Skip to content

Commit 97eda3c

Browse files
stackable-botstackable-bot
committed
chore: Generated commit to update templated files since the last template run up to stackabletech/operator-templating@7dffd3c
Reference-to: stackabletech/operator-templating@7dffd3c (chore: Allow RUSTSEC-2024-0436 and github.com/kube-rs/kube-rs)
1 parent 6de8388 commit 97eda3c

5 files changed

Lines changed: 979 additions & 98 deletions

File tree

‎Makefile‎

Lines changed: 4 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -9,17 +9,11 @@
99

1010
.PHONY: build publish
1111

12-
TAG := $(shell git rev-parse --short HEAD)
1312
OPERATOR_NAME := secret-operator
1413
VERSION := $(shell cargo metadata --format-version 1 | jq -r '.packages[] | select(.name=="stackable-${OPERATOR_NAME}") | .version')
15-
ARCH := $(shell uname -m | sed -e 's#x86_64#amd64#' | sed -e 's#aarch64#arm64#')
1614

1715
OCI_REGISTRY_HOSTNAME := oci.stackable.tech
1816
OCI_REGISTRY_PROJECT_IMAGES := sdp
19-
OCI_REGISTRY_PROJECT_CHARTS := sdp-charts
20-
# This will be overwritten by an environmental variable if called from the github action
21-
HELM_CHART_NAME := ${OPERATOR_NAME}
22-
HELM_CHART_ARTIFACT := target/helm/${OPERATOR_NAME}-${VERSION}.tgz
2317

2418
SHELL=/usr/bin/env bash -euo pipefail
2519

@@ -33,78 +27,12 @@ render-docs:
3327
docker-build:
3428
docker build --force-rm --build-arg VERSION=${VERSION} -t "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-${ARCH}" -f docker/Dockerfile .
3529

