Skip to content

Commit b73df7d

Browse files
emosbaughsgalsaleh
emosbaugh
authored and
sgalsaleh
committed
feat: build third party images with chainguard
1 parent 7891136 commit b73df7d

File tree

14 files changed

+677
-32
lines changed

14 files changed

+677
-32
lines changed

‎.github/workflows/image-deps-updater.yaml

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: Update image deps
2+
3+
on:
4+
schedule:
5+
- cron: '0 4 * * *'
6+
workflow_dispatch:
7+
inputs:
8+
k0s-version:
9+
description: 'K0s version for discovering image versions'
10+
required: false
11+
push:
12+
branches:
13+
- sgalsaleh/sc-108755/use-chainguard-images-for-embedded-cluster
14+
15+
jobs:
16+
update-k0s-images:
17+
runs-on: ubuntu-20.04
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@v4
21+
22+
- name: Compile buildtools
23+
run: |
24+
make buildtools
25+
26+
- name: Update k0s images
27+
env:
28+
REGISTRY_SERVER: docker.io
29+
REGISTRY_USER: ${{ secrets.DOCKERHUB_USER }}
30+
REGISTRY_PASS: ${{ secrets.DOCKERHUB_PASSWORD }}
31+
run: output/bin/buildtools update images k0s
32+
33+
- name: Create Pull Request # creates a PR if there are differences
34+
uses: peter-evans/create-pull-request@v6
35+
id: cpr
36+
with:
37+
token: ${{ secrets.AUTOMATED_PR_GH_PAT }}
38+
commit-message: 'Update image versions'
39+
title: 'Automated image updates'
40+
branch: automation/image-dependencies
41+
delete-branch: true
42+
labels: |
43+
automated-pr
44+
images
45+
type::security
46+
draft: false
47+
# base: "main"
48+
base: "sgalsaleh/sc-108755/use-chainguard-images-for-embedded-cluster"
49+
body: "Automated changes by the [image-deps-updater](https://github.com/replicatedhq/embedded-cluster/blob/main/.github/workflows/image-deps-updater.yaml) GitHub action"
50+
51+
- name: Check outputs
52+
if: ${{ steps.cpr.outputs.pull-request-number }}
53+
run: |
54+
echo "Pull Request Number - ${{ steps.cpr.outputs.pull-request-number }}"
55+
echo "Pull Request URL - ${{ steps.cpr.outputs.pull-request-url }}"

‎.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,5 @@ pkg/goods/images
77
.pre-commit-config.yaml
88
vendor
99
e2e/kots-release-install/license.yaml
10+
/build/
11+
/bin/

