build: add Dockerfile for controller, build with bottlerocket-sdk

[etungsten]

Note: Depends on #84

Issue number:
Closes #11

Description of changes:

commit cab144a3efc5675b75ea33c482a9f6798ff857fa
Author: Erikson Tung <etung@amazon.com>
Date:   Mon Aug 23 15:22:47 2021 -0700

    dependency: use default kube-rs features, disable rustls

Author: Erikson Tung <etung@amazon.com>
Date:   Thu Aug 19 13:54:29 2021 -0700

    build: add Dockerfile for controller, build with bottlerocket-sdk
    
    Build the binaries with the bottlerocket-sdk.
    
    Dockerfile: install openssl with musl for controller, test-agent

Testing done:
Able to build the example-test-agent and the controller and run the binaries with their respective container images.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[webern]

We might needs something like this to make TLS implementations (whether OpenSSL or Rustls) happy https://github.com/bottlerocket-os/bottlerocket-ecs-updater/blob/develop/Dockerfile#L34..L35

Obviously merge #84 first, but this looks fine. Thanks!

[etungsten]

Push above adds the CA certificates store to the container images.

[jpculp]

This seems fine to me after #84 is merged.

[etungsten]

Push above rebases onto develop.

[etungsten]

Push above changes a few things:

• Remove the rustls feature. rustls cannot reach a cluster through ip kube-rs/kube#153 is a hard blocker for us
• Switched to default features and thus need to build openssl with musl toolchain for the openssl-sys crate that kube-rs depends on.

Also removed redundant WORKDIR as pointed out by @arnaldo2792

[webern]

I think we should build an image tagged e.g. bottlerocket-sdk-with-openssl and then use it in both FROM lines. This deduplicates the code. I don't think we need to push the tagged image anywhere, but the makefile can ensure that other docker builds depend on it so we know it will be built and available locally.

[webern]

depend on it so we know it will be built and available locally.

We might also see if Ben thinks the use case seems likely enough to warrant including musl openssl-devl in the SDK itself, which would be ideal.

[etungsten]

Push above separates out the openssl musl build into a separate Dockerfile that creates an augmented bottlerocket-sdk with openssl built with the musl toolchain that we use for building the other container images.

[etungsten]

Push above changes some Makefile target names as recommended by @webern

[etungsten]

Push above relocates the OPENSSL_* env vars to the sdk-openssl image. Also some minor changes to names.
Push below changes test-sys to testsys and removes --network=host for docker builds.

Images still build fine.

[webern]

🍰

[arnaldo2792]

A few nits, but approved 👍

[arnaldo2792]

Nit: Shouldn't ENVs be closer to ARGs?

[etungsten]

I don't think it's absolutely necessary since it's not used for building openssl. These are environment variables we should set after we're able to successfully build openssl with musl. It's intended for building the openssl-sys crate later when we build the controller image. I'll add a comment here to indicate what these environment variables are for.

[etungsten]

Push above and below addresses @arnaldo2792 's comments.

Tested the builds and they still work.

[arnaldo2792]

👀