Skip to content

Commit c11e2db

Browse files
csatib02csatib02
authored
Merge pull request #1995 from kube-logging/feat/move-in-drainwatch
feat: move in fluentd-drain-watch
2 parents 6f0c43b + 3002395 commit c11e2db

File tree

16 files changed

+288
-21
lines changed

16 files changed

+288
-21
lines changed

‎.github/workflows/dependency-images.yaml

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,4 +50,15 @@ jobs:
5050
contents: read
5151
packages: write
5252
id-token: write
53-
security-events: write
53+
security-events: write
54+
55+
fluentd-drain-watch:
56+
name: Fluentd drain watch
57+
uses: ./.github/workflows/fluentd-drain-watch.yaml
58+
with:
59+
publish: ${{ inputs.publish }}
60+
permissions:
61+
contents: read
62+
packages: write
63+
id-token: write
64+
security-events: write

‎.github/workflows/e2e.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,10 @@ jobs:
3737
context: images/syslog-ng-reloader
3838
tags: syslog-ng-reloader:local
3939
output: syslog-ng-reloader.tar
40+
- image: fluentd-drain-watch
41+
context: images/fluentd-drain-watch
42+
tags: fluentd-drain-watch:local
43+
output: fluentd-drain-watch.tar
4044

4145
steps:
4246
- name: Checkout
@@ -91,6 +95,7 @@ jobs:
9195
docker load --input /tmp/fluentd-full.tar
9296
docker load --input /tmp/config-reloader.tar
9397
docker load --input /tmp/syslog-ng-reloader.tar
98+
docker load --input /tmp/fluentd-drain-watch.tar
9499
docker load --input /tmp/controller.tar
95100
docker image ls -a
96101
@@ -149,6 +154,7 @@ jobs:
149154
docker load --input /tmp/fluentd-full.tar
150155
docker load --input /tmp/config-reloader.tar
151156
docker load --input /tmp/syslog-ng-reloader.tar
157+
docker load --input /tmp/fluentd-drain-watch.tar
152158
docker load --input /tmp/controller.tar
153159
docker image ls -a
154160

‎.github/workflows/fluentd-drain-watch.yaml

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
name: Fluentd drain watch
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
publish:
7+
description: Publish artifacts to the artifact store
8+
default: false
9+
required: false
10+
type: boolean
11+
12+
permissions:
13+
contents: read
14+
15+
16+
jobs:
17+
fluentd-drain-watch-image:
18+
name: Fluentd drain watch image
19+
runs-on: ubuntu-latest
20+
21+
permissions:
22+
contents: read
23+
packages: write
24+
id-token: write
25+
security-events: write
26+
27+
steps:
28+
- name: Checkout repository
29+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
30+
31+
- name: Set up QEMU
32+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
33+
34+
- name: Set up Docker Buildx
35+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
36+
37+
- name: Set up Cosign
38+
uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
39+
if: ${{ inputs.publish }}
40+
41+
- name: Set image name
42+
id: image-name
43+
run: echo "value=ghcr.io/${{ github.repository }}/fluentd-drain-watch" >> "$GITHUB_OUTPUT"
44+
45+
- name: Gather build metadata
46+
id: meta
47+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
48+
with:
49+
images: ${{ steps.image-name.outputs.value }}
50+
flavor: |
51+
latest = false
52+
tags: |
53+
type=ref,event=branch
54+
type=ref,event=pr
55+
type=semver,pattern={{raw}}
56+
type=raw,value=latest,enable={{is_default_branch}}
57+
labels: |
58+
org.opencontainers.image.description=Fluentd drain watch image for the Logging operator.
59+
org.opencontainers.image.title=Logging operator Fluentd drain watch image
60+
org.opencontainers.image.authors=Kube logging authors
61+
org.opencontainers.image.documentation=https://kube-logging.dev/docs/
62+
63+
- name: Login to GitHub Container Registry
64+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
65+
with:
66+
registry: ghcr.io
67+
username: ${{ github.actor }}
68+
password: ${{ github.token }}
69+
if: ${{ inputs.publish }}
70+
71+
- name: Build and push fluentd-drain-watch image
72+
id: build
73+
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
74+
with:
75+
context: images/fluentd-drain-watch
76+
platforms: linux/amd64,linux/arm64
77+
tags: ${{ steps.meta.outputs.tags }}
78+
labels: ${{ steps.meta.outputs.labels }}
79+
cache-from: type=gha
80+
cache-to: type=gha,mode=max
81+
outputs: |
82+
type=image,push=${{ inputs.publish }},name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
83+
type=oci,dest=image.tar,name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
84+
85+
- name: Sign image with GitHub OIDC Token
86+
if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
87+
env:
88+
DIGEST: ${{ steps.build.outputs.digest }}
89+
TAGS: ${{ steps.meta.outputs.tags }}
90+
run: |
91+
images=""
92+
for tag in ${TAGS[@]}; do
93+
images+="${tag}@${DIGEST} "
94+
done
95+
96+
cosign sign --yes --rekor-url "https://rekor.sigstore.dev/" ${images}
97+
98+
- name: Verify signed image with cosign
99+
if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
100+
env:
101+
DIGEST: ${{ steps.build.outputs.digest }}
102+
TAGS: ${{ steps.meta.outputs.tags }}
103+
run: |
104+
for tag in ${TAGS[@]}; do
105+
cosign verify "${tag}@${DIGEST}" \
106+
--rekor-url "https://rekor.sigstore.dev/" \
107+
--certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/fluentd-drain-watch.yaml@${{ github.ref }}" \
108+
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" | jq
109+
done
110+
111+
- name: Extract OCI tarball
112+
run: |
113+
mkdir -p image
114+
tar -xf image.tar -C image
115+
116+
- name: Run Trivy vulnerability scanner
117+
uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # 0.30.0
118+
env:
119+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
120+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
121+
with:
122+
input: image
123+
format: sarif
124+
output: trivy-results.sarif
125+
126+
- name: Upload Trivy scan results as artifact
127+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
128+
with:
129+
name: "[${{ github.job }}] Trivy scan results"
130+
path: trivy-results.sarif
131+
retention-days: 5
132+
133+
- name: Upload Trivy scan results to GitHub Security tab
134+
uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
135+
with:
136+
sarif_file: trivy-results.sarif

