Skip to content

Commit a2cdb66

Browse files
csatib02csatib02
authored
chore(images): pull in fluentd image build (#1907)
Signed-off-by: Bence Csati <bence.csati@axoflow.com>
1 parent dca6fd4 commit a2cdb66

File tree

28 files changed

+1234
-39
lines changed

28 files changed

+1234
-39
lines changed

‎.github/workflows/artifacts.yaml‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,11 @@ name: Artifacts
33
on:
44
workflow_call:
55
inputs:
6+
version:
7+
description: Version to build
8+
default: latest
9+
required: true
10+
type: string
611
publish:
712
description: Publish artifacts to the artifact store
813
default: false
@@ -26,6 +31,18 @@ on:
2631
container-image-ref:
2732
description: Container image ref
2833
value: ${{ jobs.container-image.outputs.ref }}
34+
fluentd-full-image-name:
35+
description: Fluentd-full container image name
36+
value: ${{ jobs.fluentd-full-image.outputs.name }}
37+
fluentd-full-image-digest:
38+
description: Fluentd-full container image digest
39+
value: ${{ jobs.fluentd-full-image.outputs.digest }}
40+
fluentd-full-image-tag:
41+
description: Fluentd-full container image tag
42+
value: ${{ jobs.fluentd-full-image.outputs.tag }}
43+
fluentd-full-image-ref:
44+
description: Fluentd-full container image ref
45+
value: ${{ jobs.fluentd-full-image.outputs.ref }}
2946
helm-chart-name:
3047
description: Helm chart OCI name
3148
value: ${{ jobs.helm-chart.outputs.name }}
@@ -128,6 +145,7 @@ jobs:
128145
labels: ${{ steps.meta.outputs.labels }}
129146
cache-from: type=gha
130147
cache-to: type=gha,mode=max
148+
build-args: GO_BUILD_FLAGS=-ldflags=-X=github.com/kube-logging/logging-operator/pkg/sdk/logging/api/v1beta1.Version=${{ inputs.version }}
131149
outputs: ${{ steps.build-output.outputs.value }},name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
132150
# push: ${{ inputs.publish }}
133151

@@ -213,7 +231,7 @@ jobs:
213231
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
214232
env:
215233
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
216-
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:1
234+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
217235
with:
218236
input: image
219237
format: sarif
@@ -367,7 +385,7 @@ jobs:
367385
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
368386
env:
369387
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
370-
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:1
388+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
371389
with:
372390
scan-type: config
373391
scan-ref: charts/${{ steps.chart-name.outputs.value }}
@@ -490,7 +508,7 @@ jobs:
490508
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
491509
env:
492510
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
493-
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:1
511+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
494512
with:
495513
scan-type: config
496514
scan-ref: charts/${{ env.subchartPath }}

‎.github/workflows/ci.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,9 +89,22 @@ jobs:
8989
name: Artifacts
9090
uses: ./.github/workflows/artifacts.yaml
9191
with:
92+
version: "latest"
9293
publish: ${{ github.event_name == 'push' }}
9394
permissions:
9495
contents: read
9596
packages: write
9697
id-token: write
9798
security-events: write
99+
100+
dependency-images:
101+
name: Dependency images
102+
uses: ./.github/workflows/dependency-images.yaml
103+
with:
104+
publish: ${{ github.event_name == 'push' }}
105+
image-types: "full"
106+
permissions:
107+
contents: read
108+
packages: write
109+
id-token: write
110+
security-events: write

