Skip to content

Commit ff390bb

Browse files
fiddlermikeyfiddlermikey
authored
Merge pull request #11 from Keyfactor/main
Configurable metrics RBAC, custom Command metadata
2 parents 09ff154 + 037e9d9 commit ff390bb

31 files changed

+1483
-763
lines changed

‎.github/workflows/release.yml‎

Lines changed: 186 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,213 @@
1-
name: helm_release
1+
name: Build and Release
22
on:
3+
push:
4+
branches:
5+
- '*'
36
pull_request:
47
branches:
58
- 'v*'
69
types:
10+
# action should run when the pull request is closed
11+
# (regardless of whether it was merged or just closed)
712
- closed
13+
# Make sure the action runs every time new commits are
14+
# pushed to the pull request's branch
15+
- synchronize
16+
17+
env:
18+
REGISTRY: ghcr.io
19+
820
jobs:
21+
build:
22+
name: Build Containers
23+
runs-on: ubuntu-latest
24+
strategy:
25+
fail-fast: false
26+
matrix:
27+
platform:
28+
- linux/arm64
29+
- linux/amd64
30+
- linux/s390x
31+
- linux/ppc64le
32+
33+
permissions:
34+
contents: read
35+
packages: write
36+
37+
steps:
38+
39+
- name: Set IMAGE_NAME
40+
run: |
41+
echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >>${GITHUB_ENV}
42+
43+
# Checkout code
44+
# https://github.com/actions/checkout
45+
- name: Checkout code
46+
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
47+
48+
# Extract metadata (tags, labels) for Docker
49+
# https://github.com/docker/metadata-action
50+
- name: Extract Docker metadata
51+
id: meta
52+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
53+
with:
54+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
55+
56+
# Set up QEMU
57+
# https://github.com/docker/setup-qemu-action
58+
- name: Set up QEMU
59+
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
60+
61+
# Set up BuildKit Docker container builder to be able to build
62+
# multi-platform images and export cache
63+
# https://github.com/docker/setup-buildx-action
64+
- name: Set up Docker Buildx
65+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
66+
67+
# Login to Docker registry
68+
# https://github.com/docker/login-action
69+
- name: Log into registry ${{ env.REGISTRY }}
70+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
71+
with:
72+
registry: ${{ env.REGISTRY }}
73+
username: ${{ github.actor }}
74+
password: ${{ secrets.GITHUB_TOKEN }}
75+
76+
# Build and push Docker image with Buildx
77+
# https://github.com/docker/build-push-action
78+
- name: Build and push Docker image
79+
id: build
80+
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
81+
with:
82+
context: .
83+
platforms: ${{ matrix.platform }}
84+
labels: ${{ steps.meta.outputs.labels }}
85+
push: ${{ github.event.pull_request.merged == true }}
86+
outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true
87+
88+
# Export digest
89+
- name: Export digest
90+
if: github.event.pull_request.merged == true
91+
run: |
92+
mkdir -p /tmp/digests
93+
digest="${{ steps.build.outputs.digest }}"
94+
touch "/tmp/digests/${digest#sha256:}"
95+
96+
# Upload digest
97+
- name: Upload digest
98+
if: github.event.pull_request.merged == true
99+
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
100+
with:
101+
name: digests
102+
path: /tmp/digests/*
103+
if-no-files-found: error
104+
retention-days: 1
105+
106+
merge:
107+
runs-on: ubuntu-latest
108+
if: github.event.pull_request.merged == true
109+
needs:
110+
- build
111+
steps:
112+
- name: Set IMAGE_NAME
113+
run: |
114+
echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >>${GITHUB_ENV}
115+
116+
# Download digests
117+
# https://github.com/actions/download-artifact
118+
- name: Download digests
119+
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
120+
with:
121+
name: digests
122+
path: /tmp/digests
123+
124+
# Set up BuildKit Docker container builder to be able to build
125+
# multi-platform images and export cache
126+
# https://github.com/docker/setup-buildx-action
127+
- name: Set up Docker Buildx
128+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
129+
130+
# Extract metadata (tags, labels) for Docker
131+
# https://github.com/docker/metadata-action
132+
- name: Extract Docker metadata
133+
id: meta
134+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
135+
with:
136+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
137+
138+
# Login to Docker registry
139+
# https://github.com/docker/login-action
140+
- name: Log into registry ${{ env.REGISTRY }}
141+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
142+
with:
143+
registry: ${{ env.REGISTRY }}
144+
username: ${{ github.actor }}
145+
password: ${{ secrets.GITHUB_TOKEN }}
146+
147+
# Create manifest list and push
148+
- name: Create manifest list and push
149+
working-directory: /tmp/digests
150+
run: |
151+
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
152+
$(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
153+
154+
- name: Inspect image
155+
run: |
156+
docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
157+
9158
helm:
10159
runs-on: ubuntu-latest
11160
if: github.event.pull_request.merged == true
161+
needs:
162+
- merge
12163
steps:
13-
- name: Extract Version Tag
14-
id: extract_version
15-
run: /bin/bash -c 'echo ::set-output name=VERSION::$(echo ${GITHUB_REF##*/} | cut -c2-)'
164+
- name: Set IMAGE_NAME
165+
run: |
166+
echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >>${GITHUB_ENV}
167+
168+
# Checkout code
169+
# https://github.com/actions/checkout
170+
- name: Checkout code
171+
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
172+
173+
# Extract metadata (tags, labels) to use in Helm chart
174+
# https://github.com/docker/metadata-action
175+
- name: Extract Docker metadata
176+
id: meta
177+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
178+
with:
179+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
16180