‎Makefile

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -44,15 +44,13 @@ GOVERSION := $(shell go env GOVERSION)
4444
FLUENTD_IMG ?= fluentd-full:local
4545
CONFIG_RELOADER_IMG ?= config-reloader:local
4646
SYSLOG_NG_RELOADER_IMG ?= syslog-ng-reloader:local
47+
FLUENTD_DRAIN_WATCH_IMG ?= fluentd-drain-watch:local
4748
OPERATOR_IMG ?= controller:local
4849
OPERATOR_IMG_DEBUG ?= controller:debug
4950

5051
# Produce CRDs that work back to Kubernetes 1.11 (no version conversion)
5152
CRD_OPTIONS ?= crd:maxDescLen=0
5253

53-
DRAIN_WATCH_IMAGE_TAG_NAME ?= ghcr.io/kube-logging/fluentd-drain-watch
54-
DRAIN_WATCH_IMAGE_TAG_VERSION ?= latest
55-
5654
VERSION := $(shell git describe --abbrev=0 --tags)
5755

5856
E2E_TEST_TIMEOUT ?= 20m
@@ -117,11 +115,12 @@ docker-build-e2e-test: ## Build the coverage docker image
117115
sed -i'' -e 's@image: .*@image: '"${OPERATOR_IMG}"'@' ./config/default/manager_image_patch.yaml
118116
${DOCKER} build -t ${CONFIG_RELOADER_IMG} images/config-reloader
119117
${DOCKER} build -t ${SYSLOG_NG_RELOADER_IMG} images/syslog-ng-reloader
118+
${DOCKER} build -t ${FLUENTD_DRAIN_WATCH_IMG} images/fluentd-drain-watch
120119
${DOCKER} build -t ${FLUENTD_IMG} --target full images/fluentd
121120

122121
.PHONY: docker-build-drain-watch
123122
docker-build-drain-watch: ## Build the drain-watch docker image
124-
${DOCKER} build drain-watch-image -t ${DRAIN_WATCH_IMAGE_TAG_NAME}:${DRAIN_WATCH_IMAGE_TAG_VERSION}
123+
${DOCKER} build drain-watch-image -t ${FLUENTD_DRAIN_WATCH_IMG} images/fluentd-drain-watch
125124

126125
.PHONY: docker-push
127126
docker-push: ## Push the docker image
@@ -233,6 +232,7 @@ test-e2e-nodeps:
233232
LOGGING_OPERATOR_IMAGE="${OPERATOR_IMG}" \
234233
CONFIG_RELOADER_IMAGE="${CONFIG_RELOADER_IMG}" \
235234
SYSLOG_NG_RELOADER_IMAGE="${SYSLOG_NG_RELOADER_IMG}" \
235+
FLUENTD_DRAIN_WATCH_IMAGE="${FLUENTD_DRAIN_WATCH_IMG}" \
236236
FLUENTD_IMAGE="${FLUENTD_IMG}" \
237237
KIND_PATH="$(KIND)" \
238238
KIND_IMAGE="$(KIND_IMAGE)" \

‎e2e/common/helpers.go

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -34,12 +34,14 @@ import (
3434
)
3535

