mirror of
https://github.com/vmware-tanzu/pinniped.git
synced 2026-09-20 06:54:20 +00:00
initial commit on ci branch: migrates code from private repo
This commit is contained in:
Ryan Richard
@@ -0,0 +1,14 @@
|
||||
# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
# For running Go linters
|
||||
FROM debian:12.7-slim AS builder
|
||||
|
||||
RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN curl -sfLo /tmp/codecov https://uploader.codecov.io/latest/linux/codecov
|
||||
RUN chmod +x /tmp/codecov
|
||||
|
||||
FROM golang:1.23.2
|
||||
RUN apt-get update -y && apt-get dist-upgrade -y
|
||||
COPY --from=builder /tmp/codecov /usr/local/bin/codecov
|
||||
@@ -0,0 +1,10 @@
|
||||
# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
FROM gcr.io/go-containerregistry/crane as crane
|
||||
FROM mikefarah/yq:4.44.3 AS yq
|
||||
|
||||
FROM golang:1.23
|
||||
COPY --from=yq /usr/bin/yq /usr/local/bin
|
||||
COPY --from=crane /ko-app/crane /usr/local/bin
|
||||
ENTRYPOINT ["bash"]
|
||||
@@ -0,0 +1,16 @@
|
||||
# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
FROM mikefarah/yq:4.44.3 AS yq
|
||||
|
||||
FROM debian:12.7-slim
|
||||
|
||||
# Note: libdigest-sha-perl is to get shasum, which is used when installing Carvel tools below.
|
||||
RUN apt-get update && apt-get install -y ca-certificates jq curl libdigest-sha-perl && rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Install Carvel tools.
|
||||
RUN bash -c "set -eo pipefail; curl -fsL https://carvel.dev/install.sh | bash" && \
|
||||
ytt version && kapp version && kbld version && kwt version && imgpkg version && vendir version
|
||||
|
||||
# Install yq.
|
||||
COPY --from=yq /usr/bin/yq /usr/local/bin/yq
|
||||
@@ -0,0 +1,25 @@
|
||||
# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
# For deploying an EKS cluster and setting it up to run our tests.
|
||||
|
||||
FROM weaveworks/eksctl:v0.193.0 AS eksctl
|
||||
FROM mikefarah/yq:4.44.3 AS yq
|
||||
FROM amazon/aws-cli:2.18.15
|
||||
RUN yum update -y && yum install -y jq && yum install -y perl-Digest-SHA && yum clean all
|
||||
COPY --from=eksctl /usr/local/bin /usr/local/bin
|
||||
COPY --from=yq /usr/bin/yq /usr/local/bin/yq
|
||||
|
||||
# Install Carvel tools.
|
||||
RUN bash -c "set -eo pipefail; curl -fsL https://carvel.dev/install.sh | bash" && \
|
||||
ytt version && kapp version && kbld version && kwt version && imgpkg version && vendir version
|
||||
|
||||
# Install aws-iam-authenticator.
|
||||
# This gets installed automatically via eksctl, but currently it downloads v0.5.2,
|
||||
# which will give us a v1alpha1 execcredential rather than a v1beta1 which we want.
|
||||
# When this has changed, we can delete this:
|
||||
# https://github.com/weaveworks/eksctl/blob/main/build/docker/Dockerfile#L49
|
||||
RUN curl -sfL \
|
||||
https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v0.6.14/aws-iam-authenticator_0.6.14_linux_amd64 \
|
||||
-o /usr/local/bin/aws-iam-authenticator \
|
||||
&& chmod u+x /usr/local/bin/aws-iam-authenticator
|
||||
@@ -0,0 +1,15 @@
|
||||
# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
# For running the GitHub CLI.
|
||||
FROM debian:12.7-slim AS builder
|
||||
|
||||
RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN curl \
|
||||
-sfLo /tmp/gh.tar.gz \
|
||||
https://github.com/cli/cli/releases/download/v2.40.0/gh_2.40.0_linux_amd64.tar.gz \
