Skip to content

Commit 27ac495

Browse files
csatib02csatib02
committed
feat: move in syslog-ng-config-reloader
Signed-off-by: Bence Csati <[email protected]>
1 parent c8b6ad4 commit 27ac495

File tree

12 files changed

+211
-11
lines changed

12 files changed

+211
-11
lines changed

‎.github/workflows/dependency-images.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,14 @@ jobs:
4040
packages: write
4141
id-token: write
4242
security-events: write
43+
44+
syslog-ng-reloader:
45+
name: Syslog-ng reloader
46+
uses: ./.github/workflows/syslog-ng-reloader.yaml
47+
with:
48+
publish: ${{ inputs.publish }}
49+
permissions:
50+
contents: read
51+
packages: write
52+
id-token: write
53+
security-events: write

‎.github/workflows/e2e.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@ jobs:
3333
context: images/config-reloader
3434
tags: config-reloader:local
3535
output: config-reloader.tar
36+
- image: syslog-ng-reloader
37+
context: images/syslog-ng-reloader
38+
tags: syslog-ng-reloader:local
39+
output: syslog-ng-reloader.tar
3640

3741
steps:
3842
- name: Checkout
@@ -86,6 +90,7 @@ jobs:
8690
run: |
8791
docker load --input /tmp/fluentd-full.tar
8892
docker load --input /tmp/config-reloader.tar
93+
docker load --input /tmp/syslog-ng-reloader.tar
8994
docker load --input /tmp/controller.tar
9095
docker image ls -a
9196
@@ -142,6 +147,7 @@ jobs:
142147
run: |
143148
docker load --input /tmp/fluentd-full.tar
144149
docker load --input /tmp/config-reloader.tar
150+
docker load --input /tmp/syslog-ng-reloader.tar
145151
docker load --input /tmp/controller.tar
146152
docker image ls -a
147153

‎.github/workflows/syslog-ng-reloader.yaml

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
name: Syslog-ng reloader
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
publish:
7+
description: Publish artifacts to the artifact store
8+
default: false
9+
required: false
10+
type: boolean
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
syslog-ng-reloader-image:
17+
name: Syslog-ng reloader image
18+
runs-on: ubuntu-latest
19+
20+
steps:
21+
- name: Checkout repository
22+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
23+
24+
- name: Set up QEMU
25+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
26+
27+
- name: Set up Docker Buildx
28+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
29+
30+
- name: Set up Cosign
31+
uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
32+
if: ${{ inputs.publish }}
33+
34+
- name: Set image name
35+
id: image-name
36+
run: echo "value=ghcr.io/${{ github.repository }}/syslog-ng-reloader" >> "$GITHUB_OUTPUT"
37+
38+
- name: Gather build metadata
39+
id: meta
40+
uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
41+
with:
42+
images: ${{ steps.image-name.outputs.value }}
43+
flavor: |
44+
latest = false
45+
tags: |
46+
type=ref,event=branch
47+
type=ref,event=pr
48+
type=semver,pattern={{raw}}
49+
type=raw,value=latest,enable={{is_default_branch}}
50+
labels: |
51+
org.opencontainers.image.description=Syslog-ng reloader image for the Logging operator.
52+
org.opencontainers.image.title=Logging operator Syslog-ng reloader image
53+
org.opencontainers.image.authors=Kube logging authors
54+
org.opencontainers.image.documentation=https://kube-logging.dev/docs/
55+
56+
- name: Login to GitHub Container Registry
57+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
58+
with:
59+
registry: ghcr.io
60+
username: ${{ github.actor }}
61+
password: ${{ github.token }}
62+
if: ${{ inputs.publish }}
63+
64+
- name: Build and push config-reloader image
65+
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
66+
with:
67+
context: images/syslog-ng-reloader
68+
platforms: linux/amd64,linux/arm64
69+
tags: ${{ steps.meta.outputs.tags }}
70+
labels: ${{ steps.meta.outputs.labels }}
71+
cache-from: type=gha
72+
cache-to: type=gha,mode=max
73+
outputs: |
74+
type=image,push=${{ inputs.publish }},name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
75+
type=oci,dest=image.tar,name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
76+
77+
- name: Sign image with GitHub OIDC Token
78+
if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
79+
env:
80+
DIGEST: ${{ steps.build.outputs.digest }}
81+
TAGS: ${{ steps.meta.outputs.tags }}
82+
run: |
83+
images=""
84+
for tag in ${TAGS[@]}; do
85+
images+="${tag}@${DIGEST} "
86+
done
87+
88+
cosign sign --yes --rekor-url "https://rekor.sigstore.dev/" ${images}
89+
90+
- name: Verify signed image with cosign
91+
if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
92+
env:
93+
DIGEST: ${{ steps.build.outputs.digest }}
94+
TAGS: ${{ steps.meta.outputs.tags }}
95+
run: |
96+
for tag in ${TAGS[@]}; do
97+
cosign verify "${tag}@${DIGEST}" \
98+
--rekor-url "https://rekor.sigstore.dev/" \
99+
--certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/syslog-ng-reloader.yaml@${{ github.ref }}" \
100+
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" | jq
101+
done
102+
103+
- name: Extract OCI tarball
104+
run: |
105+
mkdir -p image
106+
tar -xf image.tar -C image
107+
108+
- name: Run Trivy vulnerability scanner
109+
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
110+
env:
111+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
112+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
113+
with:
114+
input: image
115+
format: sarif
116+
output: trivy-results.sarif
117+
118+
- name: Upload Trivy scan results as artifact
119+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
120+
with:
121+
name: "[${{ github.job }}] Trivy scan results"
122+
path: trivy-results.sarif
123+
retention-days: 5
124+
125+
- name: Upload Trivy scan results to GitHub Security tab
126+
uses: github/codeql-action/upload-sarif@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
127+
with:
128+
sarif_file: trivy-results.sarif

