Skip to content
This repository was archived by the owner on Apr 24, 2024. It is now read-only.

Commit 7fa5207

Browse files
lennartacklennartack
committed
Add docker github action
1 parent e7dced1 commit 7fa5207

File tree

4 files changed

+121
-35
lines changed

4 files changed

+121
-35
lines changed

‎.github/workflows/docker-publish.yaml

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
name: Docker
2+
3+
# This workflow uses actions that are not certified by GitHub.
4+
# They are provided by a third-party and are governed by
5+
# separate terms of service, privacy policy, and support
6+
# documentation.
7+
8+
on:
9+
push:
10+
branches: ["main"]
11+
tags: ["*.*.*"]
12+
# pull_request:
13+
# branches: ["main"]
14+
15+
env:
16+
# Use docker.io for Docker Hub if empty
17+
REGISTRY: ghcr.io
18+
# github.repository as <account>/<repo>
19+
IMAGE_PREFIX: ${{ github.repository }}
20+
21+
jobs:
22+
build:
23+
runs-on: ubuntu-latest
24+
strategy:
25+
fail-fast: false
26+
image: controller
27+
permissions:
28+
contents: read
29+
packages: write
30+
# This is used to complete the identity challenge
31+
# with sigstore/fulcio when running outside of PRs.
32+
id-token: write
33+
34+
steps:
35+
# Install the cosign tool except on PR
36+
# https://github.com/sigstore/cosign-installer
37+
- name: Install cosign
38+
if: github.event_name != 'pull_request'
39+
uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1
40+
with:
41+
cosign-release: 'v2.1.1'
42+
43+
# Set up BuildKit Docker container builder to be able to build
44+
# multi-platform images and export cache
45+
# https://github.com/docker/setup-buildx-action
46+
- name: Set up Docker Buildx
47+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
48+
49+
# Login against a Docker registry except on PR
50+
# https://github.com/docker/login-action
51+
- name: Log into registry ${{ env.REGISTRY }}
52+
if: github.event_name != 'pull_request'
53+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
54+
with:
55+
registry: ${{ env.REGISTRY }}
56+
username: ${{ github.actor }}
57+
password: ${{ secrets.GITHUB_TOKEN }}
58+
59+
# Extract metadata (tags, labels) for Docker
60+
# https://github.com/docker/metadata-action
61+
- name: Extract Docker metadata
62+
id: meta
63+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
64+
with:
65+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/${{ matrix.image }}
66+
67+
# Build and push Docker image with Buildx (don't push on PR)
68+
# https://github.com/docker/build-push-action
69+
- name: Build and push Docker image
70+
id: build-and-push
71+
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
72+
with:
73+
push: ${{ github.event_name != 'pull_request' }}
74+
tags: ${{ steps.meta.outputs.tags }}
75+
labels: ${{ steps.meta.outputs.labels }}
76+
cache-from: type=gha
77+
cache-to: type=gha,mode=max
78+
79+
# Sign the resulting Docker image digest except on PRs.
80+
# This will only write to the public Rekor transparency log when the Docker
81+
# repository is public to avoid leaking data. If you would like to publish
82+
# transparency data even for private images, pass --force to cosign below.
83+
# https://github.com/sigstore/cosign
84+
- name: Sign the published Docker image
85+
if: ${{ github.event_name != 'pull_request' }}
86+
env:
87+
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
88+
TAGS: ${{ steps.meta.outputs.tags }}
89+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
90+
# This step uses the identity token to provision an ephemeral certificate
91+
# against the sigstore community Fulcio instance.
92+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎Makefile

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ BUNDLE_METADATA_OPTS ?= $(BUNDLE_CHANNELS) $(BUNDLE_DEFAULT_CHANNEL)
2929
#
3030
# For example, running 'make bundle-build bundle-push catalog-build catalog-push' will build and push both
3131
# k8s.delta10.nl/dns-resolution-operator-bundle:$VERSION and k8s.delta10.nl/dns-resolution-operator-catalog:$VERSION.
32-
IMAGE_TAG_BASE ?= k8s.delta10.nl/dns-resolution-operator
32+
IMAGE_TAG_BASE ?= delta10.nl/dns-resolution-operator
3333