‎.github/workflows/dependency-images.yaml‎

Lines changed: 300 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,300 @@
1+
name: Dependency images
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
publish:
7+
description: Publish artifacts to the artifact store
8+
default: false
9+
required: false
10+
type: boolean
11+
image-types:
12+
description: 'Types of images to build (comma-separated: base,filters,full)'
13+
type: string
14+
default: 'base,filters,full'
15+
required: false
16+
outputs:
17+
fluentd-image-name:
18+
description: Container image name
19+
value: ${{ jobs.fluentd.outputs.name }}
20+
fluentd-image-digest:
21+
description: Container image digest
22+
value: ${{ jobs.fluentd.outputs.digest }}
23+
fluentd-image-tag:
24+
description: Container image tag
25+
value: ${{ jobs.fluentd.outputs.tag }}
26+
fluentd-image-ref:
27+
description: Container image ref
28+
value: ${{ jobs.fluentd.outputs.ref }}
29+
30+
permissions:
31+
contents: read
32+
33+
jobs:
34+
prepare-matrix:
35+
name: Prepare matrix
36+
runs-on: ubuntu-latest
37+
38+
outputs:
39+
image-types: ${{ steps.set-matrix.outputs.image-types }}
40+
41+
steps:
42+
- name: Set matrix
43+
id: set-matrix
44+
run: |
45+
IMAGE_TYPES=$(echo '${{ inputs.image-types }}' | jq -R -c 'split(",")')
46+
echo "image-types=${IMAGE_TYPES}" >> $GITHUB_OUTPUT
47+
48+
fluentd-image:
49+
name: Fluentd image
50+
needs: prepare-matrix
51+
runs-on: ${{ matrix.platform == 'linux/arm64' && 'linux-arm64' || 'ubuntu-latest' }}
52+
53+
permissions:
54+
contents: read
55+
packages: write
56+
id-token: write
57+
58+
outputs:
59+
name: ${{ steps.image-name.outputs.value }}
60+
digest: ${{ steps.build.outputs.digest }}
61+
tag: ${{ steps.meta.outputs.version }}
62+
ref: ${{ steps.image-ref.outputs.value }}
63+
64+
strategy:
65+
matrix:
66+
platform:
67+
- linux/amd64
68+
- linux/arm64
69+
image-type: ${{ fromJson(needs.prepare-matrix.outputs.image-types) }}
70+
71+
steps:
72+
- name: Prepare arm64 environment
73+
if: matrix.platform == 'linux/arm64'
74+
run: |
75+
sudo install -m 0755 -d /etc/apt/keyrings
76+
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
77+
echo \
78+
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
79+
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
80+
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
81+
sudo apt-get update && sudo apt-get install -y acl docker-ce docker-ce-cli containerd.io docker-buildx-plugin
82+
USERID=$(id -u)
83+
sudo setfacl --modify user:${USERID}:rw /var/run/docker.sock
84+
85+
- name: Checkout repository
86+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
87+
88+
- name: Set up QEMU
89+
uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
90+
with:
91+
platforms: all
92+
93+
- name: Set up Docker Buildx
94+
uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
95+
96+
- name: Set up Cosign
97+
uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
98+
99+
- name: Set image name
100+
id: image-name
101+
run: echo "value=ghcr.io/${{ github.repository }}/fluentd" >> "$GITHUB_OUTPUT"
102+
103+
- name: Gather build metadata
104+
id: meta
105+
uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
106+
with:
107+
images: ${{ steps.image-name.outputs.value }}
108+
labels: |
109+
org.opencontainers.image.description=Custom Fluentd image for the Logging operator.
110+
org.opencontainers.image.title=Logging operator Fluentd image
111+
org.opencontainers.image.authors=Kube logging authors
112+
org.opencontainers.image.documentation=https://kube-logging.dev/docs/
113+
114+
- name: Login to GitHub Container Registry
115+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
116+
with:
117+
registry: ghcr.io
118+
username: ${{ github.actor }}
119+
password: ${{ github.token }}
120+
121+
- name: Build and push fluentd-${{ matrix.image-type }}-${{ matrix.platform }} image
122+
id: build
123+
uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
124+
with:
125+
context: images/fluentd
126+
platforms: ${{ matrix.platform }}
127+
labels: ${{ steps.meta.outputs.labels }}
128+
cache-from: type=gha
129+
cache-to: type=gha,mode=max
130+
target: ${{ matrix.image-type }}
131+
outputs: type=image,name=${{ steps.image-name.outputs.value }},push-by-digest=true,push=true,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
132+
133+
- name: Export digest
134+
run: |
135+
mkdir -p /tmp/digests
136+
digest="${{ steps.build.outputs.digest }}"
137+
touch "/tmp/digests/${digest#sha256:}"
138+
139+
platform=${{ matrix.platform }}
140+
echo "PLATFORM=${platform//\//-}" >> $GITHUB_ENV
141+
142+
- name: Upload digest
143+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
144+
with:
145+
name: digests-${{ matrix.image-type }}-${{ env.PLATFORM }}
146+
path: /tmp/digests/*
147+
if-no-files-found: error
148+
retention-days: 1
149+
150+
- name: Sign image with GitHub OIDC Token
151+
if: ${{ github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
152+
env:
153+
DIGEST: ${{ steps.build.outputs.digest }}
154+
TAGS: ${{ steps.meta.outputs.tags }}
155+
run: |
156+