‎Makefile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ GOVERSION := $(shell go env GOVERSION)
4040
# Image name to use for building/pushing image targets
4141
FLUENTD_IMG ?= fluentd-full:local
4242
CONFIG_RELOADER_IMG ?= config-reloader:local
43+
SYSLOG_NG_RELOADER_IMG ?= syslog-ng-reloader:local
4344
OPERATOR_IMG ?= controller:local
4445
OPERATOR_IMG_DEBUG ?= controller:debug
4546

@@ -110,6 +111,7 @@ docker-build-e2e-test: ## Build the coverage docker image
110111
${DOCKER} build --build-arg GO_BUILD_FLAGS="-cover -covermode=atomic" -t ${OPERATOR_IMG} --target e2e-test .
111112
sed -i'' -e 's@image: .*@image: '"${OPERATOR_IMG}"'@' ./config/default/manager_image_patch.yaml
112113
${DOCKER} build -t ${CONFIG_RELOADER_IMG} images/config-reloader
114+
${DOCKER} build -t ${SYSLOG_NG_RELOADER_IMG} images/syslog-ng-reloader
113115
${DOCKER} build -t ${FLUENTD_IMG} --target full images/fluentd
114116

115117
.PHONY: docker-build-drain-watch
@@ -221,6 +223,7 @@ test-e2e-nodeps:
221223
cd e2e && \
222224
LOGGING_OPERATOR_IMAGE="${OPERATOR_IMG}" \
223225
CONFIG_RELOADER_IMAGE="${CONFIG_RELOADER_IMG}" \
226+
SYSLOG_NG_RELOADER_IMAGE="${SYSLOG_NG_RELOADER_IMG}" \
224227
FLUENTD_IMAGE="${FLUENTD_IMG}" \
225228
KIND_PATH="$(KIND)" \
226229
KIND_IMAGE="$(KIND_IMAGE)" \

‎e2e/common/helpers.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ const (
3838
FluentdImageTag = "local"
3939
ConfigReloaderRepo = "config-reloader"
4040
ConfigReloaderTag = "local"
41+
SyslogNGReloaderRepo = "syslog-ng-reloader"
42+
SyslogNGReloaderTag = "local"
4143
)
4244

4345
var sequence uint32

‎e2e/common/setup/loggingoperator.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,11 @@ var (
4141
repository: "config-reloader",
4242
tag: "local",
4343
},
44+
{
45+
lookupEnv: "SYSLOG_NG_RELOADER_IMAGE",
46+
repository: "syslogng-reload",
47+
tag: "local",
48+
},
4449
{
4550
lookupEnv: "FLUENTD_IMAGE",
4651
repository: "fluentd-full",

‎e2e/logging_metrics_monitoring/logging_metrics_monitoring_test.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,10 @@ func TestLoggingMetrics_Monitoring(t *testing.T) {
141141
},
142142
},
143143
SyslogNGSpec: &v1beta1.SyslogNGSpec{
144+
ConfigReloadImage: &v1beta1.BasicImageSpec{
145+
Repository: common.SyslogNGReloaderRepo,
146+
Tag: common.SyslogNGReloaderTag,
147+
},
144148
Metrics: &v1beta1.Metrics{
145149
ServiceMonitor: true,
146150
},

‎e2e/syslog-ng-aggregator-detached/syslog_ng_aggregator_detached_test.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,10 @@ func TestSyslogNGDetachedIsRunningAndForwardingLogs(t *testing.T) {
104104
Namespace: ns,
105105
},
106106
Spec: v1beta1.SyslogNGSpec{
107+
ConfigReloadImage: &v1beta1.BasicImageSpec{
108+
Repository: common.SyslogNGReloaderRepo,
109+
Tag: common.SyslogNGReloaderTag,
110+
},
107111
StatefulSetOverrides: &typeoverride.StatefulSet{
108112
Spec: typeoverride.StatefulSetSpec{
109113
Template: typeoverride.PodTemplateSpec{
@@ -157,6 +161,10 @@ func TestSyslogNGDetachedIsRunningAndForwardingLogs(t *testing.T) {
157161
Namespace: ns,
158162
},
159163
Spec: v1beta1.SyslogNGSpec{
164+
ConfigReloadImage: &v1beta1.BasicImageSpec{
165+
Repository: common.SyslogNGReloaderRepo,
166+
Tag: common.SyslogNGReloaderTag,
167+
},
160168
StatefulSetOverrides: &typeoverride.StatefulSet{
161169
Spec: typeoverride.StatefulSetSpec{
162170
Template: typeoverride.PodTemplateSpec{

‎e2e/syslog-ng-aggregator/syslog_ng_aggregator_test.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,10 @@ func TestSyslogNGIsRunningAndForwardingLogs(t *testing.T) {
9595
},
9696
},
9797
SyslogNGSpec: &v1beta1.SyslogNGSpec{
98+
ConfigReloadImage: &v1beta1.BasicImageSpec{
99+
Repository: common.SyslogNGReloaderRepo,
100+
Tag: common.SyslogNGReloaderTag,
101+
},
98102
StatefulSetOverrides: &typeoverride.StatefulSet{
99103
Spec: typeoverride.StatefulSetSpec{
100104
Template: typeoverride.PodTemplateSpec{

‎images/syslog-ng-reloader/Dockerfile

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
FROM ghcr.io/kube-logging/custom-runner:v0.12.0 AS custom-runner
2+
3+
FROM alpine:3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c
4+
5+
RUN apk add socat
6+
7+
COPY --from=custom-runner /runner /
8+
9+
WORKDIR /
10+
11+
ENTRYPOINT ["/runner"]

0 commit comments

Comments
 (0)