‎Makefile

Lines changed: 159 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,22 @@ VERSION ?= $(shell git describe --tags --dirty)
22
UNAME := $(shell uname)
33
ARCH := $(shell uname -m)
44
APP_NAME = embedded-cluster
5+
COREDNS_IMAGE =
6+
COREDNS_VERSION =
7+
CALICO_NODE_IMAGE =
8+
CALICO_NODE_VERSION =
9+
METRICS_SERVER_IMAGE =
10+
METRICS_SERVER_VERSION =
511
ADMIN_CONSOLE_CHART_REPO_OVERRIDE =
6-
ADMIN_CONSOLE_CHART_VERSION = 1.111.0
12+
ADMIN_CONSOLE_CHART_VERSION = 1.112.1-build.1
713
ADMIN_CONSOLE_IMAGE_OVERRIDE =
814
ADMIN_CONSOLE_MIGRATIONS_IMAGE_OVERRIDE =
9-
EMBEDDED_OPERATOR_CHART_URL = oci://registry.replicated.com/library
10-
EMBEDDED_OPERATOR_CHART_NAME = embedded-cluster-operator
11-
EMBEDDED_OPERATOR_CHART_VERSION = 0.36.5
12-
EMBEDDED_OPERATOR_UTILS_IMAGE = busybox:1.36.1
15+
ADMIN_CONSOLE_KURL_PROXY_IMAGE_OVERRIDE =
16+
EMBEDDED_OPERATOR_CHART_VERSION = 0.40.2
17+
EMBEDDED_OPERATOR_BINARY_URL_OVERRIDE =
18+
EMBEDDED_OPERATOR_UTILS_IMAGE ?= replicated/embedded-cluster-utils
19+
EMBEDDED_OPERATOR_UTILS_IMAGE_VERSION ?= $(subst +,-,$(VERSION))
20+
EMBEDDED_OPERATOR_UTILS_IMAGE_LOCATION = proxy.replicated.com/anonymous/$(EMBEDDED_OPERATOR_UTILS_IMAGE):$(EMBEDDED_OPERATOR_UTILS_IMAGE_VERSION)
1321
EMBEDDED_CLUSTER_OPERATOR_IMAGE_OVERRIDE =
1422
OPENEBS_CHART_VERSION = 4.1.0
1523
OPENEBS_UTILS_VERSION = 4.1.0
@@ -20,28 +28,36 @@ VELERO_CHART_VERSION = 6.3.0
2028
VELERO_IMAGE_VERSION = v1.13.2
2129
VELERO_AWS_PLUGIN_IMAGE_VERSION = v1.9.2
2230
KUBECTL_VERSION = v1.30.1
23-
K0S_VERSION = v1.29.5+k0s.0-ec.0
24-
K0S_GO_VERSION = v1.29.5+k0s.0
25-
PREVIOUS_K0S_VERSION ?= v1.28.8+k0s.0
26-
K0S_BINARY_SOURCE_OVERRIDE = https://ec-k0s-binaries.s3.amazonaws.com/k0s-v1.29.5%2Bk0s.0-ec.0
31+
K0S_VERSION = v1.29.6+k0s.0
32+
K0S_GO_VERSION = v1.29.6+k0s.0
33+
PREVIOUS_K0S_VERSION ?= v1.28.10+k0s.0
34+
K0S_BINARY_SOURCE_OVERRIDE =
2735
PREVIOUS_K0S_BINARY_SOURCE_OVERRIDE =
2836
TROUBLESHOOT_VERSION = v0.93.1
2937
KOTS_VERSION = v$(shell echo $(ADMIN_CONSOLE_CHART_VERSION) | sed 's/\([0-9]\+\.[0-9]\+\.[0-9]\+\).*/\1/')
3038
KOTS_BINARY_URL_OVERRIDE =
31-
LOCAL_ARTIFACT_MIRROR_IMAGE ?= registry.replicated.com/library/embedded-cluster-local-artifact-mirror
32-
LOCAL_ARTIFACT_MIRROR_IMAGE_LOCATION = ${LOCAL_ARTIFACT_MIRROR_IMAGE}:$(subst +,-,$(VERSION))
39+
LOCAL_ARTIFACT_MIRROR_IMAGE ?= replicated/embedded-cluster-local-artifact-mirror
40+
LOCAL_ARTIFACT_MIRROR_IMAGE_VERSION ?= $(subst +,-,$(VERSION))
41+
LOCAL_ARTIFACT_MIRROR_IMAGE_LOCATION = proxy.replicated.com/anonymous/$(LOCAL_ARTIFACT_MIRROR_IMAGE):$(LOCAL_ARTIFACT_MIRROR_IMAGE_VERSION)
3342
LD_FLAGS = -X github.com/replicatedhq/embedded-cluster/pkg/defaults.K0sVersion=$(K0S_VERSION) \
3443
-X github.com/replicatedhq/embedded-cluster/pkg/defaults.Version=$(VERSION) \
3544
