Skip to content

Commit 6208d1c

Browse files
committed
Merge branch 'main' into ROCKS-2675/enable-ecr-rework
2 parents c57fd66 + ca2236e commit 6208d1c

21 files changed

Lines changed: 518 additions & 531 deletions

File tree

.github/actions/upload-rock/action.yml

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@ inputs:
2525
description: "The github token needed for downloading the artifact from a different repository or workflow run."
2626
decrypt-passphrase:
2727
description: "The passphrase for the artifact if it is encrypted."
28+
skopeo-image:
29+
description: "Skopeo image used to inspect and upload the artifact."
30+
required: false
31+
# Skopeo v1.22.2.
32+
default: "quay.io/skopeo/stable@sha256:c7d3c512612f52805023cd38351081dad7e2729fc13d14b701e47c7c8bdd6615"
2833
outputs:
2934
digest:
3035
description: "The digest of the uploaded image"
@@ -53,22 +58,26 @@ runs:
5358
- name: Get Metadata
5459
id: meta
5560
shell: bash
61+
env:
62+
SKOPEO_IMAGE: ${{ inputs.skopeo-image }}
5663
run: |
5764
docker run --rm \
5865
-v $PWD:/workdir -w /workdir \
59-
"quay.io/skopeo/stable:v1.20.0" \
66+
"${SKOPEO_IMAGE}" \
6067
inspect oci-archive:${{ inputs.artifact_name }} > metadata.json
6168
6269
digest="$(cat metadata.json | jq -r .Digest)"
6370
echo "digest=$digest" >> $GITHUB_OUTPUT
6471
6572
- name: Upload Rock to Registry
6673
shell: bash
74+
env:
75+
SKOPEO_IMAGE: ${{ inputs.skopeo-image }}
6776
run: |
6877
for tag in ${{ inputs.tags }}; do
69-
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
78+
docker run --rm \
7079
-v $PWD:/workdir -w /workdir \
71-
"quay.io/skopeo/stable:v1.20.0" \
80+
"${SKOPEO_IMAGE}" \
7281
copy \
7382
--dest-username "${{ inputs.username }}" \
7483
--dest-password "${{ inputs.password }}" \

.github/base_digests/26.04

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
public.ecr.aws/ubuntu/ubuntu:resolute@sha256:215ce47dc5c697ba3bcda7367ac1f6448d039306017d3c6a539dcefd2911efdb
1+
public.ecr.aws/ubuntu/ubuntu:resolute@sha256:a5da6f6b18c3a4b8dcc73244592f7096f417d2667966d0e33460e9e308f25f67

.github/workflows/Image.yaml

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@ on:
4747
env:
4848
VULNERABILITY_REPORT_SUFFIX: ".vulnerability-report.json"
4949
ROCK_REPO_DIR: rock-repo
50+
# Skopeo v1.22.2.
51+
SKOPEO_IMAGE: "quay.io/skopeo/stable@sha256:c7d3c512612f52805023cd38351081dad7e2729fc13d14b701e47c7c8bdd6615"
5052

