fix: Add libsasl2-modules-gssapi-mit to Dockerfile #10308
Conversation
ryanhall07
force-pushed
the
rhall-gssapi-distroless
branch
from
28a19ec to
b14b665
Compare
ryanhall07
requested review from
niedbalski,
patrick-stephens and
celalettin1286
as code owners
|
@ryanhall07 Before I can merge. Please follow the contribution guidelines https://github.com/fluent/fluent-bit/blob/master/CONTRIBUTING.md#commit-changes for the commit message. Use dockerfile: xxx. |
|
We should really update the sanity tests as well to start verifying these runtime dependencies ideally too. |
|
Does this resolve #10240? Are there any others we should add now? |
dockerfiles/Dockerfile
Outdated
| @@ -132,6 +132,7 @@ RUN echo "deb http://deb.debian.org/debian bookworm-backports main" >> /etc/apt/ | |||
| libpsl5 \ | |||
| libbrotli1 \ | |||
| libsasl2-2 \ | |||
| libsasl2-modules-gssapi-mit \ | |||
There was a problem hiding this comment.
I presume this requires no additional build time dependencies?
|
to get this merged we need the change mentioned in #10308 (comment) |
stoksc
force-pushed
the
rhall-gssapi-distroless
branch
from
b14b665 to
3805046
Compare
|
@edsiper @niedbalski I've updated the commit to match expectations. |
|
I would like to really see some tests to be honest around preventing regressions, whacking in random libraries without them makes it hard to later know/verify why those libraries are present. Can we add a build time check potentially in cmake to test for presence or some other simple dry-run approach that will verify loading the library to ensure it is present? e.g. a config like #10240 (comment) can be used to exercise at least the library loading. |
stoksc
force-pushed
the
rhall-gssapi-distroless
branch
from
3805046 to
e2efeed
Compare
|
@patrick-stephens I will try to add a simple test. FWIW, I have a true end to end test for this that runs Kafka and Kerberos that works, but it is complicated. Give me a moment to digest some stuff and clean this up and I'll ping back for review. It isn't ready yet, sorry. |
|
A question though, why is there so much divergence between production and debug's packages? |
libsasl2-modules-gssapi-mit is needed by librdkafka to use the following configurations for authentication with Kafka: ``` rdkafka.security.protocol SASL_SSL rdkafka.sasl.mechanism GSSAPI ``` krb5-user is needed by librdkafka to invoke `kinit` to obtains ticket-granting tickets These changes _cannot_ be added to the production image target because librdkafka uses the `system` call to invoke `kinit`, the distroless base does not have a shell, and we are not going to add it. Signed-off-by: Ryan Hall <[email protected]> Signed-off-by: Bradley Laney <[email protected]>
stoksc
force-pushed
the
rhall-gssapi-distroless
branch
from
e2efeed to
13df210
Compare
|
I had to unwind the changes to the |
Debug needs a lot of things to help you debug things, production should only have what is required to run. In addition, "just" adding a shell and package managers requires another entire stack of dependencies - one of the reasons for distroless. |
This shared library is needed for users of the kafka plugin + kerberos+gssapi.
Without they get the error
Fixes #10240
Enter
[N/A]in the box, if an item is not applicable to your change.Testing
Before we can approve your change; please submit the following in a comment:
If this is a change to packaging of containers or native binaries then please confirm it works for all targets.
ok-package-testlabel to test for all targets (requires maintainer to do).Documentation
Backporting
Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.