-X github.com/replicatedhq/embedded-cluster/pkg/defaults.TroubleshootVersion=$(TROUBLESHOOT_VERSION) \
3645
-X github.com/replicatedhq/embedded-cluster/pkg/defaults.KubectlVersion=$(KUBECTL_VERSION) \
3746
-X github.com/replicatedhq/embedded-cluster/pkg/defaults.LocalArtifactMirrorImage=$(LOCAL_ARTIFACT_MIRROR_IMAGE_LOCATION) \
47+
-X github.com/replicatedhq/embedded-cluster/pkg/config/images.CoreDNSImage=$(COREDNS_IMAGE) \
48+
-X github.com/replicatedhq/embedded-cluster/pkg/config/images.CoreDNSVersion=$(COREDNS_VERSION) \
49+
-X github.com/replicatedhq/embedded-cluster/pkg/config/images.CalicoNodeImage=$(CALICO_NODE_IMAGE) \
50+
-X github.com/replicatedhq/embedded-cluster/pkg/config/images.CalicoNodeVersion=$(CALICO_NODE_VERSION) \
51+
-X github.com/replicatedhq/embedded-cluster/pkg/config/images.MetricsServerImage=$(METRICS_SERVER_IMAGE) \
52+
-X github.com/replicatedhq/embedded-cluster/pkg/config/images.MetricsServerVersion=$(METRICS_SERVER_VERSION) \
3853
-X github.com/replicatedhq/embedded-cluster/pkg/addons/adminconsole.ChartRepoOverride=$(ADMIN_CONSOLE_CHART_REPO_OVERRIDE) \
3954
-X github.com/replicatedhq/embedded-cluster/pkg/addons/adminconsole.Version=$(ADMIN_CONSOLE_CHART_VERSION) \
4055
-X github.com/replicatedhq/embedded-cluster/pkg/addons/adminconsole.ImageOverride=$(ADMIN_CONSOLE_IMAGE_OVERRIDE) \
4156
-X github.com/replicatedhq/embedded-cluster/pkg/addons/adminconsole.MigrationsImageOverride=$(ADMIN_CONSOLE_MIGRATIONS_IMAGE_OVERRIDE) \
57+
-X github.com/replicatedhq/embedded-cluster/pkg/addons/adminconsole.KurlProxyImageOverride=$(ADMIN_CONSOLE_KURL_PROXY_IMAGE_OVERRIDE) \
4258
-X github.com/replicatedhq/embedded-cluster/pkg/addons/adminconsole.KotsVersion=$(KOTS_VERSION) \
4359
-X github.com/replicatedhq/embedded-cluster/pkg/addons/embeddedclusteroperator.Version=$(EMBEDDED_OPERATOR_CHART_VERSION) \
44-
-X github.com/replicatedhq/embedded-cluster/pkg/addons/embeddedclusteroperator.UtilsImage=$(EMBEDDED_OPERATOR_UTILS_IMAGE) \
60+
-X github.com/replicatedhq/embedded-cluster/pkg/addons/embeddedclusteroperator.UtilsImage=$(EMBEDDED_OPERATOR_UTILS_IMAGE_LOCATION) \
4561
-X github.com/replicatedhq/embedded-cluster/pkg/addons/embeddedclusteroperator.ImageOverride=$(EMBEDDED_CLUSTER_OPERATOR_IMAGE_OVERRIDE) \
4662
-X github.com/replicatedhq/embedded-cluster/pkg/addons/openebs.Version=$(OPENEBS_CHART_VERSION) \
4763
-X github.com/replicatedhq/embedded-cluster/pkg/addons/openebs.UtilsVersion=$(OPENEBS_UTILS_VERSION) \
@@ -52,6 +68,8 @@ LD_FLAGS = -X github.com/replicatedhq/embedded-cluster/pkg/defaults.K0sVersion=$
5268
-X github.com/replicatedhq/embedded-cluster/pkg/addons/velero.VeleroTag=$(VELERO_IMAGE_VERSION) \
5369
-X github.com/replicatedhq/embedded-cluster/pkg/addons/velero.AwsPluginTag=$(VELERO_AWS_PLUGIN_IMAGE_VERSION)
5470

