Skip to content

Commit e9a22ac

Browse files
emosbaughemosbaugh
authored
feat: build operator image with chainguard (#250)
1 parent 72698eb commit e9a22ac

File tree

8 files changed

+238
-86
lines changed

8 files changed

+238
-86
lines changed

‎.github/workflows/deploy-helm-production.yaml

Lines changed: 36 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -6,41 +6,47 @@ on:
66
- 'v[0-9]+.[0-9]+.[0-9]+\-build\.[0-9]+'
77

88
jobs:
9-
package-and-publish-operator:
9+
10+
get-tag:
1011
runs-on: ubuntu-latest
12+
outputs:
13+
tag: ${{ steps.tag.outputs.tag }}
1114
steps:
1215
- name: Get tag
1316
id: tag
14-
uses: dawidd6/action-get-tag@v1
15-
with:
16-
strip_v: true
17+
run: |
18+
TAG=${{ github.ref_name }}
19+
echo "tag=${TAG#v}" >> "$GITHUB_OUTPUT"
20+
21+
package-and-publish-operator:
22+
runs-on: ubuntu-latest
23+
needs: [get-tag]
24+
steps:
1725
- name: Checkout
1826
uses: actions/checkout@v4
1927
- name: Setup Go
2028
uses: actions/setup-go@v5
2129
with:
2230
go-version-file: go.mod
23-
- name: Login to registry
24-
uses: docker/login-action@v3
25-
with:
26-
registry: registry.replicated.com
27-
username: ${{secrets.KOTS_HELM_USER_PROD}}
28-
password: ${{secrets.KOTS_HELM_PASS_PROD}}
29-
- name: Docker Image
30-
uses: docker/build-push-action@v6
31-
with:
32-
push: true
33-
tags: |
34-
registry.replicated.com/library/embedded-cluster-operator-image:${{steps.tag.outputs.tag}}
31+
- name: Build melange package
32+
run: |
33+
export VERSION=${{needs.get-tag.outputs.tag}}
34+
make melange
35+
- name: Publish apko image
36+
run: |
37+
export VERSION=${{needs.get-tag.outputs.tag}}
38+
export IMAGE=replicated/embedded-cluster-operator-image:${VERSION}
39+
make apko-login \
40+
REGISTRY=docker.io \
41+
USERNAME=${{secrets.DOCKERHUB_USER}} \
42+
PASSWORD=${{secrets.DOCKERHUB_PASSWORD}}
43+
make apko-publish
44+
echo ::notice title=digest::$(cat build/digest)
45+
3546
package-and-publish-helmchart:
3647
runs-on: 'ubuntu-20.04'
37-
needs: package-and-publish-operator
48+
needs: [get-tag, package-and-publish-operator]
3849
steps:
39-
- name: Get tag
40-
id: tag
41-
uses: dawidd6/action-get-tag@v1
42-
with:
43-
strip_v: true
4450
- name: Checkout
4551
uses: actions/checkout@v4
4652
- name: Install Helm
@@ -53,28 +59,24 @@ jobs:
5359
HELM_USER: ${{secrets.KOTS_HELM_USER_PROD}}
5460
HELM_PASS: ${{secrets.KOTS_HELM_PASS_PROD}}
5561
HELM_REGISTRY: registry.replicated.com
56-
CHART_VERSION: ${{steps.tag.outputs.tag}}
62+
CHART_VERSION: ${{needs.get-tag.outputs.tag}}
5763
run: |
58-
export OPERATOR_IMAGE_NAME=registry.replicated.com/library/embedded-cluster-operator-image
64+
export OPERATOR_IMAGE_NAME=replicated/embedded-cluster-operator-image
5965
export OPERATOR_IMAGE_TAG=${CHART_VERSION}
6066
export CHART_REMOTE=oci://registry.replicated.com/library
6167
6268
../../scripts/publish-helm-chart.sh
6369
6470
releaser:
6571
runs-on: ubuntu-latest
72+
needs: [get-tag, package-and-publish-helmchart]
6673
steps:
67-
- name: Checkout
68-
uses: actions/checkout@v4
69-
with:
70-
fetch-depth: 0
71-
- name: Set up Go
72-
uses: actions/setup-go@v5
73-
with:
74-
go-version-file: go.mod
75-
- name: Build linux-amd64
74+
- uses: imjasonh/setup-crane@v0.4
75+
- name: Download artifact
7676
run: |
77-
make build
77+
mkdir -p bin
78+
crane export --platform linux/amd64 docker.io/replicated/embedded-cluster-operator-image:${{needs.get-tag.outputs.tag}} \
79+
| tar -Oxf - manager > bin/manager
7880
- name: Release
7981
uses: softprops/action-gh-release@v2
8082
with:

‎.github/workflows/deploy-helm-staging.yaml

Lines changed: 30 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -6,41 +6,47 @@ on:
66
- 'v[0-9]+.[0-9]+.[0-9]+\-alpha\.[0-9]+'
77

88
jobs:
9-
package-and-publish-operator:
9+
10+
get-tag:
1011
runs-on: ubuntu-latest
12+
outputs:
13+
tag: ${{ steps.tag.outputs.tag }}
1114
steps:
1215
- name: Get tag
1316
id: tag
14-
uses: dawidd6/action-get-tag@v1
15-
with:
16-
strip_v: true
17+
run: |
18+
TAG=${{ github.ref_name }}
19+
echo "tag=${TAG#v}" >> "$GITHUB_OUTPUT"
20+
21+
package-and-publish-operator:
22+
runs-on: ubuntu-latest
23+
needs: [get-tag]
24+
steps:
1725
- name: Checkout
1826
uses: actions/checkout@v4
1927
- name: Setup Go
2028
uses: actions/setup-go@v5
2129
with:
2230
go-version-file: go.mod
23-
- name: Login to registry
24-
uses: docker/login-action@v3
25-
with:
26-
registry: registry.staging.replicated.com
27-
username: ${{secrets.KOTS_HELM_USER_STAGING}}
28-
password: ${{secrets.KOTS_HELM_PASS_STAGING}}
29-
- name: Docker Image
30-
uses: docker/build-push-action@v6
31-
with:
32-
push: true
33-
tags: |
34-
registry.staging.replicated.com/library/embedded-cluster-operator-image:${{steps.tag.outputs.tag}}
31+
- name: Build melange package
32+
run: |
33+
export VERSION=${{needs.get-tag.outputs.tag}}
34+
make melange
35+
- name: Publish apko image
36+
run: |
37+
export VERSION=${{needs.get-tag.outputs.tag}}
38+
export IMAGE=replicated/embedded-cluster-operator-image-staging:${VERSION}
39+
make apko-login \
40+
REGISTRY=docker.io \
41+
USERNAME=${{secrets.DOCKERHUB_USER}} \
42+
PASSWORD=${{secrets.DOCKERHUB_PASSWORD}}
43+
make apko-publish
44+
echo ::notice title=digest::$(cat build/digest)
45+
3546
package-and-publish-helmchart:
3647
runs-on: 'ubuntu-20.04'
37-
needs: package-and-publish-operator
48+
needs: [get-tag, package-and-publish-operator]
3849
steps:
39-
- name: Get tag
40-
id: tag
41-
uses: dawidd6/action-get-tag@v1
42-
with:
43-
strip_v: true
4450
- name: Checkout
4551
uses: actions/checkout@v4
4652
- name: Install Helm
@@ -53,9 +59,9 @@ jobs:
5359
HELM_USER: ${{secrets.KOTS_HELM_USER_STAGING}}
5460
HELM_PASS: ${{secrets.KOTS_HELM_PASS_STAGING}}
5561
HELM_REGISTRY: registry.staging.replicated.com
56-
CHART_VERSION: ${{steps.tag.outputs.tag}}
62+
CHART_VERSION: ${{needs.get-tag.outputs.tag}}
5763
run: |
58-
export OPERATOR_IMAGE_NAME=registry.staging.replicated.com/library/embedded-cluster-operator-image
64+
export OPERATOR_IMAGE_NAME=replicated/embedded-cluster-operator-image-staging
5965
export OPERATOR_IMAGE_TAG=${CHART_VERSION}
6066
export CHART_REMOTE=oci://registry.staging.replicated.com/library
6167