5153
jobs:
5254
prepare-build:
@@ -344,8 +346,6 @@ jobs:
344346
ROCKS_DEV_LP_USERNAME: ${{ secrets.ROCKS_DEV_LP_USERNAME }}
345347
CPC_BUILD_TOOLS_REPO: git.launchpad.net/~cloudware/cloudware/+git/cpc_build_tools
346348
# CPC_BUILD_TOOLS_REPO_REF: 9b716ed8a8ba728d036b54b1bb17a8f49dbda434
347-
SKOPEO_BRANCH: "v1.20.0"
348-
SKOPEO_URL: "https://github.com/containers/skopeo"
349349
run: |
350350
./src/image/requirements.sh
351351
./src/uploads/requirements.sh
@@ -393,8 +393,11 @@ jobs:
393393
set -x
394394
fi
395395
source src/shared/logs.sh
396-
arches=$(skopeo inspect --raw \
397-
oci-archive:${STEPS_RENAME_OCI_ARCHIVE_OUTPUTS_NAME} \
396+
arches=$(docker run --rm \
397+
-v "$PWD:/workdir" -w /workdir \
398+
"${SKOPEO_IMAGE}" \
399+
inspect --raw \
400+
"oci-archive:${STEPS_RENAME_OCI_ARCHIVE_OUTPUTS_NAME}" \
398401
| jq -r 'if has("manifests") then .manifests[].platform.architecture else "${{ runner.arch }}" end' \
399402
| jq -nRcr '[inputs] | join(",")')
400403
@@ -436,7 +439,10 @@ jobs:
436439
log_info "Generate SBOM for ${arch}"
437440
438441
# --insecure-policy is required on private-endpoint runners.
439-
skopeo --insecure-policy --override-arch "${arch}" copy \
442+
docker run --rm \
443+
-v "$PWD:/workdir" -w /workdir \
444+
"${SKOPEO_IMAGE}" \
445+
--insecure-policy --override-arch "${arch}" copy \
440446
"oci-archive:${STEPS_RENAME_OCI_ARCHIVE_OUTPUTS_NAME}" \
441447
"oci:${STEPS_RENAME_OCI_ARCHIVE_OUTPUTS_NAME}.${arch}:${STEPS_RENAME_OCI_ARCHIVE_OUTPUTS_CANONICAL_TAG}" \
442448
@@ -524,6 +530,7 @@ jobs:
524530
name: ${{ github.repository_owner }}/oci-factory/${{ matrix.name }}
525531
tags: ${{ matrix.track }}_${{ matrix.revision }}
526532
registry: ghcr.io
533+
skopeo-image: ${{ env.SKOPEO_IMAGE }}
527534
password: ${{ secrets.GITHUB_TOKEN }}
528535
username: ${{ github.actor }}
529536

.github/workflows/Release.yaml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -196,8 +196,6 @@ jobs:
196196
ROCKS_DEV_LP_USERNAME: ${{ secrets.ROCKS_DEV_LP_USERNAME }}
197197
CPC_BUILD_TOOLS_REPO: git.launchpad.net/~cloudware/cloudware/+git/cpc_build_tools
198198
# CPC_BUILD_TOOLS_REPO_REF: 9b716ed8a8ba728d036b54b1bb17a8f49dbda434
199-
SKOPEO_BRANCH: 'v1.20.0'
200-
SKOPEO_URL: 'https://github.com/containers/skopeo'
201199
run: |
202200
./src/image/requirements.sh
203201
pip install -r src/image/requirements.txt

.github/workflows/Test-Rock.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,8 @@ env:
6464
VULNERABILITY_REPORT_SUFFIX: ".vulnerability-report.json" # TODO: inherit string from caller
6565
TEST_IMAGE_NAME: "test-img"
6666
TEST_IMAGE_TAG: "test"
67-
SKOPEO_IMAGE: "quay.io/skopeo/stable:v1.20.0"
67+
# Skopeo v1.22.2.
68+
SKOPEO_IMAGE: "quay.io/skopeo/stable@sha256:c7d3c512612f52805023cd38351081dad7e2729fc13d14b701e47c7c8bdd6615"
6869
UMOCI_VERSION: "v0.4.7"
6970
UMOCI_BINARY: "umoci.amd64"
7071
DIVE_IMAGE: "wagoodman/dive:v0.13.1"

.github/workflows/Vulnerability-Scan.yaml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,8 @@ on:
3939

4040
env:
4141
VULNERABILITY_REPORT_SUFFIX: '.vulnerability-report.json' # TODO: inherit string from caller
42-
SKOPEO_IMAGE: 'quay.io/skopeo/stable:v1.20.0'
42+
# Skopeo v1.22.2.
43+
SKOPEO_IMAGE: 'quay.io/skopeo/stable@sha256:c7d3c512612f52805023cd38351081dad7e2729fc13d14b701e47c7c8bdd6615'
4344

