chore: update image build

Signed-off-by: Maryam Tahhan <[email protected]>
redhat-et · Jan 15, 2025 · 5c2d7f9 · 5c2d7f9
1 parent 7862850
commit 5c2d7f9
Show file tree

Hide file tree

Showing 5 changed files with 77 additions and 39 deletions.
diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml
@@ -1,51 +1,85 @@
-name: Build AF_XDP Device Plugin Image
+name: image
 
-on:
-    push:
+on: # yamllint disable-line rule:truthy
+  push:
     branches:
       - main
     paths:
       - .github/workflows/build-image.yml
-      - images/amd64.dockerfile
+      - ./images/amd64.dockerfile
   pull_request:
     paths:
       - .github/workflows/build-image.yml
-      - images/amd64.dockerfile
+      - ./images/amd64.dockerfile
   workflow_dispatch:
 
 jobs:
-  build-image:
+  image_build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+      packages: write
     strategy:
       fail-fast: false
       matrix:
         include:
-          - registry: quay.io
-            organization: afxdp-plugins-for-kubernetes
-            image: afxdp-device-plugin
-            dockerfile: ./images/amd64.dockerfile
-            context: .
-            tags: 'latest'
+          - IMAGE_NAME: afxdp-dp-plugin
+            IMAGE_FILE: ./images/amd64.dockerfile
+            PLATFORMS: linux/amd64
+            LABEL: latest
 
     steps:
-     - uses: actions/checkout@v4
-
-     - name: Set up Docker Buildx
-       uses: docker/setup-buildx-action@v3
-
-     - name: Login to quay.io
-       uses: docker/login-action@v3
-       with:
-          registry: ${{matrix.registry}}/${{matrix.organization}}
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
-
-     - name: Build and push image
-       uses: docker/build-push-action@v5
-       with:
-          push: true
-          tags: ${{matrix.registry}}/${{matrix.organization}}/${{matrix.image}}:${{matrix.tags}}
-          labels: 'latest'
-          file: ${{ matrix.dockerfile }}
-          build-args: ${{ matrix.build_args }}
-          context: ${{ matrix.context }}
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # NOTE:  setting fetch-depth to 0 to retrieve the entire history
+          # instead of a shallow-clone so that all tags are fetched as well.
+          # This is necessary for computing the VERSION using `git describe`
+          fetch-depth: 0
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          image: tonistiigi/binfmt:qemu-v8.1.5
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Set up cosign
+        uses: sigstore/cosign-installer@main
+
+      - name: Login to Quay
+        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
+        uses: docker/login-action@v3
+        with:
+          registry: quay.io/afxdp-plugins-for-kubernete
+          username: ${{ secrets.quay_username }}
+          password: ${{ secrets.quay_robot_token }}
+
+      - name: Build and (conditionally) push image
+        id: build-push-image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: ${{ matrix.PLATFORMS }}
+          push: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
+          tags: quay.io/afxdp-plugins-for-kubernete/${{ matrix.IMAGE_NAME }}:${{ matrix.LABEL }}
+          labels: ${{ matrix.LABEL }}
+          build-args: ${{matrix.BUILD_ARGS}}
+          file: ${{ matrix.IMAGE_FILE }}
+
+      - name: Sign images with GitHub OIDC Token
+        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
+        run: |
+          cosign sign -y quay.io/afxdp-plugins-for-kubernete/${{ matrix.IMAGE_NAME }}:${{ matrix.LABEL }}@${{ steps.build-push-image.outputs.digest }}
+
+      - name: Generate image attestation
+        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
+
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: quay.io/afxdp-plugins-for-kubernete/${{ matrix.IMAGE_NAME }}
+          subject-digest: ${{ steps.build-push-image.outputs.digest }}
+          push-to-registry: true
diff --git a/.github/workflows/public-ci.yml b/.github/workflows/public-ci.yml
@@ -62,7 +62,7 @@ jobs:
           && pkg-config --libs --static libelf
 
