logs/test/integration/openshift3
-
-openshift4_integration_tests:
-  machine:
-    image: ubuntu-2004:202111-01
-    docker_layer_caching: true
-  working_directory: ~/kubernetes-monitor
-  steps:
-    - checkout
-    - setup_node16
-    - install_python_requests
-    - run:
-        name: create temp dir for logs
-        command: mkdir -p /tmp/logs/test/integration/openshift4
-    - run:
-        name: Integration tests OpenShift 4
-        command: |
-          export OPERATOR_VERSION="0.0.1-${CIRCLE_SHA1}"
-          export KUBERNETES_MONITOR_IMAGE_NAME_AND_TAG=$(./scripts/circleci-jobs/setup-integration-tests.py)
-          .circleci/do-exclusively --branch staging --job ${CIRCLE_JOB} npm run test:integration:openshift4:operator
-    - run:
-        name: Notify Slack on failure
-        command: |
-          ./scripts/slack/notify_failure_on_branch.py "${CIRCLE_BRANCH}" "${CIRCLE_JOB}" "${CIRCLE_BUILD_URL}" "${CIRCLE_PULL_REQUEST}" "${SLACK_WEBHOOK}"
-        when: on_fail
-    - store_artifacts:
-        path: /tmp/logs/test/integration/openshift4
-
 ######################## MERGE TO STAGING ########################
 tag_and_push:
   docker:
@@ -400,9 +267,13 @@ publish:
           LATEST_TAG=${LATEST_TAG_WITH_V:1}
           IMAGE_NAME_APPROVED=snyk/kubernetes-monitor:${LATEST_TAG}-approved
           IMAGE_NAME_PUBLISHED=snyk/kubernetes-monitor:${LATEST_TAG}
+          IMAGE_NAME_APPROVED_UBI8=snyk/kubernetes-monitor:${LATEST_TAG}-ubi8-approved
+          IMAGE_NAME_PUBLISHED_UBI8=snyk/kubernetes-monitor:${LATEST_TAG}-ubi8
           echo "export LATEST_TAG=${LATEST_TAG}" >> $BASH_ENV
           echo "export IMAGE_NAME_APPROVED=${IMAGE_NAME_APPROVED}" >> $BASH_ENV
           echo "export IMAGE_NAME_PUBLISHED=${IMAGE_NAME_PUBLISHED}" >> $BASH_ENV
+          echo "export IMAGE_NAME_APPROVED_UBI8=${IMAGE_NAME_APPROVED_UBI8}" >> $BASH_ENV
+          echo "export IMAGE_NAME_PUBLISHED_UBI8=${IMAGE_NAME_PUBLISHED_UBI8}" >> $BASH_ENV
     - snyk/scan:
         severity-threshold: high
         monitor-on-build: true
@@ -411,14 +282,25 @@ publish:
         severity-threshold: high
         target-file: Dockerfile
         monitor-on-build: true
+        additional-arguments: --project-name=alpine
+    - snyk/scan:
+        docker-image-name: ${IMAGE_NAME_APPROVED_UBI8}
+        severity-threshold: high
+        target-file: Dockerfile.ubi8
+        monitor-on-build: true
+        additional-arguments: --project-name=ubi8
     - run:
         name: Publish
         command: |
           docker login --username ${DOCKERHUB_USER} --password ${DOCKERHUB_PASSWORD} &&
           docker pull ${IMAGE_NAME_APPROVED} &&
           docker tag ${IMAGE_NAME_APPROVED} ${IMAGE_NAME_PUBLISHED} &&
           docker push ${IMAGE_NAME_PUBLISHED} &&
+          docker pull ${IMAGE_NAME_APPROVED_UBI8} &&
+          docker tag ${IMAGE_NAME_APPROVED_UBI8} ${IMAGE_NAME_PUBLISHED_UBI8} &&
+          docker push ${IMAGE_NAME_PUBLISHED_UBI8} &&
           ./scripts/slack/notify_push.py ${IMAGE_NAME_PUBLISHED} &&
+          ./scripts/slack/notify_push.py ${IMAGE_NAME_PUBLISHED_UBI8} &&
           ./scripts/publish-gh-pages.sh ${LATEST_TAG}
     - run:
         name: Download operator-sdk
@@ -432,7 +314,7 @@ publish:
         name: Create Operator and push Operator image to DockerHub
         command: |
           export OPERATOR_TAG="${LATEST_TAG}"
-          export MONITOR_TAG="${LATEST_TAG}"
+          export MONITOR_TAG="${LATEST_TAG}-ubi8"
           python3 scripts/operator/create_operator_and_push.py "${OPERATOR_TAG}" "${MONITOR_TAG}" "${DOCKERHUB_USER}" "${DOCKERHUB_PASSWORD}"
           echo "export OPERATOR_TAG=${OPERATOR_TAG}" >> $BASH_ENV
     - snyk/scan: