Skip to content

Commit d5245bd

Browse files
jimmidysonjimmidyson
committed
refactor: Update helm registry initialization
This commit updates the helm registry initialization by separating out the image used for copying the charts to the PVC and using the released mindthegap image directly for serving the bundles. This is a small security enhancement by using the minimal image that mindthegap already provides. This commit also copies a statically compiled version of `cp` to a scratch container in order to us a minimal container with no package manager or shell, again this is a minor security enhancement. This change means that the bundles are copied to a subdirectory on the PVC as globbing cannot be used without a shell present, whereas recursive copying works correctly. This is a breaking change but should not affect any users at this point (e.g. not yet included in any downstream releases). Finally, this commit updates the helm values to use a more structured approach. While this is a breaking change, the Helm chart is only used to generate the clusterctl provider components YAML and as such does not have any impact on existing users.
1 parent 50b447e commit d5245bd

File tree

9 files changed

+89
-59
lines changed

9 files changed

+89
-59
lines changed

‎.envrc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ export DEVBOX_NO_ENVRC_UPDATE=1
77

88
eval "$(devbox generate direnv --print-envrc --env-file .dev-envrc)"
99

10-
dotenv_if_exists '.envrc.local'
11-
dotenv_if_exists '.envrc.e2e'
10+
source_env_if_exists '.envrc.local'
11+
source_env_if_exists '.envrc.e2e'
1212

1313
# check out https://www.jetpack.io/devbox/docs/ide_configuration/direnv/
1414
# for more details

‎.github/workflows/checks.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -234,14 +234,19 @@ jobs:
234234
name: Build Docker images
235235
run: devbox run -- make release-snapshot
236236

237+
- if: steps.list-changed.outputs.changed == 'true'
238+
name: Export image tag
239+
id: export-image-tag
240+
run: echo test-image-tag="$(devbox run -- gojq -r .version dist/metadata.json)-$(devbox run -- go env GOARCH)" >> "$GITHUB_OUTPUT"
241+
237242
- if: steps.list-changed.outputs.changed == 'true'
238243
name: Sideload docker image
239244
run: |
240245
devbox run -- \
241246
kind load docker-image \
242247
--name "${KIND_CLUSTER_NAME}" \
243-
"ko.local/cluster-api-runtime-extensions-nutanix:$(devbox run -- gojq -r .version dist/metadata.json)-$(devbox run -- go env GOARCH)" \
244-
"ghcr.io/nutanix-cloud-native/caren-helm-reg:$(devbox run -- gojq -r .version dist/metadata.json)-$(devbox run -- go env GOARCH)"
248+
"ko.local/cluster-api-runtime-extensions-nutanix:${{ steps.export-image-tag.outputs.test-image-tag }}" \
249+
"ghcr.io/nutanix-cloud-native/caren-helm-reg:${{ steps.export-image-tag.outputs.test-image-tag }}"
245250
246251
- if: steps.list-changed.outputs.changed == 'true'
247252
name: Setup Cluster API and cert-manager
@@ -253,7 +258,7 @@ jobs:
253258
devbox run -- \
254259
ct install \
255260
--config charts/ct-config.yaml \
256-
--helm-extra-set-args "--set-string image.repository=ko.local/cluster-api-runtime-extensions-nutanix --set-string image.tag=$(devbox run -- gojq -r .version dist/metadata.json)-$(devbox run -- go env GOARCH) --set-string helmRepositoryImage.tag=$(devbox run -- gojq -r .version dist/metadata.json)-$(devbox run -- go env GOARCH)"
261+
--helm-extra-set-args "--set-string image.repository=ko.local/cluster-api-runtime-extensions-nutanix --set-string image.tag=${{ steps.export-image-tag.outputs.test-image-tag }} --set-string helmRepository.images.bundleInitializer.tag=${{ steps.export-image-tag.outputs.test-image-tag }}"
257262
env:
258263
KUBECONFIG: ${{ env.KIND_KUBECONFIG }}
259264

‎.goreleaser.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ before:
4444
$(helm template {{ .ProjectName }} ./charts/{{ .ProjectName }} \
4545
--namespace caren-system \
4646
--set-string image.tag=v{{ trimprefix .Version "v" }}{{ if .IsSnapshot }}-{{ .Runtime.Goarch }}{{ end }} \
47-
--set-string helmRepositoryImage.tag=v{{ trimprefix .Version "v" }}{{ if .IsSnapshot }}-{{ .Runtime.Goarch }} \
47+
--set-string helmRepository.images.bundleInitializer.tag=v{{ trimprefix .Version "v" }}{{ if .IsSnapshot }}-{{ .Runtime.Goarch }} \
4848
--set-string image.repository=ko.local/{{ .ProjectName }}{{ end }} \
4949
)
5050
EOF'