4445
jobs:
4546
configure-scan:
@@ -75,7 +76,7 @@ jobs:
7576
src_password="${GITHUB_TOKEN}"
7677
fi
7778
78-
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
79+
docker run --rm \
7980
-v "$PWD:/workdir" -w /workdir \
8081
"${SKOPEO_IMAGE}" \
8182
copy "docker://${INPUTS_OCI_IMAGE_NAME}" \

oci/airflow/documentation.yaml

Lines changed: 80 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,28 @@
1-
version: 1
1+
version: 2
22

33
application: airflow
44
description: >
5-
Apache Airflow is a platform to programmatically author, schedule, and monitor workflows. This rock ("airflow") packages Airflow built from source on Ubuntu with Python and a wide set of providers.
5+
Apache Airflow is a platform to programmatically author, schedule, and monitor workflows.
6+
This rock packages Airflow built from source on Ubuntu 24.04 with Python and a wide set of
7+
providers pre-installed (Amazon, GCP, Kubernetes, MySQL, Postgres, and more), so common
8+
integrations work out of the box without requiring additional pip installation inside the container.
69
7-
docker:
8-
parameters:
9-
- -p 8080:8080
10-
- -e AIRFLOW_HOME=/opt/airflow
11-
- -v /path/to/dags:/opt/airflow/dags
12-
- -v /path/to/airflow.cfg:/opt/airflow/airflow.cfg
13-
access: |
14-
### Entrypoint and Pebble
10+
website: https://airflow.apache.org/
11+
issues: https://github.com/canonical/airflow-rocks/issues
12+
source-code: https://github.com/canonical/airflow-rocks
1513

