Skip to content

Commit a24dec2

Browse files
vivekr-splunkVivek Reddyigor.grzankowskiIgor-splunk
authored
CSPL-3064: Support for Distroless Image Creation in Splunk Operator for Kubernetes (#1421)
* adding support for distoless Signed-off-by: Vivek Reddy <[email protected]> * adding document changes for distroless Signed-off-by: Vivek Reddy <[email protected]> * adding github workflow for distroless Signed-off-by: Vivek Reddy <[email protected]> * adding github workflow for distroless Signed-off-by: Vivek Reddy <[email protected]> * adding github workflow for distroless Signed-off-by: Vivek Reddy <[email protected]> * adding github workflow for distroless Signed-off-by: Vivek Reddy <[email protected]> * Add workflow to push distroless image. * Add - CSPL-3064 branch to triggers for Arm Distroless Smoke Test WorkFlow * Add - CSPL-3064 branch to triggers for Arm Distroless Smoke Test WorkFlow * Add - CSPL-3064 branch to triggers for Arm Distroless Smoke Test WorkFlow * Remove stuttering from name * Use correct distroless image name * Use correct distroless image name * Comment out vurneability-scan * Comment out vurneability-scan * Use correct naming convention in merge develop to main * Use sidecar in distroless int workflow. * Update manifest path * Update sidecar manifest * Add kustomize patch to deploy sidecar-debug * Fix kustomize * Fix command * Fix sidecar name * supporting debug pod in pipeline Signed-off-by: Vivek Reddy <[email protected]> * renamed sidecar name * Fix distroless-build-test-push-workflow.yml to not build for amd * Fix distroless build test push workflow * fix * comment vurn scan out * Update build push distro workflow * Update distorless-int-test-worfklow * Review suggestions * Remove empty lines from install.md * Remove running on CSPL-3064 --------- Signed-off-by: Vivek Reddy <[email protected]> Co-authored-by: Vivek Reddy <[email protected]> Co-authored-by: igor.grzankowski <[email protected]> Co-authored-by: Igor Grzankowski <[email protected]>
1 parent 9598514 commit a24dec2

