Skip to content

Commit 6919c63

Browse files
jhrozekjhrozek
committed
Add RHEL-9 support
- Uses el8/el8 instead of just centos. Because el8/el9 are the RPM dist tags used in RHEL and derivativies, this should be safe to use regardless of distro - Use RH UBI as the base image instead of centos - Renames the el8 Dockerfile from ./images/centos/Dockerfile to ./images/el8/Dockerfile - Adds Alma Linux 9 VM host for e2e testing Signed-off-by: Jakub Hrozek <[email protected]>
1 parent cda0750 commit 6919c63

File tree

9 files changed

+152
-40
lines changed

9 files changed

+152
-40
lines changed

‎.github/workflows/build_image.yaml

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@ jobs:
2222
dockerfiles: |
2323
./images/fedora/Dockerfile
2424
25-
build-centos:
26-
name: Build CentOS image
25+
build-el8:
26+
name: Build EL8 image
2727
runs-on: ubuntu-20.04
2828

2929
steps:
@@ -32,7 +32,22 @@ jobs:
3232
- name: Buildah Action
3333
uses: redhat-actions/buildah-build@v2
3434
with:
35-
image: selinuxd-centos
35+
image: selinuxd-el8
3636
tags: latest ${{ github.sha }}
3737
dockerfiles: |
38-
./images/centos/Dockerfile
38+
./images/el8/Dockerfile
39+
40+
build-el9:
41+
name: Build EL9 image
42+
runs-on: ubuntu-20.04
43+
44+
steps:
45+
- uses: actions/checkout@v3
46+
47+
- name: Buildah Action
48+
uses: redhat-actions/buildah-build@v2
49+
with:
50+
image: selinuxd-el9
51+
tags: latest ${{ github.sha }}
52+
dockerfiles: |
53+
./images/el9/Dockerfile

‎.github/workflows/build_test.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,13 @@ jobs:
1111
runs-on: ubuntu-latest
1212
strategy:
1313
matrix:
14-
almalinux: ["8"]
14+
ubi: ["8", "9"]
1515
container:
16-
image: almalinux:${{ matrix.almalinux }}
16+
image: registry.access.redhat.com/ubi${{ matrix.ubi }}/ubi:latest
1717
steps:
1818
- uses: actions/checkout@v3
1919
- name: install packages
20-
run: yum -y --enablerepo=powertools install golang make libsemanage-devel
20+
run: dnf -y install container-selinux go-toolset make findutils git-core
2121
- name: build selinuxd
2222
run: |
2323
make

‎.github/workflows/e2e.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
runs-on: ubuntu-20.04
1010
strategy:
1111
matrix:
12-
base: ["fedora", "centos"]
12+
base: ["fedora", "el8", "el9"]
1313
steps:
1414
- uses: actions/checkout@v3
1515
- run: make ${{ matrix.base }}-image
@@ -25,7 +25,7 @@ jobs:
2525
timeout-minutes: 80
2626
strategy:
2727
matrix:
28-
base: ["fedora", "centos"]
28+
base: ["fedora", "el8", "el9"]
2929
env:
3030
RUN: ./hack/ci/run.sh
3131
IMG: quay.io/security-profiles-operator/selinuxd-${{ matrix.base }}:latest
@@ -84,7 +84,7 @@ jobs:
8484
timeout-minutes: 80
8585
strategy:
8686
matrix:
87-
base: ["fedora", "centos"]
87+
base: ["fedora", "el8", "el9"]
8888
env:
8989
RUN: ./hack/ci/run.sh
9090
IMG: quay.io/security-profiles-operator/selinuxd-${{ matrix.base }}:latest

‎.github/workflows/verify.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,13 @@ jobs:
1111
runs-on: ubuntu-latest
1212
strategy:
1313
matrix:
14-
almalinux : ["8"]
14+
ubi: ["8", "9"]
1515
container:
16-
image: almalinux:${{ matrix.almalinux }}
16+
image: registry.access.redhat.com/ubi${{ matrix.ubi }}/ubi:latest
1717
steps:
1818
- uses: actions/checkout@v3
1919
- name: install packages
20-
run: yum -y --enablerepo=powertools install golang make libsemanage-devel diffutils
20+
run: dnf -y install container-selinux go-toolset make findutils git-core diffutils tar
2121
- name: run verify
2222
run: |
2323
make verify

