mirror of https://github.com/fluxcd/flux2.git
Stefan Prodan
2 years ago
committed by
GitHub
commit
e7847b75db
@ -0,0 +1,50 @@
|
|||||||
|
# Flux GitHub Workflows
|
||||||
|
|
||||||
|
## End-to-end Testing
|
||||||
|
|
||||||
|
The e2e workflows run a series of tests to ensure that the Flux CLI and
|
||||||
|
the GitOps Toolkit controllers work well all together.
|
||||||
|
The tests are written in Go, Bash, Make and Terraform.
|
||||||
|
|
||||||
|
| Workflow | Jobs | Runner | Role |
|
||||||
|
|--------------------|----------------------|----------------|-----------------------------------------------|
|
||||||
|
| e2e.yaml | e2e-amd64-kubernetes | GitHub Ubuntu | integration testing with Kubernetes Kind<br/> |
|
||||||
|
| e2e-arm64.yaml | e2e-arm64-kubernetes | Equinix Ubuntu | integration testing with Kubernetes Kind<br/> |
|
||||||
|
| e2e-bootstrap.yaml | e2e-boostrap-github | GitHub Ubuntu | integration testing with GitHub API<br/> |
|
||||||
|
| e2e-azure.yaml | e2e-amd64-aks | GitHub Ubuntu | integration testing with Azure API<br/> |
|
||||||
|
| scan.yaml | scan-fossa | GitHub Ubuntu | license scanning<br/> |
|
||||||
|
| scan.yaml | scan-snyk | GitHub Ubuntu | vulnerability scanning<br/> |
|
||||||
|
| scan.yaml | scan-codeql | GitHub Ubuntu | vulnerability scanning<br/> |
|
||||||
|
|
||||||
|
## Components Update
|
||||||
|
|
||||||
|
The components update workflow scans the GitOps Toolkit controller repositories for new releases,
|
||||||
|
amd when it finds a new controller version, the workflow performs the following steps:
|
||||||
|
- Updates the controller API package version in `go.mod`.
|
||||||
|
- Patches the controller CRDs version in the `manifests/crds` overlay.
|
||||||
|
- Patches the controller Deployment version in `manifests/bases` overlay.
|
||||||
|
- Opens a Pull Request against the `main` branch.
|
||||||
|
- Triggers the e2e test suite to run for the opened PR.
|
||||||
|
|
||||||
|
|
||||||
|
| Workflow | Jobs | Runner | Role |
|
||||||
|
|-------------|-------------------|---------------|-----------------------------------------------------|
|
||||||
|
| update.yaml | update-components | GitHub Ubuntu | update the GitOps Toolkit APIs and controllers<br/> |
|
||||||
|
|
||||||
|
## Release
|
||||||
|
|
||||||
|
The release workflow is triggered by a semver Git tag and performs the following steps:
|
||||||
|
- Generates the Flux install manifests (YAML).
|
||||||
|
- Generates the OpenAPI validation schemas for the GitOps Toolkit CRDs (JSON).
|
||||||
|
- Generates a Software Bill of Materials (SPDX JSON).
|
||||||
|
- Builds the Flux CLI binaries and the multi-arch container images.
|
||||||
|
- Pushes the container images to GitHub Container Registry and DockerHub.
|
||||||
|
- Signs the sbom, the binaries checksum and the container images with Cosign and GitHub OIDC.
|
||||||
|
- Uploads the sbom, binaries, checksums and install manifests to GitHub Releases.
|
||||||
|
- Pushes the install manifests as OCI artifacts to GitHub Container Registry and DockerHub.
|
||||||
|
- Signs the OCI artifacts with Cosign and GitHub OIDC.
