Skip to content

Commit 7cfc2f7

Browse files
Julien-BenJulien-Ben
authored
Sign images (#1533)
* Bump Sonar * Refactor inventories * Refactor agent inventory * Use logger * Sign released images * Add --sign flag to CLI * Update release notes * Use Actions env. variables * Remove the if for testing * Change AWS default region * Artifactory login * Debug env variable access * Fix logging * Try echo variable * Update release-single-image.yml * Replace env with var * Putting back the conditional release * Remove dot after ubi * Fix pipeline arguments * Refactor e2e inventory
1 parent ea008d7 commit 7cfc2f7

12 files changed

+367
-534
lines changed

‎.action_templates/jobs/setup.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ setup:
44
fail-fast: false
55
matrix:
66
include:
7-
- pipeline-argument: mongodb-kubernetes-operator
7+
- pipeline-argument: operator
88
- pipeline-argument: version-upgrade-hook
99
- pipeline-argument: readiness-probe
1010
- pipeline-argument: agent

‎.action_templates/jobs/tests.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ tests:
1010
- test-name: replica_set_enterprise_upgrade_4_5
1111
distro: ubi
1212
- test-name: replica_set_enterprise_upgrade_5_6
13-
distro: ubi.
13+
distro: ubi
1414
- test-name: replica_set_enterprise_upgrade_6_7
1515
distro: ubi
1616
- test-name: replica_set_recovery

‎.github/workflows/release-images.yml

+7-1
Original file line numberDiff line numberDiff line change
@@ -56,11 +56,17 @@ jobs:
5656

5757
- name: Publish Image To Quay
5858
if: steps.release_status.outputs.OUTPUT == 'unreleased'
59-
run: python pipeline.py --image-name ${{ matrix.pipeline-argument }} --release
59+
run: python pipeline.py --image-name ${{ matrix.pipeline-argument }} --release --sign
6060
env:
6161
MONGODB_COMMUNITY_CONFIG: "${{ github.workspace }}/scripts/ci/config.json"
6262
AWS_ACCESS_KEY_ID: "${{ secrets.AWS_ACCESS_KEY_ID }}"
6363
AWS_SECRET_ACCESS_KEY: "${{ secrets.AWS_SECRET_ACCESS_KEY }}"
64+
GRS_USERNAME: "${{ vars.GRS_USERNAME }}"
65+
GRS_PASSWORD: "${{ secrets.GRS_PASSWORD }}"
66+
PKCS11_URI: "${{ vars.PKCS11_URI }}"
67+
ARTIFACTORY_USERNAME: "${{ vars.ARTIFACTORY_USERNAME }}"
68+
ARTIFACTORY_PASSWORD: "${{ secrets.ARTIFACTORY_PASSWORD }}"
69+
AWS_DEFAULT_REGION: "${{ vars.AWS_DEFAULT_REGION }}"
6470

6571
create-draft-release:
6672
runs-on: ubuntu-latest

‎.github/workflows/release-single-image.yml

+6-1
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,13 @@ jobs:
4646

4747
- name: Publish Image To Quay
4848
if: steps.release_status.outputs.OUTPUT == 'unreleased'
49-
run: python pipeline.py --image-name ${{ github.event.inputs.pipeline-argument }} --release
49+
run: python pipeline.py --image-name ${{ github.event.inputs.pipeline-argument }} --release --sign
5050
env:
5151
MONGODB_COMMUNITY_CONFIG: "${{ github.workspace }}/scripts/ci/config.json"
5252
AWS_ACCESS_KEY_ID: "${{ secrets.AWS_ACCESS_KEY_ID }}"
5353
AWS_SECRET_ACCESS_KEY: "${{ secrets.AWS_SECRET_ACCESS_KEY }}"
54+
GRS_USERNAME: "${{ vars.GRS_USERNAME }}"
55+
GRS_PASSWORD: "${{ secrets.GRS_PASSWORD }}"
56+
PKCS11_URI: "${{ vars.PKCS11_URI }}"
57+
ARTIFACTORY_USERNAME: "${{ vars.ARTIFACTORY_USERNAME }}"
58+
ARTIFACTORY_PASSWORD: "${{ secrets.ARTIFACTORY_PASSWORD }}"

‎docs/RELEASE_NOTES.md

+3-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
1-
# MongoDB Kubernetes Operator 0.9.0
1+
# MongoDB Kubernetes Operator 0.10.0
22

3-
## MongoDBCommunity Resource
3+
## Released images signed
44

5-
- Changes
6-
- Introduced support for [Mongodb7](https://www.mongodb.com/docs/manual/release-notes/7.0/)
7-
- Upgrading Kubernetes client APIs to 1.26
5+
All container images published for the community operator are signed with our private key. This is visible on our Quay registry. Signature can be verified using our public key, which is available at [this address](https://cosign.mongodb.com/mongodb-enterprise-kubernetes-operator.pem).