‎Makefile

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ IMAGE_TAG=latest
2626
IMAGE_REF=$(IMAGE_NAME):$(IMAGE_TAG)
2727

2828
IMAGE_REPO?=quay.io/security-profiles-operator/$(IMAGE_REF)
29+
EL8_IMAGE_REPO?=quay.io/security-profiles-operator/$(IMAGE_NAME)-el8:$(IMAGE_TAG)
30+
EL9_IMAGE_REPO?=quay.io/security-profiles-operator/$(IMAGE_NAME)-el9:$(IMAGE_TAG)
31+
# Tag centos the same as EL8 for now, remove after some SPO releases pass
2932
CENTOS_IMAGE_REPO?=quay.io/security-profiles-operator/$(IMAGE_NAME)-centos:$(IMAGE_TAG)
3033
FEDORA_IMAGE_REPO?=quay.io/security-profiles-operator/$(IMAGE_NAME)-fedora:$(IMAGE_TAG)
3134

@@ -119,11 +122,21 @@ image: default-image centos-image fedora-image
119122

120123
.PHONY: default-image
121124
default-image:
122-
$(CONTAINER_RUNTIME) build -f images/centos/Dockerfile -t $(IMAGE_REPO) .
125+
$(MAKE) el8-image
123126

127+
# backwards compatibility
124128
.PHONY: centos-image
125129
centos-image:
126-
$(CONTAINER_RUNTIME) build -f images/centos/Dockerfile -t $(CENTOS_IMAGE_REPO) .
130+
$(MAKE) el8-image
131+
$(CONTAINER_RUNTIME) tag $(EL8_IMAGE_REPO) $(CENTOS_IMAGE_REPO)
132+
133+
.PHONY: el8-image
134+
el8-image:
135+
$(CONTAINER_RUNTIME) build -f images/el8/Dockerfile -t $(EL8_IMAGE_REPO) .
136+
137+
.PHONY: el9-image
138+
el9-image:
139+
$(CONTAINER_RUNTIME) build -f images/el9/Dockerfile -t $(EL9_IMAGE_REPO) .
127140

128141
.PHONY: fedora-image
129142
fedora-image:

‎hack/ci/Vagrantfile-centos renamed to ‎hack/ci/Vagrantfile-el8

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ Vagrant.configure("2") do |config|
2020
config.vm.provision "set-env", type: "shell", run: "once" do |sh|
2121
sh.inline = <<~SHELL
2222
set -euxo pipefail
23-
echo "export IMG='quay.io/security-profiles-operator/selinuxd-centos:latest'" >> /etc/profile.d/selinuxd-env.sh
24-
echo "export OS='centos'" >> /etc/profile.d/selinuxd-env.sh
23+
echo "export IMG='quay.io/security-profiles-operator/selinuxd-el8:latest'" >> /etc/profile.d/selinuxd-env.sh
24+
echo "export OS='el8'" >> /etc/profile.d/selinuxd-env.sh
2525
echo "export CONTAINER_NAME='selinuxd'" >> /etc/profile.d/selinuxd-env.sh
2626
SHELL
2727
end

‎hack/ci/Vagrantfile-el9

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# -*- mode: ruby -*-
2+
# vi: set ft=ruby :
3+
4+
# Vagrant box for testing
5+
Vagrant.configure("2") do |config|
6+
config.vm.box = "almalinux/9"
7+
memory = 6144
8+
cpus = 4
9+
10+
config.vm.provider :virtualbox do |v|
11+
v.memory = memory
12+
v.cpus = cpus
13+
end
14+
15+
config.vm.provider :libvirt do |v|
16+
v.memory = memory
17+
v.cpus = cpus
18+
end
19+
20+
config.vm.provision "set-env", type: "shell", run: "once" do |sh|
21+
sh.inline = <<~SHELL
22+
set -euxo pipefail
23+
echo "export IMG='quay.io/security-profiles-operator/selinuxd-el9:latest'" >> /etc/profile.d/selinuxd-env.sh
24+
echo "export OS='el9'" >> /etc/profile.d/selinuxd-env.sh
25+
echo "export CONTAINER_NAME='selinuxd'" >> /etc/profile.d/selinuxd-env.sh
26+
SHELL
27+
end
28+
29+
config.vm.provision "install-dependencies", type: "shell", run: "once" do |sh|
30+
sh.inline = <<~SHELL
31+
whoami
32+
set -euxo pipefail
33+
dnf install -y \
34+
make \
35+
golang \
36+
podman \
37+
container-selinux \
38+
oci-seccomp-bpf-hook \
39+
udica
40+
SHELL
41+
end
42+
43+
config.vm.provision "load-test-image", type: "shell", run: "once" do |sh|
44+
sh.inline = <<~SHELL
45+
set -euxo pipefail
46+
sudo podman load -i /vagrant/image.tar
47+
SHELL
48+
end
49+
50+
end

