[kube] use local image for kubernetes integration tests

This PR replaces the use of the `nginx:latest` Docker image in Kubernetes integration tests with a custom-built image based on `alpine:3.20.3`. This custom image includes a shell for `kubectl exec` integration tests and a compiled binary to act as an HTTP server.

This change addresses recent issues where test workflows failed due to problems downloading the `nginx` image.

.github/workflows/kube-integration-tests-non-root.yaml

@@ -89,6 +89,14 @@ jobs:
           cp -r $HOME/.kube /home/
           chown -R ci:ci /home/.kube
 
+      - name: Build Alpine image with webserver
+        run: |
+          docker load -i ./fixtures/alpine/alpine-3.23.amd64.tar
+          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o ./fixtures/alpine/webserver ./fixtures/alpine/webserver.go
+          docker build -t alpine-webserver:v1 -f ./fixtures/alpine/Dockerfile ./fixtures/alpine/
+          kind load docker-image alpine-webserver:v1
+          rm -f ./fixtures/alpine/webserver
+
       - name: Run tests
         timeout-minutes: 40
         run: |

fixtures/alpine/Dockerfile

@@ -0,0 +1,5 @@
+FROM alpine:3.20.3
+
+COPY webserver /webserver
+
+CMD [ "/webserver" ]

fixtures/alpine/webserver.go

@@ -0,0 +1,26 @@
+// Teleport
+// Copyright (C) 2024 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package main
+
+import "net/http"
+
+func main() {
+	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("Hello, world!"))
+	})
+	http.ListenAndServe(":80", nil)
+}

integration/kube_integration_test.go

@@ -1467,7 +1467,7 @@ func testKubeEphemeralContainers(t *testing.T, suite *KubeSuite) {
 	sessCreatorTerm := NewTerminal(250)
 	group := &errgroup.Group{}
 	group.Go(func() error {
-		cmd := []string{"/bin/sh", "echo", "hello from an ephemeral container"}
+		cmd := []string{"/bin/sh", "-c", "echo hello from an ephemeral container"}
 		debugPod, _, err := generateDebugContainer(contName, cmd, pod)
 		if err != nil {
 			return trace.Wrap(err)
@@ -1572,7 +1572,7 @@ func generateDebugContainer(name string, cmd []string, pod *v1.Pod) (*v1.Pod, *v
 	ec := &v1.EphemeralContainer{
 		EphemeralContainerCommon: v1.EphemeralContainerCommon{
 			Name:                     name,
-			Image:                    "alpine:latest",
+			Image:                    localPodImage,
 			Command:                  cmd,
 			ImagePullPolicy:          v1.PullIfNotPresent,
 			Stdin:                    true,
@@ -1928,6 +1928,8 @@ func newNamespace(name string) *v1.Namespace {
 	}
 }
 
+const localPodImage = "alpine-webserver:v1"
+
 func newPod(ns, name string) *v1.Pod {
 	return &v1.Pod{
 		ObjectMeta: metav1.ObjectMeta{
@@ -1937,7 +1939,7 @@ func newPod(ns, name string) *v1.Pod {
 		Spec: v1.PodSpec{
 			Containers: []v1.Container{{
 				Name:  "nginx",
-				Image: "nginx:alpine",
+				Image: localPodImage,
 			}},
 		},
 	}