|
||||
&& tar -C /tmp --strip-components=1 -xzvf /tmp/gh.tar.gz
|
||||
|
||||
FROM golang:1.23.2
|
||||
COPY --from=builder /tmp/bin/gh /usr/local/bin/gh
|
||||
@@ -0,0 +1,80 @@
|
||||
# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
# For running the integration tests as a client to a k8s cluster
|
||||
|
||||
FROM mikefarah/yq:4.44.3 AS yq
|
||||
|
||||
# We need gcloud for running integration tests against GKE
|
||||
# because the kubeconfig uses gcloud as an `auth-provider`.
|
||||
# Use FROM gcloud-sdk instead of FROM golang because its
|
||||
# a lot easier to install Go than to install gcloud in the
|
||||
# subsequent commands below.
|
||||
FROM google/cloud-sdk:498.0.0-slim
|
||||
|
||||
# Install apache2-utils (for htpasswd to bcrypt passwords for the
|
||||
# local-user-authenticator) and jq.
|
||||
RUN apt-get update && apt-get install -y apache2-utils jq wget zip procps alien google-cloud-sdk-gke-gcloud-auth-plugin && rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Print version of gke-gcloud-auth-plugin
|
||||
RUN gke-gcloud-auth-plugin --version
|
||||
|
||||
# Create a non-root user account that can be used to run the tests.
|
||||
RUN useradd --create-home testrunner
|
||||
|
||||
# Install latest beta chrome.
|
||||
RUN \
|
||||
chown root:root /tmp && \
|
||||
chmod 1777 /tmp && \
|
||||
curl -fsSL -o - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add && \
|
||||
echo "deb https://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google-chrome.list && \
|
||||
apt-get -y update && \
|
||||
apt-get -y install google-chrome-beta
|
||||
|
||||
# Output Chrome version used
|
||||
RUN google-chrome --version
|
||||
|
||||
# Install Go. The download URL that can be used below for any version of Go can be found on https://go.dev/dl/
|
||||
ENV PATH /usr/local/go/bin:$PATH
|
||||
RUN curl -fsSL https://go.dev/dl/go1.23.2.linux-amd64.tar.gz -o /tmp/go.tar.gz && \
|
||||
tar -C /usr/local -xzf /tmp/go.tar.gz && \
|
||||
rm /tmp/go.tar.gz && \
|
||||
go version
|
||||
ENV GOPATH /go
|
||||
ENV PATH $GOPATH/bin:$PATH
|
||||
RUN mkdir -p "$GOPATH/src" "$GOPATH/bin" && chmod -R 777 "$GOPATH"
|
||||
WORKDIR $GOPATH
|
||||
|
||||
# Install go tools gotestsum and test2json to record the test output in a nice format.
|
||||
RUN go install gotest.tools/gotestsum@latest
|
||||
RUN env GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o test2json -ldflags="-s -w" cmd/test2json && \
|
||||
mv test2json /usr/local/bin/test2json
|
||||
|
||||
# Install Carvel tools.
|
||||
RUN bash -c "set -eo pipefail; curl -fsSL https://carvel.dev/install.sh | bash" && \
|
||||
ytt version && kapp version && kbld version && kwt version && imgpkg version && vendir version
|
||||
|
||||
# Install the latest kubectl as documented here: https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/
|
||||
RUN curl -fsSL "https://dl.k8s.io/release/$(curl -fsSL "https://dl.k8s.io/release/stable.txt")/bin/linux/amd64/kubectl" \
|
||||
-o /bin/kubectl && chmod 0755 /bin/kubectl
|
||||
|
||||
# Install aws-iam-authenticator
|
||||
RUN curl -fsSL \
|
||||
https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v0.6.14/aws-iam-authenticator_0.6.14_linux_amd64 \
|
||||
-o /bin/aws-iam-authenticator \
|
||||
&& chmod 0755 /bin/aws-iam-authenticator
|
||||
|
||||
# Install TMC CLI.
|
||||
# Update: The TMC CLI has been deprecated and replaced by the tanzu CLI. Commenting this out for now.
|
||||
#RUN curl -fsSL https://tanzuuserauthentication.stable.tmc-dev.cloud.vmware.com/v1alpha/system/binaries \
