add distroless otel init (#10035)

add distroless otel init

charts/ingress-nginx/templates/_helpers.tpl

@@ -201,8 +201,12 @@ Extra modules.
 
 - name: {{ .name }}
   image: {{ .image }}
+  {{- if .distroless | default false }}
+  command: ['/init_module']
+  {{- else }}
   command: ['sh', '-c', '/usr/local/bin/init_module.sh']
-  {{- if (.containerSecurityContext) }}
+  {{- end }}
+  {{- if .containerSecurityContext }}
   securityContext: {{ .containerSecurityContext | toYaml | nindent 4 }}
   {{- end }}
   volumeMounts:

charts/ingress-nginx/templates/controller-deployment.yaml

@@ -190,7 +190,7 @@ spec:
       {{- end }}
       {{- if .Values.controller.opentelemetry.enabled}}
           {{ $otelContainerSecurityContext := $.Values.controller.opentelemetry.containerSecurityContext | default $.Values.controller.containerSecurityContext }}
-          {{- include "extraModules" (dict "name" "opentelemetry" "image" .Values.controller.opentelemetry.image "containerSecurityContext" $otelContainerSecurityContext) | nindent 8}}
+          {{- include "extraModules" (dict "name" "opentelemetry" "image" .Values.controller.opentelemetry.image "containerSecurityContext" $otelContainerSecurityContext "distroless" false) | nindent 8}}
       {{- end}}
     {{- end }}
     {{- if .Values.controller.hostNetwork }}

images/opentelemetry/rootfs/Dockerfile

@@ -21,9 +21,11 @@ COPY . /opt/third_party/
 # install build tools
 RUN apk update \
 	&& apk upgrade \
-	&& apk add -U bash cmake \
+	&& apk add -U bash cmake ninja \
 	&& bash /opt/third_party/build.sh -p
 
+ENV NINJA_STATUS "[%p/%f/%t]"
+
 # install gRPC
 FROM base as grpc
 RUN bash /opt/third_party/build.sh -g v1.49.2
@@ -39,7 +41,17 @@ COPY --from=grpc /opt/third_party/install/ /usr
 COPY --from=otel-cpp /opt/third_party/install/ /usr
 RUN bash /opt/third_party/build.sh -n
 
-FROM alpine:3.18.0 as final
-COPY --from=base /opt/third_party/init_module.sh /usr/local/bin/init_module.sh
+FROM cgr.dev/chainguard/go:latest as build-init
+
+WORKDIR /go/src/app
+COPY . .
+
+RUN go mod download
+RUN CGO_ENABLED=0 go build -o /go/bin/init_module
+
+FROM cgr.dev/chainguard/static as final
+COPY --from=build-init /go/bin/init_module /
 COPY --from=nginx /etc/nginx/modules /etc/nginx/modules
 COPY --from=nginx /opt/third_party/install/lib /etc/nginx/modules
+
+CMD ["/init_module"]

images/opentelemetry/rootfs/build.sh

@@ -70,6 +70,7 @@ install_grpc()
   mkdir -p $BUILD_PATH/grpc
   cd ${BUILD_PATH}/grpc
   cmake -DCMAKE_INSTALL_PREFIX=${INSTAL_DIR} \
+    -G Ninja \
     -DGRPC_GIT_TAG=${GRPC_GIT_TAG} /opt/third_party \
     -DgRPC_BUILD_GRPC_NODE_PLUGIN=OFF \
     -DgRPC_BUILD_GRPC_OBJECTIVE_C_PLUGIN=OFF \
@@ -92,6 +93,7 @@ install_otel()
   cd .build
 
   cmake -DCMAKE_BUILD_TYPE=Release \
+        -G Ninja \
         -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE  \
         -DWITH_ZIPKIN=OFF \
         -DWITH_JAEGER=OFF \
@@ -143,6 +145,7 @@ install_nginx()
   mkdir -p build
   cd build
   cmake -DCMAKE_BUILD_TYPE=Release \
+    -G Ninja \
     -DCMAKE_INSTALL_PREFIX=${INSTAL_DIR} \
     -DBUILD_SHARED_LIBS=ON \
     -DNGINX_VERSION=${NGINX_VERSION} \

images/opentelemetry/rootfs/go.mod

@@ -0,0 +1,3 @@
+module init-otel
+
+go 1.20

images/opentelemetry/rootfs/init_module.go

@@ -0,0 +1,104 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+)
+
+func main() {
+	// Enable error handling for all operations
+	err := run()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func run() error {
+	// Create the target directory if it doesn't exist
+	targetDir := "/modules_mount/etc/nginx/modules/otel"
+	err := os.MkdirAll(targetDir, os.ModePerm)
+	if err != nil {
+		return fmt.Errorf("failed to create target directory: %w", err)
+	}
+
+	// Copy files from source directory to target directory
+	sourceDir := "/etc/nginx/modules/"
+	err = filepath.Walk(sourceDir, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		// Skip directories
+		if info.IsDir() {
+			return nil
+		}
+
+		// Calculate the destination path
+		relPath, err := filepath.Rel(sourceDir, path)
+		if err != nil {
+			return err
+		}
+		destPath := filepath.Join(targetDir, relPath)
+
+		// Create the destination directory if it doesn't exist
+		destDir := filepath.Dir(destPath)
+		err = os.MkdirAll(destDir, os.ModePerm)
+		if err != nil {
+			return err
+		}
+
+		// Copy the file
+		err = copyFile(path, destPath)
+		if err != nil {
+			return err
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return fmt.Errorf("failed to copy files: %w", err)
+	}
+
+	return nil
+}
+
+func copyFile(sourcePath, destPath string) error {
+	sourceFile, err := os.Open(sourcePath)
+	if err != nil {
+		return err
+	}
+	defer sourceFile.Close()
+
+	destFile, err := os.Create(destPath)
+	if err != nil {
+		return err
+	}
+	defer destFile.Close()
+
+	_, err = io.Copy(destFile, sourceFile)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

images/opentelemetry/rootfs/init_module.sh

@@ -1,22 +0,0 @@
-#!/bin/sh
-
-# Copyright 2021 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-mkdir -p /modules_mount/etc/nginx/modules/otel
-cp -R /etc/nginx/modules/* /modules_mount/etc/nginx/modules/otel