Skip to content

Commit c09247e

Browse files
dereknoladereknola
committed
Publish kube-webhook-certgen image
Signed-off-by: Derek Nola <derek.nola@suse.com>
1 parent 6723eca commit c09247e

3 files changed

Lines changed: 240 additions & 10 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 108 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,115 @@ jobs:
9191
path: nginx-ingress-e2e-ctr.tar
9292
retention-days: 1
9393

94+
build-certgen:
95+
permissions:
96+
contents: read
97+
id-token: write # needed for the Vault authentication
98+
99+
runs-on: ubuntu-latest
100+
steps:
101+
- name: Check out code
102+
uses: actions/checkout@v6
103+
104+
# This is a roundabout OP, since the Makefile defaults to this value,
105+
# but the publish-image action requires a tag, that it then passses to the Makefile
106+
- name: Set Tag
107+
run: |
108+
KWC_TAG=$(cat ./images/kube-webhook-certgen/TAG)
109+
echo "KWC_TAG=$KWC_TAG" >> $GITHUB_ENV
110+
111+
# Only pull vault secrets if the repository is rancher
112+
- name: "Read secrets"
113+
if: github.repository_owner == 'rancher'
114+
uses: rancher-eio/read-vault-secrets@main
115+
with:
116+
secrets: |
117+
secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials username | DOCKER_USERNAME ;
118+
secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials password | DOCKER_TOKEN ;
119+
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials registry | PRIME_REGISTRY ;
120+
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials username | PRIME_REGISTRY_USERNAME ;
121+
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials password | PRIME_REGISTRY_PASSWORD
122+
123+
- name: Check if image already exists on DockerHub
124+
id: certgen_exists
125+
run: |
126+
REPO="${{ github.repository_owner }}/kube-webhook-certgen"
127+
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://hub.docker.com/v2/repositories/${REPO}/tags/${KWC_TAG}")
128+
if [[ "$STATUS" == "200" ]]; then
129+
echo "exists=true" >> "$GITHUB_OUTPUT"
130+
else
131+
echo "exists=false" >> "$GITHUB_OUTPUT"
132+
fi
133+
134+
- name: Check if image already exists on Prime Registry
135+
id: prime_certgen_exists
136+
run: |
137+
# Short-circuit and assume the image exists if this is not the rancher repository
138+
if [[ "${{ github.repository_owner }}" != "rancher" ]]; then
139+
echo "prime_exists=true" >> "$GITHUB_OUTPUT"
140+
exit 0
141+
fi
142+
143+
REPO="${{ env.PRIME_REGISTRY }}/rancher/kube-webhook-certgen"
144+
skopeo inspect "docker://${REPO}:${KWC_TAG}" 1> /dev/null
145+
if [[ $? -eq 0 ]]; then
146+
echo "prime_exists=true" >> "$GITHUB_OUTPUT"
147+
else
148+
echo "prime_exists=false" >> "$GITHUB_OUTPUT"
149+
fi
150+
151+
- name: Login to Container Registry with Rancher Secrets
152+
if: github.repository_owner == 'rancher' && ( steps.certgen_exists.outputs.exists != 'true' || steps.prime_certgen_exists.outputs.prime_exists != 'true' )
153+
uses: docker/login-action@v3
154+
with:
155+
username: ${{ env.DOCKER_USERNAME }}
156+
password: ${{ env.DOCKER_TOKEN }}
157+
158+
# For forks, setup docker login with GHA secrets
159+
- name: Login to Container Registry
160+
if: github.repository_owner != 'rancher' && steps.certgen_exists.outputs.exists != 'true'
161+
uses: docker/login-action@v3
162+
with:
163+
username: ${{ secrets.DOCKER_USERNAME }}
164+
password: ${{ secrets.DOCKER_TOKEN }}
165+
166+
- name: Set up QEMU
167+
if: steps.certgen_exists.outputs.exists != 'true' || steps.prime_certgen_exists.outputs.prime_exists != 'true'
168+
uses: docker/setup-qemu-action@v3
169+
170+
- name: Set up Docker Buildx
171+
if: steps.certgen_exists.outputs.exists != 'true' || steps.prime_certgen_exists.outputs.prime_exists != 'true'
172+
uses: docker/setup-buildx-action@v3
173+
174+
- name: Setup Docker Credentials
175+
if: github.repository_owner != 'rancher' && steps.certgen_exists.outputs.exists != 'true'
176+
env:
177+
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
178+
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
179+
run: |
180+
echo "DOCKER_USERNAME=$DOCKER_USERNAME" >> $GITHUB_ENV
181+
echo "DOCKER_TOKEN=$DOCKER_TOKEN" >> $GITHUB_ENV
182+
183+
- name: Build and push kube-webhook-certgen image
184+
if: steps.certgen_exists.outputs.exists != 'true' || steps.prime_certgen_exists.outputs.prime_exists != 'true'
185+
uses: rancher/ecm-distro-tools/actions/publish-image@9cc9d787c12b5ed1acdeb504e4ff59511ffd39c9 # v0.62.0
186+
with:
187+
image: kube-webhook-certgen
188+
tag: ${{ env.KWC_TAG }}
189+
make-target: push -C ./images/ NAME=kube-webhook-certgen
190+
public-repo: ${{ github.repository_owner }}
191+
public-username: ${{ env.DOCKER_USERNAME }}
192+
public-password: ${{ env.DOCKER_TOKEN }}
193+
push-to-public: ${{ steps.certgen_exists.outputs.exists != 'true' }}
194+
195+
prime-repo: rancher
196+
prime-registry: ${{ env.PRIME_REGISTRY }}
197+
prime-username: ${{ env.PRIME_REGISTRY_USERNAME }}
198+
prime-password: ${{ env.PRIME_REGISTRY_PASSWORD }}
199+
push-to-prime: ${{ github.repository_owner == 'rancher' && steps.prime_certgen_exists.outputs.prime_exists != 'true' }}
200+
94201
e2e:
95-
needs: [e2e-build-base, e2e-build-ctr]
202+
needs: [e2e-build-base, e2e-build-ctr, build-certgen]
96203
permissions:
97204
contents: read
98205
runs-on: ubuntu-latest