71+
export PATH := $(shell pwd)/bin:$(PATH)
72+
5573
.DEFAULT_GOAL := default
5674
default: embedded-cluster-linux-amd64
5775

@@ -89,7 +107,10 @@ pkg/goods/bins/kubectl-preflight: Makefile
89107

90108
pkg/goods/bins/local-artifact-mirror: Makefile
91109
mkdir -p pkg/goods/bins
92-
CGO_ENABLED=0 go build -o pkg/goods/bins/local-artifact-mirror ./cmd/local-artifact-mirror
110+
go build \
111+
-tags osusergo,netgo \
112+
-ldflags="-s -w -extldflags=-static" \
113+
-o pkg/goods/bins/local-artifact-mirror ./cmd/local-artifact-mirror
93114

94115
pkg/goods/internal/bins/kubectl-kots: Makefile
95116
mkdir -p pkg/goods/internal/bins
@@ -158,6 +179,8 @@ clean:
158179
rm -rf output
159180
rm -rf pkg/goods/bins
160181
rm -rf pkg/goods/internal/bins
182+
rm -rf build
183+
rm -rf bin
161184

162185
.PHONY: lint
163186
lint:
@@ -176,20 +199,134 @@ scan:
176199
--ignore-unfixed \
177200
./
178201

179-
print-%:
180-
@echo -n $($*)
202+
.PHONY: build-utils-image
203+
build-utils-image: export IMAGE ?= $(EMBEDDED_OPERATOR_UTILS_IMAGE):$(EMBEDDED_OPERATOR_UTILS_IMAGE_VERSION)
204+
build-utils-image: export VERSION ?= $(EMBEDDED_OPERATOR_UTILS_IMAGE_VERSION)
205+
build-utils-image: export MELANGE_CONFIG = deploy/packages/utils/melange.tmpl.yaml
206+
build-utils-image: export APKO_CONFIG = deploy/images/utils/apko.tmpl.yaml
207+
build-utils-image: apko-build
181208

182-
.PHONY: build-local-artifact-mirror-image
183-
build-local-artifact-mirror-image:
184-
docker build -t $(LOCAL_ARTIFACT_MIRROR_IMAGE_LOCATION) -f Dockerfile .
209+
.PHONY: build-and-push-utils-image
210+
build-and-push-utils-image: export IMAGE ?= $(EMBEDDED_OPERATOR_UTILS_IMAGE):$(EMBEDDED_OPERATOR_UTILS_IMAGE_VERSION)
211+
build-and-push-utils-image: export VERSION ?= $(EMBEDDED_OPERATOR_UTILS_IMAGE_VERSION)
212+
build-and-push-utils-image: export APKO_CONFIG = deploy/images/utils/apko.tmpl.yaml
213+
build-and-push-utils-image: apko-login apko-build-and-publish
185214

186-
.PHONY: push-local-artifact-mirror-image
187-
push-local-artifact-mirror-image:
188-
docker push $(LOCAL_ARTIFACT_MIRROR_IMAGE_LOCATION)
215+
.PHONY: build-local-artifact-mirror-image
216+
build-local-artifact-mirror-image: export IMAGE ?= $(LOCAL_ARTIFACT_MIRROR_IMAGE):$(LOCAL_ARTIFACT_MIRROR_IMAGE_VERSION)
217+
build-local-artifact-mirror-image: export VERSION ?= $(LOCAL_ARTIFACT_MIRROR_IMAGE_VERSION)
218+
build-local-artifact-mirror-image: export MELANGE_CONFIG = deploy/packages/local-artifact-mirror/melange.tmpl.yaml
219+
build-local-artifact-mirror-image: export APKO_CONFIG = deploy/images/local-artifact-mirror/apko.tmpl.yaml
220+
build-local-artifact-mirror-image: melange-build apko-build
189221