|
||||
# | jq -r .versions[].linuxX64 \
|
||||
# | xargs curl -fsSL -o /bin/tmc && chmod 0755 /bin/tmc && \
|
||||
# tmc version
|
||||
|
||||
# Install yq.
|
||||
COPY --from=yq /usr/bin/yq /usr/local/bin/yq
|
||||
|
||||
# install latest nmap
|
||||
RUN wget https://nmap.org/dist/nmap-7.92-1.x86_64.rpm &&\
|
||||
alien nmap-7.92-1.x86_64.rpm &&\
|
||||
dpkg -i nmap_7.92-2_amd64.deb
|
||||
@@ -0,0 +1,80 @@
|
||||
# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
# For running the integration tests as a client to a k8s cluster
|
||||
|
||||
FROM mikefarah/yq:4.44.3 AS yq
|
||||
|
||||
# We need gcloud for running integration tests against GKE
|
||||
# because the kubeconfig uses gcloud as an `auth-provider`.
|
||||
# Use FROM gcloud-sdk instead of FROM golang because its
|
||||
# a lot easier to install Go than to install gcloud in the
|
||||
# subsequent commands below.
|
||||
FROM google/cloud-sdk:498.0.0-slim
|
||||
|
||||
# Install apache2-utils (for htpasswd to bcrypt passwords for the
|
||||
# local-user-authenticator) and jq.
|
||||
RUN apt-get update && apt-get install -y apache2-utils jq wget zip procps alien google-cloud-sdk-gke-gcloud-auth-plugin && rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Print version of gke-gcloud-auth-plugin
|
||||
RUN gke-gcloud-auth-plugin --version
|
||||
|
||||
# Create a non-root user account that can be used to run the tests.
|
||||
RUN useradd --create-home testrunner
|
||||
|
||||
# Install latest stable chrome.
|
||||
RUN \
|
||||
chown root:root /tmp && \
|
||||
chmod 1777 /tmp && \
|
||||
curl -fsSL -o - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add && \
|
||||
echo "deb https://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google-chrome.list && \
|
||||
apt-get -y update && \
|
||||
apt-get -y install google-chrome-stable
|
||||
|
||||
# Output Chrome version used
|
||||
RUN google-chrome --version
|
||||
|
||||
# Install Go. The download URL that can be used below for any version of Go can be found on https://go.dev/dl/
|
||||
ENV PATH /usr/local/go/bin:$PATH
|
||||
RUN curl -fsSL https://go.dev/dl/go1.23.2.linux-amd64.tar.gz -o /tmp/go.tar.gz && \
|
||||
tar -C /usr/local -xzf /tmp/go.tar.gz && \
|
||||
rm /tmp/go.tar.gz && \
|
||||
go version
|
||||
ENV GOPATH /go
|
||||
ENV PATH $GOPATH/bin:$PATH
|
||||
RUN mkdir -p "$GOPATH/src" "$GOPATH/bin" && chmod -R 777 "$GOPATH"
|
||||
WORKDIR $GOPATH
|
||||
|
||||
# Install go tools gotestsum and test2json to record the test output in a nice format.
|
||||
RUN go install gotest.tools/gotestsum@latest
|
||||
RUN env GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o test2json -ldflags="-s -w" cmd/test2json && \
|
||||
mv test2json /usr/local/bin/test2json
|
||||
|
||||
# Install Carvel tools.
|
||||
RUN bash -c "set -eo pipefail; curl -fsSL https://carvel.dev/install.sh | bash" && \
|
||||
ytt version && kapp version && kbld version && kwt version && imgpkg version && vendir version
|
||||
|
||||
# Install the latest kubectl as documented here: https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/
|
||||
RUN curl -fsSL "https://dl.k8s.io/release/$(curl -fsSL "https://dl.k8s.io/release/stable.txt")/bin/linux/amd64/kubectl" \
|
||||
-o /bin/kubectl && chmod 0755 /bin/kubectl
|
||||
|
||||
# Install aws-iam-authenticator
|
||||
RUN curl -fsSL \
|
||||
https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v0.6.14/aws-iam-authenticator_0.6.14_linux_amd64 \
|
||||
-o /bin/aws-iam-authenticator \
|
||||
&& chmod 0755 /bin/aws-iam-authenticator
|
||||
|
||||
# Install TMC CLI.
|
||||
# Update: The TMC CLI has been deprecated and replaced by the tanzu CLI. Commenting this out for now.
|
||||
#RUN curl -fsSL https://tanzuuserauthentication.stable.tmc-dev.cloud.vmware.com/v1alpha/system/binaries \