‎.github/workflows/support-images.yml‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
name: Publish Support Images
2+
on:
3+
workflow_dispatch: {}
4+
5+
# Supports out-of-band publishing of supporting images, such as kube-webhook-certgen.
6+
# We also handle publishing of these supporting images in the main release workflow,
7+
# but this allows us to publish updates to these images without needing to cut a new release
8+
# of the entire ingress-nginx controller.
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
kube-webhook-certgen:
15+
permissions:
16+
contents: read
17+
id-token: write # needed for the Vault authentication
18+
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: Check out code
22+
uses: actions/checkout@v6
23+
24+
# This is a roundabout OP, since the Makefile defaults to this value,
25+
# but the publish-image action requires a tag, that it then passses to the Makefile
26+
- name: Set Tag
27+
run: |
28+
KWC_TAG=$(cat ./images/kube-webhook-certgen/TAG)
29+
echo "KWC_TAG=$KWC_TAG" >> $GITHUB_ENV
30+
31+
# Only pull vault secrets if the repository is rancher
32+
- name: "Read secrets"
33+
if: github.repository_owner == 'rancher'
34+
uses: rancher-eio/read-vault-secrets@main
35+
with:
36+
secrets: |
37+
secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials username | DOCKER_USERNAME ;
38+
secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials password | DOCKER_TOKEN ;
39+
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials registry | PRIME_REGISTRY ;
40+
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials username | PRIME_REGISTRY_USERNAME ;
41+
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials password | PRIME_REGISTRY_PASSWORD
42+
43+
- name: Check if image already exists on DockerHub
44+
id: certgen_exists
45+
run: |
46+
REPO="${{ github.repository_owner }}/kube-webhook-certgen"
47+
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://hub.docker.com/v2/repositories/${REPO}/tags/${KWC_TAG}")
48+
if [[ "$STATUS" == "200" ]]; then
49+
echo "exists=true" >> "$GITHUB_OUTPUT"
50+
else
51+
echo "exists=false" >> "$GITHUB_OUTPUT"
52+
fi
53+
54+
- name: Check if image already exists on Prime Registry
55+
id: prime_certgen_exists
56+
run: |
57+
# Short-circuit and assume the image exists if this is not the rancher repository
58+
if [[ "${{ github.repository_owner }}" != "rancher" ]]; then
59+
echo "prime_exists=true" >> "$GITHUB_OUTPUT"
60+
exit 0
61+
fi
62+
63+
REPO="${{ env.PRIME_REGISTRY }}/rancher/kube-webhook-certgen"
64+
skopeo inspect "docker://${REPO}:${KWC_TAG}" 1> /dev/null
65+
if [[ $? -eq 0 ]]; then
66+
echo "prime_exists=true" >> "$GITHUB_OUTPUT"
67+
else
68+
echo "prime_exists=false" >> "$GITHUB_OUTPUT"
69+
fi
70+
71+
- name: Login to Container Registry with Rancher Secrets
72+
if: github.repository_owner == 'rancher' && ( steps.certgen_exists.outputs.exists != 'true' || steps.prime_certgen_exists.outputs.prime_exists != 'true' )
73+
uses: docker/login-action@v3
74+
with:
75+
username: ${{ env.DOCKER_USERNAME }}
76+
password: ${{ env.DOCKER_TOKEN }}
77+
78+
# For forks, setup docker login with GHA secrets
79+
- name: Login to Container Registry
80+
if: github.repository_owner != 'rancher' && steps.certgen_exists.outputs.exists != 'true'
81+
uses: docker/login-action@v3
82+
with:
83+
username: ${{ secrets.DOCKER_USERNAME }}
84+
password: ${{ secrets.DOCKER_TOKEN }}
85+
86+
- name: Set up QEMU
87+
if: steps.certgen_exists.outputs.exists != 'true' || steps.prime_certgen_exists.outputs.prime_exists != 'true'
88+
uses: docker/setup-qemu-action@v3
89+
90+
- name: Set up Docker Buildx
91+
if: steps.certgen_exists.outputs.exists != 'true' || steps.prime_certgen_exists.outputs.prime_exists != 'true'
92+
uses: docker/setup-buildx-action@v3
93+
94+
- name: Setup Docker Credentials
95+
if: github.repository_owner != 'rancher' && steps.certgen_exists.outputs.exists != 'true'
96+
env:
97+
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
98+
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
99+
run: |
100+
echo "DOCKER_USERNAME=$DOCKER_USERNAME" >> $GITHUB_ENV
101+
echo "DOCKER_TOKEN=$DOCKER_TOKEN" >> $GITHUB_ENV
102+
103+
- name: Build and push kube-webhook-certgen image
104+
if: steps.certgen_exists.outputs.exists != 'true' || steps.prime_certgen_exists.outputs.prime_exists != 'true'
105+
uses: rancher/ecm-distro-tools/actions/publish-image@9cc9d787c12b5ed1acdeb504e4ff59511ffd39c9 # v0.62.0
106+
with:
107+
image: kube-webhook-certgen
108+
tag: ${{ env.KWC_TAG }}
109+
make-target: push -C ./images/ NAME=kube-webhook-certgen
110+
public-repo: ${{ github.repository_owner }}
111+
public-username: ${{ env.DOCKER_USERNAME }}
112+
public-password: ${{ env.DOCKER_TOKEN }}
113+
push-to-public: ${{ steps.certgen_exists.outputs.exists != 'true' }}
114+
115+
prime-repo: rancher
116+
prime-registry: ${{ env.PRIME_REGISTRY }}
117+
prime-username: ${{ env.PRIME_REGISTRY_USERNAME }}
118+
prime-password: ${{ env.PRIME_REGISTRY_PASSWORD }}
119+
push-to-prime: ${{ github.repository_owner == 'rancher' && steps.prime_certgen_exists.outputs.prime_exists != 'true' }}

