diff --git a/.drone.yml b/.drone.yml deleted file mode 100644 index 2729e1e..0000000 --- a/.drone.yml +++ /dev/null @@ -1,143 +0,0 @@ ---- -kind: pipeline -type: docker -name: linux-amd64 - -platform: - os: linux - arch: amd64 - -steps: -- name: build - pull: always - image: rancher/hardened-build-base:v1.20.7b3 - commands: - - make DRONE_TAG=${DRONE_TAG} - volumes: - - name: docker - path: /var/run/docker.sock - when: - ref: - include: - - refs/heads/main - - refs/pull/** - - refs/tags/* - -- name: publish - image: rancher/hardened-build-base:v1.20.7b3 - commands: - - docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD - - make DRONE_TAG=${DRONE_TAG} image-push - environment: - DOCKER_PASSWORD: - from_secret: docker_password - DOCKER_USERNAME: - from_secret: docker_username - volumes: - - name: docker - path: /var/run/docker.sock - when: - event: - - tag - -- name: scan - image: rancher/hardened-build-base:v1.20.7b3 - commands: - - make DRONE_TAG=${DRONE_TAG} image-scan - volumes: - - name: docker - path: /var/run/docker.sock - when: - ref: - include: - - refs/heads/main - - refs/pull/** - - refs/tags/* - -volumes: -- name: docker - host: - path: /var/run/docker.sock ---- -kind: pipeline -type: docker -name: linux-arm64 - -platform: - os: linux - arch: arm64 - -steps: -- name: build - pull: always - image: rancher/hardened-build-base:v1.20.7b3 - commands: - - make DRONE_TAG=${DRONE_TAG} - volumes: - - name: docker - path: /var/run/docker.sock - when: - ref: - include: - - refs/heads/main - - refs/pull/** - - refs/tags/* - -- name: publish - image: rancher/hardened-build-base:v1.20.7b3 - commands: - - docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD - - make DRONE_TAG=${DRONE_TAG} image-push - environment: - DOCKER_PASSWORD: - from_secret: docker_password - DOCKER_USERNAME: - from_secret: docker_username - volumes: - - name: docker - path: /var/run/docker.sock - when: - event: - - tag - -- name: scan - image: rancher/hardened-build-base:v1.20.7b3 - commands: - - make DRONE_TAG=${DRONE_TAG} image-scan - volumes: - - name: docker - path: /var/run/docker.sock - when: - ref: - include: - - refs/heads/main - - refs/pull/** - - refs/tags/* - -volumes: -- name: docker - host: - path: /var/run/docker.sock ---- -kind: pipeline -type: docker -name: manifest -platform: - os: linux - arch: amd64 -steps: -- name: push - image: plugins/manifest:1.2.3 - settings: - password: - from_secret: docker_password - username: - from_secret: docker_username - spec: manifest.tmpl - ignore_missing: true - when: - event: - - tag -depends_on: -- linux-amd64 -- linux-arm64 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml new file mode 100644 index 0000000..c173deb --- /dev/null +++ b/.github/workflows/build.yml @@ -0,0 +1,70 @@ +on: + push: + branches: + - master + pull_request: + +permissions: + contents: read + security-events: write # upload Sarif results + +name: Build +jobs: + build-amd64: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Set the TAG value + id: get-TAG + run: | + echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV" + - name: Build container image + uses: docker/build-push-action@v5 + with: + context: . + push: false + tags: rancher/hardened-cluster-autoscaler:${{ env.TAG }}-amd64 + file: Dockerfile + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@0.18.0 + with: + image-ref: rancher/hardened-cluster-autoscaler:${{ env.TAG }}-amd64 + ignore-unfixed: true + vuln-type: 'os,library' + severity: 'CRITICAL,HIGH' + format: 'sarif' + output: 'trivy-results.sarif' + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v3 + if: always() + with: + sarif_file: 'trivy-results.sarif' + + build-arm64: + runs-on: ubuntu-latest + steps: + - name: Check out code + uses: actions/checkout@v4 + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Set the TAG value + id: get-TAG + run: | + echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV" + - name: Build container image + uses: docker/build-push-action@v5 + with: + context: . + push: false + tags: rancher/hardened-cluster-autoscaler:${{ env.TAG }}-arm64 + file: Dockerfile + outputs: type=docker + platforms: linux/arm64 diff --git a/.github/workflows/image-push.yml b/.github/workflows/image-push.yml new file mode 100644 index 0000000..e15eceb --- /dev/null +++ b/.github/workflows/image-push.yml @@ -0,0 +1,34 @@ +on: + release: + types: [published] + +permissions: + contents: read + +jobs: + push-multiarch: + runs-on: ubuntu-latest + steps: + - name: Check out code + uses: actions/checkout@v4 + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Login to Container Registry + uses: docker/login-action@v3 + with: + username: ${{ secrets.docker_username }} + password: ${{ secrets.docker_password }} + + - name: Build container image + uses: docker/build-push-action@v5 + with: + context: . + push: true + tags: rancher/hardened-cluster-autoscaler:${{ github.event.release.tag_name }} + file: Dockerfile + platforms: linux/amd64, linux/arm64 diff --git a/Dockerfile b/Dockerfile index de63da3..666f677 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,7 +13,7 @@ FROM base-builder as autoscaler-builder ARG SRC=github.com/kubernetes-sigs/cluster-proportional-autoscaler ARG PKG=github.com/kubernetes-sigs/cluster-proportional-autoscaler RUN git clone --depth=1 https://${SRC}.git $GOPATH/src/${PKG} -ARG TAG=1.8.10 +ARG TAG=v1.8.10 ARG ARCH="amd64" WORKDIR $GOPATH/src/${PKG} RUN git fetch --all --tags --prune diff --git a/Makefile b/Makefile index bc4ab11..cfafe8d 100644 --- a/Makefile +++ b/Makefile @@ -17,17 +17,14 @@ SRC ?= github.com/kubernetes-sigs/cluster-proportional-autoscaler TAG ?= v1.8.10$(BUILD_META) export DOCKER_BUILDKIT?=1 -ifneq ($(DRONE_TAG),) - TAG := $(DRONE_TAG) -endif - ifeq (,$(filter %$(BUILD_META),$(TAG))) - $(error TAG needs to end with build metadata: $(BUILD_META)) + $(error TAG $(TAG) needs to end with build metadata: $(BUILD_META)) endif .PHONY: image-build image-build: - docker build \ + docker buildx build \ + --platform=$(ARCH) \ --pull \ --build-arg PKG=$(PKG) \ --build-arg SRC=$(SRC) \ @@ -53,3 +50,14 @@ image-manifest: .PHONY: image-scan image-scan: trivy image --severity $(SEVERITIES) --no-progress --ignore-unfixed $(ORG)/hardened-cluster-autoscaler:$(TAG) + +PHONY: log +log: + @echo "ARCH=$(ARCH)" + @echo "TAG=$(TAG)" + @echo "ORG=$(ORG)" + @echo "PKG=$(PKG)" + @echo "SRC=$(SRC)" + @echo "BUILD_META=$(BUILD_META)" + @echo "K3S_ROOT_VERSION=$(K3S_ROOT_VERSION)" + @echo "UNAME_M=$(UNAME_M)" diff --git a/manifest.tmpl b/manifest.tmpl deleted file mode 100644 index 7d5d3b7..0000000 --- a/manifest.tmpl +++ /dev/null @@ -1,12 +0,0 @@ -image: rancher/hardened-cluster-autoscaler:{{build.tag}} -manifests: - - - image: rancher/hardened-cluster-autoscaler:{{build.tag}}-amd64 - platform: - architecture: amd64 - os: linux - - - image: rancher/hardened-cluster-autoscaler:{{build.tag}}-arm64 - platform: - architecture: arm64 - os: linux diff --git a/updatecli/updatecli.d/updatebuildbase.yaml b/updatecli/updatecli.d/updatebuildbase.yaml index de7cf1f..e7f3d81 100644 --- a/updatecli/updatecli.d/updatebuildbase.yaml +++ b/updatecli/updatecli.d/updatebuildbase.yaml @@ -42,16 +42,6 @@ targets: transformers: - addprefix: "rancher/hardened-build-base:" - drone: - name: "Bump to latest build base version in Dockerfile" - kind: file - scmid: default - disablesourceinput: true - spec: - file: .drone.yml - matchpattern: '(?m)^ image: rancher/hardened-build-base:(.*)' - replacepattern: ' image: rancher/hardened-build-base:{{ source "buildbase" }}' - scms: default: kind: github