Terrascan 1.3.0 fails to build on alpine

[ifosch]

• terrascan version: 1.3.0
• Operating System: alpine

Description

I have a Dockerfile for terrascan which is failing to build version 1.3.0.
There is some dependency problem happening when running go get.
With version 1.2.0 it was working fine.

What I Did

The Dockerfile is like the following:

FROM golang:alpine AS build-env

RUN apk add --update git

RUN CGO_ENABLED=0 GO111MODULE=on go get github.com/accurics/terrascan/cmd/terrascan

FROM scratch

COPY --from=build-env /go/bin/terrascan /usr/bin/terrascan
COPY --from=build-env /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/

ENTRYPOINT [ "/usr/bin/terrascan" ]

Then the command I'm using to build it is

docker build -t terrascan:1.3.0 terrascan/

The output fails with the following error:

pkg/mod/k8s.io/client-go@v10.0.0+incompatible/discovery/cached_discovery.go:28:2: module github.com/googleapis/gnostic@latest found (v0.5.3), but does not contain package github.com/googleapis/gnostic/OpenAPIv2
pkg/mod/k8s.io/kube-openapi@v0.0.0-20200805222855-6aeccd4b50c6/pkg/util/proto/document.go:24:2: case-insensitive import collision: "github.com/googleapis/gnostic/openapiv2" and "github.com/googleapis/gnostic/OpenAPIv2"
pkg/mod/k8s.io/client-go@v10.0.0+incompatible/kubernetes/scheme/register.go:22:2: module k8s.io/api@latest found (v0.20.2), but does not contain package k8s.io/api/admissionregistration/v1alpha1
pkg/mod/k8s.io/client-go@v10.0.0+incompatible/kubernetes/scheme/register.go:27:2: module k8s.io/api@latest found (v0.20.2), but does not contain package k8s.io/api/auditregistration/v1alpha1

[amirbenv]

Thanks for the report! Looking into it

[jlk]

hey @ifosch - I'm digging into see what's up here. I can reproduce with your Dockerfile, but using ours (build/Dockerfile) it works fine...

The issues seem to be with 3rd party code - client-go and kube-openapi. Will keep poking to see what's up...

[williepaul]

There are some known issues with some of the indirect dependencies of the libraries we use. (see kubernetes/client-go#741 for more info). In the meantime, a possible workaround would be to clone and build instead of using go get to do it. Here's a working example based on your dockerfile above:

FROM golang:alpine AS build-env

RUN apk add --update git

RUN git clone https://github.com/accurics/terrascan && cd terrascan \
  && CGO_ENABLED=0 GO111MODULE=on go build -o /go/bin/terrascan cmd/terrascan/main.go

FROM scratch

COPY --from=build-env /go/bin/terrascan /usr/bin/terrascan
COPY --from=build-env /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/

ENTRYPOINT [ "/usr/bin/terrascan" ]

[ifosch]

Great, I've tested this and this way i can build terrascan 1.3.0 ok. Thank you so much @williepaul