|
||||||
|
|
||||||
|
| Workflow | Jobs | Runner | Role |
|
||||||
|
|--------------|------------------------|---------------|------------------------------------------------------|
|
||||||
|
| release.yaml | release-flux-cli | GitHub Ubuntu | build, push and sign the CLI release artifacts<br/> |
|
||||||
|
| release.yaml | release-flux-manifests | GitHub Ubuntu | build, push and sign the Flux install manifests<br/> |
|
||||||
@ -1,75 +0,0 @@
|
|||||||
name: release-manifests
|
|
||||||
on:
|
|
||||||
release:
|
|
||||||
types: [published]
|
|
||||||
workflow_dispatch:
|
|
||||||
|
|
||||||
permissions:
|
|
||||||
contents: read
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
build-push:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
permissions:
|
|
||||||
id-token: write # needed for keyless signing
|
|
||||||
packages: write # needed for ghcr access
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v3
|
|
||||||
- name: Setup Kustomize
|
|
||||||
uses: fluxcd/pkg/actions/kustomize@main
|
|
||||||
- name: Setup Flux CLI
|
|
||||||
uses: ./action/
|
|
||||||
- name: Prepare
|
|
||||||
id: prep
|
|
||||||
run: |
|
|
||||||
VERSION=$(flux version --client | awk '{ print $NF }')
|
|
||||||
echo ::set-output name=VERSION::${VERSION}
|
|
||||||
- name: Login to GHCR
|
|
||||||
uses: docker/login-action@v2
|
|
||||||
with:
|
|
||||||
registry: ghcr.io
|
|
||||||
username: fluxcdbot
|
|
||||||
password: ${{ secrets.GHCR_TOKEN }}
|
|
||||||
- name: Login to DockerHub
|
|
||||||
uses: docker/login-action@v2
|
|
||||||
with:
|
|
||||||
username: fluxcdbot
|
|
||||||
password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
|
|
||||||
- name: Push manifests to GHCR
|
|
||||||
run: |
|
|
||||||
mkdir -p ./ghcr.io/flux-system
|
|
||||||
flux install --registry=ghcr.io/fluxcd \
|
|
||||||
--components-extra=image-reflector-controller,image-automation-controller \
|
|
||||||
--export > ./ghcr.io/flux-system/gotk-components.yaml
|
|
||||||
|
|
||||||
cd ./ghcr.io && flux push artifact \
|
|
||||||
oci://ghcr.io/fluxcd/flux-manifests:${{ steps.prep.outputs.VERSION }} \
|
|
||||||
--path="./flux-system" \
|
|
||||||
--source=${{ github.repositoryUrl }} \
|
|
||||||
--revision="${{ github.ref_name }}/${{ github.sha }}"
|
|
||||||
- name: Push manifests to DockerHub
|
|
||||||
run: |
|
|
||||||
mkdir -p ./docker.io/flux-system
|
|
||||||
flux install --registry=docker.io/fluxcd \
|
|
||||||
--components-extra=image-reflector-controller,image-automation-controller \
|
|
||||||
--export > ./docker.io/flux-system/gotk-components.yaml
|
|
||||||
|
|
||||||
cd ./docker.io && flux push artifact \
|
|
||||||
oci://docker.io/fluxcd/flux-manifests:${{ steps.prep.outputs.VERSION }} \
|
|
||||||
--path="./flux-system" \
|
|
||||||
--source=${{ github.repositoryUrl }} \
|
|
||||||
--revision="${{ github.ref_name }}/${{ github.sha }}"
|
|
||||||
- uses: sigstore/cosign-installer@main
|
|
||||||
- name: Sign manifests
|
|
||||||
env:
|
|
||||||
COSIGN_EXPERIMENTAL: 1
|
|
||||||
run: |
|
|
||||||
cosign sign ghcr.io/fluxcd/flux-manifests:${{ steps.prep.outputs.VERSION }}
|
|
||||||
cosign sign docker.io/fluxcd/flux-manifests:${{ steps.prep.outputs.VERSION }}
|
|
||||||
- name: Tag manifests
|
|
||||||
run: |
|
|
||||||
flux tag artifact oci://ghcr.io/fluxcd/flux-manifests:${{ steps.prep.outputs.VERSION }} \
|
|
||||||
--tag latest
|
|
||||||
|
|
||||||
flux tag artifact oci://docker.io/fluxcd/flux-manifests:${{ steps.prep.outputs.VERSION }} \
|
|
||||||
--tag latest
|
|
||||||
Loading…
Reference in New Issue