190222
.PHONY: build-and-push-local-artifact-mirror-image
191-
build-and-push-local-artifact-mirror-image: build-local-artifact-mirror-image push-local-artifact-mirror-image
223+
build-and-push-local-artifact-mirror-image: export IMAGE ?= $(LOCAL_ARTIFACT_MIRROR_IMAGE):$(LOCAL_ARTIFACT_MIRROR_IMAGE_VERSION)
224+
build-and-push-local-artifact-mirror-image: export VERSION ?= $(LOCAL_ARTIFACT_MIRROR_IMAGE_VERSION)
225+
build-and-push-local-artifact-mirror-image: export MELANGE_CONFIG = deploy/packages/local-artifact-mirror/melange.tmpl.yaml
226+
build-and-push-local-artifact-mirror-image: export APKO_CONFIG = deploy/images/local-artifact-mirror/apko.tmpl.yaml
227+
build-and-push-local-artifact-mirror-image: melange-build apko-login apko-build-and-publish
228+
229+
CHAINGUARD_TOOLS_USE_DOCKER = 0
230+
ifeq ($(CHAINGUARD_TOOLS_USE_DOCKER),"1")
231+
MELANGE_CACHE_DIR ?= /go/pkg/mod
232+
APKO_CMD = docker run -v $(shell pwd):/work -w /work -v $(shell pwd)/build/.docker:/root/.docker cgr.dev/chainguard/apko
233+
MELANGE_CMD = docker run --privileged --rm -v $(shell pwd):/work -w /work -v "$(shell go env GOMODCACHE)":${MELANGE_CACHE_DIR} cgr.dev/chainguard/melange
234+
else
235+
MELANGE_CACHE_DIR ?= build/.melange-cache
236+
APKO_CMD = apko
237+
MELANGE_CMD = melange
238+
endif
239+
240+
$(MELANGE_CACHE_DIR):
241+
mkdir -p $(MELANGE_CACHE_DIR)
242+
243+
.PHONY: apko-build
244+
apko-build: export ARCHS ?= amd64
245+
apko-build: check-env-IMAGE apko-template
246+
cd build && ${APKO_CMD} \
247+
build apko.yaml ${IMAGE} apko.tar \
248+
--arch ${ARCHS}
249+
250+
.PHONY: apko-build-and-publish
251+
apko-build-and-publish: export ARCHS ?= amd64
252+
apko-build-and-publish: check-env-IMAGE apko-template
253+
cd build && ${APKO_CMD} \
254+
publish apko.yaml ${IMAGE} \
255+
--arch ${ARCHS} | tee digest
256+
257+
.PHONY: apko-login
258+
apko-login:
259+
rm -f build/.docker/config.json
260+
@ { [ "${PASSWORD}" = "" ] || [ "${USERNAME}" = "" ] ; } || \
261+
${APKO_CMD} \
262+
login -u "${USERNAME}" \
263+
--password "${PASSWORD}" "${REGISTRY}"
264+
265+
.PHONY: melange-build
266+
melange-build: export ARCHS ?= amd64
267+
melange-build: $(MELANGE_CACHE_DIR) melange-template
268+
${MELANGE_CMD} \
269+
keygen build/melange.rsa
270+
${MELANGE_CMD} \
271+
build build/melange.yaml \
272+
--arch ${ARCHS} \
273+
--signing-key build/melange.rsa \
274+
--cache-dir=$(MELANGE_CACHE_DIR) \
275+
--source-dir . \
276+
--out-dir build/packages/
277+
278+
.PHONY: melange-template
279+
melange-template: check-env-MELANGE_CONFIG check-env-VERSION
280+
mkdir -p build
281+
envsubst '$${VERSION}' < ${MELANGE_CONFIG} > build/melange.yaml
282+
283+
.PHONY: apko-template
284+
apko-template: check-env-APKO_CONFIG check-env-VERSION
285+
mkdir -p build
286+
envsubst '$${VERSION}' < ${APKO_CONFIG} > build/apko.yaml
192287

193288
.PHONY: buildtools
194289
buildtools:
195290
go build -o ./output/bin/buildtools ./cmd/buildtools
291+
292+
.PHONY: cache-files
293+
cache-files: export EMBEDDED_OPERATOR_BINARY_URL_OVERRIDE
294+
cache-files:
295+
./scripts/cache-files.sh
296+
297+
## Location to install dependencies to
298+
LOCALBIN ?= $(shell pwd)/bin
299+
$(LOCALBIN):
300+
mkdir -p $(LOCALBIN)
301+
302+
## Tool Binaries
303+
MELANGE ?= $(LOCALBIN)/melange
304+
APKO ?= $(LOCALBIN)/apko
305+
306+
# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
307+
ifeq (,$(shell go env GOBIN))
308+
GOBIN=$(shell go env GOPATH)/bin
309+
else
310+
GOBIN=$(shell go env GOBIN)
311+
endif
312+
313+
melange: $(MELANGE)
314+
$(MELANGE): $(LOCALBIN)
315+
go install chainguard.dev/melange@latest && \
316+
test -s $(GOBIN)/melange && \
317+
ln -sf $(GOBIN)/melange $(LOCALBIN)/melange
318+
319+
apko: $(APKO)
320+
$(APKO): $(LOCALBIN)
321+
go install chainguard.dev/apko@latest && \
322+
test -s $(GOBIN)/apko && \
323+
ln -sf $(GOBIN)/apko $(LOCALBIN)/apko
324+
325+
print-%:
326+
@echo -n $($*)
327+
328+
check-env-%:
329+
@ if [ "${${*}}" = "" ]; then \
330+
echo "Environment variable $* not set"; \
331+
exit 1; \
332+
fi

0 commit comments

Comments
 (0)