     - name: Run build
-      run: make build
+      run: make fixup && make build
 
 # go-static-tools scans code base and packages using go-vet, go mod verify and staticcheck
   go-static-tools:
@@ -98,7 +98,7 @@ jobs:
           && pkg-config --libs --static libelf
 
     - name: Install staticcheck
-      run: go install honnef.co/go/tools/cmd/staticcheck@latest
+      run: go install honnef.co/go/tools/cmd/staticcheck@v0.4.0
 
     - name: run static analysis
       run: make static-ci

diff --git a/Makefile b/Makefile
@@ -70,6 +70,9 @@ buildcni: buildc
 
 build: builddp buildcni
 
+fixup:
+	@sed -i "s/LDFLAGS: -L. -lxdp -lbpf -lelf -lz/LDFLAGS: -L. -lxdp -lbpf -lelf -lz -lzstd/g" internal/bpf/bpfWrapper.go
+
 ##@ Container build.
 image-builder-check:
 	@if [ -z '$(CTR_CMD)' ] ; then echo '!! ERROR: containerized builds require podman||docker CLI, none found $$PATH' >&2 && exit 1; fi

diff --git a/images/amd64.dockerfile b/images/amd64.dockerfile
@@ -16,7 +16,7 @@ FROM golang:1.20@sha256:efe38cb419e2b2012f66d1782d2efe2fd8884c71d9f342581e1697ba
 COPY . /usr/src/afxdp_k8s_plugins
 WORKDIR /usr/src/afxdp_k8s_plugins
 RUN apt-get update \
-&& apt-get -y install --no-install-recommends libxdp-dev=1.3.1-1 zstd \
+&& apt-get -y install --no-install-recommends libxdp-dev=1.3.1-1 \
 && apt-get -y install -o APT::Keep-Downloaded-Packages=false --no-install-recommends clang=1:14.0-55.7~deb12u1 \
 && apt-get -y install -o APT::Keep-Downloaded-Packages=false --no-install-recommends llvm=1:14.0-55.7~deb12u1 \
 && apt-get -y install -o APT::Keep-Downloaded-Packages=false --no-install-recommends gcc-multilib=4:12.2.0-3 \
@@ -30,11 +30,12 @@ RUN apk add --no-cache build-base~=0.5-r3 \
 && apk add --no-cache libxdp-dev~=1.2.10-r0 \
 && apk add --no-cache libbpf-dev~=1.0.1-r0 \
 && apk add --no-cache llvm15~=15.0.7-r0 \
-&& apk add --no-cache clang15~=15.0.7-r0 zstd \
+&& apk add --no-cache clang15~=15.0.7-r0 \
+&& apk add --no-cache \
 && make builddp
 
 FROM amd64/alpine:3.18@sha256:25fad2a32ad1f6f510e528448ae1ec69a28ef81916a004d3629874104f8a7f70
-RUN apk --no-cache -U add iproute2-rdma~=6.3.0-r0 acl~=2.3 zstd\
+RUN apk --no-cache -U add iproute2-rdma~=6.3.0-r0 acl~=2.3 \
       && apk add --no-cache xdp-tools~=1.2.10-r0
 COPY --from=cnibuilder /usr/src/afxdp_k8s_plugins/bin/afxdp /afxdp/afxdp
 COPY --from=dpbuilder /usr/src/afxdp_k8s_plugins/bin/afxdp-dp /afxdp/afxdp-dp

diff --git a/internal/bpf/bpfWrapper.go b/internal/bpf/bpfWrapper.go
@@ -19,7 +19,7 @@ package bpf
 //#include <xdp/libxdp.h>
 //#include <xdp/xsk.h>
 //#cgo CFLAGS: -I.
-//#cgo LDFLAGS: -L. -lxdp -lbpf -lelf -lz -lzstd
+//#cgo LDFLAGS: -L. -lxdp -lbpf -lelf -lz
 //#include "bpfWrapper.h"
 //#include "log.h"
 import "C"