15 files changed

+1295
-86
lines changed

‎.github/workflows/distroless-build-test-push-workflow.yml‎

Lines changed: 336 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,336 @@
1+
name: Build and Test Distroless
2+
on: push
3+
jobs:
4+
check-formating:
5+
runs-on: ubuntu-latest
6+
steps:
7+
- uses: actions/checkout@v2
8+
- name: Dotenv Action
9+
id: dotenv
10+
uses: falti/dotenv-action@d4d12eaa0e1dd06d5bdc3d7af3bf4c8c93cb5359
11+
- name: Setup Go
12+
uses: actions/setup-go@v2
13+
with:
14+
go-version: ${{ steps.dotenv.outputs.GO_VERSION }}
15+
- name: Check Source formatting
16+
run: make fmt && if [[ $? -ne 0 ]]; then false; fi
17+
- name: Lint source code
18+
run: make vet && if [[ $? -ne 0 ]]; then false; fi
19+
unit-tests:
20+
runs-on: ubuntu-latest
21+
needs: check-formating
22+
steps:
23+
- uses: actions/checkout@v2
24+
- name: Dotenv Action
25+
id: dotenv
26+
uses: falti/dotenv-action@d4d12eaa0e1dd06d5bdc3d7af3bf4c8c93cb5359
27+
- name: Setup Go
28+
uses: actions/setup-go@v2
29+
with:
30+
go-version: ${{ steps.dotenv.outputs.GO_VERSION }}
31+
- name: Install goveralls
32+
run: |
33+
go version
34+
go install github.com/mattn/goveralls@latest
35+
- name: Install Ginkgo
36+
run: |
37+
make setup/ginkgo
38+
go mod tidy
39+
- name: Run Unit Tests
40+
run: make test
41+
- name: Run Code Coverage
42+
run: goveralls -coverprofile=coverage.out -service=circle-ci -repotoken ${{ secrets.COVERALLS_TOKEN }}
43+
- name: Upload Coverage artifacts
44+
uses: actions/[email protected]
45+
with:
46+
name: coverage.out
47+
path: coverage.out
48+
build-operator-image:
49+
runs-on: ubuntu-latest
50+
needs: unit-tests
51+
env:
52+
SPLUNK_ENTERPRISE_IMAGE: ${{ secrets.SPLUNK_ENTERPRISE_IMAGE }}
53+
SPLUNK_OPERATOR_IMAGE_NAME: splunk/splunk-operator
54+
ECR_REPOSITORY: ${{ secrets.ECR_REPOSITORY }}
55+
S3_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
56+
steps:
57+
- name: Set up cosign
58+
uses: sigstore/cosign-installer@main
59+
60+
- uses: actions/checkout@v2
61+
- name: Dotenv Action
62+
id: dotenv
63+
uses: falti/dotenv-action@d4d12eaa0e1dd06d5bdc3d7af3bf4c8c93cb5359
64+
- name: Setup Go
65+
uses: actions/setup-go@v2
66+
with:
67+
go-version: ${{ steps.dotenv.outputs.GO_VERSION }}
68+
- name: Install Ginkgo
69+
run: |
70+
make setup/ginkgo
71+
- name: Set up Docker Buildx
72+
uses: docker/[email protected]
73+
- name: Install Operator SDK
74+
run: |
75+
export ARCH=$(case $(uname -m) in x86_64) echo -n amd64 ;; aarch64) echo -n arm64 ;; *) echo -n $(uname -m) ;; esac)
76+
export OS=$(uname | awk '{print tolower($0)}')
77+
export OPERATOR_SDK_DL_URL=https://github.com/operator-framework/operator-sdk/releases/download/${{ steps.dotenv.outputs.OPERATOR_SDK_VERSION }}
78+
sudo curl -LO ${OPERATOR_SDK_DL_URL}/operator-sdk_${OS}_${ARCH}
79+
sudo chmod +x operator-sdk_${OS}_${ARCH}
80+
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
81+
- name: Configure AWS credentials
82+
uses: aws-actions/configure-aws-credentials@v1
83+
with:
84+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
85+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
86+
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
87+
- name: Login to Amazon ECR
88+
id: login-ecr
89+
uses: aws-actions/amazon-ecr-login@v1
90+
- name: Build and push Splunk Operator Image
91+
run: |
92+
make docker-buildx IMG=${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA-distroless
93+
- name: Sign Splunk Operator image with a key
94+
run: |
95+
cosign sign --yes --key env://COSIGN_PRIVATE_KEY ${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:${{ github.sha }}-distroless
96+
env:
97+
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
98+
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
99+
# vulnerability-scan:
100+
# permissions:
101+
# actions: read
102+
# contents: read
103+
# security-events: write
104+
# runs-on: ubuntu-latest
105+
# needs: build-operator-image
106+
# env:
107+
# SPLUNK_ENTERPRISE_IMAGE: ${{ secrets.SPLUNK_ENTERPRISE_IMAGE }}
108+
# SPLUNK_OPERATOR_IMAGE_NAME: splunk/splunk-operator
109+
# ECR_REPOSITORY: ${{ secrets.ECR_REPOSITORY }}
110+
# S3_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
111+
# IMAGE_NAME: ${{ secrets.ECR_REPOSITORY }}/splunk/splunk-operator:${{ github.sha }}-distroless
112+
# steps:
113+
# - name: Set up cosign
114+
# uses: sigstore/cosign-installer@main
115+
# - uses: actions/checkout@v2
116+