‎inventories/e2e-inventory.yaml

+5-38
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
vars:
22
registry: <registry>
3+
architecture: amd64
34

45
images:
5-
- name: e2e-arm64
6+
- name: e2e
67
vars:
78
context: .
89
template_context: scripts/dev/templates
910
inputs:
1011
- image
11-
platform: linux/arm64
12+
platform: linux/$(inputs.params.architecture)
1213
stages:
1314
- name: e2e-template
1415
task_type: dockerfile_template
@@ -31,40 +32,6 @@ images:
3132

3233
output:
3334
- registry: $(inputs.params.registry)/$(inputs.params.image)
34-
tag: $(inputs.params.version_id)-arm64
35+
tag: $(inputs.params.version_id)-$(inputs.params.architecture)
3536
- registry: $(inputs.params.registry)/$(inputs.params.image)
36-
tag: latest-arm64
37-
38-
- name: e2e-amd64
39-
vars:
40-
context: .
41-
template_context: scripts/dev/templates
42-
inputs:
43-
- image
44-
platform: linux/amd64
45-
stages:
46-
- name: e2e-template
47-
task_type: dockerfile_template
48-
distro: e2e
49-
50-
inputs:
51-
- builder
52-
- base_image
53-
54-
output:
55-
- dockerfile: scripts/dev/templates/Dockerfile.ubi-$(inputs.params.version_id)
56-
57-
- name: e2e-build
58-
task_type: docker_build
59-
60-
dockerfile: scripts/dev/templates/Dockerfile.ubi-$(inputs.params.version_id)
61-
62-
labels:
63-
quay.expires-after: 48h
64-
65-
output:
66-
- registry: $(inputs.params.registry)/$(inputs.params.image)
67-
tag: $(inputs.params.version_id)-amd64
68-
- registry: $(inputs.params.registry)/$(inputs.params.image)
69-
tag: latest-amd64
70-
37+
tag: latest-$(inputs.params.architecture)

‎inventories/operator-inventory.yaml

+10-123
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
vars:
22
registry: <registry>
3+
architecture: amd64
34

45
images:
5-
- name: operator-amd64
6+
- name: operator
67
vars:
78
context: .
89
template_context: scripts/dev/templates/operator
@@ -11,7 +12,7 @@ images:
1112
- image
1213
- image_dev
1314

14-
platform: linux/amd64
15+
platform: linux/$(inputs.params.architecture)
1516

1617
stages:
1718
#
@@ -30,7 +31,7 @@ images:
3031

3132
output:
3233
- registry: $(inputs.params.registry)/$(inputs.params.image_dev)
33-
tag: $(inputs.params.version_id)-context-amd64
34+
tag: $(inputs.params.version_id)-context-$(inputs.params.architecture)
3435

3536
- name: operator-template-dev
3637
task_type: dockerfile_template
@@ -51,16 +52,16 @@ images:
5152
- version_id
5253

5354
buildargs:
54-
imagebase: $(inputs.params.registry)/$(inputs.params.image_dev):$(inputs.params.version_id)-context-amd64
55+
imagebase: $(inputs.params.registry)/$(inputs.params.image_dev):$(inputs.params.version_id)-context-$(inputs.params.architecture)
5556

5657
labels:
5758
quay.expires-after: 48h
5859

5960
output:
6061
- registry: $(inputs.params.registry)/$(inputs.params.image_dev)
61-
tag: $(inputs.params.version_id)-amd64
62+
tag: $(inputs.params.version_id)-$(inputs.params.architecture)
6263
- registry: $(inputs.params.registry)/$(inputs.params.image_dev)
63-
tag: latest-amd64
64+
tag: latest-$(inputs.params.architecture)
6465

6566
#
6667
# Release build stages
@@ -83,7 +84,7 @@ images:
8384

8485
output:
8586
- registry: $(inputs.params.registry)/$(inputs.params.image)
86-
tag: $(inputs.params.release_version)-context-amd64
87+
tag: $(inputs.params.release_version)-context-$(inputs.params.architecture)
8788