|
||||
# | jq -r .versions[].linuxX64 \
|
||||
# | xargs curl -fsSL -o /bin/tmc && chmod 0755 /bin/tmc && \
|
||||
# tmc version
|
||||
|
||||
# Install yq.
|
||||
COPY --from=yq /usr/bin/yq /usr/local/bin/yq
|
||||
|
||||
# install latest nmap
|
||||
RUN wget https://nmap.org/dist/nmap-7.92-1.x86_64.rpm &&\
|
||||
alien nmap-7.92-1.x86_64.rpm &&\
|
||||
dpkg -i nmap_7.92-2_amd64.deb
|
||||
@@ -0,0 +1,34 @@
|
||||
# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
# For deploying apps onto Kubernetes clusters (including GKE)
|
||||
|
||||
FROM google/cloud-sdk:498.0.0-slim
|
||||
|
||||
# Install apache2-utils (for htpasswd to bcrypt passwords for the
|
||||
# local-user-authenticator) and jq.
|
||||
RUN apt-get update && apt-get install -y apache2-utils jq wget zip procps dnsutils google-cloud-sdk-gke-gcloud-auth-plugin && rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Print version of gke-gcloud-auth-plugin
|
||||
RUN gke-gcloud-auth-plugin --version
|
||||
|
||||
# Install Carvel tools.
|
||||
RUN bash -c "set -eo pipefail; curl -fsL https://carvel.dev/install.sh | bash" && \
|
||||
ytt version && kapp version && kbld version && kwt version && imgpkg version && vendir version
|
||||
|
||||
# Install latest kubectl.
|
||||
RUN curl -sfL "https://dl.k8s.io/release/$(curl -sfL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
|
||||
-o /bin/kubectl && chmod u+x /bin/kubectl
|
||||
|
||||
# Install aws-iam-authenticator
|
||||
RUN curl -sfL \
|
||||
https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v0.6.14/aws-iam-authenticator_0.6.14_linux_amd64 \
|
||||
-o /bin/aws-iam-authenticator \
|
||||
&& chmod u+x /bin/aws-iam-authenticator
|
||||
|
||||
# Install TMC CLI.
|
||||
# Update: The TMC CLI has been deprecated and replaced by the tanzu CLI. Commenting this out for now.
|
||||
#RUN curl -sfL https://tanzuuserauthentication.stable.tmc-dev.cloud.vmware.com/v1alpha/system/binaries \
|
||||
# | jq -r .versions[].linuxX64 \
|
||||
# | xargs curl -sfL -o /bin/tmc && chmod +x /bin/tmc && \
|
||||
# tmc version
|
||||
@@ -0,0 +1,20 @@
|
||||
# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
ARG GO_VERSION
|
||||
|
||||
FROM golang:${GO_VERSION}
|
||||
|
||||
ARG GO_VERSION
|
||||
ARG K8S_PKG_VERSION
|
||||
ARG CONTROLLER_GEN_VERSION
|
||||
ARG CRD_REF_DOCS_COMMIT_SHA
|
||||
|
||||
ENV GO_VERSION=$GO_VERSION
|
||||
ENV K8S_PKG_VERSION=$K8S_PKG_VERSION
|
||||
ENV CONTROLLER_GEN_VERSION=$CONTROLLER_GEN_VERSION
|
||||
ENV CRD_REF_DOCS_COMMIT_SHA=$CRD_REF_DOCS_COMMIT_SHA
|
||||
|
||||
COPY setup.sh /codegen/
|
||||
|
||||
RUN /codegen/setup.sh
|
||||
Executable
+89
@@ -0,0 +1,89 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
if [ -z "$GO_VERSION" ]; then
|
||||
echo "missing GO_VERSION"
|
||||
exit 1
|
||||
fi
|
||||
if [ -z "$K8S_PKG_VERSION" ]; then
|
||||
echo "missing K8S_PKG_VERSION"
|
||||
exit 1
|
||||
fi
|
||||
if [ -z "$CONTROLLER_GEN_VERSION" ]; then
|
||||
echo "missing CONTROLLER_GEN_VERSION"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Debugging output for CI...
|
||||
echo "GO_VERSION: $GO_VERSION"
|
||||
echo "K8S_PKG_VERSION: $K8S_PKG_VERSION"
|
||||
echo "CONTROLLER_GEN_VERSION: $CONTROLLER_GEN_VERSION"
|
||||
echo "CRD_REF_DOCS_COMMIT_SHA: $CRD_REF_DOCS_COMMIT_SHA"
|
||||
|
||||
apt-get update -y && apt-get dist-upgrade -y
|
||||
|
||||
cd /codegen/
|
||||
|
||||
cat <<EOF >tools.go
|
||||
package tools
|
||||
|
||||
import (
|
||||
_ "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
_ "k8s.io/api/core/v1"
|
||||
_ "k8s.io/code-generator"
|
||||
)
|
||||
EOF
|
||||
|
||||
cat <<EOF >go.mod
|
||||
module codegen
|
||||
|
||||
go 1.21
|
||||
|
||||
require (
|
||||
k8s.io/apimachinery v$K8S_PKG_VERSION
|
||||
k8s.io/code-generator v$K8S_PKG_VERSION
|
||||
k8s.io/api v$K8S_PKG_VERSION
|
||||
)
