diff --git a/.drone.yml b/.drone.yml deleted file mode 100644 index 312ac56..0000000 --- a/.drone.yml +++ /dev/null @@ -1,121 +0,0 @@ ---- -kind: pipeline -type: docker -name: linux-amd64 - -platform: - os: linux - arch: amd64 - -steps: -- name: build - pull: always - image: rancher/hardened-build-base:v1.21.8b1 - commands: - - make DRONE_TAG=${DRONE_TAG} - volumes: - - name: docker - path: /var/run/docker.sock - -- name: publish - image: rancher/hardened-build-base:v1.21.8b1 - commands: - - docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD - - make DRONE_TAG=${DRONE_TAG} image-push - environment: - DOCKER_PASSWORD: - from_secret: docker_password - DOCKER_USERNAME: - from_secret: docker_username - volumes: - - name: docker - path: /var/run/docker.sock - when: - event: - - tag - -- name: scan - image: rancher/hardened-build-base:v1.21.8b1 - commands: - - make DRONE_TAG=${DRONE_TAG} image-scan - volumes: - - name: docker - path: /var/run/docker.sock - -volumes: -- name: docker - host: - path: /var/run/docker.sock ---- -kind: pipeline -type: docker -name: linux-arm64 - -platform: - os: linux - arch: arm64 - -steps: -- name: build - pull: always - image: rancher/hardened-build-base:v1.21.8b1 - commands: - - make DRONE_TAG=${DRONE_TAG} - volumes: - - name: docker - path: /var/run/docker.sock - -- name: publish - image: rancher/hardened-build-base:v1.21.8b1 - commands: - - docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD - - make DRONE_TAG=${DRONE_TAG} image-push - environment: - DOCKER_PASSWORD: - from_secret: docker_password - DOCKER_USERNAME: - from_secret: docker_username - volumes: - - name: docker - path: /var/run/docker.sock - when: - event: - - tag - -- name: scan - image: rancher/hardened-build-base:v1.21.8b1 - commands: - - make DRONE_TAG=${DRONE_TAG} image-scan - volumes: - - name: docker - path: /var/run/docker.sock - -volumes: -- name: docker - host: - path: /var/run/docker.sock - ---- -kind: pipeline -type: docker -name: manifest -platform: - os: linux - arch: amd64 -steps: -- name: push - image: plugins/manifest:1.2.3 - settings: - password: - from_secret: docker_password - username: - from_secret: docker_username - spec: manifest.tmpl - ignore_missing: true - when: - event: - - tag -depends_on: -- linux-amd64 -- linux-arm64 -... diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml new file mode 100644 index 0000000..b58cb11 --- /dev/null +++ b/.github/workflows/build.yml @@ -0,0 +1,70 @@ +on: + push: + branches: + - master + pull_request: + +permissions: + contents: read + security-events: write # upload Sarif results + +name: Build +jobs: + build-amd64: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Set the TAG value + id: get-TAG + run: | + echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV" + - name: Build container image + uses: docker/build-push-action@v5 + with: + context: . + push: false + tags: rancher/hardened-k8s-metrics-server:${{ env.TAG }}-amd64 + file: Dockerfile + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@0.18.0 + with: + image-ref: rancher/hardened-k8s-metrics-server:${{ env.TAG }}-amd64 + ignore-unfixed: true + vuln-type: 'os,library' + severity: 'CRITICAL,HIGH' + format: 'sarif' + output: 'trivy-results.sarif' + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v3 + if: always() + with: + sarif_file: 'trivy-results.sarif' + + build-arm64: + runs-on: ubuntu-latest + steps: + - name: Check out code + uses: actions/checkout@v4 + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Set the TAG value + id: get-TAG + run: | + echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV" + - name: Build container image + uses: docker/build-push-action@v5 + with: + context: . + push: false + tags: rancher/hardened-k8s-metrics-server:${{ env.TAG }}-arm64 + file: Dockerfile + outputs: type=docker + platforms: linux/arm64 diff --git a/.github/workflows/image-push.yml b/.github/workflows/image-push.yml new file mode 100644 index 0000000..eb3da27 --- /dev/null +++ b/.github/workflows/image-push.yml @@ -0,0 +1,44 @@ +on: + release: + types: [published] + +permissions: + contents: read + +jobs: + push-multiarch: + permissions: + contents: read + id-token: write + runs-on: ubuntu-latest + steps: + - name: Check out code + uses: actions/checkout@v4 + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + + - name: "Read secrets" + uses: rancher-eio/read-vault-secrets@main + with: + secrets: | + secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials username | DOCKER_USERNAME ; + secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials password | DOCKER_PASSWORD + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Login to Container Registry + uses: docker/login-action@v3 + with: + username: ${{ env.DOCKER_USERNAME }} + password: ${{ env.DOCKER_PASSWORD }} + + - name: Build container image + uses: docker/build-push-action@v5 + with: + context: . + push: true + tags: rancher/hardened-k8s-metrics-server:${{ github.event.release.tag_name }} + file: Dockerfile + platforms: linux/amd64, linux/arm64 diff --git a/Dockerfile b/Dockerfile index ac49f90..f632e1c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -40,6 +40,6 @@ RUN if [ "${ARCH}" = "amd64" ]; then \ RUN install -s bin/* /usr/local/bin RUN metrics-server --help -FROM scratch +FROM scratch as k8s-metrics-server COPY --from=builder /usr/local/bin/metrics-server / ENTRYPOINT ["/metrics-server"] diff --git a/Makefile b/Makefile index d69a6ed..09401c1 100644 --- a/Makefile +++ b/Makefile @@ -18,38 +18,39 @@ PKG ?= github.com/kubernetes-incubator/metrics-server SRC ?= github.com/kubernetes-sigs/metrics-server TAG ?= v0.7.0$(BUILD_META) -ifneq ($(DRONE_TAG),) - TAG := $(DRONE_TAG) -endif - ifeq (,$(filter %$(BUILD_META),$(TAG))) -$(error TAG needs to end with build metadata: $(BUILD_META)) +$(error TAG $(TAG) needs to end with build metadata: $(BUILD_META)) endif .PHONY: image-build image-build: - docker build \ - --pull \ + docker buildx build \ + --platform=$(ARCH) \ --build-arg PKG=$(PKG) \ --build-arg SRC=$(SRC) \ - --build-arg ARCH=$(ARCH) \ --build-arg TAG=$(TAG:$(BUILD_META)=) \ + --build-arg ARCH=$(ARCH) \ + --target k8s-metrics-server \ --tag $(ORG)/hardened-k8s-metrics-server:$(TAG) \ --tag $(ORG)/hardened-k8s-metrics-server:$(TAG)-$(ARCH) \ + --load \ . .PHONY: image-push image-push: docker push $(ORG)/hardened-k8s-metrics-server:$(TAG)-$(ARCH) -.PHONY: image-manifest -image-manifest: - DOCKER_CLI_EXPERIMENTAL=enabled docker manifest create --amend \ - $(ORG)/hardened-k8s-metrics-server:$(TAG) \ - $(ORG)/hardened-k8s-metrics-server:$(TAG)-$(ARCH) - DOCKER_CLI_EXPERIMENTAL=enabled docker manifest push \ - $(ORG)/hardened-k8s-metrics-server:$(TAG) - .PHONY: image-scan image-scan: trivy image --severity $(SEVERITIES) --no-progress --ignore-unfixed $(ORG)/hardened-k8s-metrics-server:$(TAG) + + +PHONY: log +log: + @echo "ARCH=$(ARCH)" + @echo "TAG=$(TAG)" + @echo "ORG=$(ORG)" + @echo "PKG=$(PKG)" + @echo "SRC=$(SRC)" + @echo "BUILD_META=$(BUILD_META)" + @echo "UNAME_M=$(UNAME_M)" diff --git a/manifest.tmpl b/manifest.tmpl deleted file mode 100644 index 4838305..0000000 --- a/manifest.tmpl +++ /dev/null @@ -1,17 +0,0 @@ -image: rancher/hardened-k8s-metrics-server:{{build.tag}} -manifests: - - - image: rancher/hardened-k8s-metrics-server:{{build.tag}}-amd64 - platform: - architecture: amd64 - os: linux - - - image: rancher/hardened-k8s-metrics-server:{{build.tag}}-arm64 - platform: - architecture: arm64 - os: linux - - - image: rancher/hardened-k8s-metrics-server:{{build.tag}}-s390x - platform: - architecture: s390x - os: linux