36-
docker-publish:
37-
# Push to Harbor
38-
# We need to use "value" here to prevent the variable from being recursively expanded by make (username contains a dollar sign, since it's a Harbor bot)
39-
docker login --username '${value OCI_REGISTRY_SDP_USERNAME}' --password '${OCI_REGISTRY_SDP_PASSWORD}' '${OCI_REGISTRY_HOSTNAME}'
40-
DOCKER_OUTPUT=$$(docker push --all-tags '${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}');\
41-
# Obtain the digest of the pushed image from the output of `docker push`, because signing by tag is deprecated and will be removed from cosign in the future\
42-
REPO_DIGEST_OF_IMAGE=$$(echo "$$DOCKER_OUTPUT" | awk '/^${VERSION}-${ARCH}: digest: sha256:[0-9a-f]{64} size: [0-9]+$$/ { print $$3 }');\
43-
if [ -z "$$REPO_DIGEST_OF_IMAGE" ]; then\
44-
echo 'Could not find repo digest for container image: ${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-${ARCH}';\
45-
exit 1;\
46-
fi;\
47-
# This generates a signature and publishes it to the registry, next to the image\
48-
# Uses the keyless signing flow with Github Actions as identity provider\
49-
cosign sign -y "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}@$$REPO_DIGEST_OF_IMAGE";\
50-
# Generate the SBOM for the operator image, this leverages the already generated SBOM for the operator binary by cargo-cyclonedx\
51-
syft scan --output cyclonedx-json@1.5=sbom.json --select-catalogers "-cargo-auditable-binary-cataloger,+sbom-cataloger" --scope all-layers --source-name "${OPERATOR_NAME}" --source-version "${VERSION}-${ARCH}" "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}@$$REPO_DIGEST_OF_IMAGE";\
52-
# Determine the PURL for the container image\
53-
URLENCODED_REPO_DIGEST_OF_IMAGE=$$(echo "$$REPO_DIGEST_OF_IMAGE" | sed 's/:/%3A/g');\
54-
PURL="pkg:oci/${OPERATOR_NAME}@$$URLENCODED_REPO_DIGEST_OF_IMAGE?arch=${ARCH}&repository_url=${OCI_REGISTRY_HOSTNAME}%2F${OCI_REGISTRY_PROJECT_IMAGES}%2F${OPERATOR_NAME}";\
55-
# Get metadata from the image\
56-
IMAGE_DESCRIPTION=$$(docker inspect --format='{{.Config.Labels.description}}' "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-${ARCH}");\
57-
IMAGE_NAME=$$(docker inspect --format='{{.Config.Labels.name}}' "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-${ARCH}");\
58-
# Merge the SBOM with the metadata for the operator\
59-
jq -s '{"metadata":{"component":{"description":"'"$$IMAGE_NAME. $$IMAGE_DESCRIPTION"'","supplier":{"name":"Stackable GmbH","url":["https://stackable.tech/"]},"author":"Stackable GmbH","purl":"'"$$PURL"'","publisher":"Stackable GmbH"}}} * .[0]' sbom.json > sbom.merged.json;\
60-
# Attest the SBOM to the image\
61-
cosign attest -y --predicate sbom.merged.json --type cyclonedx "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}@$$REPO_DIGEST_OF_IMAGE"
62-
63-
# This assumes "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-amd64 and "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-arm64 are built and pushed
64-
docker-manifest-list-build:
65-
docker manifest create "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}" --amend "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-amd64" --amend "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-arm64"
66-
67-
docker-manifest-list-publish:
68-
# Push to Harbor
69-
# We need to use "value" here to prevent the variable from being recursively expanded by make (username contains a dollar sign, since it's a Harbor bot)
70-
docker login --username '${value OCI_REGISTRY_SDP_USERNAME}' --password '${OCI_REGISTRY_SDP_PASSWORD}' '${OCI_REGISTRY_HOSTNAME}'
71-
DIGEST_HARBOR=$$(docker manifest push "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}");\
72-
# Refer to image via its digest (oci.stackable.tech/sdp/airflow@sha256:0a1b2c...);\
73-
# This generates a signature and publishes it to the registry, next to the image\
74-
# Uses the keyless signing flow with Github Actions as identity provider\
75-
cosign sign -y "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}@$$DIGEST_HARBOR"
76-
77-
# TODO remove if not used/needed
78-
docker: docker-build docker-publish
79-
80-
print-docker-tag:
81-
@echo "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}"
82-
83-
helm-publish:
84-
# Push to Harbor
85-
# We need to use "value" here to prevent the variable from being recursively expanded by make (username contains a dollar sign, since it's a Harbor bot)
86-
helm registry login --username '${value OCI_REGISTRY_SDP_CHARTS_USERNAME}' --password '${OCI_REGISTRY_SDP_CHARTS_PASSWORD}' '${OCI_REGISTRY_HOSTNAME}'
87-
# Obtain the digest of the pushed artifact from the output of `helm push`, because signing by tag is deprecated and will be removed from cosign in the future\
88-
HELM_OUTPUT=$$(helm push '${HELM_CHART_ARTIFACT}' 'oci://${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_CHARTS}' 2>&1);\
89-
REPO_DIGEST_OF_ARTIFACT=$$(echo "$$HELM_OUTPUT" | awk '/^Digest: sha256:[0-9a-f]{64}$$/ { print $$2 }');\
90-
if [ -z "$$REPO_DIGEST_OF_ARTIFACT" ]; then\
91-
echo 'Could not find repo digest for helm chart: ${HELM_CHART_NAME}';\
92-
exit 1;\
93-
fi;\
94-
# Login to Harbor, needed for cosign to be able to push the signature for the Helm chart\
95-
docker login --username '${value OCI_REGISTRY_SDP_CHARTS_USERNAME}' --password '${OCI_REGISTRY_SDP_CHARTS_PASSWORD}' '${OCI_REGISTRY_HOSTNAME}';\
96-
# This generates a signature and publishes it to the registry, next to the chart artifact\
97-
# Uses the keyless signing flow with Github Actions as identity provider\
98-
cosign sign -y "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_CHARTS}/${HELM_CHART_NAME}@$$REPO_DIGEST_OF_ARTIFACT"
99-
100-
helm-package:
101-
mkdir -p target/helm && helm package --destination target/helm deploy/helm/${OPERATOR_NAME}
102-
10330
## Chart related targets
10431
compile-chart: version crds config
10532

10633
chart-clean:
10734
rm -rf "deploy/helm/${OPERATOR_NAME}/configs"
35+
rm -rf "deploy/helm/${OPERATOR_NAME}/crds"
10836

10937
version:
11038
cat "deploy/helm/${OPERATOR_NAME}/Chart.yaml" | yq ".version = \"${VERSION}\" | .appVersion = \"${VERSION}\"" > "deploy/helm/${OPERATOR_NAME}/Chart.yaml.new"
@@ -116,11 +44,9 @@ config:
11644
cp -r deploy/config-spec/* "deploy/helm/${OPERATOR_NAME}/configs";\
11745
fi
11846