16-
The rock uses [Pebble](https://documentation.ubuntu.com/pebble/), a lightweight service manager. Pebble is PID 1 in the container, and it supervises the Airflow service defined in the rock.
14+
docker:
15+
parameters: >-
16+
-p 8080:8080
17+
-e AIRFLOW_HOME=/opt/airflow
18+
-v /path/to/dags:/opt/airflow/dags
19+
-v /path/to/airflow.cfg:/opt/airflow/airflow.cfg
20+
run_conclusion: |
21+
Pebble (PID 1) launches the `airflow` service, which runs `airflow standalone`. This
22+
initializes a local SQLite metadata database, creates a default admin user, and starts
23+
the webserver and scheduler in a single process group (intended for development use).
24+
The generated admin password is printed in the container logs.
25+
Access the Airflow web UI at http://localhost:8080.
1726
1827
#### Airflow service
1928
@@ -23,95 +32,79 @@ docker:
2332
startup: enabled
2433
```
2534
26-
`airflow standalone` initializes a local metadata DB, creates a default admin user, and starts the webserver, scheduler, and other core components in one process group (intended for development).
35+
`airflow standalone` initializes a local metadata DB, creates a default admin user,
36+
and starts the webserver, scheduler, and other core components in one process group
37+
(intended for development).
2738
2839
#### Configuration & State
2940
30-
- Runtime state (AIRFLOW_HOME) lives at `/opt/airflow`. This includes `airflow.cfg`, `airflow.db` (Database by default for standalone), logs, and `dags/`.
41+
- Runtime state (AIRFLOW_HOME) lives at `/opt/airflow`. This includes `airflow.cfg`,
42+
`airflow.db` (Database by default for standalone), logs, and `dags/`.
3143
- It is required to mount volumes to persist that data or to inject custom dags.
3244
For example:
3345
`-v ./dags:/opt/airflow/dags`
3446
`-v ./airflow.cfg:/opt/airflow/airflow.cfg`
3547
3648
#### Providers
3749
38-
The rock is built from Airflow with many providers pre-installed (Amazon, GCP, Kubernetes, MySQL, Postgres, etc.), so common integrations work out of the box without requiring `pip install` inside the container.
50+
The rock is built from Airflow with many providers pre-installed (Amazon, GCP,
51+
Kubernetes, MySQL, Postgres, etc.), so common integrations work out of the box without requiring
52+
`pip install` inside the container.
3953
4054
### Full Configuration Reference:
41-
Airflow offers a large number of configuration options that can be set via environment variables or `airflow.cfg`.
42-
For the complete list of configurable settings, consult the official [configuration reference](https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html)
55+
Airflow offers a large number of configuration options that can be set via environment variables
56+
or `airflow.cfg`.
57+
For the complete list of configurable settings, consult the official
58+
[configuration reference](https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html)
59+
4360
44-
parameters:
45-
- type: -e
46-
value: 'AIRFLOW_HOME=/opt/airflow'
47-
description: >
48-
Root directory for Airflow state inside the container (DB, logs, dags, config).
49-
The rock sets this to /opt/airflow.
50-
- type: -e
51-
value: 'AIRFLOW__CORE__LOAD_EXAMPLES=false'
52-
description: >
53-
Whether to load the DAG examples that ship with Airflow. It’s good to get started, but you probably want to set this to False in a production environment
54-
- type: -e
55-
value: 'AIRFLOW__CORE__EXECUTOR=LocalExecutor'
56-
description: >
57-
The executor class that airflow should use. Choices include LocalExecutor, CeleryExecutor, KubernetesExecutor or the full import path to the class when using a custom executor.
58-
- type: -e
59-
value: 'AIRFLOW__DATABASE__SQL_ALCHEMY_CONN=postgresql+psycopg2://airflow:airflow@db:5432/airflow'
60-
description: >
61-
SQLAlchemy connection string for the Airflow metadata DB. `airflow standalone` defaults to local SQLite, but for production you generally want Postgres or MySQL. Override this to point at an external DB.
62-
- type: e
63-
value: 'AIRFLOW__CORE__AUTH_MANAGER=airflow.api_fastapi.auth.managers.simple.simple_auth_manager.SimpleAuthManager'
64-
description: >
65-
For more information on available authentication managers and the configuration options they require, refer to the official [Airflow Auth Manager documentation](https://airflow.apache.org/docs/apache-airflow/stable/core-concepts/auth-manager/index.html)
66-
- type: -p
67-
value: '8080:8080'
68-
description: >
69-
Airflow Webserver UI (HTTP).
70-
This is what you open in the browser.
71-
These are documented in the [upstream Helm chart](https://airflow.apache.org/docs/helm-chart/stable/parameters-ref.html).