# - name: Dotenv Action
117+
# id: dotenv
118+
# uses: falti/dotenv-action@d4d12eaa0e1dd06d5bdc3d7af3bf4c8c93cb5359
119+
# - name: Set up Docker Buildx
120+
# uses: docker/[email protected]
121+
# - name: Configure AWS credentials
122+
# uses: aws-actions/configure-aws-credentials@v1
123+
# with:
124+
# aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
125+
# aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
126+
# aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
127+
#
128+
# - name: Login to Amazon ECR
129+
# uses: aws-actions/amazon-ecr-login@v1
130+
# - name: Pull Splunk Operator Image Locally
131+
# run: |
132+
# docker pull ${{ env.IMAGE_NAME }}
133+
# - name: Verify Signed Splunk Operator image
134+
# run: |
135+
# cosign verify --key env://COSIGN_PUBLIC_KEY ${{ env.IMAGE_NAME }}
136+
# env:
137+
# COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
138+
# - name: Run Trivy vulnerability scanner
139+
# uses: aquasecurity/trivy-action@master
140+
# with:
141+
# image-ref: '${{ env.IMAGE_NAME }}'
142+
# format: sarif
143+
# #exit-code: 1
144+
# severity: 'CRITICAL'
145+
# ignore-unfixed: true
146+
# output: 'trivy-results.sarif'
147+
# - name: Upload Trivy scan results to GitHub Security tab
148+
# uses: github/codeql-action/upload-sarif@v3
149+
# with:
150+
# sarif_file: 'trivy-results.sarif'
151+
smoke-tests:
152+
strategy:
153+
fail-fast: false
154+
matrix:
155+
test: [
156+
basic,
157+
appframeworksS1,
158+
managerappframeworkc3,
159+
managerappframeworkm4,
160+
managersecret,
161+
managermc,
162+
]
163+
runs-on: ubuntu-latest
164+
env:
165+
CLUSTER_NODES: 1
166+
CLUSTER_WORKERS: 3
167+
SPLUNK_ENTERPRISE_IMAGE: ${{ secrets.SPLUNK_ENTERPRISE_IMAGE }}
168+
SPLUNK_ENTERPRISE_RELEASE_IMAGE: ${{ secrets.SPLUNK_ENTERPRISE_RELEASE_IMAGE }}
169+
SPLUNK_OPERATOR_IMAGE_NAME: splunk/splunk-operator
170+
SPLUNK_OPERATOR_IMAGE_FILENAME: splunk-operator
171+
TEST_FOCUS: "${{ matrix.test }}"
172+
# This regex matches any string not containing smoke keyword
173+
TEST_TO_SKIP: "^(?:[^s]+|s(?:$|[^m]|m(?:$|[^o]|o(?:$|[^k]|k(?:$|[^e])))))*$"
174+
TEST_CLUSTER_PLATFORM: eks
175+
EKS_VPC_PRIVATE_SUBNET_STRING: ${{ secrets.EKS_VPC_PRIVATE_SUBNET_STRING }}
176+
EKS_VPC_PUBLIC_SUBNET_STRING: ${{ secrets.EKS_VPC_PUBLIC_SUBNET_STRING }}
177+
TEST_BUCKET: ${{ secrets.TEST_BUCKET }}
178+
TEST_INDEXES_S3_BUCKET: ${{ secrets.TEST_INDEXES_S3_BUCKET }}
179+
ECR_REPOSITORY: ${{ secrets.ECR_REPOSITORY }}
180+
PRIVATE_REGISTRY: ${{ secrets.ECR_REPOSITORY }}
181+
S3_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
182+
ENTERPRISE_LICENSE_LOCATION: ${{ secrets.ENTERPRISE_LICENSE_LOCATION }}
183+
EKS_SSH_PUBLIC_KEY: ${{ secrets.EKS_SSH_PUBLIC_KEY }}
184+
CLUSTER_WIDE: "true"
185+
DEPLOYMENT_TYPE: ""
186+
steps:
187+
- name: Set Test Cluster Name
188+
run: |
189+
echo "TEST_CLUSTER_NAME=eks-integration-test-cluster-${{ matrix.test }}-$GITHUB_RUN_ID" >> $GITHUB_ENV
190+
- name: Chekcout code
191+
uses: actions/checkout@v2
192+
- name: Dotenv Action
193+
id: dotenv
194+
uses: falti/dotenv-action@d4d12eaa0e1dd06d5bdc3d7af3bf4c8c93cb5359
195+
- name: Change splunk enterprise to release image on main branches
196+
if: github.ref == 'refs/heads/main'
197+
run: |
198+
echo "SPLUNK_ENTERPRISE_IMAGE=${{ steps.dotenv.outputs.SPLUNK_ENTERPRISE_RELEASE_IMAGE }}" >> $GITHUB_ENV
199+
- name: Install Kubectl
200+
uses: Azure/setup-kubectl@v3
201+
with:
202+
version: ${{ steps.dotenv.outputs.KUBECTL_VERSION }}
203+
- name: Install Python
204+
uses: actions/setup-python@v2
205+
- name: Install AWS CLI
206+
run: |
207+
curl "${{ steps.dotenv.outputs.AWSCLI_URL}}" -o "awscliv2.zip"
208+
unzip awscliv2.zip
209+
sudo ./aws/install --update
210+
aws --version
211+
- name: Setup Go
212+
uses: actions/setup-go@v2
213+
with:
214+
go-version: ${{ steps.dotenv.outputs.GO_VERSION }}
215+
- name: Install Ginkgo
216+
run: |
217+
make setup/ginkgo
218+
- name: Install Helm
219+
run: |
220+
curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
221+
chmod 700 get_helm.sh
222+
./get_helm.sh
223+
DESIRED_VERSION=v3.8.2 bash get_helm.sh
224+
- name: Install EKS CTL
225+
run: |
226+
curl --silent --insecure --location "https://github.com/weaveworks/eksctl/releases/download/${{ steps.dotenv.outputs.EKSCTL_VERSION }}/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp
227+
sudo mv /tmp/eksctl /usr/local/bin
228+
eksctl version
