Skip to content

Commit c1df74b

Browse files
csatib02csatib02
authored
Merge pull request #1997 from kube-logging/feat/move-in-node-exporter-image
feat: move in node-exporter image
2 parents c11e2db + 31b87f0 commit c1df74b

File tree

25 files changed

+393
-26
lines changed

25 files changed

+393
-26
lines changed

‎.github/workflows/config-reloader.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ jobs:
103103
for tag in ${TAGS[@]}; do
104104
cosign verify "${tag}@${DIGEST}" \
105105
--rekor-url "https://rekor.sigstore.dev/" \
106-
--certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/config-reloader-image.yaml@${{ github.ref }}" \
106+
--certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/config-reloader.yaml@${{ github.ref }}" \
107107
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" | jq
108108
done
109109

‎.github/workflows/dependency-images.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,3 +62,14 @@ jobs:
6262
packages: write
6363
id-token: write
6464
security-events: write
65+
66+
node-exporter:
67+
name: Node exporter
68+
uses: ./.github/workflows/node-exporter.yaml
69+
with:
70+
publish: ${{ inputs.publish }}
71+
permissions:
72+
contents: read
73+
packages: write
74+
id-token: write
75+
security-events: write

‎.github/workflows/e2e.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,10 @@ jobs:
4141
context: images/fluentd-drain-watch
4242
tags: fluentd-drain-watch:local
4343
output: fluentd-drain-watch.tar
44+
- image: node-exporter
45+
context: images/node-exporter
46+
tags: node-exporter:local
47+
output: node-exporter.tar
4448

4549
steps:
4650
- name: Checkout
@@ -96,6 +100,7 @@ jobs:
96100
docker load --input /tmp/config-reloader.tar
97101
docker load --input /tmp/syslog-ng-reloader.tar
98102
docker load --input /tmp/fluentd-drain-watch.tar
103+
docker load --input /tmp/node-exporter.tar
99104
docker load --input /tmp/controller.tar
100105
docker image ls -a
101106
@@ -155,6 +160,7 @@ jobs:
155160
docker load --input /tmp/config-reloader.tar
156161
docker load --input /tmp/syslog-ng-reloader.tar
157162
docker load --input /tmp/fluentd-drain-watch.tar
163+
docker load --input /tmp/node-exporter.tar
158164
docker load --input /tmp/controller.tar
159165
docker image ls -a
160166

‎.github/workflows/node-exporter.yaml

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
name: Node exporter
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
publish:
7+
description: Publish artifacts to the artifact store
8+
default: false
9+
required: false
10+
type: boolean
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
node-exporter-image:
17+
name: Node exporter image
18+
runs-on: ubuntu-latest
19+
20+
permissions:
21+
contents: read
22+
packages: write
23+
id-token: write
24+
security-events: write
25+
26+
steps:
27+
- name: Checkout repository
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
29+
30+
- name: Set up QEMU
31+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
32+
33+
- name: Set up Docker Buildx
34+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
35+
36+
- name: Set up Cosign
37+
uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
38+
if: ${{ inputs.publish }}
39+
40+
- name: Set image name
41+
id: image-name
42+
run: echo "value=ghcr.io/${{ github.repository }}/node-exporter" >> "$GITHUB_OUTPUT"
43+
44+
- name: Gather build metadata
45+
id: meta
46+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
47+
with:
48+
images: ${{ steps.image-name.outputs.value }}
49+
flavor: |
50+
latest = false
51+
tags: |
52+
type=ref,event=branch
53+
type=ref,event=pr
54+
type=semver,pattern={{raw}}
55+
type=raw,value=latest,enable={{is_default_branch}}
56+
labels: |
57+
org.opencontainers.image.description=Node exporter image for the Logging operator.
58+
org.opencontainers.image.title=Logging operator Node exporter image
59+
org.opencontainers.image.authors=Kube logging authors
60+
org.opencontainers.image.documentation=https://kube-logging.dev/docs/
61+
62+
- name: Login to GitHub Container Registry
63+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
64+
with:
65+
registry: ghcr.io
66+
username: ${{ github.actor }}
67+
password: ${{ github.token }}
68+
if: ${{ inputs.publish }}
69+
70+
- name: Build and push Node exporter image
71+
id: build
72+
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
73+
with:
74+
context: images/node-exporter
75+
platforms: linux/amd64,linux/arm64
76+
tags: ${{ steps.meta.outputs.tags }}
77+
labels: ${{ steps.meta.outputs.labels }}
78+
cache-from: type=gha
79+
cache-to: type=gha,mode=max
80+
outputs: |
81+
type=image,push=${{ inputs.publish }},name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
82+
type=oci,dest=image.tar,name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
83+
84+
- name: Sign image with GitHub OIDC Token
85+
if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
86+
env:
87+
DIGEST: ${{ steps.build.outputs.digest }}
88+
TAGS: ${{ steps.meta.outputs.tags }}
89+
run: |
90+
images=""
91+
for tag in ${TAGS[@]}; do
92+
images+="${tag}@${DIGEST} "
93+
done
94+
95+
cosign sign --yes --rekor-url "https://rekor.sigstore.dev/" ${images}
96+
97+
- name: Verify signed image with cosign
98+
if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
99+
env:
100+
DIGEST: ${{ steps.build.outputs.digest }}
101+
TAGS: ${{ steps.meta.outputs.tags }}
102+
run: |
103+
for tag in ${TAGS[@]}; do
104+
cosign verify "${tag}@${DIGEST}" \
105+
--rekor-url "https://rekor.sigstore.dev/" \
106+
--certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/node-exporter.yaml@${{ github.ref }}" \
107+
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" | jq
108+
done
109+
110+
- name: Extract OCI tarball
111+
run: |
112+
mkdir -p image
113+
tar -xf image.tar -C image
114+
115+
- name: Run Trivy vulnerability scanner
116+
uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # 0.30.0
117+
env:
118+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
119+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
120+
with:
121+
input: image
122+
format: sarif
123+
output: trivy-results.sarif
124+
125+
- name: Upload Trivy scan results as artifact
126+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
127+
with:
128+
name: "[${{ github.job }}] Trivy scan results"
129+
path: trivy-results.sarif
130+
retention-days: 5
131+
132+
- name: Upload Trivy scan results to GitHub Security tab
133+
uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
134+
with:
135+
sarif_file: trivy-results.sarif

