chore: update minio chart to use chainguard latest-dev images

[zachariahmiller]

Description

update minio chart to use chainguard latest-dev images for minio.
...

Related Issue

Fixes #

Relates to #

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps(https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md#submitting-a-pull-request) followed

[jeff-mccoy]

can you clarify why we are doing this really ugly script? Is this a chainguard ism?

[mjnagel]

@jeff-mccoy Zach can probably confirm but if I'm remembering right its a copy from the upstream image to get to parity for the chainguard image. Upstream minio provides that script (see here and the script here), but the chainguard image doesn't have it. So running the chainguard image with the upstream chart doesn't work out of the box, because it expects that entrypoint.

[zachariahmiller]

The community helm chart doesn't let us override the container entrypoint and on it expects the script in the container. For minio itself this required doing the ugly script volume mount and using the latest-dev chainguard image. For minio-client, it was just using sh so it only required the latest-dev image. These were still much smaller than the upstream but not as small as the images without a shell.

FWIW this would have been possible to avoid and just use the latest chainguard images if we were using the minio operator to deploy minio as that chart is more flexible, but would have been a bigger lift and would have some additional overhead in-cluster.

[mjnagel]

@zachariahmiller thoughts on closing this (and the related issue)? I'm not sure the pain here is worth the benefits of the change (although I'd love the slimmer images and less cve surface area). Maybe can re-evaluate if we have a diff image solution or build our own slimmer image here for minio itself 🙃

Edit: for what its worth, looks like the upstream image has slimmed down by about half since the original issue:

❯ docker images | grep minio
quay.io/minio/minio                                                     latest                  19980ec05da4   3 days ago      153MB

[zachariahmiller]

Yeah totally