72-
- type: -p
73-
value: '8794:8794'
74-
description: >
75-
Triggerer log server port. Used for log streaming and collection by the Airflow triggerer.
76-
Officially defined in the Airflow Helm Chart as `ports.triggererLogs`.
77-
These are documented in the [upstream Helm chart](https://airflow.apache.org/docs/helm-chart/stable/parameters-ref.html).
78-
- type: -p
79-
value: '8793:8793'
80-
description: >
81-
Worker log server port. Used for log streaming and collection by Airflow workers in distributed setups.
82-
Officially defined in the Airflow Helm Chart as `ports.workerLogs`.
83-
These are documented in the [upstream Helm chart](https://airflow.apache.org/docs/helm-chart/stable/parameters-ref.html).
84-
- type: -v
85-
value: '/path/to/dags:/opt/airflow/dags'
86-
description: >
87-
Mount your DAGs from the host so you can iterate without rebuilding the rock.
88-
Anything in /opt/airflow/dags will be auto-discovered.
89-
- type: -v
90-
value: '/path/to/logs:/opt/airflow/logs'
91-
description: >
92-
Persist task logs outside the container (useful for debugging and restarts).
93-
- type: -v
94-
value: '/path/to/airflow.cfg:/opt/airflow/airflow.cfg'
95-
description: >
96-
Inject a custom airflow.cfg instead of the auto-generated one from
97-
`airflow standalone`.
98-
- type: -v
99-
value: '/path/to/requirements.txt:/requirements.txt'
100-
description: >
101-
(Optional) If you extend this rock and want extra Python deps at runtime,
102-
you can mount and install them in an init hook / derived image.
103-
- type: -e
104-
value: 'AIRFLOW__API__SECRET_KEY=change-me'
105-
description: >
106-
Secret key used to run your api server. It should be as random as possible. However, when running more than 1 instances of the api, make sure all of them use the same secret_key otherwise one of them will error with “CSRF session token is missing”.
107-
- type: -e
108-
value: 'AIRFLOW__API__BASE_URL=https://airflow.example.com'
109-
description: >
110-
The base url of the API server.
111-
- type: -e
112-
value: 'AIRFLOW__CORE__MAX_ACTIVE_TASKS_PER_DAG=16'
113-
description: >
114-
The maximum number of task instances allowed to run concurrently in each dag run.
61+
config:
62+
'`AIRFLOW_HOME`':
63+
type: env
64+
description: Root directory for Airflow state inside the container (DB, logs, DAGs, config).
65+
default: /opt/airflow
66+
'`AIRFLOW__CORE__LOAD_EXAMPLES`':
67+
type: env
68+
description: Load the example DAGs shipped with Airflow. Disable in production environments.
69+
'`AIRFLOW__CORE__EXECUTOR`':
70+
type: env
71+
description: Executor class used by Airflow. Supported values include `LocalExecutor`, `CeleryExecutor`, `KubernetesExecutor`, or the full import path to a custom executor class.
72+
'`AIRFLOW__DATABASE__SQL_ALCHEMY_CONN`':
73+
type: env
74+
description: SQLAlchemy connection string for the Airflow metadata database. `airflow standalone` defaults to local SQLite; override for a production Postgres or MySQL database.
75+
'`AIRFLOW__CORE__AUTH_MANAGER`':
76+
type: env
77+
description: Auth manager class. Refer to the [Airflow Auth Manager documentation](https://airflow.apache.org/docs/apache-airflow/stable/core-concepts/auth-manager/index.html) for available options and required configuration.
78+
'`AIRFLOW__API__SECRET_KEY`':
79+
type: env
80+
description: Secret key for the API server. Use a random value; all instances in a cluster must share the same key.
81+
'`AIRFLOW__API__BASE_URL`':
82+
type: env
83+
description: Base URL of the API server.
84+
'`AIRFLOW__CORE__MAX_ACTIVE_TASKS_PER_DAG`':
85+
type: env
86+
description: Maximum number of task instances allowed to run concurrently per DAG run.
87+
'`-p 8080:8080`':
88+
type: port
89+
description: Expose port 8080 on the host for the Airflow web UI (HTTP).
90+
'`-p 8794:8794`':
91+
type: port
92+
description: Expose port 8794 on the host for the Airflow triggerer log server.
93+
'`-p 8793:8793`':
94+
type: port
95+
description: Expose port 8793 on the host for the Airflow worker log server.
96+
'`-v <path>:/opt/airflow/dags`':
97+
type: mount
98+
description: Mount a local DAGs directory. Files are auto-discovered by the scheduler.
99+
'`-v <path>:/opt/airflow/logs`':
100+
type: mount
101+
description: Persist task logs outside the container.
102+
'`-v <path>:/opt/airflow/airflow.cfg`':
103+
type: mount
104+
description: Inject a custom `airflow.cfg` in place of the auto-generated one.
105+
'`-v <path>:/requirements.txt`':
106+
type: mount
107+
description: (Optional) Mount additional Python dependencies to install at runtime.
115108

116109
override_tracks:
117110
3-24.04:

0 commit comments

Comments
 (0)