I have added a system for showing fatal and non-fatal deprecation warnings. It's configurable by command and environment.
If we merge this PR, running a rootless image with any OPA command other than `opa run` will result in a fatal error and exit code 1.
It's possible for users to continue to use the image by unsetting: OPA_DOCKER_IMAGE_TAG=rootless.
`opa run` will show the message, but it's not fatal for this command. This is intended to avoid production disruption.
Signed-off-by: Charlie Egan <charlie@styra.com>
Since all published OPA images now run with a non-root uid/gid,
there is no need to publish the rootless image tag. Currently
if the rootless variant is run, a log message at the Warn
level is printed.
This change increaes the log level for that message to Error
in order to make it more explict to stop using this variant in the
future.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Currently all OPA image variants except "rootless" use
uid/gid 0 (i.e. root). Per container security best
practices it is better to run as non-root. So now OPA
defaults to non-root uid/gid in images. If root user
if needed, it can be explicitly set.
The "rootless" image variant is no longer needed and
will be not published in future releases.
Also currently the debug variant is published
for `linux/amd64` platform. For `linux/arm64` only static
images are generated. The debug variant can be useful
for debugging purposes and hence this change adds that
to the static image which can then be used on amd64 and arm64 arch.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Charlie Egan