‎charts/cluster-api-runtime-extensions-nutanix/README.md‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,14 @@ A Helm chart for cluster-api-runtime-extensions-nutanix
3232
| deployment.replicas | int | `1` | |
3333
| env | object | `{}` | |
3434
| helmAddonsConfigMap | string | `"default-helm-addons-config"` | |
35-
| helmRepositoryImage.pullPolicy | string | `"IfNotPresent"` | |
36-
| helmRepositoryImage.repository | string | `"ghcr.io/nutanix-cloud-native/caren-helm-reg"` | |
37-
| helmRepositoryImage.tag | string | `""` | |
38-
| helmRepositorySecurityContext.fsGroup | int | `65534` | |
39-
| helmRepositorySecurityContext.runAsGroup | int | `65534` | |
40-
| helmRepositorySecurityContext.runAsUser | int | `65534` | |
35+
| helmRepository.images.bundleInitializer.pullPolicy | string | `"IfNotPresent"` | |
36+
| helmRepository.images.bundleInitializer.repository | string | `"ghcr.io/nutanix-cloud-native/caren-helm-reg"` | |
37+
| helmRepository.images.bundleInitializer.tag | string | `""` | |
38+
| helmRepository.images.mindthegap.pullPolicy | string | `"IfNotPresent"` | |
39+
| helmRepository.images.mindthegap.repository | string | `"ghcr.io/mesosphere/mindthegap"` | |
40+
| helmRepository.images.mindthegap.tag | string | `"v1.16.0"` | |
41+
| helmRepository.securityContext.fsGroup | int | `65534` | |
42+
| helmRepository.securityContext.runAsUser | int | `65534` | |
4143
| hooks.ccm.aws.helmAddonStrategy.defaultValueTemplateConfigMap.create | bool | `true` | |
4244
| hooks.ccm.aws.helmAddonStrategy.defaultValueTemplateConfigMap.name | string | `"default-aws-ccm-helm-values-template"` | |
4345
| hooks.ccm.aws.k8sMinorVersionToCCMVersion."1.27" | string | `"v1.27.9"` | |

‎charts/cluster-api-runtime-extensions-nutanix/templates/helm-repository.yaml‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -62,8 +62,8 @@ spec:
6262
spec:
6363
initContainers:
6464
- name: copy-charts
65-
image: "{{ .Values.helmRepositoryImage.repository }}:{{ default $.Chart.AppVersion .Values.helmRepositoryImage.tag }}"
66-
command: ["/bin/sh", "-c", "cp /charts/*.tar /helm-charts"]
65+
image: "{{ .Values.helmRepository.images.bundleInitializer.repository }}:{{ default $.Chart.AppVersion .Values.helmRepository.images.bundleInitializer.tag }}"
66+
command: ["/bin/cp", "-r", "/charts/", "/helm-charts/bundles/"]
6767
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
6868
volumeMounts:
6969
- name: charts-volume
@@ -74,13 +74,12 @@ spec:
7474
- name: serve
7575
protocol: TCP
7676
containerPort: 5000
77-
image: "{{ .Values.helmRepositoryImage.repository }}:{{ default $.Chart.AppVersion .Values.helmRepositoryImage.tag }}"
77+
image: "{{ .Values.helmRepository.images.mindthegap.repository }}:{{ .Values.helmRepository.images.mindthegap.tag }}"
7878
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
79-
command: ["/usr/bin/mindthegap"]
8079
args:
8180
- serve
8281
- bundle
83-
- --bundle=/helm-charts/helm-charts-*.tar
82+
- --bundle=/helm-charts/bundles/helm-charts-*.tar
8483
- --listen-port=5000
8584
- --listen-address=0.0.0.0
8685
- --tls-private-key-file=/certs/tls.key
@@ -101,7 +100,7 @@ spec:
101100
periodSeconds: 1
102101
priorityClassName: {{ .Values.priorityClassName }}
103102
securityContext:
104-
{{ with .Values.helmRepositorySecurityContext }}
103+
{{ with .Values.helmRepository.securityContext }}
105104
{{- toYaml . | nindent 8}}
106105
{{- end }}
107106
volumes:

‎charts/cluster-api-runtime-extensions-nutanix/values.schema.json‎

Lines changed: 43 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -38,30 +38,51 @@
3838
"helmAddonsConfigMap": {
3939
"type": "string"
4040
},
41-
"helmRepositoryImage": {
41+
"helmRepository": {
4242
"properties": {
43-
"pullPolicy": {
44-
"type": "string"
45-
},
46-
"repository": {
47-
"type": "string"
48-
},
49-
"tag": {
50-
"type": "string"
51-
}
52-
},
53-
"type": "object"
54-
},
55-
"helmRepositorySecurityContext": {
56-
"properties": {
57-
"fsGroup": {
58-
"type": "integer"
59-
},
60-
"runAsGroup": {
61-
"type": "integer"
43+
"images": {
44+
"properties": {
45+
"bundleInitializer": {
46+
"properties": {
47+
"pullPolicy": {
48+
"type": "string"
49+
},
50+
"repository": {
51+
"type": "string"
52+
},
53+
"tag": {
54+
"type": "string"
55+
}
56+
},
57+
"type": "object"
58+
},
59+
"mindthegap": {
60+
"properties": {
61+
"pullPolicy": {
62+
"type": "string"
63+
},
64+
"repository": {
65+
"type": "string"
66+
},
67+
"tag": {
68+
"type": "string"
69+
}
70+
},
71+
"type": "object"
72+
}
73+
},
74+
"type": "object"
6275
},
63-
"runAsUser": {
64-
"type": "integer"
76+
"securityContext": {
77+
"properties": {
78+
"fsGroup": {
79+
"type": "integer"
80+
},
81+
"runAsUser": {
82+
"type": "integer"
83+
}
84+
},
85+
"type": "object"
6586
}
6687
},
6788
"type": "object"