17-
- name: Checkout
18-
uses: actions/checkout@v3
181+
# Set version from DOCKER_METADATA_OUTPUT_VERSION as environment variable
182+
- name: Set Version
183+
run: |
184+
echo "VERSION=${DOCKER_METADATA_OUTPUT_VERSION:1}" >> $GITHUB_ENV
19185
20186
# Change version and appVersion in Chart.yaml to the tag in the closed PR
21187
- name: Update Helm App/Chart Version
22188
shell: bash
23189
run: |
24-
sed -i "s/^version: .*/version: ${{ steps.extract_version.outputs.VERSION }}/g" deploy/charts/command-cert-manager-issuer/Chart.yaml
25-
sed -i "s/^appVersion: .*/appVersion: \"${{ steps.extract_version.outputs.VERSION }}\"/g" deploy/charts/command-cert-manager-issuer/Chart.yaml
190+
sed -i "s/^version: .*/version: ${{ env.VERSION }}/g" deploy/charts/command-cert-manager-issuer/Chart.yaml
191+
sed -i "s/^appVersion: .*/appVersion: \"${{ env.DOCKER_METADATA_OUTPUT_VERSION }}\"/g" deploy/charts/command-cert-manager-issuer/Chart.yaml
192+
193+
# Setup Helm
194+
# https://github.com/Azure/setup-helm
195+
- name: Install Helm
196+
uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
197+
with:
198+
token: ${{ secrets.GITHUB_TOKEN }}
26199

200+
# Helm requires an ident name to be set for chart-releaser to work
27201
- name: Configure Git
28202
run: |
29203
git config user.name "$GITHUB_ACTOR"
30204
git config user.email "[email protected]"
31205
32-
- name: Install Helm
33-
uses: azure/setup-helm@v3
34-
206+
# Build and release Helm chart to GitHub Pages
207+
# https://github.com/helm/chart-releaser-action
35208
- name: Run chart-releaser
36-
uses: helm/[email protected]
209+
uses: helm/chart-releaser-action@be16258da8010256c6e82849661221415f031968 # v1.5.0
37210
env:
38211
CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
39212
with:
40-
pages_branch: gh-pages
41-
charts_dir: deploy/charts
42-
mark_as_latest: true
43-
packages_with_index: true
213+
charts_dir: deploy/charts

‎.github/workflows/test.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: test
2+
on: [workflow_dispatch, push, pull_request]
3+
jobs:
4+
build:
5+
name: Build and Lint
6+
runs-on: ubuntu-latest
7+
timeout-minutes: 5
8+
steps:
9+
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
10+
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
11+
with:
12+
go-version-file: 'go.mod'
13+
cache: true
14+
- run: go mod download
15+
- run: go build -v .
16+
- name: Run linters
17+
uses: golangci/golangci-lint-action@08e2f20817b15149a52b5b3ebe7de50aff2ba8c5 # v3.4.0
18+
with:
19+
version: latest
20+
test:
21+
name: Go Test
22+
needs: build
23+
runs-on: ubuntu-latest
24+
timeout-minutes: 5
25+
steps:
26+
- name: Checkout
27+
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
28+
- name: Set up Go 1.x
29+
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
30+
with:
31+
go-version-file: 'go.mod'
32+
cache: true
33+
- run: go mod download
34+
- env:
35+
COMMAND_CERTIFICATE_AUTHORITY_HOSTNAME: ${{ vars.COMMAND_CERTIFICATE_AUTHORITY_HOSTNAME }}
36+
COMMAND_CERTIFICATE_AUTHORITY_LOGICAL_NAME: ${{ vars.COMMAND_CERTIFICATE_AUTHORITY_LOGICAL_NAME }}
37+
COMMAND_CERTIFICATE_TEMPLATE: ${{ vars.COMMAND_CERTIFICATE_TEMPLATE }}
38+
COMMAND_HOSTNAME: ${{ vars.COMMAND_HOSTNAME }}
39+
COMMAND_USERNAME: ${{ secrets.COMMAND_USERNAME }}
40+
COMMAND_PASSWORD: ${{ secrets.COMMAND_PASSWORD }}
41+
name: Run go test
42+
run: go test -v ./...