‎Makefile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ FLUENTD_IMG ?= fluentd-full:local
4545
CONFIG_RELOADER_IMG ?= config-reloader:local
4646
SYSLOG_NG_RELOADER_IMG ?= syslog-ng-reloader:local
4747
FLUENTD_DRAIN_WATCH_IMG ?= fluentd-drain-watch:local
48+
NODE_EXPORTER_IMG ?= node-exporter:local
4849
OPERATOR_IMG ?= controller:local
4950
OPERATOR_IMG_DEBUG ?= controller:debug
5051

@@ -116,6 +117,7 @@ docker-build-e2e-test: ## Build the coverage docker image
116117
${DOCKER} build -t ${CONFIG_RELOADER_IMG} images/config-reloader
117118
${DOCKER} build -t ${SYSLOG_NG_RELOADER_IMG} images/syslog-ng-reloader
118119
${DOCKER} build -t ${FLUENTD_DRAIN_WATCH_IMG} images/fluentd-drain-watch
120+
${DOCKER} build -t ${NODE_EXPORTER_IMG} images/node-exporter
119121
${DOCKER} build -t ${FLUENTD_IMG} --target full images/fluentd
120122

121123
.PHONY: docker-build-drain-watch
@@ -233,6 +235,7 @@ test-e2e-nodeps:
233235
CONFIG_RELOADER_IMAGE="${CONFIG_RELOADER_IMG}" \
234236
SYSLOG_NG_RELOADER_IMAGE="${SYSLOG_NG_RELOADER_IMG}" \
235237
FLUENTD_DRAIN_WATCH_IMAGE="${FLUENTD_DRAIN_WATCH_IMG}" \
238+
NODE_EXPORTER_IMAGE="${NODE_EXPORTER_IMG}" \
236239
FLUENTD_IMAGE="${FLUENTD_IMG}" \
237240
KIND_PATH="$(KIND)" \
238241
KIND_IMAGE="$(KIND_IMAGE)" \

‎config/samples/logging_logging_with_monitoring.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ spec:
1111
enableRecreateWorkloadOnImmutableFieldChange: true
1212
fluentd:
1313
bufferVolumeImage:
14-
repository: ghcr.io/kube-logging/node-exporter
14+
repository: ghcr.io/kube-logging/logging-operator/node-exporter
1515
bufferVolumeMetrics:
1616
prometheusRules: true
1717
serviceMonitor: true

‎e2e/common/helpers.go

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ const (
4242
SyslogNGReloaderTag = "local"
4343
FluentdDrainWatchRepo = "fluentd-drain-watch"
4444
FluentdDrainWatchTag = "local"
45+
NodeExporterRepo = "node-exporter"
46+
NodeExporterTag = "local"
4547
)
4648