3434
# BUNDLE_IMG defines the image:tag used for the bundle.
3535
# You can use it as an arg. (E.g make bundle-build BUNDLE_IMG=<some-registry>/<project-name-bundle>:<tag>)
@@ -51,7 +51,7 @@ endif
5151
OPERATOR_SDK_VERSION ?= v1.33.0
5252

5353
# Image URL to use all building/pushing image targets
54-
IMG ?= controller:latest
54+
IMG ?= dns-resolution-operator:${VERSION}
5555
# ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
5656
ENVTEST_K8S_VERSION = 1.27.1
5757

@@ -188,10 +188,20 @@ KUBECTL ?= kubectl
188188
KUSTOMIZE ?= $(LOCALBIN)/kustomize
189189
CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
190190
ENVTEST ?= $(LOCALBIN)/setup-envtest
191+
HELMIFY = $(LOCALBIN)/helmify
191192

192193
## Tool Versions
193194
KUSTOMIZE_VERSION ?= v5.0.1
194195
CONTROLLER_TOOLS_VERSION ?= v0.12.0
196+
HELMIFY_VERSION ?= v0.4.10
197+
198+
.PHONY: helmify
199+
helmify: $(HELMIFY) ## Download helmify locally if necessary.
200+
$(HELMIFY): $(LOCALBIN)
201+
test -s $(LOCALBIN)/helmify || GOBIN=$(LOCALBIN) go install github.com/arttor/helmify/cmd/helmify@${HELMIFY_VERSION}
202+
203+
helm: manifests kustomize helmify
204+
$(KUSTOMIZE) build config/default | $(HELMIFY) -crd-dir
195205

196206
.PHONY: kustomize
197207
kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary. If wrong version is installed, it will be removed before downloading.

‎config/default/kustomization.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Adds namespace to all resources.
2-
namespace: dns-resolution-operator-system
2+
namespace: dns-resolution-operator
33

44
# Value of this field is prepended to the
55
# names of all resources, e.g. a deployment named

‎config/manager/manager.yaml

Lines changed: 16 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -36,35 +36,21 @@ spec:
3636
labels:
3737
control-plane: controller-manager
3838
spec:
39-
# TODO(user): Uncomment the following code to configure the nodeAffinity expression
40-
# according to the platforms which are supported by your solution.
41-
# It is considered best practice to support multiple architectures. You can
42-
# build your manager image using the makefile target docker-buildx.
43-
# affinity:
44-
# nodeAffinity:
45-
# requiredDuringSchedulingIgnoredDuringExecution:
46-
# nodeSelectorTerms:
47-
# - matchExpressions:
48-
# - key: kubernetes.io/arch
49-
# operator: In
50-
# values:
51-
# - amd64
52-
# - arm64
53-
# - ppc64le
54-
# - s390x
55-
# - key: kubernetes.io/os
56-
# operator: In
57-
# values:
58-
# - linux
39+
affinity:
40+
nodeAffinity:
41+
requiredDuringSchedulingIgnoredDuringExecution:
42+
nodeSelectorTerms:
43+
- matchExpressions:
44+
- key: kubernetes.io/arch
45+
operator: In
46+
values:
47+
- amd64
48+
- key: kubernetes.io/os
49+
operator: In
50+
values:
51+
- linux
5952
securityContext:
6053
runAsNonRoot: true
61-
# TODO(user): For common cases that do not require escalating privileges
62-
# it is recommended to ensure that all your Pods/Containers are restrictive.
63-
# More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
64-
# Please uncomment the following code if your project does NOT have to work on old Kubernetes
65-
# versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
66-
# seccompProfile:
67-
# type: RuntimeDefault
6854
containers:
6955
- command:
7056
- /manager
@@ -89,14 +75,12 @@ spec:
8975
port: 8081
9076
initialDelaySeconds: 5
9177
periodSeconds: 10
92-
# TODO(user): Configure the resources accordingly based on the project requirements.
93-
# More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
9478
resources:
9579
limits:
9680
cpu: 500m
97-
memory: 128Mi
81+
memory: 512Mi
9882
requests:
99-
cpu: 10m
100-
memory: 64Mi
83+
cpu: 100m
84+
memory: 128Mi
10185
serviceAccountName: controller-manager
10286
terminationGracePeriodSeconds: 10

0 commit comments

Comments
 (0)