images=""
157+
for tag in ${TAGS[@]}; do
158+
images+="${tag}@${DIGEST} "
159+
done
160+
161+
cosign sign --yes --rekor-url "https://rekor.sigstore.dev/" ${images}
162+
163+
- name: Verify signed image with cosign
164+
if: ${{ github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
165+
env:
166+
DIGEST: ${{ steps.build.outputs.digest }}
167+
TAGS: ${{ steps.meta.outputs.tags }}
168+
run: |
169+
for tag in ${TAGS[@]}; do
170+
cosign verify "${tag}@${DIGEST}" \
171+
--rekor-url "https://rekor.sigstore.dev/" \
172+
--certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/dependency-images.yaml@${{ github.ref }}" \
173+
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" | jq
174+
done
175+
176+
merge-fluentd-image:
177+
name: Merge Fluentd image
178+
runs-on: ubuntu-latest
179+
needs: [prepare-matrix, fluentd-image]
180+
181+
permissions:
182+
contents: read
183+
packages: write
184+
id-token: write
185+
security-events: write
186+
187+
strategy:
188+
matrix:
189+
image-type: ${{ fromJson(needs.prepare-matrix.outputs.image-types) }}
190+
191+
steps:
192+
- name: Set up Docker Buildx
193+
uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
194+
195+
- name: Set up Cosign
196+
uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
197+
198+
- name: Login to GitHub Container Registry
199+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
200+
with:
201+
registry: ghcr.io
202+
username: ${{ github.actor }}
203+
password: ${{ github.token }}
204+
if: inputs.publish
205+
206+
- name: Download digests
207+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
208+
with:
209+
path: /tmp/digests
210+
pattern: digests-${{ matrix.image-type }}-*
211+
merge-multiple: true
212+
213+
- name: Gather build metadata
214+
id: meta
215+
uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
216+
with:
217+
images: ${{ needs.fluentd-image.outputs.name }}
218+
flavor: |
219+
latest = false
220+
tags: |
221+
type=ref,event=branch,suffix=-${{ matrix.image-type }}
222+
type=ref,event=pr,prefix=pr-,suffix=-${{ matrix.image-type }}
223+
type=semver,pattern={{raw}},suffix=-${{ matrix.image-type }}
224+
type=raw,value=latest,enable={{is_default_branch}},suffix=-${{ matrix.image-type }}
225+
226+
- name: Create multi-arch manifest list
227+
working-directory: /tmp/digests
228+
run: |
229+
if [[ "${{ inputs.publish }}" == "true" ]]; then
230+
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
231+
$(printf '${{ needs.fluentd-image.outputs.name }}@sha256:%s ' *)
232+
else
233+
docker buildx imagetools create --dry-run $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
234+
$(printf '${{ needs.fluentd-image.outputs.name }}@sha256:%s ' *)
235+
fi
236+
237+
- name: Export digest
238+
run: |
239+
DIGEST=$(docker buildx imagetools inspect ${{ needs.fluentd-image.outputs.name }}:${{ steps.meta.outputs.version }} --format '{{json .}}' | jq -r '.manifest.digest')
240+
echo "DIGEST=$DIGEST" >> $GITHUB_ENV
241+
242+
- name: Sign image with GitHub OIDC Token
243+
if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
244+
env:
245+
DIGEST: ${{ env.DIGEST }}
246+
TAGS: ${{ steps.meta.outputs.tags }}
247+
run: |
248+
images=""
249+
for tag in ${TAGS[@]}; do
250+
images+="${tag}@${DIGEST} "
251+
done
252+
253+
cosign sign --yes --rekor-url "https://rekor.sigstore.dev/" ${images}
254+
255+
- name: Verify signed image with cosign
256+
if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
257+
env:
258+
DIGEST: ${{ env.DIGEST }}
259+
TAGS: ${{ steps.meta.outputs.tags }}
260+
run: |
261+
for tag in ${TAGS[@]}; do
262+
cosign verify "${tag}@${DIGEST}" \
263+
--rekor-url "https://rekor.sigstore.dev/" \
264+
--certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/dependency-images.yaml@${{ github.ref }}" \
265+
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" | jq
266+
done
267+
268+
- name: Set image ref
269+
id: image-ref
270+
run: echo "value=${{ needs.fluentd-image.outputs.name }}@${{ env.DIGEST }}" >> "$GITHUB_OUTPUT"
271+
272+
- name: Fetch image
273+
run: skopeo --insecure-policy copy docker://${{ needs.fluentd-image.outputs.name }}:${{ steps.meta.outputs.version }} oci-archive:image.tar
274+
275+
- name: Extract OCI tarball
276+
run: |
277+
mkdir -p image
278+
tar -xf image.tar -C image
279+
280+
- name: Run Trivy vulnerability scanner
281+
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
282+
env:
283+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
284+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
285+
with:
286+
input: image
287+
format: sarif
288+
output: trivy-results.sarif
289+
290+
- name: Upload Trivy scan results as artifact
291+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
292+
with:
293+
name: "[${{ github.job }}-${{ matrix.image-type }}] Trivy scan results"
294+
path: trivy-results.sarif
295+
retention-days: 5
296+
297+
- name: Upload Trivy scan results to GitHub Security tab
298+
uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
299+
with:
300+
sarif_file: trivy-results.sarif

0 commit comments

Comments
 (0)