|
||||
EOF
|
||||
|
||||
# Resolve dependencies and download the modules.
|
||||
go mod tidy
|
||||
go mod download
|
||||
|
||||
# Copy the downloaded source code of k8s.io/code-generator so we can "go install" all its commands.
|
||||
rm -rf "$(go env GOPATH)/src"
|
||||
mkdir -p "$(go env GOPATH)/src/k8s.io"
|
||||
cp -pr "$(go env GOMODCACHE)/k8s.io/code-generator@v$K8S_PKG_VERSION" "$(go env GOPATH)/src/k8s.io/code-generator"
|
||||
|
||||
# Install the commands to $GOPATH/bin. Also sed the related shell scripts, but leave those in the src dir.
|
||||
# Note that update-codegen.sh invokes these shell scripts at this src path.
|
||||
# The sed is a dirty hack to avoid having the code-generator shell scripts run go install again.
|
||||
# In version 0.23.0 the line inside the shell script that previously said "go install ..." started
|
||||
# to instead say "GO111MODULE=on go install ..." so this sed is a little wrong, but still seems to work.
|
||||
(cd "$(go env GOPATH)/src/k8s.io/code-generator" &&
|
||||
go install -v ./cmd/... &&
|
||||
sed -i -E -e 's/(go install.*)/# \1/g' ./*.sh)
|
||||
|
||||
if [[ ! -f "$(go env GOPATH)/bin/openapi-gen" ]]; then
|
||||
# Starting in Kube 1.30, openapi-gen moved from k8s.io/code-generator to k8s.io/kube-openapi.
|
||||
# Assuming that we are still in the /codegen directory, get the specific version of kube-openapi
|
||||
# that is selected as an indirect dependency by the go.mod.
|
||||
kube_openapi_version=$(go list -m k8s.io/kube-openapi | cut -f2 -d' ')
|
||||
# Install that version of its openapi-gen command.
|
||||
go install -v "k8s.io/kube-openapi/cmd/openapi-gen@$kube_openapi_version"
|
||||
fi
|
||||
|
||||
go install -v sigs.k8s.io/controller-tools/cmd/controller-gen@v$CONTROLLER_GEN_VERSION
|
||||
|
||||
# We use a commit sha instead of a release semver because this project does not create
|
||||
# releases very often. They seem to only release 1-2 times per year, but commit to
|
||||
# main more often.
|
||||
go install -v github.com/elastic/crd-ref-docs@$CRD_REF_DOCS_COMMIT_SHA
|
||||
|
||||
# List all the commands that we just installed.
|
||||
echo "Installed the following commands to $(go env GOPATH)/bin:"
|
||||
ls "$(go env GOPATH)/bin"
