Push whisker images

.semaphore/push-images/whisker-backend.yml

@@ -0,0 +1,47 @@
+version: v1.0
+name: Publish whisker backend images
+agent:
+  machine:
+    type: f1-standard-2
+    os_image: ubuntu2204
+
+execution_time_limit:
+  minutes: 60
+
+global_job_config:
+  env_vars:
+    - name: DEV_REGISTRIES
+      value: quay.io/calico docker.io/calico
+  secrets:
+    - name: docker
+    - name: quay-robot-calico+semaphoreci
+  prologue:
+    commands:
+      - checkout
+      # Semaphore is doing shallow clone on a commit without tags.
+      # unshallow it for GIT_VERSION:=$(shell git describe --tags --dirty --always)
+      - retry git fetch --unshallow
+      - echo $DOCKER_TOKEN | docker login --username "$DOCKER_USER" --password-stdin
+      - echo $QUAY_TOKEN | docker login --username "$QUAY_USER" --password-stdin quay.io
+      - export BRANCH_NAME=$SEMAPHORE_GIT_BRANCH
+
+blocks:
+  - name: Publish whisker backend images
+    dependencies: []
+    skip:
+      when: "branch !~ '.+'"
+    task:
+      jobs:
+        - name: Linux multi-arch
+          commands:
+            - if [ -z "${SEMAPHORE_GIT_PR_NUMBER}" ]; then make -C whisker-backend cd CONFIRM=true; fi
+  - name: Publish whisker backend multi-arch manifests
+    dependencies:
+      - Publish whisker backend images
+    skip:
+      when: "branch !~ '.+'"
+    task:
+      jobs:
+        - name: Linux multi-arch manifests
+          commands:
+            - if [ -z "${SEMAPHORE_GIT_PR_NUMBER}" ]; then make -C whisker-backend push-manifests-with-tag CONFIRM=true; fi

.semaphore/push-images/whisker.yml

@@ -0,0 +1,47 @@
+version: v1.0
+name: Publish whisker images
+agent:
+  machine:
+    type: f1-standard-2
+    os_image: ubuntu2204
+
+execution_time_limit:
+  minutes: 60
+
+global_job_config:
+  env_vars:
+    - name: DEV_REGISTRIES
+      value: quay.io/calico docker.io/calico
+  secrets:
+    - name: docker
+    - name: quay-robot-calico+semaphoreci
+  prologue:
+    commands:
+      - checkout
+      # Semaphore is doing shallow clone on a commit without tags.
+      # unshallow it for GIT_VERSION:=$(shell git describe --tags --dirty --always)
+      - retry git fetch --unshallow
+      - echo $DOCKER_TOKEN | docker login --username "$DOCKER_USER" --password-stdin
+      - echo $QUAY_TOKEN | docker login --username "$QUAY_USER" --password-stdin quay.io
+      - export BRANCH_NAME=$SEMAPHORE_GIT_BRANCH
+
+blocks:
+  - name: Publish whisker images
+    dependencies: []
+    skip:
+      when: "branch !~ '.+'"
+    task:
+      jobs:
+        - name: Linux multi-arch
+          commands:
+            - if [ -z "${SEMAPHORE_GIT_PR_NUMBER}" ]; then make -C whisker cd CONFIRM=true; fi
+  - name: Publish whisker multi-arch manifests
+    dependencies:
+      - Publish whisker images
+    skip:
+      when: "branch !~ '.+'"
+    task:
+      jobs:
+        - name: Linux multi-arch manifests
+          commands:
+            - if [ -z "${SEMAPHORE_GIT_PR_NUMBER}" ]; then make -C whisker push-manifests-with-tag CONFIRM=true; fi

.semaphore/semaphore.yml.d/03-promotions.yml

@@ -55,6 +55,14 @@ promotions:
     pipeline_file: push-images/goldmane.yml
     auto_promote:
       when: "branch =~ 'master|release-'"
+  - name: Push Whisker images
+    pipeline_file: push-images/whisker.yml
+    auto_promote:
+      when: "branch =~ 'master|release-'"
+  - name: Push Whisker Backend images
+    pipeline_file: push-images/whisker-backend.yml
+    auto_promote:
+      when: "branch =~ 'master|release-'"
   - name: Publish openstack packages
     pipeline_file: push-images/packaging.yaml
     auto_promote:

release/pkg/manager/calico/manager.go

@@ -60,6 +60,8 @@ var (
 		"pod2daemon",
 		"typha",
 		"goldmane",
+		"whisker",
+		"whisker-backend",
 	}
 
 	// Directories for Windows.

