Skip to content

Commit ba7491a

Browse files
csatib02csatib02
authored
Merge pull request #1861 from kube-logging/feat/crd-subchart-as-oci-artifact
feat(gha): provide crds subchart as oci artifact
2 parents a6e3a6b + 3c5bf5f commit ba7491a

24 files changed

+146
-14
lines changed

‎.github/workflows/artifacts.yaml‎

Lines changed: 138 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,15 @@ on:
3535
helm-chart-package:
3636
description: Helm chart package name
3737
value: ${{ jobs.helm-chart.outputs.package }}
38+
subchart-name:
39+
description: CRD subchart OCI name
40+
value: ${{ jobs.crd-subchart.outputs.name }}
41+
subchart-tag:
42+
description: CRD subchart tag
43+
value: ${{ jobs.crd-subchart.outputs.tag }}
44+
subchart-package:
45+
description: CRD subchart package name
46+
value: ${{ jobs.crd-subchart.outputs.package }}
3847

3948
permissions:
4049
contents: read
@@ -201,7 +210,7 @@ jobs:
201210
tar -xf image.tar -C image
202211
203212
- name: Run Trivy vulnerability scanner
204-
uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # 0.28.0
213+
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
205214
env:
206215
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
207216
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:1
@@ -218,7 +227,7 @@ jobs:
218227
retention-days: 5
219228

220229
- name: Upload Trivy scan results to GitHub Security tab
221-
uses: github/codeql-action/upload-sarif@407ffafae6a767df3e0230c3df91b6443ae8df75 # v2.22.8
230+
uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
222231
with:
223232
sarif_file: trivy-results.sarif
224233

@@ -242,9 +251,9 @@ jobs:
242251
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
243252

244253
- name: Set up Helm
245-
uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
254+
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
246255
with:
247-
version: v3.12.0
256+
version: v3.13.3
248257

249258
- name: Set up Cosign
250259
uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
@@ -352,7 +361,7 @@ jobs:
352361
fi
353362
354363
- name: Run Trivy vulnerability scanner
355-
uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # 0.28.0
364+
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
356365
env:
357366
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
358367
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:1
@@ -370,6 +379,129 @@ jobs:
370379
retention-days: 5
371380

372381
- name: Upload Trivy scan results to GitHub Security tab
373-
uses: github/codeql-action/upload-sarif@407ffafae6a767df3e0230c3df91b6443ae8df75 # v2.22.8
382+
uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
383+
with:
384+
sarif_file: trivy-results.sarif
385+
386+
crd-subchart:
387+
if: github.repository == 'kube-logging/logging-operator'
388+
name: CRD subchart
389+
runs-on: ubuntu-latest
390+
391+
permissions:
392+
contents: read
393+
packages: write
394+
id-token: write
395+
security-events: write
396+
397+
outputs:
398+
name: ${{ steps.oci-chart-name.outputs.value }}
399+
tag: ${{ steps.version.outputs.value }}
400+
package: ${{ steps.build.outputs.package }}
401+
402+
env:
403+
subchartPath: logging-operator/charts/logging-operator-crds
404+
subchartName: logging-operator-crds
405+
406+
steps:
407+
- name: Checkout repository
408+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
409+
410+
- name: Set up Helm
411+
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
412+
with:
413+
version: v3.13.3
414+
415+
- name: Set up Cosign
416+
uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
417+
418+
- name: Set chart name
419+
id: chart-name
420+
run: echo "value=${{ github.event.repository.name }}/${{ env.subchartName }}" >> "$GITHUB_OUTPUT"
421+
422+
- name: Set OCI registry name
423+
id: oci-registry-name
424+
run: echo "value=ghcr.io/${{ github.repository_owner }}/helm-charts" >> "$GITHUB_OUTPUT"
425+
426+
- name: Set OCI chart name
427+
id: oci-chart-name
428+
run: echo "value=${{ steps.oci-registry-name.outputs.value }}/${{ steps.chart-name.outputs.value }}" >> "$GITHUB_OUTPUT"
429+
430+
- name: Helm lint
431+
run: helm lint charts/${{ env.subchartPath }}
432+
433+
- name: Determine raw version
434+
uses: haya14busa/action-cond@94f77f7a80cd666cb3155084e428254fea4281fd # v1.2.1
435+
id: version
436+
with:
437+
cond: ${{ inputs.release }}
438+
if_true: ${{ github.ref_name }}
439+
if_false: 0.0.0
440+
441+
- name: Helm package
442+
id: build
443+
run: |
444+
helm package charts/${{ env.subchartPath }} --version ${{ steps.version.outputs.value }} --app-version ${{ steps.version.outputs.value }}
445+
echo "package=${{ github.workspace }}/${{ env.subchartName }}-${{ steps.version.outputs.value }}.tgz" >> "$GITHUB_OUTPUT"
446+
447+
- name: Upload chart as artifact
448+
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
449+
with:
450+
name: "[${{ github.job }}] Helm chart"
451+
path: ${{ steps.build.outputs.package }}
452+
453+
- name: Login to GitHub Container Registry
454+
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
455+
with:
456+
registry: ghcr.io
457+
username: ${{ github.actor }}
458+
password: ${{ github.token }}
459+
if: inputs.publish && inputs.release
460+
461+
- name: Helm push
462+
id: push
463+
run: |
464+
helm push ${{ steps.build.outputs.package }} oci://${{ steps.oci-registry-name.outputs.value }}/${{ github.event.repository.name }} &> push-metadata.txt
465+
echo "digest=$(awk '/Digest: /{print $2}' push-metadata.txt)" >> "$GITHUB_OUTPUT"
466+
env:
467+
HELM_REGISTRY_CONFIG: ~/.docker/config.json
468+
if: inputs.publish && inputs.release
469+
470+
- name: Sign chart with GitHub OIDC Token
471+
if: ${{ inputs.publish && inputs.release && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
472+
env:
473+
DIGEST: ${{ steps.push.outputs.digest }}
474+
run: cosign sign --yes --rekor-url "https://rekor.sigstore.dev/" "${{ steps.oci-chart-name.outputs.value }}@${DIGEST}"
475+
476+
- name: Verify signed chart with cosign
477+
if: ${{ inputs.publish && inputs.release && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
478+
env:
479+
DIGEST: ${{ steps.push.outputs.digest }}
480+
run: |
481+
cosign verify "${{ steps.oci-chart-name.outputs.value }}@${DIGEST}" \
482+
--rekor-url "https://rekor.sigstore.dev/" \
483+
--certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/artifacts.yaml@${{ github.ref }}" \
484+
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" | jq
485+
486+
- name: Run Trivy vulnerability scanner
487+
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
488+
env:
489+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
490+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:1
491+
with:
492+
scan-type: config
493+
scan-ref: charts/${{ env.subchartPath }}
494+
format: sarif
495+
output: trivy-results.sarif
496+
497+
- name: Upload Trivy scan results as artifact
498+
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
499+
with:
500+
name: "[${{ github.job }}] Trivy scan results"
501+
path: trivy-results.sarif
502+
retention-days: 5
503+
504+
- name: Upload Trivy scan results to GitHub Security tab
505+
uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
374506
with:
375507
sarif_file: trivy-results.sarif

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ manifests: ${CONTROLLER_GEN} ## Generate manifests e.g. CRD, RBAC etc.
149149
cd pkg/sdk && $(CONTROLLER_GEN) $(CRD_OPTIONS) webhook paths="./..." output:crd:artifacts:config=../../config/crd/bases output:webhook:artifacts:config=../../config/webhook
150150
$(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=manager-role paths="./controllers/..." output:rbac:artifacts:config=./config/rbac
151151
cp config/crd/bases/* charts/logging-operator/crds/
152-
for f in config/crd/bases/*.yaml; do sed '/controller-gen.kubebuilder.io\/version/ r hack/crds.annotations.snippet.txt' $${f} > charts/logging-operator/charts/crds/templates/$${f##*/}; done
152+
for f in config/crd/bases/*.yaml; do sed '/controller-gen.kubebuilder.io\/version/ r hack/crds.annotations.snippet.txt' $${f} > charts/logging-operator/charts/logging-operator-crds/templates/$${f##*/}; done
153153
echo "{{- if .Values.rbac.enabled }}" > ./charts/logging-operator/templates/clusterrole.yaml
154154
cat config/rbac/role.yaml | sed -e 's@manager-role@{{ template "logging-operator.fullname" . }}@' | sed -e '/creationTimestamp/d' | cat >> ./charts/logging-operator/templates/clusterrole.yaml
155155
echo "{{- end }}" >> ./charts/logging-operator/templates/clusterrole.yaml