229+
- name: Set up Docker Buildx
230+
uses: docker/[email protected]
231+
- name: Install Operator SDK
232+
run: |
233+
sudo curl -L -o /usr/local/bin/operator-sdk https://github.com/operator-framework/operator-sdk/releases/download/${{ steps.dotenv.outputs.OPERATOR_SDK_VERSION }}/operator-sdk-${{ steps.dotenv.outputs.OPERATOR_SDK_VERSION }}-x86_64-linux-gnu
234+
sudo chmod +x /usr/local/bin/operator-sdk
235+
- name: Configure Docker Hub credentials
236+
uses: docker/login-action@v1
237+
with:
238+
username: ${{ secrets.DOCKERHUB_USERNAME }}
239+
password: ${{ secrets.DOCKERHUB_TOKEN}}
240+
- name: Set Splunk Operator image
241+
run: |
242+
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA-distroless" >> $GITHUB_ENV
243+
- name: Pull Splunk Enterprise Image
244+
run: docker pull ${{ env.SPLUNK_ENTERPRISE_IMAGE }}
245+
- name: Configure AWS credentials
246+
uses: aws-actions/configure-aws-credentials@v1
247+
with:
248+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
249+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
250+
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
251+
- name: Login to Amazon ECR
252+
id: login-ecr
253+
uses: aws-actions/amazon-ecr-login@v1
254+
- name: Tag and Push Splunk Enterprise Image to ECR
255+
run: |
256+
docker tag ${{ env.SPLUNK_ENTERPRISE_IMAGE }} ${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_ENTERPRISE_IMAGE }}
257+
docker push ${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_ENTERPRISE_IMAGE }}
258+
- name: Create EKS cluster
259+
run: |
260+
export EKS_CLUSTER_K8_VERSION=${{ steps.dotenv.outputs.EKS_CLUSTER_K8_VERSION }}
261+
make cluster-up
262+
- name: install metric server
263+
run: |
264+
kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
265+
- name: install k8s dashboard
266+
run: |
267+
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.5/aio/deploy/recommended.yaml
268+
- name: Setup Kustomize
269+
run: |
270+
sudo snap install kustomize
271+
mkdir -p ./bin
272+
cp /snap/bin/kustomize ./bin/kustomize
273+
- name: Run smoke test
274+
id: smoketest
275+
run: |
276+
make int-test
277+
- name: Collect Test Logs
278+
if: ${{ always() }}
279+
run: |
280+
mkdir -p /tmp/pod_logs
281+
find ./test -name "*.log" -exec cp {} /tmp/pod_logs \;
282+
- name: Archive Pod Logs
283+
if: ${{ always() }}
284+
uses: actions/[email protected]
285+
with:
286+
name: "splunk-pods-logs--artifacts-${{ matrix.test }}"
287+
path: "/tmp/pod_logs/**"
288+
- name: Cleanup Test Case artifacts
289+
if: ${{ always() }}
290+
run: |
291+
make cleanup
292+
make clean
293+
- name: Cleanup up EKS cluster
294+
if: ${{ always() }}
295+
run: |
296+
make cluster-down
297+
#- name: Test Report
298+
# uses: dorny/test-reporter@v1
299+
# if: success() || failure() # run this step even if previous step failed
300+
# with:
301+
# name: Integration Tests # Name of the check run which will be created
302+
# path: inttest-*.xml # Path to test results
303+
# reporter: jest-junit # Format of test results
304+
push-latest:
305+
needs: smoke-tests
306+
if: github.ref == 'refs/heads/main'
307+
runs-on: ubuntu-latest
308+
env:
309+
SPLUNK_OPERATOR_IMAGE_NAME: splunk/splunk-operator
310+
TAG: latest
311+
steps:
312+
- name: Checkout Code
313+
uses: actions/checkout@v2
314+
- name: Dotenv Action
315+
id: dotenv
316+
uses: falti/dotenv-action@d4d12eaa0e1dd06d5bdc3d7af3bf4c8c93cb5359
317+
- name: Set up Docker Buildx
318+
uses: docker/[email protected]
319+
- name: Configure Docker Hub credentials
320+
uses: docker/login-action@v1
321+
with:
322+
username: ${{ secrets.DOCKERHUB_USERNAME }}
323+
password: ${{ secrets.DOCKERHUB_PUSH_TOKEN}}
324+
- name: Configure AWS credentials
325+
uses: aws-actions/configure-aws-credentials@v1
326+
with:
327+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
328+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
329+
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
330+
- name: Login to Amazon ECR
331+
uses: aws-actions/amazon-ecr-login@v1
332+
- name: Re-tag Splunk Operator Image
333+
run: |
334+
docker tag ${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA-distroless ${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:${{ env.TAG }}-distroless
335+
- name: Push Splunk Operator Image to Docker Hub
336+
run: docker push ${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:${{ env.TAG }}

0 commit comments

Comments
 (0)