whisker-backend/Makefile

@@ -66,9 +66,9 @@ release-build: .release-$(VERSION).created
 	$(MAKE) clean image-all RELEASE=true
 	$(MAKE) retag-build-images-with-registries RELEASE=true IMAGETAG=$(VERSION)
 	$(MAKE) retag-build-images-with-registries RELEASE=true IMAGETAG=latest
+	touch $@
 
 release-publish: release-prereqs .release-$(VERSION).published
 .release-$(VERSION).published:
 	$(MAKE) push-images-to-registries push-manifests IMAGETAG=$(VERSION) RELEASE=$(RELEASE) CONFIRM=$(CONFIRM)
-
 	touch $@

whisker/Makefile

@@ -53,3 +53,21 @@ lint: install
 	$(DOCKER_RUN_RM) -e NODE_OPTIONS=--max_old_space_size=8192 -e CNX_APP_VERSION=$(GIT_VERSION) $(BUILD_IMAGE_NAME) yarn lint --quiet
 
 ci: install format lint yarn-test
+
+###############################################################################
+# Release
+###############################################################################
+## Deploys images to registry
+cd: image-all cd-common
+
+release-build: .release-$(VERSION).created
+.release-$(VERSION).created:
+	$(MAKE) clean image-all RELEASE=true
+	$(MAKE) retag-build-images-with-registries RELEASE=true IMAGETAG=$(VERSION)
+	$(MAKE) retag-build-images-with-registries RELEASE=true IMAGETAG=latest
+	touch $@
+
+release-publish: release-prereqs .release-$(VERSION).published
+.release-$(VERSION).published:
+	$(MAKE) push-images-to-registries push-manifests IMAGETAG=$(VERSION) RELEASE=$(RELEASE) CONFIRM=$(CONFIRM)
+	touch $@

whisker/docker-image/Dockerfile.nginx

@@ -12,6 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+ARG CALICO_BASE
+
 FROM registry.access.redhat.com/ubi8/ubi:latest as ubi
 
 RUN dnf upgrade -y
@@ -21,11 +23,48 @@ COPY docker-image/nginx.repo /etc/yum.repos.d/nginx.repo
 RUN dnf --enablerepo=nginx-stable install -y \
     nginx
 
+FROM scratch as source
+
+# binary and dependencies
+COPY --from=ubi /usr/sbin/nginx /usr/sbin/nginx
+
+COPY --from=ubi /bin/sh /bin/sh
+COPY --from=ubi /usr/bin/cat /usr/bin/cat
+COPY --from=ubi /usr/bin/cd /usr/bin/cd
+COPY --from=ubi /usr/bin/coreutils /usr/bin/coreutils
+COPY --from=ubi /usr/bin/sed /usr/bin/sed
+
+COPY --from=ubi /lib64/libacl.so.1 /lib64/libacl.so.1
+COPY --from=ubi /lib64/libattr.so.1 /lib64/libattr.so.1
+COPY --from=ubi /lib64/libcap.so.2 /lib64/libcap.so.2
+COPY --from=ubi /lib64/libcrypt.so.1 /lib64/libcrypt.so.1
+COPY --from=ubi /lib64/libcrypto.so.1.1 /lib64/libcrypto.so.1.1
+COPY --from=ubi /lib64/libdl.so.2 /lib64/libdl.so.2
+COPY --from=ubi /lib64/libpcre2-8.so.0 /lib64/libpcre2-8.so.0
+COPY --from=ubi /lib64/librt.so.1 /lib64/librt.so.1
+COPY --from=ubi /lib64/libselinux.so.1 /lib64/libselinux.so.1
+COPY --from=ubi /lib64/libssl.so.1.1 /lib64/libssl.so.1.1
+COPY --from=ubi /lib64/libtinfo.so.6 /lib64/libtinfo.so.6
+COPY --from=ubi /lib64/libz.so.1 /lib64/libz.so.1
+
+# web server configs and folder permissions
+COPY --from=ubi --chown=10001:10001 /etc/nginx /etc/nginx/
+# nginx-start.sh writes clientsideConfig.js into this folder
+COPY --from=ubi --chown=10001:10001 /usr/share/nginx/html /usr/share/nginx/html/
+COPY --from=ubi --chown=10001:10001 /var/cache/nginx /var/cache/nginx/
+COPY --from=ubi --chown=10001:10001 /var/log/nginx /var/log/nginx/
+
 COPY docker-image/nginx-start.sh /usr/bin/nginx-start.sh
 
 COPY docker-image/default.conf /etc/nginx/conf.d/default.conf
 COPY docker-image/nginx.conf /etc/nginx/nginx.conf
 
 COPY dist /usr/share/nginx/html/
 
+FROM ${CALICO_BASE}
+
+COPY --from=source / /
+
+USER 10001:10001
+
 CMD ["/usr/bin/nginx-start.sh"]