Allow to build cert-manager images with a custom base image

Signed-off-by: irbekrm <irbekrm@gmail.com>

build/BUILD.bazel

@@ -20,12 +20,25 @@ DOCKERIZED_BINARIES = {
     },
 }
 
+# Allows passing --define image_type=dynamic custom flag to Bazel command.
+# Used to allow optionally build with the dynamic base image.
+config_setting(
+    name = "dynamic_image",
+    values = {
+        "define": "image_type=dynamic"
+    }
+)
+
 # When pushing to quay.io, we want to use an arch, since the archless name is now used for a
 # manifest list. Bazel doesn't support manifest lists (yet), so we can't do that either.
 [multi_arch_container(
     name = binary,
     architectures = SERVER_PLATFORMS["linux"],
-    base = "@static_base//image",
+    # Always use the static base unless dynamic explicitly requested.
+    base = select({
+        ":dynamic_image": "@dynamic_base//image",
+        "//conditions:default": "@static_base//image",
+    }),
     binary = select(for_platforms(
         for_server = meta["target"],
         only_os = "linux",

build/images.bzl

@@ -15,7 +15,7 @@
 load("@io_bazel_rules_docker//container:container.bzl", "container_pull")
 
 def define_base_images():
-    # Use 'static' distroless image for all builds
+    # Use 'static' distroless image for all builds by default.
     # To get the latest-amd64 digest for gcr.io/distroless/static, assuming
     # that $GOPATH/bin is in your $PATH, run:
     # go get github.com/genuinetools/reg && reg digest gcr.io/distroless/static:latest-amd64
@@ -25,4 +25,9 @@ def define_base_images():
         repository = "distroless/static",
         digest = "sha256:a7752b29b18bb106938caefd8dcce8a94199022cbd06ea42268b968f35e837a8",
     )
-
+    container_pull(
+        name = "dynamic_base",
+        registry = "gcr.io",
+        repository = "distroless/base",
+        digest = "sha256:75f63d4edd703030d4312dc7528a349ca34d48bec7bd754652b2d47e5a0b7873",
+    )