‎.github/workflows/pull-request.yaml

Lines changed: 53 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,25 @@
11
name: Pull request
22
on:
33
- pull_request
4+
45
jobs:
5-
tests:
6-
name: Unit tests
6+
7+
get-tag:
78
runs-on: ubuntu-latest
9+
outputs:
10+
tag: ${{ steps.tag.outputs.tag }}
11+
steps:
12+
- name: Checkout
13+
uses: actions/checkout@v4
14+
with:
15+
fetch-depth: 0
16+
- name: Get tag
17+
id: tag
18+
run: echo "tag=$(git rev-parse --short=7 HEAD)" >> "$GITHUB_OUTPUT"
19+
20+
test:
21+
runs-on: ubuntu-latest
22+
needs: [get-tag]
823
steps:
924
- name: Checkout
1025
uses: actions/checkout@v4
@@ -18,29 +33,48 @@ jobs:
1833
- name: Unit tests
1934
run: |
2035
make test
36+
2137
build:
22-
name: Build
2338
runs-on: ubuntu-latest
39+
needs: [get-tag]
2440
steps:
2541
- name: Checkout
2642
uses: actions/checkout@v4
27-
- name: Get short commit hash
28-
run: echo "SHORT_SHA=$(git rev-parse --short=7 HEAD)" >> $GITHUB_ENV
2943
- name: Setup Go
3044
uses: actions/setup-go@v5
3145
with:
3246
go-version-file: go.mod
3347
- name: Build
3448
run: |
35-
make build VERSION=dev-${{ env.SHORT_SHA }}
36-
- name: Docker Image
37-
uses: docker/build-push-action@v6
49+
export VERSION=${{needs.get-tag.outputs.tag}}
50+
make build
51+
- name: Upload artifact
52+
uses: actions/upload-artifact@v4
53+
with:
54+
name: manager
55+
path: ./bin/manager
56+
57+
package-operator:
58+
runs-on: ubuntu-latest
59+
needs: [get-tag]
60+
steps:
61+
- name: Checkout
62+
uses: actions/checkout@v4
63+
- name: Setup Go
64+
uses: actions/setup-go@v5
3865
with:
39-
push: true
40-
tags: |
41-
ttl.sh/embedded-cluster-operator-image:dev-${{ env.SHORT_SHA }}
66+
go-version-file: go.mod
67+
- name: Build melange package
68+
run: |
69+
export VERSION=${{needs.get-tag.outputs.tag}}
70+
make melange
71+
- name: Build apko image
72+
run: |
73+
export VERSION=${{needs.get-tag.outputs.tag}}
74+
export IMAGE=ttl.sh/embedded-cluster-operator-image:dev-${VERSION}
75+
make apko-build
76+
4277
check-crds:
43-
name: Check CRDs
4478
runs-on: ubuntu-latest
4579
steps:
4680
- name: Checkout
@@ -49,10 +83,10 @@ jobs:
4983
run: make manifests
5084
- name: Check CRDs
5185
run: |
52-
git diff --exit-code --name-only
53-
if [ $? -eq 0 ]; then
54-
echo "CRDs are up to date"
55-
else
56-
echo "CRDs are out of date"
57-
exit 1
58-
fi
86+
git diff --exit-code --name-only
87+
if [ $? -eq 0 ]; then
88+
echo "CRDs are up to date"
89+
else
90+
echo "CRDs are out of date"
91+
exit 1
92+
fi

‎.gitignore

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
# Go workspace file
2121
go.work
2222

23-
bin/
23+
/bin/
24+
/build/
2425

2526
*.tgz

‎Makefile

Lines changed: 65 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -113,10 +113,11 @@ test: manifests fmt vet envtest ## Run tests.
113113
##@ Build
114114

115115
.PHONY: build
116-
build: GOOS = linux
117-
build: GOARCH = amd64
118-
build: manifests fmt vet ## Build manager binary.
119-
CGO_ENABLED=0 GOOS=$(GOOS) GOARCH=$(GOARCH) go build -o bin/manager main.go
116+
build: ## Build manager binary.
117+
go build \
118+
-tags osusergo,netgo \
119+
-ldflags="-s -w -extldflags=-static" \
120+
-o bin/manager main.go
120121

121122
.PHONY: run
122123
run: manifests fmt vet ## Run a controller from your host.
@@ -299,9 +300,11 @@ catalog-push: ## Push a catalog image.
299300