‎charts/logging-operator/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,6 @@ sources:
1414
- https://github.com/kube-logging/logging-operator
1515
- https://github.com/kube-logging/helm-charts/tree/main/charts/logging-operator
1616
dependencies:
17-
- name: crds
17+
- name: logging-operator-crds
1818
version: 0.0.0
19-
condition: crds.install
19+
condition: logging-operator-crds.install

‎charts/logging-operator/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,8 @@ Use `createCustomResource=false` with Helm v3 to avoid trying to create CRDs fro
4848
| namespaceOverride | string | `""` | A namespace override for the app. |
4949
| annotations | object | `{}` | Define annotations for logging-operator pods. |
5050
| createCustomResource | bool | `false` | Deploy CRDs used by Logging Operator. |
51-
| crds.install | bool | `false` | Toggle to install and upgrade CRDs from a subchart. Make sure to use it with `--skip-crds` to avoid conflicts. [More info about limitations on CRDs in Helm 3](https://helm.sh/docs/topics/charts/#limitations-on-crds) |
52-
| crds.annotations | object | `{}` | Annotations to be added to all CRDs |
51+
| logging-operator-crds.install | bool | `false` | Toggle to install and upgrade CRDs from a subchart. Make sure to use it with `--skip-crds` to avoid conflicts. [More info about limitations on CRDs in Helm 3](https://helm.sh/docs/topics/charts/#limitations-on-crds) |
52+
| logging-operator-crds.annotations | object | `{}` | Annotations to be added to all CRDs |
5353
| http.port | int | `8080` | HTTP listen port number. |
5454
| http.service | object | `{"annotations":{},"clusterIP":"None","labels":{},"type":"ClusterIP"}` | Service definition for query http service. |
5555
| rbac.enabled | bool | `true` | Create rbac service account and roles. |

charts/logging-operator/charts/crds/Chart.yaml renamed to charts/logging-operator/charts/logging-operator-crds/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
apiVersion: v2
2-
name: crds
2+
name: logging-operator-crds
33
version: 0.0.0

charts/logging-operator/charts/crds/README.md renamed to charts/logging-operator/charts/logging-operator-crds/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# crds
1+
# logging-operator-crds
22

33
![Version: 0.0.0](https://img.shields.io/badge/Version-0.0.0-informational?style=flat-square)
44

charts/logging-operator/charts/crds/templates/logging-extensions.banzaicloud.io_eventtailers.yaml renamed to charts/logging-operator/charts/logging-operator-crds/templates/logging-extensions.banzaicloud.io_eventtailers.yaml

File renamed without changes.

charts/logging-operator/charts/crds/templates/logging-extensions.banzaicloud.io_hosttailers.yaml renamed to charts/logging-operator/charts/logging-operator-crds/templates/logging-extensions.banzaicloud.io_hosttailers.yaml

File renamed without changes.

charts/logging-operator/charts/crds/templates/logging.banzaicloud.io_clusterflows.yaml renamed to charts/logging-operator/charts/logging-operator-crds/templates/logging.banzaicloud.io_clusterflows.yaml

File renamed without changes.

charts/logging-operator/charts/crds/templates/logging.banzaicloud.io_clusteroutputs.yaml renamed to charts/logging-operator/charts/logging-operator-crds/templates/logging.banzaicloud.io_clusteroutputs.yaml

File renamed without changes.

0 commit comments

Comments
 (0)