|
||||
@@ -0,0 +1,17 @@
|
||||
# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
# We would like to use https://github.com/cfmobile/pool-trigger-resource for our pool recycle jobs.
|
||||
# Unfortuntely, the pool-trigger-resource repo seems like it is not maintained by anyone. The most recent
|
||||
# commit was six years ago. On the other hand, its implementation is a shell script which basically
|
||||
# just calls some git commands, so it shouldn't need much maintaince if it works.
|
||||
# This is an updated version of https://github.com/cfmobile/pool-trigger-resource/blob/master/Dockerfile
|
||||
# to use newer versions of linux, jq, and git. The "assets" directory's source code is copied from
|
||||
# https://github.com/cfmobile/pool-trigger-resource/tree/master/assets as of commit efefe018c88e937.
|
||||
|
||||
FROM debian:12.7-slim
|
||||
|
||||
RUN apt-get update && apt-get install -y ca-certificates jq git && rm -rf /var/lib/apt/lists/*
|
||||
|
||||
ADD assets/ /opt/resource/
|
||||
RUN chmod +rx /opt/resource/*
|
||||
+219
@@ -0,0 +1,219 @@
|
||||
#!/bin/sh
|
||||
# vim: set ft=sh
|
||||
|
||||
set -e
|
||||
|
||||
exec 3>&1 # make stdout available as fd 3 for the result
|
||||
exec 1>&2 # redirect all output to stderr for logging
|
||||
|
||||
# shellcheck source=./common.sh
|
||||
. "$(dirname "$0")"/common.sh
|
||||
|
||||
# for jq
|
||||
PATH=/usr/local/bin:$PATH
|
||||
|
||||
payload=$TMPDIR/git-resource-request
|
||||
|
||||
cat > "$payload" <&0
|
||||
|
||||
|
||||
uri=$(jq -r '.source.uri // ""' < "$payload")
|
||||
branch=$(jq -r '.source.branch // ""' < "$payload")
|
||||
pool_name=$(jq -r '.source.pool // ""' < "$payload")
|
||||
ref=$(jq -r '.version.ref // ""' < "$payload")
|
||||
|
||||
if [ -z "$uri" ]; then
|
||||
config_errors="${config_errors}invalid payload (missing uri)
|
||||
"
|
||||
fi
|
||||
|
||||
if [ -z "$branch" ]; then
|
||||
config_errors="${config_errors}invalid payload (missing branch)
|
||||
"
|
||||
fi
|
||||
|
||||
if [ -z "$pool_name" ]; then
|
||||
config_errors="${config_errors}invalid payload (missing pool)
|
||||
"
|
||||
fi
|
||||
|
||||
if [ -n "$config_errors" ]; then
|
||||
echo "$config_errors"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
###########
|
||||
#
|
||||
# end processing inputs
|
||||
#
|
||||
###########
|
||||
|
||||
###########
|
||||
#
|
||||
# start git setup
|
||||
#
|
||||
###########
|
||||
|
||||
load_pubkey "$payload"
|
||||
|
||||
destination=$TMPDIR/git-resource-repo-cache
|
||||
|
||||
if [ -d "$destination" ]; then
|
||||
cd "$destination"
|
||||
git fetch
|
||||
git reset --hard FETCH_HEAD
|
||||
else
|
||||
branchflag=""
|
||||
if [ -n "$branch" ]; then
|
||||
branchflag="--branch $branch"
|
||||
fi
|
||||
|
||||
git clone "$uri" $branchflag "$destination"
|
||||
cd "$destination"
|
||||
fi
|
||||
|
||||
|
||||
git config user.name "CI Pool Trigger Resource"
|
||||
git config user.email "ci-pool-trigger@localhost"
|
||||
|
||||
###########
|
||||
#
|
||||
# end git setup
|
||||
#
|
||||
###########
|
||||
|
||||
|
||||
###########
|
||||
#
|
||||
# start calculating pending triggers
|
||||
#
|
||||
###########
|
||||
|
||||
if [ -n "$ref" ] && git cat-file -e "$ref"; then
|
||||
ref_exists_and_is_valid=yes
|
||||
fi
|
||||
|
||||
if [ -e "$pool_name/.pending-triggers" ] && [ -e "$pool_name/.pending-removals" ]; then
|
||||
tally_files_exist=yes
|
||||
|
||||
#check validity of tally files
|
||||
fi
|
||||
|
||||
if [ -n "$ref_exists_and_is_valid" ] && [ -n "$tally_files_exist" ]; then
|
||||
files_changed=$(git show --pretty="format:" --name-status -r "$ref"..HEAD -- "$pool_name"/unclaimed/)
|
||||
|
||||
set +e
|
||||