300301
# Push operator image to ttl.sh
301302
.PHONY: build-ttl.sh
302-
build-ttl.sh:
303-
docker build --platform linux/amd64 -t ttl.sh/${CURRENT_USER}/embedded-cluster-operator-image:24h .
304-
docker push ttl.sh/${CURRENT_USER}/embedded-cluster-operator-image:24h
303+
build-ttl.sh: export IMAGE = ttl.sh/${CURRENT_USER}/embedded-cluster-operator-image:24h
304+
build-ttl.sh: export VERSION = $(shell git describe --tags --dirty --always --abbrev=8 | sed 's/^v//')
305+
build-ttl.sh: export GOOS = linux
306+
build-ttl.sh: export GOARCH = amd64
307+
build-ttl.sh: build melange apko-publish
305308

306309
.PHONY: build-chart-ttl.sh
307310
build-chart-ttl.sh: build-ttl.sh
@@ -311,3 +314,58 @@ build-chart-ttl.sh: export OPERATOR_IMAGE_TAG = 24h
311314
build-chart-ttl.sh: export CHART_REMOTE = oci://ttl.sh/${CURRENT_USER}
312315
build-chart-ttl.sh:
313316
cd charts/embedded-cluster-operator && ../../scripts/publish-helm-chart.sh
317+
318+
.PHONY: apko-build
319+
apko-build: export IMAGE ?= ttl.sh/${CURRENT_USER}/embedded-cluster-operator-image:24h
320+
apko-build: export ARCHS ?= amd64
321+
apko-build: apko-template
322+
docker run -v "${PWD}":/work -w /work/build \
323+
cgr.dev/chainguard/apko build apko.yaml ${IMAGE} apko.tar \
324+
--arch ${ARCHS}
325+
326+
.PHONY: apko-publish
327+
apko-publish: export IMAGE ?= ttl.sh/${CURRENT_USER}/embedded-cluster-operator-image:24h
328+
apko-publish: export ARCHS ?= amd64
329+
apko-publish: apko-template
330+
docker run -v "${PWD}":/work -w /work/build -v "${PWD}"/build/.docker:/root/.docker \
331+
cgr.dev/chainguard/apko publish apko.yaml ${IMAGE} \
332+
--arch ${ARCHS} | tee build/digest
333+
334+
.PHONY: apko-login
335+
apko-login: check-env-REGISTRY check-env-USERNAME check-env-PASSWORD
336+
docker run -v "${PWD}":/work -v "${PWD}"/build/.docker:/root/.docker -w /work/build \
337+
cgr.dev/chainguard/apko login -u "${USERNAME}" \
338+
--password "${PASSWORD}" "${REGISTRY}"
339+
340+
.PHONY: melange
341+
melange: export ARCHS ?= amd64
342+
melange: melange-template
343+
mkdir -p build
344+
for f in pkg controllers main.go go.mod go.sum Makefile ; do \
345+
rm -rf "build/$$f" && cp -r $$f build/ ; \
346+
done
347+
docker run --rm -v "${PWD}":/work -w /work/build \
348+
cgr.dev/chainguard/melange keygen melange.rsa
349+
docker run --privileged --rm -v "${PWD}":/work -w /work \
350+
-v "$(shell go env GOMODCACHE)":/go/pkg/mod \
351+
cgr.dev/chainguard/melange build build/melange.yaml \
352+
--arch ${ARCHS} \
353+
--signing-key build/melange.rsa \
354+
--cache-dir=/go/pkg/mod \
355+
--out-dir build/packages/
356+
357+
.PHONY: melange-template
358+
melange-template: check-env-VERSION
359+
mkdir -p build
360+
envsubst '$${VERSION}' < deploy/melange.tmpl.yaml > build/melange.yaml
361+
362+
.PHONY: apko-template
363+
apko-template: check-env-VERSION
364+
mkdir -p build
365+
envsubst '$${VERSION}' < deploy/apko.tmpl.yaml > build/apko.yaml
366+
367+
check-env-%:
368+
@ if [ "${${*}}" = "" ]; then \
369+
echo "Environment variable $* not set"; \
370+
exit 1; \
371+
fi

0 commit comments

Comments
 (0)