‎CHANGELOG.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# v1.0.4
2+
3+
## Features
4+
* feat(signer): Signer recognizes `metadata.command-issuer.keyfactor.com/<metadata-field-name>: <metadata-value>` annotations on the CertificateRequest resource and uses them to populate certificate metadata in Command.
5+
* feat(release): Container build and release now uses GitHub Actions.
6+
7+
## Fixes
8+
* fix(helm): CRDs now correspond to correct values for the `command-issuer`.
9+
* fix(helm): Signer Helm Chart now includes a `secureMetrics` value to enable/disable sidecar RBAC container for further protection of the `/metrics` endpoint.
10+
* fix(signer): Signer now returns CA chain bytes instead of appending to the leaf certificate.
11+
* fix(role): Removed permissions for `configmaps` resource types for the `leader-election-role` role.

‎Makefile‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,11 @@
11
# The version which will be reported by the --version argument of each binary
22
# and which will be used as the Docker image tag
3-
VERSION ?= 1.0.3
3+
VERSION ?= latest
44
# The Docker repository name, overridden in CI.
5-
DOCKER_REGISTRY ?= m8rmclarenkf
6-
DOCKER_IMAGE_NAME ?= command-cert-manager-external-issuer-controller
5+
DOCKER_REGISTRY ?= ""
6+
DOCKER_IMAGE_NAME ?= ""
77
# Image URL to use all building/pushing image targets
88
IMG ?= ${DOCKER_REGISTRY}/${DOCKER_IMAGE_NAME}:${VERSION}
9-
#IMG ?= command-issuer-dev:latest
109

1110
# ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
1211
ENVTEST_K8S_VERSION = 1.26.0
@@ -67,6 +66,11 @@ test: manifests generate fmt vet envtest ## Run tests.
6766

6867
##@ Build
6968

69+
.PHONY: regcheck
70+
regcheck: ## Check if the docker registry is set.
71+
@test -n "$(DOCKER_REGISTRY)" || (echo "DOCKER_REGISTRY is not set" && exit 1)
72+
@test -n "$(DOCKER_IMAGE_NAME)" || (echo "DOCKER_IMAGE_NAME is not set" && exit 1)
73+
7074
.PHONY: build
7175
build: manifests generate fmt vet ## Build manager binary.
7276
go build -o bin/manager main.go
@@ -79,10 +83,10 @@ run: manifests generate fmt vet ## Run a controller from your host.
7983
# (i.e. docker build --platform linux/arm64 ). However, you must enable docker buildKit for it.
8084
# More info: https://docs.docker.com/develop/develop-images/build_enhancements/
8185
.PHONY: docker-build
82-
docker-build: test ## Build docker image with the manager.
86+
docker-build: regcheck ## Build docker image with the manager.
8387
docker build -t ${IMG} .
8488

85-
.PHONY: docker-push
89+
.PHONY: docker-push regcheck
8690
docker-push: ## Push docker image with the manager.
8791
docker push ${IMG}
8892

@@ -94,7 +98,7 @@ docker-push: ## Push docker image with the manager.
9498
# To properly provided solutions that supports more than one platform you should use this option.
9599
PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
96100
.PHONY: docker-buildx
97-
docker-buildx: test ## Build and push docker image for the manager for cross-platform support
101+
docker-buildx: regcheck ## Build and push docker image for the manager for cross-platform support
98102
# copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile
99103
sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross
100104
- docker buildx create --name project-v3-builder
@@ -122,6 +126,14 @@ deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in
122126
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
123127
$(KUSTOMIZE) build config/default | kubectl apply -f -
124128

129+
# Build the manager image for local development. This image is not intended to be used in production.
130+
# Then, install it into the K8s cluster
131+
.PHONY: deploy-local
132+
deploy-local: manifests kustomize ## Build docker image with the manager.
133+
docker build -t command-issuer-dev:latest -f Dockerfile .
134+
cd config/manager && $(KUSTOMIZE) edit set image controller=command-issuer-dev:latest
135+
$(KUSTOMIZE) build config/default | kubectl apply -f -
136+
125137
.PHONY: undeploy
126138
undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
127139
$(KUSTOMIZE) build config/default | kubectl delete --ignore-not-found=$(ignore-not-found) -f -

0 commit comments

Comments
 (0)