Skip to content

Commit 3562d65

Browse files
csatib02csatib02
committed
feat(ci): integrate config-reloader
Signed-off-by: Bence Csati <[email protected]>
1 parent 9f89b77 commit 3562d65

File tree

28 files changed

+730
-599
lines changed

28 files changed

+730
-599
lines changed

‎.github/workflows/artifacts.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,7 @@ jobs:
130130
labels: ${{ steps.meta.outputs.labels }}
131131
cache-from: type=gha
132132
cache-to: type=gha,mode=max
133-
build-args: GO_BUILD_FLAGS=-ldflags=-X=github.com/kube-logging/logging-operator/pkg/sdk/logging/api/v1beta1.Version=${{ inputs.version }}-full
133+
build-args: GO_BUILD_FLAGS=-ldflags=-X=github.com/kube-logging/logging-operator/pkg/sdk/logging/api/v1beta1.Version=${{ inputs.version }}
134134
outputs: ${{ steps.build-output.outputs.value }},name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
135135
# push: ${{ inputs.publish }}
136136

‎.github/workflows/ci.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ jobs:
102102
uses: ./.github/workflows/dependency-images.yaml
103103
with:
104104
publish: ${{ github.event_name == 'push' }}
105-
image-types: "full"
105+
fluentd-image-types: "full"
106106
permissions:
107107
contents: read
108108
packages: write

‎.github/workflows/config-reloader.yaml

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
name: Config reloader
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
publish:
7+
description: Publish artifacts to the artifact store
8+
default: false
9+
required: false
10+
type: boolean
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
config-reloader-image:
17+
name: Config reloader image
18+
runs-on: ubuntu-latest
19+
20+
steps:
21+
- name: Checkout repository
22+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
23+
24+
- name: Set up QEMU
25+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
26+
with:
27+
platforms: all
28+
29+
- name: Set up Docker Buildx
30+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
31+
32+
- name: Set up Cosign
33+
uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
34+
if: ${{ inputs.publish }}
35+
36+
- name: Set image name
37+
id: image-name
38+
run: echo "value=ghcr.io/${{ github.repository }}/config-reloader" >> "$GITHUB_OUTPUT"
39+
40+
- name: Gather build metadata
41+
id: meta
42+
uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
43+
with:
44+
images: ${{ steps.image-name.outputs.value }}
45+
flavor: |
46+
latest = false
47+
tags: |
48+
type=ref,event=branch
49+
type=ref,event=pr
50+
type=semver,pattern={{raw}}
51+
type=raw,value=latest,enable={{is_default_branch}}
52+
labels: |
53+
org.opencontainers.image.description=Config reloader image for the Logging operator.
54+
org.opencontainers.image.title=Logging operator Config reloader image
55+
org.opencontainers.image.authors=Kube logging authors
56+
org.opencontainers.image.documentation=https://kube-logging.dev/docs/
57+
58+
- name: Login to GitHub Container Registry
59+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
60+
with:
61+
registry: ghcr.io
62+
username: ${{ github.actor }}
63+
password: ${{ github.token }}
64+
if: ${{ inputs.publish }}
65+
66+
- name: Build and push config-reloader image
67+
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
68+
with:
69+
context: images/config-reloader
70+
platforms: linux/amd64,linux/arm64
71+
tags: ${{ steps.meta.outputs.tags }}
72+
labels: ${{ steps.meta.outputs.labels }}
73+
cache-from: type=gha
74+
cache-to: type=gha,mode=max
75+
outputs: |
76+
type=image,push=${{ inputs.publish }},name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
77+
type=oci,dest=image.tar,name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
78+
79+
- name: Sign image with GitHub OIDC Token
80+
if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
81+
env:
82+
DIGEST: ${{ steps.build.outputs.digest }}
83+
TAGS: ${{ steps.meta.outputs.tags }}
84+
run: |
85+
images=""
86+
for tag in ${TAGS[@]}; do
87+
images+="${tag}@${DIGEST} "
88+
done
89+
90+
cosign sign --yes --rekor-url "https://rekor.sigstore.dev/" ${images}
91+
92+
- name: Verify signed image with cosign
93+
if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
94+
env:
95+
DIGEST: ${{ steps.build.outputs.digest }}
96+
TAGS: ${{ steps.meta.outputs.tags }}
97+
run: |
98+
for tag in ${TAGS[@]}; do
99+
cosign verify "${tag}@${DIGEST}" \
100+
--rekor-url "https://rekor.sigstore.dev/" \
101+
--certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/config-reloader-image.yaml@${{ github.ref }}" \
102+
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" | jq
103+
done
104+
105+
- name: Extract OCI tarball
106+
run: |
107+
mkdir -p image
108+
tar -xf image.tar -C image
109+
110+
- name: Run Trivy vulnerability scanner
111+
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
112+
env:
113+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
114+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
115+
with:
116+
input: image
117+
format: sarif
118+
output: trivy-results.sarif
119+
120+
- name: Upload Trivy scan results as artifact
121+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
122+
with:
123+
name: "[${{ github.job }}] Trivy scan results"
124+
path: trivy-results.sarif
125+
retention-days: 5
126+
127+
- name: Upload Trivy scan results to GitHub Security tab
128+
uses: github/codeql-action/upload-sarif@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
129+
with:
130+
sarif_file: trivy-results.sarif

0 commit comments

Comments
 (0)