3636
const (
37-
FluentdImageRepo = "fluentd-full"
38-
FluentdImageTag = "local"
39-
ConfigReloaderRepo = "config-reloader"
40-
ConfigReloaderTag = "local"
41-
SyslogNGReloaderRepo = "syslog-ng-reloader"
42-
SyslogNGReloaderTag = "local"
37+
FluentdImageRepo = "fluentd-full"
38+
FluentdImageTag = "local"
39+
ConfigReloaderRepo = "config-reloader"
40+
ConfigReloaderTag = "local"
41+
SyslogNGReloaderRepo = "syslog-ng-reloader"
42+
SyslogNGReloaderTag = "local"
43+
FluentdDrainWatchRepo = "fluentd-drain-watch"
44+
FluentdDrainWatchTag = "local"
4345
)
4446

4547
var sequence uint32

‎e2e/common/setup/loggingoperator.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,11 @@ var (
4646
repository: "syslogng-reload",
4747
tag: "local",
4848
},
49+
{
50+
lookupEnv: "FLUENTD_DRAIN_WATCH_IMAGE",
51+
repository: "fluentd-drain-watch",
52+
tag: "local",
53+
},
4954
{
5055
lookupEnv: "FLUENTD_IMAGE",
5156
repository: "fluentd-full",

‎e2e/fluentd-aggregator-detached-multiple-failures/fluentd_aggregator_detached_multiple_failures_test.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,10 @@ func TestFluentdAggregator_detached_multiple_failure(t *testing.T) {
124124
Replicas: 1,
125125
Drain: v1beta1.FluentdDrainConfig{
126126
Enabled: true,
127+
Image: v1beta1.ImageSpec{
128+
Repository: common.FluentdDrainWatchRepo,
129+
Tag: common.FluentdDrainWatchTag,
130+
},
127131
},
128132
},
129133
Workers: 2,
@@ -160,6 +164,10 @@ func TestFluentdAggregator_detached_multiple_failure(t *testing.T) {
160164
Replicas: 1,
161165
Drain: v1beta1.FluentdDrainConfig{
162166
Enabled: true,
167+
Image: v1beta1.ImageSpec{
168+
Repository: common.FluentdDrainWatchRepo,
169+
Tag: common.FluentdDrainWatchTag,
170+
},
163171
},
164172
},
165173
Workers: 2,

‎e2e/fluentd-aggregator-detached/fluentd_aggregator_detached_test.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,10 @@ func TestFluentdAggregator_detached_MultiWorker(t *testing.T) {
127127
Replicas: 1,
128128
Drain: v1beta1.FluentdDrainConfig{
129129
Enabled: true,
130+
Image: v1beta1.ImageSpec{
131+
Repository: common.FluentdDrainWatchRepo,
132+
Tag: common.FluentdDrainWatchTag,
133+
},
130134
},
131135
},
132136
Workers: 2,
@@ -165,6 +169,10 @@ func TestFluentdAggregator_detached_MultiWorker(t *testing.T) {
165169
Replicas: 1,
166170
Drain: v1beta1.FluentdDrainConfig{
167171
Enabled: true,
172+
Image: v1beta1.ImageSpec{
173+
Repository: common.FluentdDrainWatchRepo,
174+
Tag: common.FluentdDrainWatchTag,
175+
},
168176
},
169177
},
170178
},

‎e2e/fluentd-aggregator/fluentd_aggregator_test.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,10 @@ func TestFluentdAggregator_MultiWorker(t *testing.T) {
119119
Replicas: 1,
120120
Drain: v1beta1.FluentdDrainConfig{
121121
Enabled: true,
122+
Image: v1beta1.ImageSpec{
123+
Repository: common.FluentdDrainWatchRepo,
124+
Tag: common.FluentdDrainWatchTag,
125+
},
122126
},
123127
},
124128
Workers: 2,
@@ -298,6 +302,10 @@ func TestFluentdAggregator_ConfigChecks(t *testing.T) {
298302
Replicas: 1,
299303
Drain: v1beta1.FluentdDrainConfig{
300304
Enabled: true,
305+
Image: v1beta1.ImageSpec{
306+
Repository: common.FluentdDrainWatchRepo,
307+
Tag: common.FluentdDrainWatchTag,
308+
},
301309
},
302310
},
303311
Workers: 1,

‎e2e/volumedrain/volumedrain_test.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,10 @@ func TestVolumeDrain_Downscale(t *testing.T) {
117117
Replicas: 2,
118118
Drain: v1beta1.FluentdDrainConfig{
119119
Enabled: true,
120+
Image: v1beta1.ImageSpec{
121+
Repository: common.FluentdDrainWatchRepo,
122+
Tag: common.FluentdDrainWatchTag,
123+
},
120124
},
121125
},
122126
},
@@ -351,6 +355,10 @@ func TestVolumeDrain_Downscale_DeleteVolume(t *testing.T) {
351355
Drain: v1beta1.FluentdDrainConfig{
352356
Enabled: true,
353357
DeleteVolume: true,
358+
Image: v1beta1.ImageSpec{
359+
Repository: common.FluentdDrainWatchRepo,
360+
Tag: common.FluentdDrainWatchTag,
361+
},
354362
},
355363
},
356364
},

0 commit comments

Comments
 (0)