added_items=$(echo "$files_changed" | grep "^A")
|
||||
removed_items=$(echo "$files_changed" | grep "^D")
|
||||
set -e
|
||||
|
||||
if [ -n "$added_items" ]; then
|
||||
num_added_items=$(echo "$added_items" | wc -l)
|
||||
else
|
||||
num_added_items=0
|
||||
fi
|
||||
|
||||
if [ -n "$removed_items" ]; then
|
||||
num_removed_items=$(echo "$removed_items" | wc -l)
|
||||
else
|
||||
num_removed_items=0
|
||||
fi
|
||||
|
||||
old_pending_triggers=$(cat "$pool_name"/.pending-triggers)
|
||||
old_pending_removals=$(cat "$pool_name"/.pending-removals)
|
||||
|
||||
pending_triggers=$(( old_pending_triggers + num_added_items ))
|
||||
|
||||
if [ "$num_removed_items" -gt "$old_pending_removals" ]; then
|
||||
extra_removals=$(( num_removed_items - old_pending_removals ))
|
||||
pending_removals=0
|
||||
pending_triggers=$(( pending_triggers - extra_removals ))
|
||||
else
|
||||
pending_removals=$(( old_pending_removals - num_removed_items ))
|
||||
fi
|
||||
else
|
||||
pending_triggers=$(find "$pool_name"/unclaimed -not -path "*/\.*" -path "$pool_name/unclaimed/*"| wc -l)
|
||||
pending_removals=0
|
||||
fi
|
||||
###########
|
||||
#
|
||||
# end calculating pending triggers
|
||||
#
|
||||
###########
|
||||
|
||||
|
||||
###########
|
||||
#
|
||||
# start handling results
|
||||
#
|
||||
###########
|
||||
|
||||
if [ "$pending_triggers" -gt 0 ]; then
|
||||
last_commit=$(git log -1 --pretty='format:%H')
|
||||
result=$(echo "$last_commit" | jq -R '.' | jq -s "map({ref: .})")
|
||||
else
|
||||
result="[]"
|
||||
fi
|
||||
|
||||
###########
|
||||
#
|
||||
# end handling results
|
||||
#
|
||||
###########
|
||||
|
||||
|
||||
|
||||
###########
|
||||
#
|
||||
# start updating triggers
|
||||
#
|
||||
###########
|
||||
|
||||
if [ "$pending_triggers" -gt 0 ]; then
|
||||
new_pending_triggers=$(( pending_triggers - 1 ))
|
||||
new_pending_removals=$(( pending_removals + 1 ))
|
||||
echo "$new_pending_triggers" > "$pool_name"/.pending-triggers
|
||||
echo "$new_pending_removals" > "$pool_name"/.pending-removals
|
||||
git add "$pool_name"/.pending*
|
||||
|
||||
commit_message="triggering build with pending triggers: $new_pending_triggers; pending removals: $new_pending_removals"
|
||||
|
||||
if [ -n "$ref_exists_and_is_valid" ] && [ -z "$tally_files_exist" ]; then
|
||||
commit_message="$commit_message
|
||||
|
||||
.pending-triggers and/or .pending-removals are missing - re-initializing resource"
|
||||
elif [ -z "$ref_exists_and_is_valid" ] && [ -n "$tally_files_exist" ]; then
|
||||
commit_message="$commit_message
|
||||
|
||||
resource initialized with pre-existing .pending-triggers and .pending-removals - ignoring"
|
||||
elif [ -z "$ref_exists_and_is_valid" ]; then
|
||||
commit_message="$commit_message
|
||||
|
||||
initializing tally files"
|
||||
fi
|
||||
|
||||
if [ -n "$added_items" ]; then
|
||||
commit_message="$commit_message
|
||||
|
||||
additions:
|
||||
$added_items"
|
||||
fi
|
||||
|
||||
if [ -n "$removed_items" ]; then
|
||||
commit_message="$commit_message
|
||||
|
||||
removals:
|
||||
$removed_items"
|
||||
fi
|
||||
|
||||
git commit --allow-empty -m "$commit_message"
|
||||
git push
|
||||
fi
|
||||
|
||||
###########
|
||||
#
|
||||
# end updating triggers
|
||||
#
|
||||
###########
|
||||
|
||||
echo "$result" >&3
|
||||
+28
@@ -0,0 +1,28 @@
|
||||
#!/bin/sh
|
||||
|
||||
# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
export TMPDIR=${TMPDIR:-/tmp}
|
||||
|
||||
load_pubkey() {
|
||||
local private_key_path=$TMPDIR/git-resource-private-key
|
||||
|
||||
(jq -r '.source.private_key // empty' < "$1") > "$private_key_path"
|
||||
|
||||
if [ -s "$private_key_path" ]; then
|
||||
chmod 0600 "$private_key_path"