119-
# We generate a crds.yaml, so that the effect of code changes are visible.
120-
# The operator will take care of the CRD rollout itself.
12147
crds:
122-
mkdir -p extra
123-
cargo run --bin stackable-"${OPERATOR_NAME}" -- crd > extra/crds.yaml
48+
mkdir -p deploy/helm/"${OPERATOR_NAME}"/crds
49+
cargo run --bin stackable-"${OPERATOR_NAME}" -- crd | yq eval '.metadata.annotations["helm.sh/resource-policy"]="keep"' - > "deploy/helm/${OPERATOR_NAME}/crds/crds.yaml"
12450

12551
chart-lint: compile-chart
12652
docker run -it -v $(shell pwd):/build/helm-charts -w /build/helm-charts quay.io/helmpack/chart-testing:v3.5.0 ct lint --config deploy/helm/ct.yaml
@@ -134,14 +60,7 @@ regenerate-charts: chart-clean compile-chart
13460
regenerate-nix:
13561
nix run --extra-experimental-features "nix-command flakes" -f . regenerateNixLockfiles
13662

137-
build: regenerate-charts regenerate-nix helm-package docker-build
138-
139-
# This target is used by the CI
140-
# It doesn't make use of any nix dependencies and thus aviods building the
141-
# operator unnecessarily often.
142-
build-ci: regenerate-charts helm-package docker-build
143-
144-
publish: docker-publish helm-publish
63+
build: regenerate-charts regenerate-nix docker-build
14564

14665
check-nix:
14766
@which nix || (echo "Error: 'nix' is not installed. Please install it to proceed."; exit 1)

‎Tiltfile‎

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,11 @@ custom_build(
1717
outputs_image_ref_to='result/ref',
1818
)
1919

20+
# Load the latest CRDs from Nix
21+
watch_file('result')
22+
if os.path.exists('result'):
23+
k8s_yaml('result/crds.yaml')
24+
2025
# We need to set the correct image annotation on the operator Deployment to use e.g.
2126
# oci.stackable.tech/sandbox/opa-operator:7y19m3d8clwxlv34v5q2x4p7v536s00g instead of
2227
# oci.stackable.tech/sandbox/opa-operator:0.0.0-dev (which does not exist)
@@ -30,12 +35,18 @@ helm_values = settings.get('helm_values', None)
3035

3136
helm_override_image_repository = 'image.repository=' + registry + '/' + operator_name
3237

33-
k8s_yaml(helm(
34-
'deploy/helm/' + operator_name,
35-
name=operator_name,
36-
namespace="stackable-operators",
37-
set=[
38-
helm_override_image_repository,
39-
],
40-
values=helm_values,
41-
))
38+
# Exclude stale CRDs from Helm chart, and apply the rest
39+
helm_crds, helm_non_crds = filter_yaml(
40+
helm(
41+
'deploy/helm/' + operator_name,
42+
name=operator_name,
43+
namespace="stackable-operators",
44+
set=[
45+
helm_override_image_repository,
46+
],
47+
values=helm_values,
48+
),
49+
api_version = "^apiextensions\\.k8s\\.io/.*$",
50+
kind = "^CustomResourceDefinition$",
51+
)
52+
k8s_yaml(helm_non_crds)

‎deny.toml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,20 @@ ignore = [
2424
#
2525
# https://github.com/RustCrypto/RSA/issues/19 is the tracking issue
2626
"RUSTSEC-2023-0071",
27+
28+
# https://rustsec.org/advisories/RUSTSEC-2024-0436
29+
# The "paste" crate is no longer maintained because the owner states that the implementation is
30+
# finished. There are at least two (forked) alternatives which state to be maintained. They'd
31+
# need to be vetted before a potential switch. Additionally, they'd need to be in a maintained
32+
# state for a couple of years to provide any benefit over using "paste".
33+
#
34+
# This crate is only used in a single place in the xtask package inside the declarative
35+
# "write_crd" macro. The impact of vulnerabilities, if any, should be fairly minimal.
36+
#
37+
# See thread: https://users.rust-lang.org/t/paste-alternatives/126787/4
38+
#
39+
# This can only be removed again if we decide to use a different crate.
40+
"RUSTSEC-2024-0436",
2741
]
2842

2943
[bans]
@@ -67,6 +81,9 @@ license-files = [
6781
[sources]
6882
unknown-registry = "deny"
6983
unknown-git = "deny"
84+
allow-git = [
85+
"https://github.com/kube-rs/kube-rs",
86+
]
7087

7188
[sources.allow-org]
7289
github = ["stackabletech"]

0 commit comments

Comments
 (0)