Add workflow to build and push the install manifests to:
- ghcr.io/fluxcd/flux-manifests
- docker.io/fluxcd/flux-manifests
The OCI artifacts are signed with Cosign and GitHub OIDC (keyless).
The manifests pushed to GHCR have the container images set to ghcr.io/fluxcd/<controller-name> while the manifests pushed to DockerHub have the controller images set to docker.io/fluxcd/<controller-name>.
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
Due to the release CI job running on an Ubuntu machine, we do not have
easy access to `makepkg` to generate the `.SRCINFO` using `--printsrcinfo`
as this is a `pacman` specific utility, and instead we maintain a
template.
Historically seen, something went wrong here while the `PKGBUILD` file
became more complex and certain fields added there were not _also_
included in the `.SRCINFO` template.
This commit ensures everything is restored to working state, and
provides the proper fix for what was attempted in #2917. In addition,
checksums are now included in the file.
Signed-off-by: Hidde Beydals <hello@hidde.co>
- add the Flux manifests and API schemas to checksums
- sign the checksum.txt with Cosign and GitHub OIDC
- sign the flux-cli container images with Cosign and GitHub OIDC
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
- generate SBOM for Flux Go modules with Syft
- publish the SBOM SPDX JSON files to GitHub releases with GoReleaser
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
The check() run started to fail after #2288 since ENVTEST_ARCH was not
set correctly on ARM/ARM64. This should fix the problem for the flux-go
and flux-scm AUR packages.
Signed-off-by: Aurel Canciu <aurelcanciu@gmail.com>
Without git installed, makepkg fails to fetch the source. This breaks
the build for people who build their aur packages inside temporary
containers (for example aurutils with the -c flag).
Signed-off-by: Tom Alexander <tom@fizz.buzz>
Refactor logic to install helper tools into one function in the
Makefile. Add support for envtest to help install tools like kubectl,
etcd which helps users run tests more conveniently.
Signed-off-by: Sanskar Jaiswal <jaiswalsanskar078@gmail.com>
Signed-off-by: Chanwit Kaewkasi <chanwit@gmail.com>
This change publishes the auto-generated JSON schemas as a single URL,
so that it is consumable by a tool like VS Code.
The CRD generator creates 2 files, a tar.gz for Kubeval,
and another one is a JSON file. The JSON file is a combination of
all schemas, put under the "oneOf" operator.
There's another location which uses the "manifests directory" target
directly, but isn't run when testing a PR: the release workflow.
Signed-off-by: Michael Bridgen <michael@weave.works>
Using the directory cmd/flux/manifests as a prerequisite causes a
problem: if the script that creates the files within fails, the next
invocation of make will see the directory and assume it
succeeded. Since the executable expects certain files to be present,
but they are not explicit prerequisites of the recipe for building the
binary, this results in a successful build but a broken `flux`
executable.
Instead, depend on a file that's explicitly updated when the script
has succeeded, and which itself depends on the inputs.
A couple of the CI workflows run
make cmd/flux/manifests
before doing other things, presumably as a way to avoid running the
whole test suite in a CI pipeline for some purpose other than testing,
so these needed changing as well.
Signed-off-by: Michael Bridgen <michael@weave.works>
This commit adds suggestion for some of the required fields because
there can be a few exceptions in which these values can not be
provided. For example when the `flux` binary can not be installed, or
the set of controllers has been installed with just an `install.yaml`
file.
We use this approach instead of making the fields optional because it
guides people to provide the information whenever they can, which
should result in higher quality bug reports.
As a tiny addition, the reference to "Flux v2" has been renamed to just
"Flux" as we are slowly transitioning "Flux v1" into "Flux Legacy".
Signed-off-by: Hidde Beydals <hello@hidde.co>
This will help users to provide bug reports of high quality, as the
requested information is now rendered into dedicated fields, while
allowing us to mark fields as "required".
Signed-off-by: Hidde Beydals <hello@hidde.co>
This includes updating the version in the `manifests/crds` directory
for the component thas has a newer latest version.
Signed-off-by: Hidde Beydals <hello@hidde.co>
We noticed that some of our components had not received `go.mod` updates
while they did receive updates for the versions declared in the YAML
manifests.