|
||||
|
||||
eval "$(ssh-agent)" >/dev/null 2>&1
|
||||
trap 'kill $SSH_AGENT_PID' 0
|
||||
|
||||
ssh-add "$private_key_path" >/dev/null 2>&1
|
||||
|
||||
mkdir -p ~/.ssh
|
||||
cat > ~/.ssh/config <<EOF
|
||||
StrictHostKeyChecking no
|
||||
LogLevel quiet
|
||||
EOF
|
||||
chmod 0600 ~/.ssh/config
|
||||
fi
|
||||
}
|
||||
Executable
+2
@@ -0,0 +1,2 @@
|
||||
#!/bin/sh
|
||||
cat
|
||||
Executable
+2
@@ -0,0 +1,2 @@
|
||||
#!/bin/sh
|
||||
cat
|
||||
@@ -0,0 +1,4 @@
|
||||
# Copyright 2024 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
FROM bitnami/openldap:2.6.8
|
||||
@@ -0,0 +1,28 @@
|
||||
# Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
# The cfssl/cfssl container image on dockerhub is built poorly.
|
||||
# For every arch, the image contains /bin/* binaries for amd64.
|
||||
# Therefore, we cannot use bash on arm64 inside this container image.
|
||||
# This was observed in cfssl/cfssl:v1.6.4.
|
||||
# However, they do compile their own binaries for both arm64 and amd64,
|
||||
# so we can just copy their binaries into a vanilla linux base image.
|
||||
FROM cfssl/cfssl:v1.6.5 as cfssl
|
||||
|
||||
# We just need any basic unix with bash, but we can pick the same
|
||||
# base image that they use, just in case they did any dynamic linking.
|
||||
FROM golang:1.23
|
||||
|
||||
# Thier Docerfile https://github.com/cloudflare/cfssl/blob/master/Dockerfile
|
||||
# calls their Makefile https://github.com/cloudflare/cfssl/blob/master/Makefile
|
||||
# which builds several binaries. Copy them all.
|
||||
COPY --from=cfssl /usr/bin/cf* /usr/local/bin
|
||||
COPY --from=cfssl /usr/bin/mkbundle /usr/local/bin
|
||||
COPY --from=cfssl /usr/bin/multirootca /usr/local/bin
|
||||
# Their Dockerfile also populates this directory, so copy that too.
|
||||
COPY --from=cfssl /etc/cfssl /etc/cfssl
|
||||
|
||||
# These lines are copied from the cfssl Dockerfile.
|
||||
EXPOSE 8888
|
||||
ENTRYPOINT ["cfssl"]
|
||||
CMD ["--help"]
|
||||
@@ -0,0 +1,4 @@
|
||||
# Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
FROM ghcr.io/dexidp/dex:v2.41.1
|
||||
@@ -0,0 +1,13 @@
|
||||
# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
# Use a runtime image based on Debian slim
|
||||
FROM debian:12.7-slim
|
||||
|
||||
# Install Squid and drop in a very basic, open proxy configuration.
|
||||
RUN apt-get update && apt-get install -y squid
|
||||
COPY squid.conf /etc/squid/squid.conf
|
||||
EXPOSE 3128
|
||||
|
||||
# Launch Squid as a foreground process.
|
||||
CMD squid -N -C -n proxy -d1 2>&1
|
||||
@@ -0,0 +1,56 @@
|
||||
## listen on TCP 3128
|
||||
http_port 3128
|
||||
|
||||
## Prevent caching anything (pass through only)
|
||||
cache deny all
|
||||
|
||||
## Allow all connections.
|
||||
http_access allow all
|
||||
|
||||
## Where does Squid log to?
|
||||
cache_store_log none
|
||||
cache_log /dev/null
|
||||
access_log daemon:/var/log/squid/access.log squid
|
||||
access_log syslog:user.info squid
|
||||
|
||||
## When logging, web auditors want to see the full uri, even with the query terms
|
||||
strip_query_terms off
|
||||
|
||||
## Keep 7 days of logs
|
||||
logfile_rotate 7
|
||||
|
||||
## How much RAM, in MB, to use for cache? Default since squid 3.1 is 256 MB
|
||||
cache_mem 8 MB
|
||||
|
||||
## Maximum size of individual objects to store in cache
|
||||
maximum_object_size 1 MB
|
||||
|
||||
## Amount of data to buffer from server to client
|
||||
read_ahead_gap 64 KB
|
||||
|
||||
## Number of file descriptors to support (default is 2**20 which takes up ~408 MB of memory)
|
||||
max_filedescriptors 65536
|
||||
|
||||
## Drop X-Forwarded-For headers
|
||||
forwarded_for delete
|
||||
|
||||
## Suppress sending squid version information
|
||||
httpd_suppress_version_string on
|
||||
|
||||
## How long to wait when shutting down squid
|
||||
shutdown_lifetime 10 seconds
|
||||
|
||||
## What hostname to display? (defaults to system hostname)
|
||||
visible_hostname proxy
|
||||
|
||||
## Drop some response headers that Squid normally adds (just being paranoid here)
|
||||
reply_header_access Server deny all
|
||||
reply_header_access Via deny all
|
||||
reply_header_access X-Cache deny all
|
||||
reply_header_access X-Cache-Lookup deny all
|
||||
reply_header_access X-Squid-Error deny all
|
||||
|
||||
## Drop denied connections with just a TCP reset (no error page that might leak info)
|
||||
deny_info TCP_RESET all
|
||||
|
||||
dns_v4_first off
|
||||
@@ -0,0 +1,4 @@
|
||||
# Copyright 2021 the Pinniped contributors. All Rights Reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
FROM bitnami/kubectl:latest
|
||||
Reference in New Issue
Block a user