ROX-19827: migrate infra-server/certifier images to quay.io (#1201)

Author: tommartensen

.github/workflows/PR.yaml

@@ -20,6 +20,9 @@ jobs:
   lint:
     uses: ./.github/workflows/lint.yaml
 
+  unit-tests:
+    uses: ./.github/workflows/unit-tests.yaml
+
   build-and-push:
     uses: ./.github/workflows/build-and-push.yaml
     secrets: inherit

.github/workflows/ReleaseTagged.yaml

@@ -16,6 +16,9 @@ jobs:
   lint:
     uses: ./.github/workflows/lint.yaml
 
+  unit-tests:
+    uses: ./.github/workflows/unit-tests.yaml
+
   build-and-push:
     uses: ./.github/workflows/build-and-push.yaml
     secrets: inherit

.github/workflows/build-and-push.yaml

@@ -8,7 +8,7 @@ defaults:
     working-directory: go/src/github.com/stackrox/infra
 
 jobs:
-  build-and-push:
+  build-and-push-server:
     runs-on: ubuntu-latest
     container:
       image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.3.61
@@ -40,26 +40,45 @@ jobs:
           make proto-generated-srcs
           git diff --exit-code HEAD
 
-      - name: Go Unit Test
-        run: |
-          make unit-test
-
       - name: Build Infra Server
         run: |
           make image
 
+      - name: Login for image push
+        uses: docker/login-action@v3
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_RHACS_ENG_INFRA_RW_USERNAME }}
+          password: ${{ secrets.QUAY_RHACS_ENG_INFRA_RW_PASSWORD }}
+
+      - name: Push
+        run: |
+          make push
+
+  build-and-push-certifier:
+    runs-on: ubuntu-latest
+    container:
+      image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.3.61
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: go/src/github.com/stackrox/infra
+
       - name: Build Certifier
         run: |
           cd certifier && make image
 
       - name: Login for image push
         uses: docker/login-action@v3
         with:
-          registry: us.gcr.io
-          username: _json_key
-          password: ${{ secrets.INFRA_IMAGE_PUSH }}
+          registry: quay.io
+          username: ${{ secrets.QUAY_RHACS_ENG_INFRA_RW_USERNAME }}
+          password: ${{ secrets.QUAY_RHACS_ENG_INFRA_RW_PASSWORD }}
 
       - name: Push
         run: |
-          make push
           cd certifier && make push

.github/workflows/unit-tests.yaml

@@ -0,0 +1,33 @@
+name: Unit Tests
+
+on:
+  workflow_call:
+
+defaults:
+  run:
+    working-directory: go/src/github.com/stackrox/infra
+
+jobs:
+  unit-test:
+    runs-on: ubuntu-latest
+    container:
+      image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.3.61
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: go/src/github.com/stackrox/infra
+
+      - name: Setup env
+        run: |
+          GOPATH="$GITHUB_WORKSPACE/go"
+          echo GOPATH="${GOPATH}" >> "$GITHUB_ENV"
+          PATH="${PATH}:${GOPATH}/bin"
+          echo PATH="${PATH}" >> "$GITHUB_ENV"
+
+      - name: Go Unit Test
+        run: |
+          make unit-test

Makefile

@@ -25,7 +25,7 @@ endif
 tag:
 	@echo $(VERSION)
 
-IMAGE=us.gcr.io/stackrox-infra/infra-server:$(VERSION)
+IMAGE=quay.io/rhacs-eng/infra-server:$(VERSION)
 .PHONY: image-name
 image-name:
 	@echo $(IMAGE)

certifier/Makefile

@@ -15,7 +15,7 @@ endif
 tag:
 	@echo $(VERSION)
 
-IMAGE=us.gcr.io/stackrox-infra/certifier:$(VERSION)
+IMAGE=quay.io/rhacs-eng/infra-certifier:$(VERSION)
 .PHONY: image-name
 image-name:
 	@echo $(IMAGE)

chart/infra-server/static/workflow-aks.yaml

@@ -48,7 +48,7 @@ spec:
             archive:
               tar: {}
       container:
-        image: gcr.io/stackrox-infra/automation-flavors/aks:0.2.16
+        image: quay.io/stackrox-io/ci:automation-flavors-aks-0.10.1
         imagePullPolicy: Always
         command:
           - entrypoint
@@ -96,7 +96,7 @@ spec:
 
     - name: destroy
       container:
-        image: gcr.io/stackrox-infra/automation-flavors/aks:0.2.16
+        image: quay.io/stackrox-io/ci:automation-flavors-aks-0.10.1
         imagePullPolicy: Always
         command:
           - entrypoint

chart/infra-server/static/workflow-example.yaml

@@ -13,7 +13,6 @@ data:
     {{ required ".Values.demo__demo_cert_bot_json is undefined" .Values.demo__demo_cert_bot_json }}
 
 ---
-
 apiVersion: batch/v1
 kind: CronJob
 metadata:
@@ -27,7 +26,7 @@ spec:
         spec:
           containers:
           - name: certifier
-            image: us.gcr.io/stackrox-infra/certifier:0.0.0-5
+            image: quay.io/rhacs-eng/infra-certifier:{{ required "A valid .Values.tag entry is required!" .Values.tag }}
             imagePullPolicy: IfNotPresent
             args:
               - --common-name=*.demo.stackrox.com
@@ -46,9 +45,10 @@ spec:
             - name: configuration
               secret:
                 secretName: demo-certifier-credentials
+          imagePullSecrets:
+            - name: infra-image-registry-pull-secret
 
 ---
-
 apiVersion: batch/v1
 kind: CronJob
 metadata:
@@ -62,7 +62,7 @@ spec:
         spec:
           containers:
           - name: certifier
-            image: us.gcr.io/stackrox-infra/certifier:0.8.8
+            image: quay.io/rhacs-eng/infra-certifier:{{ required "A valid .Values.tag entry is required!" .Values.tag }}
             imagePullPolicy: IfNotPresent
             args:
               - --common-name=*.demos.rox.systems
@@ -82,5 +82,6 @@ spec:
             - name: configuration
               secret:
                 secretName: demo-certifier-credentials
-
+          imagePullSecrets:
+            - name: infra-image-registry-pull-secret
 {{ end }}

chart/infra-server/templates/demo-certifier.yaml

@@ -25,7 +25,7 @@ spec:
     spec:
       containers:
         - name: infra-server
-          image: us.gcr.io/stackrox-infra/infra-server:{{ required "A valid .Values.tag entry is required!" .Values.tag }}
+          image: quay.io/rhacs-eng/infra-server:{{ required "A valid .Values.tag entry is required!" .Values.tag }}
           env:
             - name: GOOGLE_APPLICATION_CREDENTIALS
               value: /configuration/google-credentials.json
@@ -55,9 +55,5 @@ spec:
         - name: configuration
           secret:
             secretName: infra-server-secrets
-
-{{ if eq .Values.environment "development" }}
-
       imagePullSecrets:
         - name: infra-image-registry-pull-secret
-{{ end }}