8889
- name: operator-template-release
8990
task_type: dockerfile_template
@@ -107,125 +108,11 @@ images:
107108
dockerfile: scripts/dev/templates/operator/Dockerfile.operator-$(inputs.params.release_version)
108109

109110
buildargs:
110-
imagebase: $(inputs.params.registry)/$(inputs.params.image):$(inputs.params.release_version)-context-amd64
111+
imagebase: $(inputs.params.registry)/$(inputs.params.image):$(inputs.params.release_version)-context-$(inputs.params.architecture)
111112

112113
labels:
113114
quay.expires-after: Never
114115

115116
output:
116117
- registry: $(inputs.params.registry)/$(inputs.params.image)
117-
tag: $(inputs.params.release_version)-amd64
118-
119-
- name: operator-arm64
120-
vars:
121-
context: .
122-
template_context: scripts/dev/templates/operator
123-
124-
inputs:
125-
- image
126-
- image_dev
127-
128-
platform: linux/arm64
129-
130-
stages:
131-
#
132-
# Dev build stages
133-
#
134-
- name: operator-builder-dev
135-
task_type: docker_build
136-
tags: [ "ubi" ]
137-
dockerfile: scripts/dev/templates/operator/Dockerfile.builder
138-
139-
buildargs:
140-
builder_image: $(inputs.params.builder_image)
141-
142-
labels:
143-
quay.expires-after: 48h
144-
145-
output:
146-
- registry: $(inputs.params.registry)/$(inputs.params.image_dev)
147-
tag: $(inputs.params.version_id)-context-arm64
148-
149-
- name: operator-template-dev
150-
task_type: dockerfile_template
151-
tags: [ "ubi" ]
152-
template_file_extension: operator
153-
inputs:
154-
- base_image
155-
156-
output:
157-
- dockerfile: scripts/dev/templates/operator/Dockerfile.operator-$(inputs.params.version_id)
158-
159-
- name: operator-build-dev
160-
task_type: docker_build
161-
tags: [ "ubi" ]
162-
dockerfile: scripts/dev/templates/operator/Dockerfile.operator-$(inputs.params.version_id)
163-
164-
inputs:
165-
- version_id
166-
167-
buildargs:
168-
imagebase: $(inputs.params.registry)/$(inputs.params.image_dev):$(inputs.params.version_id)-context-arm64
169-
170-
labels:
171-
quay.expires-after: 48h
172-
173-
output:
174-
- registry: $(inputs.params.registry)/$(inputs.params.image_dev)
175-
tag: $(inputs.params.version_id)-arm64
176-
- registry: $(inputs.params.registry)/$(inputs.params.image_dev)
177-
tag: latest-arm64
178-
179-
#
180-
# Release build stages
181-
#
182-
- name: operator-builder-release
183-
task_type: docker_build
184-
tags: [ "ubi", "release" ]
185-
186-
inputs:
187-
- builder_image
188-
- release_version
189-
190-
dockerfile: scripts/dev/templates/operator/Dockerfile.builder
191-
192-
labels:
193-
quay.expires-after: Never
194-
195-
buildargs:
196-
builder_image: $(inputs.params.builder_image)
197-
198-
output:
199-
- registry: $(inputs.params.registry)/$(inputs.params.image)
200-
tag: $(inputs.params.release_version)-context-arm64
201-
202-
- name: operator-template-release
203-
task_type: dockerfile_template
204-
tags: [ "ubi", "release" ]
205-
template_file_extension: operator
206-
inputs:
207-
- base_image
208-
- release_version
209-
210-
output:
211-
- dockerfile: scripts/dev/templates/operator/Dockerfile.operator-$(inputs.params.release_version)
212-
- dockerfile: $(inputs.params.s3_bucket)/mongodb-kubernetes-operator/$(inputs.params.release_version)/ubi/Dockerfile
213-
214-
- name: operator-build-release
215-
task_type: docker_build
216-
tags: [ "ubi", "release" ]
217-
218-
inputs:
219-
- release_version
220-
221-
dockerfile: scripts/dev/templates/operator/Dockerfile.operator-$(inputs.params.release_version)
222-
223-
buildargs:
224-
imagebase: $(inputs.params.registry)/$(inputs.params.image):$(inputs.params.release_version)-context-arm64
225-
226-
labels:
227-
quay.expires-after: Never
228-
229-
output:
230-
- registry: $(inputs.params.registry)/$(inputs.params.image)
231-
tag: $(inputs.params.release_version)-arm64
118+
tag: $(inputs.params.release_version)-$(inputs.params.architecture)

0 commit comments

Comments
 (0)