Was able to trace this back to a behavior change in Go since `1.16.x`,
resulting in it no longer making automated changes to `go.mod` and
`go.sum`[1]. This is an issue for our updater script as it relies
on `go list -m all`, which now after the first `go mod edit` returns:
```console
$ go list -m all
go: github.com/fluxcd/notification-controller/api@v0.10.0: missing
go.sum entry; to add it:
go mod download github.com/fluxcd/notification-controller/api
```
To work around the issue without having to repeatedly call `go mod
tidy`, I have opted to simply `grep` on the contents of `go.mod` as a
workaround.
[1]: https://blog.golang.org/go116-module-changes#TOC_3.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This changes the name of the repository that is used for the GitHub
end-to-end tests to a name that is still traceable to the source
(repository) that created it, by using the format
`<ORIGIN_REPOSITORY_NAME>-<PSEUDO_RAND_SUFFIX>`.
The `PSEUDO_RAND_SUFFIX` is a SHA1 sum of the name of the branch and
commit SHA the tests run for, resulting in a 40 character suffix that
unlike the short commit SHA used before, should not result in collisions.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This commit makes a couple of changes to the `flux-{go,scm}` packages
so that they properly build again:
- The manifests are generated before the compilation of the `flux`
binary.
- The `makedepends` have been updated to require a version of Go
`>=1.16` (which is a requirement for `embed`).
- The `makedepends` have been updated to require a `kustomize` version
`>=3.0` (as we use `transformers`).
Signed-off-by: Hidde Beydals <hello@hidde.co>
There was an assumption in this script that it is always executed in Git
repository/directory, this is however not always true, for example when
one downloads the `.tar.gz` that is made available for every release
by GitHub (and used in one of our AUR packages).
This commit changes this, and makes the first argument of `bundle.sh`
configurable, so a custom manifests directory can always be defined
_without_ relying on Git.
Omitting it, or passing an empty string, will still fall back to the
previous behavior of using `git rev-parse --show-toplevel`.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This commit changes the way the build of manifests is triggered by
making smarter use of the capabilities of Make. The result should be
that the manifests are only regenerated if:
1. There is no `cmd/flux/manifests/` directory.
2. There have been made changes to the YAML files in the `manifests/`
directory that are newer than the files in `cmd/flux/manifests/`.
Signed-off-by: Hidde Beydals <hello@hidde.co>
- add make target for generating the install manifests using kustomize
- embed the generated manifests in flux binary
- the install and bootstrap commands default to using the embedded manifests
- download the install manifests from GitHub only if the install/bootstrap version arg is set
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
- deletes Flux components (deployments and services)
- deletes Flux RBAC (service accounts, cluster roles and cluster role bindings)
- removes the Kubernetes finalizers from Flux custom resources
- deletes Flux custom resource definitions and custom resources
- deletes the namespace where Flux was installed
- preserves the Kubernetes objects and Helm releases that were reconciled on the cluster by Flux
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
- Include link to changelog of component in commit and PR message
- Label pull request automatically with `area/build`
- Enable sign-off of commits to free us from manual labour
Signed-off-by: Hidde Beydals <hello@hidde.co>
This adds the image controller specs and refs to the workflow that
prepares the docs, and links to them in the index.
Signed-off-by: Michael Bridgen <michael@weave.works>
This results in the automatic rebase of an outstanding PR on merges to
this branch, removing the need of manually firing it.
Signed-off-by: Hidde Beydals <hello@hidde.co>
Using a lock to prevent parallel executions in GoReleaser's custom
publishers. The custom publisher logic executes the tasks in parallel
for each available artifact.
https://goreleaser.com/customization/publishers/#how-it-works
Signed-off-by: Aurel Canciu <aurelcanciu@gmail.com>
The AUR_BOT_SSH_PRIVATE_KEY environment variable needs to be set in
goreleaser so publishing the packages to AUR can work.
Signed-off-by: Aurel Canciu <aurelcanciu@gmail.com>
- add notification-controller/api commands to index
- move diagrams to docs website
- update CRDs docs
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
This allows controller components to be updated when they are not
included as a Go Mod dependency, which is currently the case for the
notification-controller.