‎charts/cluster-api-runtime-extensions-nutanix/values.yaml‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -132,10 +132,19 @@ image:
132132
tag: ""
133133
pullPolicy: IfNotPresent
134134

135-
helmRepositoryImage:
136-
repository: ghcr.io/nutanix-cloud-native/caren-helm-reg
137-
tag: ""
138-
pullPolicy: IfNotPresent
135+
helmRepository:
136+
images:
137+
bundleInitializer:
138+
repository: ghcr.io/nutanix-cloud-native/caren-helm-reg
139+
tag: ""
140+
pullPolicy: IfNotPresent
141+
mindthegap:
142+
repository: ghcr.io/mesosphere/mindthegap
143+
tag: "v1.16.0"
144+
pullPolicy: IfNotPresent
145+
securityContext:
146+
runAsUser: 65534
147+
fsGroup: 65534
139148

140149
# -- Optional secrets used for pulling the container image
141150
imagePullSecrets: []
@@ -160,12 +169,6 @@ resources:
160169
securityContext:
161170
runAsUser: 65532
162171

163-
# The helm-repository containers are based on an Alpine image with a different nonroot user
164-
helmRepositorySecurityContext:
165-
runAsUser: 65534
166-
runAsGroup: 65534
167-
fsGroup: 65534
168-
169172
service:
170173
annotations: {}
171174
type: ClusterIP

‎hack/addons/mindthegap-helm-registry/Dockerfile‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
1-
ARG MINDTHEGAP_VERSION=v1.14.4
1+
ARG MINDTHEGAP_VERSION=v1.16.0
2+
23
FROM --platform=${BUILDPLATFORM} ghcr.io/mesosphere/mindthegap:${MINDTHEGAP_VERSION} as bundle_builder
3-
# this gets called by goreleaser so the copy source has to be the path relative to the repo root.
4+
# This gets called by goreleaser so the copy source has to be the path relative to the repo root.
45
RUN --mount=source=./hack/addons/mindthegap-helm-registry/repos.yaml,target=/repos.yaml \
56
["/ko-app/mindthegap", "create", "bundle", "--helm-charts-file=/repos.yaml", "--output-file=/tmp/helm-charts.tar"]
67

7-
FROM --platform=${TARGETPLATFORM} ghcr.io/mesosphere/mindthegap:${MINDTHEGAP_VERSION} as mindthegap
8+
FROM --platform=${TARGETPLATFORM} busybox:1.37.0-musl as static-busybox
89

9-
FROM --platform=${TARGETPLATFORM} alpine:3.20.3
10-
# Add mindthegap binary that matches TARGETPLATFORM
11-
COPY --from=mindthegap /ko-app/mindthegap /usr/bin/mindthegap
10+
FROM --platform=${TARGETPLATFORM} scratch
1211
# Add helm charts for the current version
1312
ARG VERSION
1413
COPY --from=bundle_builder /tmp/helm-charts.tar /charts/helm-charts-${VERSION}.tar
1514
# TODO remove me as soon as its not needed to hold multiple versions of helm charts
1615
COPY --from=ghcr.io/nutanix-cloud-native/caren-helm-reg:v0.14.6 /tmp/helm-charts.tar /charts/helm-charts-v0.14.6.tar
1716
COPY --from=ghcr.io/nutanix-cloud-native/caren-helm-reg:v0.14.9 /tmp/helm-charts.tar /charts/helm-charts-v0.14.9.tar
18-
VOLUME /certs
19-
ENTRYPOINT /usr/bin/mindthegap
17+
18+
# Add statically compiled cp to the image used to copy bundles to the mounted PVC at runtime.
19+
COPY --from=static-busybox /bin/cp /bin/cp

‎make/dev.mk‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ dev.run-on-kind:
1515
helm upgrade --install cluster-api-runtime-extensions-nutanix ./charts/cluster-api-runtime-extensions-nutanix \
1616
--set-string image.repository=ko.local/cluster-api-runtime-extensions-nutanix \
1717
--set-string image.tag=$(SNAPSHOT_VERSION) \
18-
--set-string helmRepositoryImage.tag=$(SNAPSHOT_VERSION) \
18+
--set-string helmRepository.images.bundleInitializer.tag=$(SNAPSHOT_VERSION) \
1919
--wait --wait-for-jobs
2020
kubectl rollout restart deployment cluster-api-runtime-extensions-nutanix
2121
kubectl rollout restart deployment helm-repository

0 commit comments

Comments
 (0)