‎images/centos/Dockerfile renamed to ‎images/el8/Dockerfile

Lines changed: 11 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -12,33 +12,22 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
FROM docker.io/almalinux:8 AS build
16-
ARG GO_VERSION=go1.19.3
17-
ENV GOPATH="/go"
18-
ENV PATH="$GOPATH/bin:$PATH"
19-
USER root
20-
WORKDIR /work
15+
FROM registry.access.redhat.com/ubi8/ubi-minimal:latest as build
2116

22-
RUN mkdir -p bin
23-
RUN mkdir -p /go
17+
WORKDIR /work
2418

25-
RUN dnf install -y \
26-
--enablerepo=powertools \
19+
RUN microdnf install -y \
2720
container-selinux \
28-
golang make libsemanage-devel
29-
30-
# NOTE(jaosorior): This allows us to use a specific golang version in CentOS as
31-
# opposed to the older one that comes with the distro.
32-
RUN go install golang.org/dl/${GO_VERSION}@latest
33-
RUN ${GO_VERSION} download
21+
go-toolset \
22+
make \
23+
findutils \
24+
git-core && microdnf clean all
3425

3526
COPY . /work
3627

37-
RUN GO=${GO_VERSION} SEMODULE_BACKEND=policycoreutils make
28+
RUN SEMODULE_BACKEND=policycoreutils make
3829

39-
FROM docker.io/almalinux:8
40-
# TODO(jaosorior): Switch to UBI once we use static linking
41-
#FROM registry.access.redhat.com/ubi8/ubi-minimal:latest
30+
FROM registry.access.redhat.com/ubi8/ubi-minimal:latest
4231

4332
# TODO(jaosorior): See if we can run this without root
4433
USER root
@@ -47,9 +36,8 @@ LABEL name="selinuxd" \
4736
description="selinuxd is a daemon that listens for files in /etc/selinux.d/ and installs the relevant policies."
4837

4938
# TODO(jaosorior): Remove once we use static linking
50-
RUN dnf install -y \
51-
--enablerepo=powertools \
52-
policycoreutils
39+
RUN microdnf install -y \
40+
policycoreutils && microdnf clean all
5341

5442
RUN mkdir -p /usr/share/selinuxd/templates
5543
COPY --from=build /usr/share/udica/templates/* /usr/share/selinuxd/templates/

‎images/el9/Dockerfile

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Copyright © 2020 Red Hat, Inc.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
FROM registry.access.redhat.com/ubi9/ubi-minimal:latest as build
16+
17+
WORKDIR /work
18+
19+
RUN microdnf install -y \
20+
container-selinux \
21+
go-toolset \
22+
make \
23+
findutils \
24+
git-core && microdnf clean all
25+
26+
COPY . /work
27+
28+
RUN SEMODULE_BACKEND=policycoreutils make
29+
30+
FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
31+
32+
# TODO(jaosorior): See if we can run this without root
33+
USER root
34+
35+
LABEL name="selinuxd" \
36+
description="selinuxd is a daemon that listens for files in /etc/selinux.d/ and installs the relevant policies."
37+
38+
# TODO(jaosorior): Remove once we use static linking
39+
RUN microdnf install -y \
40+
policycoreutils && microdnf clean all
41+
42+
RUN mkdir -p /usr/share/selinuxd/templates
43+
COPY --from=build /usr/share/udica/templates/* /usr/share/selinuxd/templates/
44+
COPY --from=build /work/bin/selinuxdctl /usr/bin/
45+
46+
ENTRYPOINT ["/usr/bin/selinuxdctl"]

0 commit comments

Comments
 (0)