‎images/Makefile‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,14 @@
1414

1515
NAME ?=
1616

17-
BUILDER ?= ingress-nginx
1817
PLATFORMS ?= linux/amd64,linux/arm64
19-
REGISTRY ?= us-central1-docker.pkg.dev/k8s-staging-images/ingress-nginx
18+
# External Rancher tooling uses REPO, so prioritize that over REGISTRY if set
19+
REPO ?=
20+
ifneq ($(strip $(REPO)),)
21+
REGISTRY := $(REPO)
22+
else ifeq ($(strip $(REGISTRY)),)
23+
REGISTRY := rancher
24+
endif
2025
IMAGE ?= $(REGISTRY)/$(NAME)
2126
TAG ?= $(shell cat $(NAME)/TAG)
2227

@@ -25,15 +30,10 @@ BASE_IMAGE ?= $(shell cat $(DIR)/../NGINX_BASE)
2530
GOLANG_VERSION ?= $(shell cat $(DIR)/../GOLANG_VERSION)
2631
EXTRAARGS ?= $(shell cat $(NAME)/EXTRAARGS)
2732

28-
.PHONY: builder
29-
builder:
30-
docker buildx create --name $(BUILDER) --bootstrap || :
31-
docker buildx inspect $(BUILDER)
32-
3333
.PHONY: build
34-
build: builder
34+
build:
3535
docker buildx build \
36-
--builder $(BUILDER) \
36+
${IID_FILE_FLAG} \
3737
--platform $(PLATFORMS) \
3838
--label org.opencontainers.image.description="Ingress NGINX $(NAME)" \
3939
--label org.opencontainers.image.source="https://github.com/kubernetes/ingress-nginx" \
@@ -50,6 +50,10 @@ build: builder
5050
push: OUTPUT = --push
5151
push: build
5252

53+
.PHONY: load
54+
load: OUTPUT = --load
55+
load: build
56+
5357
.PHONY: test
5458
test:
5559
cd $(NAME)/rootfs && go test ./...

0 commit comments

Comments
 (0)