Fixed plugins using arm64 binaries in all container images

[fheinecke]

Due to a missing ARG directive + globbing, the build pulls in arm64 tarballs on top of amd64 tarballs, breaking amd64 images. This fixes the issue by adding the missing directive, and removing the globbing so that builds will fail rather than successfully produce broken images.

This will require an e ref bump after https://github.com/gravitational/teleport.e/pull/4408 lands. Passing build (for plugins at least) is here.

This is affecting the v16.0.0 release. I'll add a changelog entry to the backport PR.

[fheinecke]

Dev build is running here to confirm the fix.

[hugoShaka]

We know the exact archive file name in the Makefile: $(RELEASE).tar/gz can we pass this as a docker build arg to get rid of the globbing that is fragile and can catch any other old release in the build/ directory?

[fheinecke]

@hugoShaka No we cannot, at least not rewriting a large portion of the workflow that we use for building all images.

[hugoShaka]

I saw that we're using the OCI Multiarch action for this. Can I suggest, after fixing this, adding the built version/image tag as a build arg in the action? Even if not every Dockerfile uses it, having a TELEPORT_VERSION args will be useful in many cases. Here we could be more specific about the globbing logic (we'd still need globbing, but at least we'd pick the right version, like this PR does for the arch)

[fheinecke]

Yea I was looking at that. I think we might be able to avoid all globbing if we do what we're doing with distroless images, and build the file name inside the image. So instead of COPY *${TARGET_ARCH}* /path we'd have COPY teleport-${PLUGIN_NAME}-${VERSION}-${TARGETOS}-${TARGETARCH}-bin.tar.gz /path. This adds some additional coupling, but I think that this is probably reasonable.

I just ran a dev build where amd64 is in the tag name, which caused this exact same problem because the glob was not specific enough. This route is more of a PITA to implement as it requires twice as many PRs, but it's probably a safer approach.

[public-teleport-github-review-bot]

@fheinecke See the table below for backport results.

Branch	Result
branch/v16	Failed