4749
var sequence uint32
@@ -124,6 +126,10 @@ func LoggingInfra(
124126
Tag: ConfigReloaderTag,
125127
},
126128
},
129+
BufferVolumeImage: v1beta1.ImageSpec{
130+
Repository: NodeExporterRepo,
131+
Tag: NodeExporterTag,
132+
},
127133
},
128134
}
129135
RequireNoError(t, c.Create(ctx, &agent))
@@ -147,6 +153,10 @@ func LoggingInfra(
147153
Repository: ConfigReloaderRepo,
148154
Tag: ConfigReloaderTag,
149155
},
156+
BufferVolumeImage: v1beta1.ImageSpec{
157+
Repository: NodeExporterRepo,
158+
Tag: NodeExporterTag,
159+
},
150160
DisablePvc: true,
151161
Resources: v12.ResourceRequirements{
152162
Requests: v12.ResourceList{
@@ -225,6 +235,10 @@ func LoggingTenant(
225235
Repository: ConfigReloaderRepo,
226236
Tag: ConfigReloaderTag,
227237
},
238+
BufferVolumeImage: v1beta1.ImageSpec{
239+
Repository: NodeExporterRepo,
240+
Tag: NodeExporterTag,
241+
},
228242
DisablePvc: true,
229243
Resources: v12.ResourceRequirements{
230244
Requests: v12.ResourceList{

‎e2e/common/setup/loggingoperator.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,11 @@ var (
5151
repository: "fluentd-drain-watch",
5252
tag: "local",
5353
},
54+
{
55+
lookupEnv: "NODE_EXPORTER_IMAGE",
56+
repository: "node-exporter",
57+
tag: "local",
58+
},
5459
{
5560
lookupEnv: "FLUENTD_IMAGE",
5661
repository: "fluentd-full",

‎e2e/fluentd-aggregator-detached-multiple-failures/fluentd_aggregator_detached_multiple_failures_test.go

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,10 @@ func TestFluentdAggregator_detached_multiple_failure(t *testing.T) {
9090
Tag: common.ConfigReloaderTag,
9191
},
9292
},
93+
BufferVolumeImage: v1beta1.ImageSpec{
94+
Repository: common.NodeExporterRepo,
95+
Tag: common.NodeExporterTag,
96+
},
9397
},
9498
},
9599
}
@@ -109,6 +113,10 @@ func TestFluentdAggregator_detached_multiple_failure(t *testing.T) {
109113
Repository: common.ConfigReloaderRepo,
110114
Tag: common.ConfigReloaderTag,
111115
},
116+
BufferVolumeImage: v1beta1.ImageSpec{
117+
Repository: common.NodeExporterRepo,
118+
Tag: common.NodeExporterTag,
119+
},
112120
Resources: corev1.ResourceRequirements{
113121
Limits: corev1.ResourceList{
114122
corev1.ResourceCPU: resource.MustParse("500m"),
@@ -149,6 +157,10 @@ func TestFluentdAggregator_detached_multiple_failure(t *testing.T) {
149157
Repository: common.ConfigReloaderRepo,
150158
Tag: common.ConfigReloaderTag,
151159
},
160+
BufferVolumeImage: v1beta1.ImageSpec{
161+
Repository: common.NodeExporterRepo,
162+
Tag: common.NodeExporterTag,
163+
},
152164
Resources: corev1.ResourceRequirements{
153165
Limits: corev1.ResourceList{
154166
corev1.ResourceCPU: resource.MustParse("500m"),

‎e2e/fluentd-aggregator-detached/fluentd_aggregator_detached_test.go

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,10 @@ func TestFluentdAggregator_detached_MultiWorker(t *testing.T) {
9393
Tag: common.ConfigReloaderTag,
9494
},
9595
},
96+
BufferVolumeImage: v1beta1.ImageSpec{
97+
Repository: common.NodeExporterRepo,
98+
Tag: common.NodeExporterTag,
99+
},
96100
},
97101
},
98102
}
@@ -112,6 +116,10 @@ func TestFluentdAggregator_detached_MultiWorker(t *testing.T) {
112116
Repository: common.ConfigReloaderRepo,
113117
Tag: common.ConfigReloaderTag,
114118
},
119+
BufferVolumeImage: v1beta1.ImageSpec{
120+
Repository: common.NodeExporterRepo,
121+
Tag: common.NodeExporterTag,
122+
},
115123
Resources: corev1.ResourceRequirements{
116124
Limits: corev1.ResourceList{
117125
corev1.ResourceCPU: resource.MustParse("500m"),
@@ -154,6 +162,10 @@ func TestFluentdAggregator_detached_MultiWorker(t *testing.T) {
154162
Repository: common.ConfigReloaderRepo,
155163
Tag: common.ConfigReloaderTag,
156164
},
165+
BufferVolumeImage: v1beta1.ImageSpec{
166+
Repository: common.NodeExporterRepo,
167+
Tag: common.NodeExporterTag,
168+
},
157169
Resources: corev1.ResourceRequirements{
158170
Limits: corev1.ResourceList{
159171
corev1.ResourceCPU: resource.MustParse("500m"),

0 commit comments

Comments
 (0)