There are two ways of building kubemark: 1) via Dockerfile and 2) via
bazel.
In CI/CD tests we use the 1) way and use debian:jessie as the base
image.
But if you build kubemark via bazel it will use the discouraged busybox
base image.
This PR fixes that by using debian:jessie everywehre and pinning exact
sha version to make the kubemark image hermetic.
This is the 2nd attempt. The previous was reverted while we figured out
the regional mirrors (oops).
New plan: k8s.gcr.io is a read-only facade that auto-detects your source
region (us, eu, or asia for now) and pulls from the closest. To publish
an image, push k8s-staging.gcr.io and it will be synced to the regionals
automatically (similar to today). For now the staging is an alias to
gcr.io/google_containers (the legacy URL).
When we move off of google-owned projects (working on it), then we just
do a one-time sync, and change the google-internal config, and nobody
outside should notice.
We can, in parallel, change the auto-sync into a manual sync - send a PR
to "promote" something from staging, and a bot activates it. Nice and
visible, easy to keep track of.
